JFrog Artifactory

Proxy for the JFrog Artifactory REST API through the managed gateway. All operations are gated by PBAC policy.

Authentication

Artifactory authenticates REST calls with a bearer token. This connector supports two auth modes, chosen per managed resource at install time via the Authentication field:

• Per-user identity token (user_secret, default, recommended) — each user links their own JFrog identity token once, through a PolicyArc-hosted browser page reached by MCP URL elicitation on the first call. The token posts only to the AS (never through the MCP client or the model), is stored encrypted per (subject, resource), and is sent as Authorization: Bearer <token> on that user's calls — so Artifactory attributes every action to the real user, with that user's own repository permissions. If the token later expires, the upstream 401 triggers a re-link prompt.
• Shared admin token (static) — every call uses one operator-held bearer admin token from the admin_token_env secret. Artifactory attributes all calls to that one identity.

Either way, PolicyArc enforces per-user authorization at the gateway via policy before the request reaches Artifactory. See Per-user upstream credentials for how the user_secret collection flow works.

Setup

• base_url — your Artifactory base URL, e.g. https://example.jfrog.io.
• upstream_auth.type — user_secret (default) or static.
• admin_token_env — static mode only — a secret holding a bearer admin token. Hidden when user_secret is selected.

Creating a JFrog identity token

JFrog Platform → Edit Profile → Identity Tokens → generate a token. In user_secret mode each user does this for themselves on the collection page; in static mode the operator provisions the shared token once.

Troubleshooting

• 401 from Artifactory — the token is missing, wrong, or expired. In user_secret mode the gateway re-prompts the user to reconnect; in static mode check the admin_token_env secret.
• 403 from the gateway — the caller lacks the scope the route requires.
• 403 from Artifactory — the authenticated user lacks permission on that repository or path.

Manifest reference

• ID: identos.artifactory
• Version: 1.1.0
• Resource type: urn:connector:identos:artifactory
• Capabilities: mcp

Supported auth modes

Type	Details
user_secret	—
static	scheme bearer; setup fields: admin_token_env

Setup fields

ID	Label	Default	Secret?	Notes
base_url	Artifactory base URL	—	no	placeholder: https://example.jfrog.io
upstream_auth.type	Authentication	user_secret	no	user_secret (recommended) has each user link their own JFrog identity token, so actions are attributed to the real user. static uses one shared admin token for everyone.
admin_token_env	Admin token	—	yes	Used only for the static method. A secret holding a bearer admin token with permission to mint scoped tokens. / shown when upstream_auth.type == 'static'

Scopes

Scope
artifactory:read

Routes

Method	Pattern	Scope	Resource template
POST	/artifactory/api/security/token	artifactory:read	—

MCP tools

Name	Scope	Description
create_scoped_token	artifactory:read	Create a short-lived, scoped Artifactory access token (e.g. for Maven/Gradle dependency resolution).