Sold by: JFrog
Deployed on AWS
Automate trusted releases across the agentic software supply chain
4.2
Overview
Limited time offer: Get JFrog Pro for just $50/month, a $100/month savings. Available only through June 4, 2027.
Trusted by millions of developers, engineers, architects, and security professionals at thousands of enterprises, including the majority of the Fortune 100, the cloud-native JFrog Software Supply Chain Platform is the single system of record for all software packages, data, and AI assets across the software supply chain.
The JFrog Platform on AWS manages every input and output across your software supply chain with complete visibility and control. This massively scalable, fit-for-purpose platform is available as a fully managed SaaS, self-managed, and hybrid solution, giving organizations the deployment flexibility this AI era demands. By embedding security and evidence-based governance directly into development workflows from the first line of code to runtime, JFrog enables trusted, risk-mitigated releases without slowing teams down. And as your software factory evolves, JFrog governs every AI model, agent skill, and MCP server alongside traditional artifacts in one place, securing your entire agentic software supply chain.
JFrog Enterprise subscriptions include 24x7 Support and optional in-region 99.99% uptime SLA, plus an assigned support resource with regular touch points. The JFrog Platform is often leveraged to consolidate enterprise DevSecOps solutions for companies utilizing GitLab, Sonatype, Snyk, or Veracode, among others. Contact JFrog at cloud@jfrog.com for private offers on annual subscriptions, or visit < www.jfrog.com/pricing > for more information.
Key products and capabilities:
- JFrog Artifactory: Universal artifact management
- JFrog Xray: Modern, holistic SCA
- JFrog Advanced Security: Contextual analysis of vulnerabilities
- JFrog Curation: Early blocking of malicious open source packages
- JFrog AppTrust: Application risk governance
- JFrog ML: Control and govern AI/ML development
- JFrog AI Catalog: Detect, secure, and control every AI asset
- JFrog Runtime: Real-time Kubernetes security monitoring
- JFrog Distribution: Speed up secure software consumption
- JFrog Connect: IoT device management
Highlights
- 60+ natively supported package and file types, including ML models and generic repositories.
- Comprehensive, enterprise-grade security solution integrated across the entire software supply chain, eliminating tool sprawl and alert fatigue. Go beyond scanning with contextual analysis and vulnerability prioritization, anti-tampering mechanisms, and signed provenance, ensuring best practices and compliance.
- Fast, secure distribution of verified, multi-repository release bundles to sync large-scale geo-distributed teams and accelerate deployments to any target: SaaS, self-managed, or connected devices.
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimensions summary
You buy this platform through a contract with three purchasing options. The JFrog Consumption Unit bills against a pool of consumption units, letting you draw down usage across the platform. The Pro and Enterprise X options are subscription tiers, each priced in units. Pro covers base package and model management with a set amount of included consumption. Enterprise X builds on Pro, adding high-availability setup, artifact federation, and enterprise access controls. Additional consumption above the included base is available and billed on usage, with tiered rates that lower the per-GB cost as consumption grows.
Top-of-mind questions for buyers
Both storage and data transfer count toward your total monthly consumption. Your plan includes a base amount of consumption measured in GB. Once you pass that included base, extra usage is billed automatically based on the GB you consume.
Extra consumption is priced in tiers by GB consumed. Each tier discount applies only to the consumption within that tier, not your whole usage. So as your GB volume rises into higher tiers, the per-GB rate for those additional GB drops.
The JFrog Consumption Unit draws down against a pool of units as you use the platform. Pro and Enterprise X are subscription tiers with a fixed included base of consumption. Usage above that base is billed automatically. Consumption Unit fits variable usage; the tiers suit steady, predictable workloads.
jfrog.com
Helpful?
Vendor refund policy
Contact service@jfrog.com
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
24/7 SLA support service@jfrog.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Digital.ai
By Cloudsmith
Top
10
In Continuous Integration and Continuous Delivery, Application Development, Security
Top
50
In Agile Lifecycle Management
Top
10
In Source Control
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Universal Artifact Management
Support for 60+ natively supported package and file types, including ML models and generic repositories across the software supply chain.
Integrated Security Analysis
Contextual vulnerability analysis with prioritization, anti-tampering mechanisms, and signed provenance integrated across the entire software supply chain.
Software Supply Chain Visibility
Single system of record providing complete visibility and control over all software packages, data, and AI assets across the software supply chain.
Secure Distribution
Fast, secure distribution of verified multi-repository release bundles with capability to sync large-scale geo-distributed teams and accelerate deployments.
AI and ML Asset Governance
Control and governance of AI models, agent skills, and MCP servers alongside traditional artifacts within a unified platform.
