${JFROG_CLI_HOME_DIR:-$HOME/.jfrog}/skills-cache/

1. jfrog-skill-state.json

   — written by

   scripts/check-environment.sh

   (24-hour CLI check cache).

2. onemodel-schema-${JFROG_SERVER_ID}.graphql

   — cached OneModel supergraph schema (see

   references/onemodel-graphql.md

   ).

skills-cache/

/tmp/<name>-$$.json

mktemp -d

1. Confirm the operation is needed to fulfill the user's request. If the request is ambiguous or could refer to multiple systems (e.g. "builds" could mean Artifactory build-info or CI/CD pipeline runs), ask the user for clarification instead of guessing. Never fetch data from the wrong system — a wrong answer is worse than asking a question.
2. Resolve the target server using the Server selection rules below — there must be no ambiguity about which server is used
3. For mutating operations (create, update, delete, upload), confirm with the user unless the intent is clearly implied
4. Prefer read operations first to understand current state before making changes
5. Never invent preparatory mutations. If the requested operation fails because a precondition is not met (artifact missing from the specified repo, repository does not exist, package not at the expected location, build not found), stop and report the gap to the user. Do not perform copy, move, upload, create-repo, or any other mutating operation to satisfy the precondition unless the user explicitly asks for it. These "helper" mutations can have cascading effects the user has not considered — virtual repository resolution changes, storage quota consumption, replication triggers, Xray re-indexing, or permission propagation.

jf

jf

<server-id>

returned

<code>

for

<endpoint>

:

<short reason>

. Other configured server(s):

<list>

— I won't query them without your explicit instruction. How would you like to proceed?

• Disambiguating a JFrog entity, understanding entity types, or planning operations that span multiple products: read

  references/jfrog-entity-index.md

  , then follow pointers to the relevant domain file
• Looking up documentation URLs: read

  references/jfrog-url-references.md

• Repository types, artifacts, builds, properties, or permission targets (concepts): read

  references/artifactory-entities.md

  (~220 lines)
• Stored packages, package versions, version locations, or the metadata layer over Artifactory (concepts): read

  references/stored-packages-entities.md

  (~165 lines)
• Repo, file, build, permission, user/group, or replication operations: read

  references/artifactory-operations.md

  (for listing builds use AQL with

  limit

  /

  offset

  — see § Listing build names; for full build detail use

  GET /api/build/<name>/<number>?project=

  — see § Retrieving full build info)
• AQL queries: read

  references/artifactory-aql-syntax.md

  (~585 lines)
• Artifactory REST beyond the CLI, structured JSON templates (replacing interactive wizards), or any Artifactory API gap: read

  references/artifactory-api-gaps.md

  (~220 lines)

• Watches, policies, violations, components, or vulnerability scanning (concepts): read

  references/xray-entities.md

  (~290 lines)
• Exposures scanning results (secrets, IaC, service misconfigurations, application security risks): read

  references/xray-entities.md

  § Exposures (Advanced Security)
• Curation audit events (approved/blocked packages, dry-run policy evaluations, curation export): read

  references/xray-entities.md

  § Curation audit events

• Release bundles, lifecycle stages, distribution, or evidence (concepts): read

  references/release-lifecycle-entities.md

  (~180 lines)
• Applications, application versions, releasables, promotions, or AppTrust (concepts): read

  references/apptrust-entities.md

  (~155 lines)

• Public or custom catalog, package metadata, vulnerability advisories, licenses, OpenSSF, or MCP services (concepts): read

  references/catalog-entities.md

  (~190 lines)
• CVE details, vulnerability lookup by CVE ID, or severity/affected-packages/fix-versions for a specific CVE: go directly to

  references/onemodel-query-examples.md

  § Public security domain for the

  searchVulnerabilities

  query shape — this is self-contained; do not load the

  jfrog-package-safety-and-download

  skill for pure CVE lookups

• GraphQL queries (applications, packages, evidence, release bundles, catalog, cross-domain, or "list/search my" platform entities): read

  references/onemodel-graphql.md

  (~325 lines)
• Query templates and domain-specific examples: read

  references/onemodel-query-examples.md

  (~555 lines)
• Pagination, filtering, GraphQL variables, or date formatting: read

  references/onemodel-common-patterns.md

  (~280 lines)

• Platform structure, project/repo membership, or project roles vs environments (concepts): read

  references/platform-access-entities.md

• Access tokens, stats, projects, or system health: read

  references/platform-admin-operations.md

• Managing JFrog Projects, members, or environments: read

  references/projects-api.md

  (~260 lines)
• Platform REST beyond the CLI, or any platform-level API gap: read

  references/platform-admin-api-gaps.md

  (~180 lines)

• Adding a server or logging in: read

  references/jfrog-login-flow.md

  (~130 lines)
• CLI not installed, upgrade needed, or

  jq

  unavailable: read

  references/jfrog-cli-install-upgrade.md

• Batching, parallel Shell calls, or launching subagents: read

  references/general-parallel-execution.md

  (~135 lines)
• Large or parallel data gathering, list-vs-detail APIs, cache hygiene: read

  references/general-bulk-operations-and-agent-patterns.md

• Standalone HTML report with JFrog-aligned styling: read

  references/jfrog-brand-html-report.md

• Reusable gotchas from past tasks: read or extend

  references/general-use-case-hints.md

jf config

• List servers:

  jf config show

  (local operation, no network needed)
• Use a specific server: pass

  --server-id <id>

  to any command
• Switch default:

  jf config use <server-id>

• Add a new server: read

  references/jfrog-login-flow.md

  for the full login procedure (web login or manual token setup)

--help

1. jf --help

   — list all namespaces and top-level commands

2. jf <namespace> --help

   — list subcommands in a namespace

3. jf <command> --help

   — show usage, arguments, and options

rt

xr

ds

at

apptrust

evd

mc

worker

config

c

plugin

ide

Sunset notice: JFrog Pipelines has been sunset and is no longer supported. Do not use the

pl

CLI namespace or the Pipelines REST API (

/pipelines/api/...

