JFrog Shadow AI Detection Moves to Developer Workstations

A ZIP of agent skills passed between coworkers, or an MCP server built on someone’s laptop, never goes through the build pipeline where security scans happen. JFrog now wants to see those files where they live. Its AI Security product extends Shadow AI detection from Artifactory repositories to the developer workstations where coding agents run. For platform and security teams, that means an inventory of AI assets nobody approved, though policy checks against approved versions are still to come.

What Happened

JFrog’s announcement describes detection through the JFrog Agent Plugin, installed on each workstation. It runs in three steps:

1. Discover: finds potentially risky skills, MCP servers, plugins, hooks, commands and monitors.
2. Scan locally: runs a light, deterministic rules-based scan, so the same input always gets the same result.
3. Report: sends metadata, asset identity, findings and risk analysis to the JFrog Platform.

The results land in one inventory. Each record shows the asset’s name and type, the harness that reported it (Claude Code, Cursor and so on), how many workstations have it, the local risk analysis, its JFrog origin and when it was detected. Origin shows either a match to an asset already managed in Artifactory or JFrog Catalog, or “No Match.”

Why It Matters

Before this, JFrog AI Security found Shadow AI on what JFrog calls the managed path: AI models in Artifactory repositories and calls to external AI services in builds. Third-party code and open-source packages arrive through a central build process. Agent assets often don’t. JFrog’s point is that developers and agents pull skills, scripts and plugins straight from GitHub or Slack, or the agent generates them, so they skip every standard check.

The asset types it targets:

• Skills: bundles of instructions and scripts that define how an agent performs a task.
• MCP servers: connectors that let agents reach systems such as databases, Jira or Slack.
• Plugins: installable packages that bundle skills, MCP servers and more.
• Hooks: which JFrog singles out because their author alone decides what runs on a machine every time the agent is invoked.

Risk is graded by capability. JFrog’s example is that a skill able to run shell commands carries much more risk than one that only reads files.

What This Means for Platform Teams

The missing piece is policy. JFrog says checking whether a local asset is allowed, such as whether a GitHub MCP server on a laptop matches the approved one or was built from a random repository, is planned for a future release. For now, the feature gives visibility and risk ratings, not enforcement.

It fits a series of JFrog moves on the same problem. Stack Archive covered its AI asset detection framework and Agent Guard’s approved-only proxy for MCP servers. Workstation scanning adds the local path to that coverage.

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.