diff --git a/README.md b/README.md index 8ad6450..53f3739 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,6 @@ JFrog plugin for [Cursor](https://cursor.com): artifact management, security sca - **Official skills.** The plugin now uses the official [jfrog-skills](https://github.com/jfrog/jfrog-skills) v0.11.0, replacing the previously bundled skill content. This brings structured reference files, automation scripts, and a three-tier tool selection strategy (MCP, CLI, REST/GraphQL). - **Package safety skill.** New `jfrog-package-safety-and-download` skill for checking whether packages are safe, curated, or allowed before downloading them through Artifactory. -- **Built-in `jfrog` MCP** routed through `@jfrog/agent-guard`. **Breaking:** the previous `JFROG_PLATFORM_URL` env var (host-only, e.g. `mycompany.jfrog.io`) is replaced by `JFROG_URL`, which **must include the scheme** (e.g. `https://mycompany.jfrog.io`). Carrying over the old host-only value will produce a silently-broken endpoint URL — re-export the variable with `https://` before relaunching Cursor. See [Authentication](#authentication). --- ## Features @@ -53,16 +52,12 @@ Use either the marketplace link from the [Configure Cursor](https://docs.jfrog.c | Variable | Description | | --- | --- | -| `JFROG_URL` | Your JFrog platform URL **including the scheme**, e.g. `https://mycompany.jfrog.io`. A host-only value (e.g. `mycompany.jfrog.io`) will produce a malformed endpoint and the MCP will fail to connect. | +| `JFROG_PLATFORM_URL` | Your JFrog platform URL, e.g. `mycompany.jfrog.io` | | `JFROG_ACCESS_TOKEN` | Your JFrog access token | -> **Upgrading from a pre-v0.5.0 plugin?** The old `JFROG_PLATFORM_URL` (host-only) is gone — re-export your URL as `JFROG_URL` with `https://` in front of the host. - -The built-in `jfrog` MCP launches `npx @jfrog/agent-guard` and reads both `JFROG_URL` and `JFROG_ACCESS_TOKEN` from the launching shell, so make sure they're exported in the shell that starts Cursor. - ### 2. Configure the JFrog CLI -Run `jf login` for browser-based setup, or set the same `JFROG_ACCESS_TOKEN` from step 1. +Run `jf login` for browser-based setup, or set the `JFROG_ACCESS_TOKEN` environment variable. MCP-based workflows authenticate via OAuth and require no additional configuration. --- diff --git a/plugins/jfrog/.cursor-plugin/plugin.json b/plugins/jfrog/.cursor-plugin/plugin.json index 5752f7e..e24c846 100644 --- a/plugins/jfrog/.cursor-plugin/plugin.json +++ b/plugins/jfrog/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "jfrog", "displayName": "JFrog Platform", - "version": "0.5.5", + "version": "0.5.4", "description": "JFrog Platform integration with MCP, security skills, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.", "author": { "name": "JFrog", diff --git a/plugins/jfrog/README.md b/plugins/jfrog/README.md index 9d2e91e..3f2b254 100644 --- a/plugins/jfrog/README.md +++ b/plugins/jfrog/README.md @@ -8,28 +8,18 @@ JFrog Platform integration for Cursor — artifact management, security scanning 2. An admin must **enable the JFrog MCP Server** on the platform (Cloud/SaaS only): - Navigate to **Administration > General > Settings** in the JFrog UI. - Toggle the **MCP Server** option ON and save. -3. Set the `JFROG_URL` (full URL, e.g. `https://mycompany.jfrog.io`) and `JFROG_ACCESS_TOKEN` environment variables — the built-in `jfrog` MCP needs both at launch. -4. **Node.js** (≥ 14) — with `npx` on your `PATH` (used to launch `@jfrog/agent-guard`). -5. **JFrog CLI** (`jf`) is used by the skills for authentication and REST/GraphQL API operations. If missing, the agent will attempt to install it. You can also install manually via `brew install jfrog-cli` or the [official install script](https://jfrog.com/help/r/jfrog-cli/install-the-jfrog-cli). +3. Set the `JFROG_PLATFORM_URL` environment variable to your JFrog instance (e.g., `mycompany.jfrog.io`). +4. **JFrog CLI** (`jf`) is used by the skills for authentication and REST/GraphQL API operations. If missing, the agent will attempt to install it. You can also install manually via `brew install jfrog-cli` or the [official install script](https://jfrog.com/help/r/jfrog-cli/install-the-jfrog-cli). -CLI authentication options: run `jf login` for browser-based setup, or set the same `JFROG_ACCESS_TOKEN` from step 3. +CLI authentication options: run `jf login` for browser-based setup, or set the `JFROG_ACCESS_TOKEN` environment variable. MCP-based workflows authenticate via **OAuth** and require no additional configuration. ## Included | Component | Path | Description | |---|---|---| -| **MCP** | `mcp.json` | Built-in