JFrog brings software supply chain governance to Claude Code

JFrog has launched a plugin that brings its software supply chain governance into Anthropic’s Claude Code, giving enterprises visibility and control over the packages, dependencies and AI assets that AI coding agents use as they write software.

Built in collaboration with Anthropic, the plugin is available immediately to all Claude Code users.

The plugin is designed to give developers governed access to scan, curate and secure every artifact and dependency their agents consume, enforcing package security, licence compliance and provenance checks inside the development workflow as code is written rather than after the fact, and providing traceability from source commits to build artifacts so teams can answer an audit quickly.

It also extends Claude Code with what JFrog calls Platform Skills - letting developers and their agents run platform operations such as vulnerability scanning and provenance verification through natural language - and governs which Model Context Protocol (MCP) servers and agent skills an agent is allowed to pull, to block rogue access to sensitive internal data.

JFrog positioned the move as part of a deliberately agent-agnostic strategy: rather than backing a single tool, it is offering three layers of connectivity - Platform Skills, MCP tools and agent-native plugins - across any AI coding environment, starting with Claude Code and extending to Cursor and VS Code Copilot, so governance travels with the developer rather than with any one agent.

“AI agents are active participants in the software supply chain, making decisions about dependencies, builds, and deployments – but most of them are doing it blind, without any supply chain context. This is often how malicious packages, vulnerabilities, and ungoverned AI assets enter production today, exposing organisations to software supply chain attacks,” said Yoav Landman, co-founder and chief technology officer of JFrog.

“AI-enabled innovation cannot come at the expense of security or compliance. Enterprises need a universal system of record with real-time control and visibility into the decisions these agents make, that's what this integration enables.”