jfrog-ai-catalog

Set up and verify the JFrog plugin. Run on first install, to complete initial configuration, or to diagnose a broken setup.

Use to install, list, or remove MCP servers, and to discover which MCPs the user can install — including questions about available, approved, or allowed MCPs for a project. That governed catalog is the authoritative answer; do not answer those questions from local IDE/settings allowlists alone. Use whenever the user wants to add/enable/install/list/remove/uninstall/configure an MCP or write/update the agent's MCP config — even if they name a package like `@scope/pkg` and even without saying "MCP" or "JFrog". Never install an MCP any other way. All of this goes through the JFrog Agent Guard (npx @jfrog/agent-guard).

Check/download a package (npm, Maven, PyPI, Go...) via JFrog — safe, allowed, curated? Or: package op fails/blocked (ETARGET, 403, blocked by curation policy, missing version, waiver) — root cause it. Checks the JFrog Public Catalog and stored packages for a version, interprets catalog security signals, and downloads through Artifactory (JFrog Platform locations, remote cache, curation-aware package managers, or repo proxy). Do NOT use for pure CVE or vulnerability lookups (e.g. "details on CVE-2021-23337") — those are handled by the jfrog skill's Public security domain queries without this workflow. Do NOT use for installing, listing, or approving MCP servers/tools (even when named like a package, e.g. `@scope/pkg`) — that's `jfrog-mcp-management`.

Guides JFrog Platform topology, sizing (RPM, t-shirt templates), deployment, multi-site use cases, SaaS vs self-managed, HA, air-gapped, and disaster recovery using the official Reference Architecture site as the sole source of facts. Use this skill when the user asks how to size Artifactory or Xray, which deployment pattern to choose, single vs multi site, active-active, active-passive, CI/CD separation, Helm/Kubernetes install planning, or reference architecture (live WebFetch from jfrog.com/reference-architecture). Do NOT use for artifact search or download, repository or permission admin, CVE or vulnerability lookups, live jf CLI operations against their instance, or package curation — use the jfrog base skill or jfrog-package-curation instead.

Use this skill when the user asks to set up, configure, bind, or connect a package manager (npm, pip, uv, pipenv, maven, gradle, go, docker, helm, ...) to JFrog Artifactory via `jf setup` and `.jfrog/local/package-resolution.json`; when a workspace manifest exists with no matching binding entry; or when a session hook reports package-manager config missing. Skip when the binding already has the same repo key. When the session status is `already set up` or `setting up in the background`, do not invoke this skill proactively for a missing workspace binding. An explicit setup or rebind request, and a JFrog 401/403, still invoke it. Never pick a repo by discovery; use resolver output only (unless the user names or asks to browse repos, or a global key is BLOCKED). On unresolved or failed setup, ask with the failure verbatim — never switch servers. NOT for installing packages, general Artifactory repo operations (use the base jfrog skill), or MCP server setup (use jfrog-mcp-management).

Interact with the JFrog Platform via the JFrog CLI, JFrog MCP server and REST/GraphQL APIs. Use this skill when the user wants to manage Artifactory repositories, upload or download artifacts, manage builds, configure permissions, manage users and groups, work with access tokens, configure JFrog CLI servers, search artifacts, manage properties, set up replication, manage JFrog Projects, run security audits or scans, look up CVE details, query exposures scan results from JFrog Advanced Security, manage release bundles and lifecycle operations, aggregate or export platform data, or perform any JFrog Platform administration task. Also use when the user mentions jf, jfrog, artifactory, xray, distribution, evidence, apptrust, onemodel, graphql, workers, mission control, curation, advanced security, exposures, sast, or any JFrog product name. Do NOT use this skill to install, add, remove, list, or manage MCP servers.

Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.

Teach the user a new skill or concept, within this workspace.

Ask which skill or flow fits your situation. A router over the skills in this repo.

Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.

Hand the current conversation off to a fresh background agent that picks up the work immediately.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions

Use when executing implementation plans with independent tasks in the current session