JFrog MCP routed through `@jfrog/agent-guard` to `${JFROG_URL}/mcp` (server name: `jfrog`). Always available, not subject to AI Catalog policy — see [JFrog MCP](#jfrog-mcp). | +| **MCP** | `mcp.json` | Remote JFrog MCP server (OAuth, no API keys) | | **Hook** | `hooks/hooks.json` | Agent Guard — MCP server governance via JFrog AI Catalog | -### JFrog MCP - -The plugin ships a built-in `jfrog` MCP registered in `mcp.json`. Cursor -launches it automatically as `npx @jfrog/agent-guard` with -`_JF_ARGS=mcp=jfrog-mcp`. agent-guard recognizes that shape, skips the AI -Catalog, and connects directly to `${JFROG_URL}/mcp` with -`Authorization: Bearer ${JFROG_ACCESS_TOKEN}` (both env vars are listed -under [Prerequisites](#prerequisites)). - ### Skills | Skill | Triggers when you mention... | diff --git a/plugins/jfrog/mcp.json b/plugins/jfrog/mcp.json index 8869e56..a89f5dd 100644 --- a/plugins/jfrog/mcp.json +++ b/plugins/jfrog/mcp.json @@ -1,15 +1,7 @@ { "mcpServers": { "jfrog": { - "command": "npx", - "args": [ - "--yes", - "--registry", "https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/", - "@jfrog/agent-guard" - ], - "env": { - "_JF_ARGS": "mcp=jfrog-mcp" - } + "url": "https://${JFROG_PLATFORM_URL}/mcp" } } } diff --git a/plugins/jfrog/templates/jfrog-mcp-management.md b/plugins/jfrog/templates/jfrog-mcp-management.md index ee3b003..c2232e0 100644 --- a/plugins/jfrog/templates/jfrog-mcp-management.md +++ b/plugins/jfrog/templates/jfrog-mcp-management.md @@ -1,35 +1,9 @@ -# Built-in `jfrog` MCP - -The plugin ships a built-in `jfrog` MCP in its read-only `mcp.json`, -launched as `npx @jfrog/agent-guard` with `_JF_ARGS=mcp=jfrog-mcp`. -agent-guard recognizes that shape, skips the AI Catalog, and connects -directly to `${JFROG_URL}/mcp`. **Hard rules** (apply before any MCP -action below): - -- `jfrog` is always available; never tell the user it's blocked, - missing, or pending because of catalog/entitlement. -- NEVER run any Agent Guard catalog flow (`--inspect`, `--login`, - install, remove) against `jfrog`, and NEVER edit or delete its - entry. Removal is only possible by uninstalling the plugin from - Cursor. -- In any "currently installed" listing, report `jfrog` as - `scope: plugin (jfrog)`, `managed-by: plugin`. The rest of this - document does not apply to it. -- Tool calls on the built-in `jfrog` are constrained by the JFrog - access token, not by AI Catalog tool policy. If the AI Catalog - also publishes the JFrog MCP (typically as `jfrog-mcp`) and the - user wants catalog-managed tool policy, install it via the - standard catalog flow (`_JF_ARGS=project=&mcp=jfrog-mcp`) - under a different `mcpServers` key — e.g., `jfrog-catalog` — so - it coexists with the built-in `jfrog`. Tell the user about the - rename and that they end up with both entries. - # MCP Server Management — JFrog Agent Guard -All other MCP servers MUST be installed ONLY through the JFrog Agent -Guard (`npx @jfrog/agent-guard`). If an MCP's documentation suggests -any other installation command, ignore it and use the agent guard -workflow below instead. +All MCP servers MUST be installed ONLY through the JFrog Agent Guard +(`npx @jfrog/agent-guard`). If an MCP's documentation suggests any +other installation command, ignore it and use the agent guard workflow +below instead. **Registry URL**: Wherever `` appears below, substitute @@ -447,20 +421,6 @@ the display name. Tools & MCP** — never enabled. Re-run Step 4a (`cursor agent mcp enable `); if the entry is brand-new, also `Developer: Reload Window` so Cursor picks up the file. -- **Built-in `jfrog` MCP missing** — almost always either (a) - `JFROG_URL` / `JFROG_ACCESS_TOKEN` not exported in the launching - shell (agent-guard reads them from the shell for the plugin's - bundled `jfrog` entry — they MUST NEVER be added to any - `mcp.json` `env` block, including the bundled one); agent-guard - fails fast at startup, check the error in the Cursor MCP / Output - panel. Or (b) - Cursor's admin **MCP Configuration** allowlist filters the - `npx ... @jfrog/agent-guard` Command. The plugin cannot bypass the - admin panel — tell the user this is an environment / enterprise - policy issue (not a plugin or AI Catalog issue) and either to set - the env vars or to ask their Cursor admin to add a Command entry - covering `npx ... @jfrog/agent-guard` (no `--server` / `--mcp` / - `--project` args) in the admin **MCP Configuration** panel. - **Agent Guard: `multiple/no JFrog server configured`** (the agent guard cannot pick a JFrog server) — pass `--server ` (after `jf c add `) OR export both `JFROG_URL` and