JFrog Plugin for Devin

JFrog plugin for Devin: JFrog Platform skills for artifact management, security scanning, and supply-chain workflows, plus the JFrog Platform MCP server (remote HTTP + OAuth).

Current version: 0.2.0 — skills from jfrog/jfrog-skills (pinned at v0.16.0) and a bundled JFrog MCP entry.

Skills

Skill	Description
jfrog	JFrog Platform operations via CLI and APIs (Artifactory, Xray, access, projects, and more).
jfrog-package-safety-and-download	Check package safety and download via Artifactory.
jfrog-ai-catalog-skills	Discover, install, manage, and publish agent skills from the JFrog AI Catalog via jf skills and Agent Guard.

After install, Devin exposes them as /jfrog:jfrog, /jfrog:jfrog-package-safety-and-download, and /jfrog:jfrog-ai-catalog-skills.

Skill content is vendored under skills/ — see VENDOR.md.

JFrog MCP

The plugin registers this MCP server (declared in mcp_config.json and referenced from .devin-plugin/plugin.json):

{
  "mcpServers": {
    "jfrog": {
      "url": "https://${env:JFROG_PLATFORM_URL}/mcp"
    }
  }
}

• Auth is OAuth against your JFrog Platform — no access token is stored in the plugin.
• Set JFROG_PLATFORM_URL (host only, for example mycompany.jfrog.io) in the environment that launches Devin CLI / Devin Local so ${env:JFROG_PLATFORM_URL} resolves.
• On first use, authenticate if prompted, or run: devin mcp login jfrog
• Plugin MCP tools are available in-session; they may not appear in the MCP settings UI yet.

Prerequisites

• Devin CLI — see Devin docs
• Devin CLI plugins enabled for your organization (devin plugins install must be allowed)
• JFROG_PLATFORM_URL — JFrog platform host only (no https://, no trailing /). Required for the bundled MCP entry.
• Skill runtime (when using the skills) — jf CLI, jq, and curl on PATH, plus a configured JFrog instance (jf config add). See jfrog-skills requirements.

Installation

devin plugins install jfrog/devin-plugin -y

Verify

devin plugins list
devin plugins info jfrog

devin plugins info jfrog should list the skills above and an MCP server named jfrog.

In a Devin CLI or Devin Local session:

/mcp

Confirm jfrog is listed (and Connected after OAuth). Ask the agent to list tools for jfrog — it should expose at least one tool.

Repository layout

devin-plugin/
├── .devin-plugin/plugin.json
├── mcp_config.json           # JFrog Platform MCP (remote HTTP + OAuth)
├── skills/
│   ├── jfrog/
│   ├── jfrog-package-safety-and-download/
│   └── jfrog-ai-catalog-skills/
├── .github/scripts/          # sync-skills vendoring
├── LICENSE
├── README.md
└── VENDOR.md

Validate locally

node scripts/validate-devin-plugin.mjs

Versioning

Bump version in .devin-plugin/plugin.json when you publish a new release, then tag (for example v0.2.0).

License

Apache License 2.0 — see LICENSE.