jfrog-package-curation

Check/download a package (npm, Maven, PyPI, Go...) via JFrog — safe, allowed, curated? Or: package op fails/blocked (ETARGET, 403, blocked by curation policy, missing version, waiver) — root cause it. Checks the JFrog Public Catalog and stored packages for a version, interprets catalog security signals, and downloads through Artifactory (JFrog Platform locations, remote cache, curation-aware package managers, or repo proxy). Do NOT use for pure CVE or vulnerability lookups (e.g. "details on CVE-2021-23337") — those are handled by the jfrog skill's Public security domain queries without this workflow. Do NOT use for installing, listing, or approving MCP servers/tools (even when named like a package, e.g. @scope/pkg).

Compatibility

"Check & download" needs only the JFrog CLI (`jf`). "Troubleshoot a failure" needs the JFrog MCP curation tools (`jfs_curation_*`) — `jf` CLI alone does not cover it; if unavailable, that section cannot run (see its Preflight). Its reference file is local; outbound HTTPS is optional there too (fetching JFrog docs on demand) — without it, it runs on the MCP tools and local reference, degraded.