AI-Powered Predictive Analytics
Generate predictive insights across the software lifecycle to enable data-driven decision making and smarter software investments.
Unified DevOps and Security Integration
Integrate DevOps and security capabilities across the full software lifecycle with unified platform architecture.
Multi-Environment Application Deployment
Deploy applications to any target environment including mainframes, VMs, containers, and cloud platforms with support for thousands of simultaneous deployments.
Enterprise Agile Planning and Scaling
Scale agile practices across all organizational levels from individual teams to entire product portfolios with enterprise-grade planning capabilities.
Application Security and Protection
Implement DevSecOps protections during the build process to prevent tampering, reverse-engineering, and attack vectors including credential theft, cryptojacking, and script injection.
Universal Package Format Support
Support for 30 package formats enabling centralized management of diverse artifact types across different package ecosystems.
Dependency Firewall with Vulnerability Scanning
Caching of packages from open-source repositories with vulnerability scanning and policy compliance validation before distribution to developers.
Zero Trust Security Architecture
Implementation of zero-trust security workflows across services, teams and users with automated access control and risk mitigation.
Cloud-Native Global Distribution
Globally distributed cloud-native infrastructure optimized for fast and reliable artifact delivery across distributed teams and geographic locations.
ISO27001 Compliance and Access Management
ISO27001 accreditation with centralized access control, compliance management and security best practices implementation for software intellectual property protection.
Standard contract
No
No
No
Customer reviews
FENINEKH C.
One Platform for All Packages: Faster, More Reliable Builds with JFrog Artifactory
Reviewed on Nov 08, 2026
Review provided by G2
What do you like best about the product?
What I value most about JFrog Artifactory is having one place to manage all our packages. Our team works on a React Native app, so we deal with npm packages, CocoaPods, and Gradle dependencies, and Artifactory lets us proxy and cache all of them through a single platform instead of juggling separate registries.
The remote repository caching has made a real difference in our day-to-day work. Before, our CI builds would occasionally fail when a public registry was slow or a package was temporarily unavailable. Now dependencies are served from our Artifactory cache, so builds are faster and much more reliable. It also protects us if a package gets removed from the public registry, since we still have the cached version.
We also use it to host our internal libraries privately. Publishing a shared component to our own npm repository and installing it like any other package is simple, and the access controls let us decide exactly who can read or publish to each repository.
An unexpected benefit has been visibility. Being able to search for an artifact, see its versions, and check where it came from has saved us time when debugging dependency issues, because we can quickly confirm which version a build actually used. With JFrog Xray, we also get alerts about known vulnerabilities in our dependencies, which helps us catch security problems before they reach production
The remote repository caching has made a real difference in our day-to-day work. Before, our CI builds would occasionally fail when a public registry was slow or a package was temporarily unavailable. Now dependencies are served from our Artifactory cache, so builds are faster and much more reliable. It also protects us if a package gets removed from the public registry, since we still have the cached version.
We also use it to host our internal libraries privately. Publishing a shared component to our own npm repository and installing it like any other package is simple, and the access controls let us decide exactly who can read or publish to each repository.
An unexpected benefit has been visibility. Being able to search for an artifact, see its versions, and check where it came from has saved us time when debugging dependency issues, because we can quickly confirm which version a build actually used. With JFrog Xray, we also get alerts about known vulnerabilities in our dependencies, which helps us catch security problems before they reach production
What do you dislike about the product?
The biggest challenge with JFrog Artifactory is the learning curve. The interface has a lot of options, and for new team members it isn’t always obvious where to find settings or how repositories, permissions, and virtual repositories fit together. Setting up our first remote and virtual repositories for npm and CocoaPods took longer than expected because we had to piece together the correct configuration from several documentation pages. A guided setup wizard for common stacks, such as React Native with npm, CocoaPods, and Gradle together, would make onboarding much faster.
The documentation could also be more consistent. Some pages refer to older versions of the UI, so the screenshots and menu names don’t always match what we see. This sometimes sends us to community forums or support to confirm a simple configuration detail. Keeping the docs aligned with the current interface and adding more end-to-end examples would help a lot.
Storage management needs more attention than we’d like. Cached artifacts and old build versions accumulate quickly, and setting up cleanup and retention policies isn’t very intuitive. Clearer built-in retention rules, along with a simple dashboard showing which repositories use the most space, would make it easier to keep storage under control and costs predictable.
Finally, pricing can be hard to evaluate for smaller teams, since some useful features like advanced security scanning are tied to higher tiers. More flexible options for small teams would make it easier to adopt the full platform.
