Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .claude-plugin/plugin.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "jfrog",
"displayName": "JFrog",
"description": "Official JFrog plugin. Connect Claude Code to JFrog to manage, secure, and govern your software supply chain. Give agents the context to build secure, compliant software.",
"version": "0.2.2",
"version": "0.2.3",
"author": {
"name": "JFrog Ltd.",
"email": "devrel@jfrog.com",
Expand Down
19 changes: 15 additions & 4 deletions templates/jfrog-mcp-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -356,10 +356,16 @@ npx --yes \
[--server <SERVER_ID>]
```

Output is a JSON array; each element has `name`, `packageName`,
`description`, `type`, `packageVersion`, optional `env[]`.

3. Filter out any `packageName` already present in the installed list
The output is a compact TSV: a header line, then one server per line,
tab-separated: `name<TAB>type<TAB>version<TAB>description`.
Run the command ONCE and present the rows directly as a numbered
table — do NOT re-run it, redirect it, or parse it with `python3`/`jq`.
The `name` column is the install identifier (the value you pass to
`--inspect --mcp` and to install); `packageName` is NOT a separate
column — for remote/http MCPs there is no package name, so `name` is
the display name.

3. Filter out any `name` already present in the installed list
(compare against `mcp=` in `_JF_ARGS`). Mark the rest as
available to install.

Expand All @@ -385,6 +391,11 @@ Output is a JSON array; each element has `name`, `packageName`,
- Package name MUST come from the catalog (`--inspect` /
`--list-available`). NEVER guess. NEVER install MCPs outside the
agent guard. NEVER use Fetch/WebFetch for catalog calls.
- NEVER pipe a catalog command through `python3`, and NEVER capture it
with `2>&1` — `npx`/`npm` writes progress to stderr, which corrupts
the output stream. For `--list-available` present the compact TSV it
prints; for `--inspect` read the JSON it prints on stdout
directly (or with a single `jq` filter), never via `python3`.
- NEVER write a raw secret into `.mcp.json` or `~/.claude.json` —
always `${ENV_VAR}`. NEVER show tokens / API keys.
- NEVER try multiple servers — ask the user to pick one.
Expand Down
Loading