JFrog MCP Server

Instructions

Implementation Reference

• tools/security.ts:14-76 (handler)

  Core handler function that queries the JFrog Xray API for artifact summaries, parses the response, aggregates issue counts by severity (Critical, High, Medium, Low, Unknown), and returns the processed summary.

  export async function getArtifactSummary(paths: GetArtifactsSummaryInput): Promise<ArtifactsSummaryOutput> {
    const full_paths = paths.paths.map(el => "default/" + el);
    const response: any = await jfrogRequest(
      "xray/api/v1/summary/artifact",
      {
        method: "POST",
        body: JSON.stringify({
          paths: full_paths,
        })
      }
    );
  
    // Debugging: Log the raw response
    console.log("Raw response from JFrog Xray API:", GetArtifactsSummaryOutputSchema.parse(response));
  
    // Validate response before parsing
    if (!response || !response.artifacts || response.artifacts.length === 0) {
      console.warn("Invalid or missing data in API response:", response);
      return { artifacts_summary: [] };
    }
  
    const apiResult =  GetArtifactsSummaryOutputSchema.parse(response);
    const severities_map = new Map<string, Array<number>>();
  
    for (const artifact of apiResult.artifacts) {
      const artifact_severities = [0, 0, 0, 0, 0];
      if (artifact.issues) {
        for (const issue of artifact.issues) {
          switch (issue.severity) {
          case "Critical":
              artifact_severities![0]++;
            break;
          case "High":
              artifact_severities![1]++;
            break;
          case "Medium":
              artifact_severities![2]++;
            break;
          case "Low":
              artifact_severities![3]++;
            break;
          case "Unknown":
              artifact_severities![4]++;
            break;
          }
        }
      }
      severities_map.set(artifact.general.path, artifact_severities);
    }
  
    const artifacts_summary = apiResult.artifacts.map((artifact) => {
      return {
        artifact_name: artifact.general.path,
        artifact_issue_count: artifact.issues ? artifact.issues.length : 0,
        artifact_critical_count: severities_map.get(artifact.general.path)![0],
        artifact_high_count: severities_map.get(artifact.general.path)![1],
        artifact_medium_count: severities_map.get(artifact.general.path)![2],
        artifact_low_count: severities_map.get(artifact.general.path)![3],
        artifact_unknown_count: severities_map.get(artifact.general.path)![4],
      };
    });
    return { artifacts_summary: artifacts_summary };
  }

• schemas/security.ts:114-139 (schema)

  Zod schemas for input (paths array), API output, tool output (ArtifactsSummarySchema), and related types used for validation in the jfrog_get_artifacts_summary tool.

  export const GetArtifactsSummaryOutputSchema = z.object({
    artifacts: z.array(JFrogXrayArtifactsSummarySchema).describe("List summaries of artifacts"),
    errors: z.array(JFrogXrayArtifactSummaryErrrosSchema).optional().nullable().describe("List summary errors of artifacts summary"),
  });
  
  export const GetArtifactsSummaryInputSchema = z.object({
    paths: z.array(z.string()).describe("List of full paths of the artifacts, the full path should include the repositotiry name"),
  });
  
  export const ArtifactsSummaryIssuesTLDRSchema = z.object({
    artifact_name: z.string().describe("Name of the artifact"),
    artifact_issue_count: z.number().describe("Number of issues found in the artifact"),
    artifact_critical_count: z.number().describe("Number of critical issues found in the artifact"),
    artifact_high_count: z.number().describe("Number of high issues found in the artifact"),
    artifact_medium_count: z.number().describe("Number of medium issues found in the artifact"),
    artifact_low_count: z.number().describe("Number of low issues found in the artifact"),
    artifact_unknown_count: z.number().describe("Number of unknown issues found in the artifact"),
  });
  
  export const ArtifactsSummarySchema = z.object({
    artifacts_summary: z.array(ArtifactsSummaryIssuesTLDRSchema).describe("Number of issues found in the artifacts per artifact"),
  });
  
  export type GetArtifactsSummaryInput = z.infer<typeof GetArtifactsSummaryInputSchema>;
  export type GetArtifactsSummaryOutput = z.infer<typeof GetArtifactsSummaryOutputSchema>;
  export type ArtifactsSummaryOutput = z.infer<typeof ArtifactsSummarySchema>;

• tools/security.ts:83-98 (registration)

  Registers the 'jfrog_get_artifacts_summary' tool with name, description, input schema, and handler that delegates to getArtifactSummary. Exported in ArtifactSecurityTools array for inclusion in main tools list.

  const getArtifactsSummaryTool = {
    name: "jfrog_get_artifacts_summary",
    description: "Get the summary of artifacts, one or many",
    inputSchema: zodToJsonSchema(GetArtifactsSummaryInputSchema),
    //outputSchema: zodToJsonSchema(ArtifactsSummarySchema),
    handler: async (args: any) => {
      const parsedArgs = GetArtifactsSummaryInputSchema.parse(args);
      return await getArtifactSummary(parsedArgs);
    }
  };
  
  /* End of Tools creation Section */
  
  export const ArtifactSecurityTools = [
    getArtifactsSummaryTool
  ];

• tools/index.ts:11-23 (registration)

  Imports and includes ArtifactSecurityTools (containing jfrog_get_artifacts_summary) in the main exported tools array used for MCP tool execution.

  import { ArtifactSecurityTools } from "./security.js";
  
  export const tools =[
    ...RepositoryTools,
    ...BuildsTools,
    ...RuntimeTools,
    ...AccessTools,
    ...AQLTools,
    ...CatalogTools,
    ...CurationTools,
    ...PermissionsTools,
    ...ArtifactSecurityTools,
  ];