). If a user asks about Pipelines, inform them the product has been sunset.

rbc

rbp

rbd

rba

rbf

rbe

rbi

rbs

rbu

rbdell

rbdelr

audit

scan

build-scan

curation-audit

sbom-enrich

access-token-create

atc

login

how

stats

generate-summary-markdown

exchange-oidc-token

completion

• jf api

  requires the product prefix in the path (

  /artifactory/...

  ,

  /xray/...

  ,

  /access/...

  ,

  /evidence/...

  ,

  /lifecycle/...

  ,

  /apptrust/...

  ,

  /distribution/...

  ,

  /onemodel/...

  ,

  /mc/...

  ). Omitting the prefix returns 404. See the product-prefix table above.

• jf api

  writes the body (success or error JSON) to stdout and

  [Info] Http Status: NNN

  to stderr on every call; non-2xx also exits 1 and adds

  [Warn] jf api: <method> <url> returned NNN

  . Pipe stdout to

  jq

  directly; never

  2>&1 | jq

  — stderr corrupts the JSON. To keep diagnostics:

  jf api <path> 2>/tmp/err-$$.log | jq .

  .

• jf api

  has no

  -L

  (follow redirects) and no

  -o

  (output file). Save bodies with shell redirection (

  jf api ... > /tmp/out-$$.json

  ); for binary downloads through the Artifactory remote proxy prefer

  jf rt dl

  , which handles the cache and redirect semantics natively.
• Remote repository content is stored in a

  -cache

  suffixed repo. Properties and AQL queries for remote repo artifacts must target the cache repo. Conversely,

  /api/repositories/<key>

  only accepts the parent remote key (without

  -cache

  ) — strip the suffix for configuration lookups.
• Do not use

  jf rt search

  — always use a direct AQL query via

  jf api /artifactory/api/search/aql -X POST -H "Content-Type: text/plain" -d '<aql>'

  . See

  references/artifactory-aql-syntax.md

  .
• Use

  --quiet

  flag for non-interactive execution (suppresses confirmation prompts). Caution:

  --quiet

  is not a global flag — commands that do not support it (e.g.

  jf rt s

  ,

  jf rt ping

  ) will fail with misleading errors like "Wrong number of arguments" or "flag provided but not defined". Check

  --help

  for a command before adding

  --quiet

  .
• Use

  --server-id

  when targeting a non-default server. If a command fails with

  --server-id

  , do not retry without it — that silently targets the default server instead. See Server selection rules.
• Never use interactive commands. All JFrog CLI operations must be performed non-interactively. Known interactive commands to avoid:

  jf config add

  ,

  jf login

  ,

  jf rt repo-template

  ,

  jf rt permission-target-template

  , and

  jf rt replication-template

  . For server setup, follow

  references/jfrog-login-flow.md

  . For templates, use JSON schemas or REST API. If a command prompts for input unexpectedly, find the non-interactive alternative via

  --help

  or REST API.

• jf config export

  output is base64-encoded JSON. Decode with

  base64 -d | jq

  to extract fields.
• Build info lookups require a scope (

  ?buildRepo=

  or

  ?project=

  ) — resolve it before calling the API. See

  references/artifactory-operations.md

  §Retrieving build info for the full workflow.
• If a

  jf api

  call returns 401, the configured token may have expired or been rotated — ask the user to re-run the login flow (see

  references/jfrog-login-flow.md

  ) for the same server. If 403, the token lacks required permissions. If 404, verify the endpoint path (especially the product prefix) and target server version. On any of these errors, do not try a different configured server as a workaround — that targets a different environment. Report the error and ask the user.
• Xray contextual analysis: the summary artifact response has two applicability fields —

  applicability

  (top-level, often null) and

  applicability_details

  (always present with a

  result

  string). Use

  applicability_details[].result

  for counts and summaries. Using the top-level

  applicability

  field for aggregation produces wrong counts because it is null when no scanner exists. See

  references/xray-entities.md

  §Contextual analysis for the eight possible result values and jq snippets.
• OneModel GraphQL: always fetch the supergraph schema from the same server you query before building operations (schemas differ by deployment); cache, validate, and execute per

  references/onemodel-graphql.md

  .
• Never duplicate a network-fetching command to retry

  jq

  parsing — save the response to a temp file first (see Preserving command output).
• When collecting detail responses in a loop (e.g. per-repo GETs), validate each body with

  jq -e .

  before appending to a results file. One non-JSON or empty response corrupts a downstream

  jq -s

  slurp. Write validated lines to an NDJSON file, then

  jq -s '.' file.ndjson

  to produce the final array. See

  references/general-bulk-operations-and-agent-patterns.md

  .
• Accumulated edge cases from real tasks live in

  references/general-use-case-hints.md

  — read when debugging odd failures; append a short entry when you confirm a new, reusable gotcha.

OUT=/tmp/jf-repos-$$.json
jf api /artifactory/api/repositories > "$OUT"
echo "$OUT"

$$

$$

1. $$

   + echo (preferred): use

   $$

   for collision safety, echo the path as shown above. The agent reads

   /tmp/jf-repos-12345.json

   from the output and passes that literal value to the next Shell call.
2. Session ID: when many files share a prefix across calls, generate an ID once (

   SID=$(date +%s)-$$

   ), echo it, and reuse in later calls.
3. Hardcoded names: last resort — risks collisions when parallel calls or subagents write to the same path.

jq

||

jq

jq '<filter>' /tmp/jf-*-$$.json

jf api