The documentation could also be more consistent. Some pages refer to older versions of the UI, so the screenshots and menu names don’t always match what we see. This sometimes sends us to community forums or support to confirm a simple configuration detail. Keeping the docs aligned with the current interface and adding more end-to-end examples would help a lot.
Storage management needs more attention than we’d like. Cached artifacts and old build versions accumulate quickly, and setting up cleanup and retention policies isn’t very intuitive. Clearer built-in retention rules, along with a simple dashboard showing which repositories use the most space, would make it easier to keep storage under control and costs predictable.
Finally, pricing can be hard to evaluate for smaller teams, since some useful features like advanced security scanning are tied to higher tiers. More flexible options for small teams would make it easier to adopt the full platform.
What problems is the product solving and how is that benefiting you?
Before JFrog Artifactory, our React Native team pulled dependencies directly from public registries like npm, CocoaPods, and Maven. We struggled with unreliable CI builds, because a slow or unavailable registry could break a build that had nothing wrong with the code. Now all dependencies are cached in Artifactory, so builds no longer depend on outside services being up. This has cut our dependency-related build failures by about 20% and reduced average CI build time by around 10 minutes, since packages are served from our own cache.
We also struggled to share internal code between projects. Shared components were copied between repositories or installed from Git links, which made versioning messy and updates easy to miss. Now we publish internal libraries to a private npm repository in Artifactory and install them like any other package, with proper version numbers. This has saved us roughly 3 hours per week that we used to spend syncing code manually, and it has made our apps more consistent.
Security was another gap. We had no easy way to know if a dependency contained a known vulnerability. With JFrog Xray scanning our artifacts, we now get alerts about vulnerable packages before they reach production, and we have fixed 15 issues that we otherwise would have missed.
Overall, Artifactory has given us a single, reliable source for every package our builds use, which makes our releases more predictable and our team more confident in what we ship.
We also struggled to share internal code between projects. Shared components were copied between repositories or installed from Git links, which made versioning messy and updates easy to miss. Now we publish internal libraries to a private npm repository in Artifactory and install them like any other package, with proper version numbers. This has saved us roughly 3 hours per week that we used to spend syncing code manually, and it has made our apps more consistent.
Security was another gap. We had no easy way to know if a dependency contained a known vulnerability. With JFrog Xray scanning our artifacts, we now get alerts about vulnerable packages before they reach production, and we have fixed 15 issues that we otherwise would have missed.
Overall, Artifactory has given us a single, reliable source for every package our builds use, which makes our releases more predictable and our team more confident in what we ship.
Retail
Powerful and Reliable, but the UI and Troubleshooting Could Be More Intuitive
Reviewed on Nov 08, 2026
Review provided by G2
What do you like best about the product?
Help to manage and version our big size artifactory. It provides useful automation and redemption. It is also quite reliable. Also we like because there is a version that could be deployed on our servers.
What do you dislike about the product?
JFrog Artifactory is a powerful tool, but the UI can feel overly complicated for day-to-day work. Tasks like finding specific artifacts, navigating between repositories, and managing permissions aren’t always intuitive. Troubleshooting can also be difficult, since error messages are sometimes vague and end up forcing you to dig through logs to understand what’s going on. On top of that, the platform can be resource-intensive and tends to require ongoing maintenance to keep it running smoothly.
What problems is the product solving and how is that benefiting you?
JFrog Artifactory helps us manage build artifacts and dependencies in a centralized place. It gives us a reliable repository for Docker images and software packages, which makes our CI/CD pipelines more consistent and reproducible. It also streamlines artifact versioning and access control, so we spend less time managing multiple package registries and our deployments are easier to maintain over time.
Hammad Ul I.
Powerful Artifact Management for CI/CD, but Setup and Licensing Can Be Challenging
Reviewed on Nov 06, 2026
Review provided by G2
What do you like best about the product?
I like JFrog’s ability to securely manage, store, and distribute software artifacts in one centralized platform, making CI/CD pipelines more efficient, reliable, and scalable.
What do you dislike about the product?
JFrog can be complex to configure and manage, and its licensing costs can be high. The user interface could also be more intuitive, with better documentation and simpler integrations.
What problems is the product solving and how is that benefiting you?
JFrog helps solve challenges around software artifact management, security, and release automation. It provides a centralized platform to store, manage, and distribute artifacts, improving CI/CD efficiency
Financial Services
A Single Source of Truth: JFrog as a Great Global Repo Manager
Reviewed on Nov 05, 2026
Review provided by G2
What do you like best about the product?
I work for quite a large company where having a single source of truth like JFrog is super helpful. Internally, we use npm, maven, docker and Go and having JFrog as our global repo manager is great.
What do you dislike about the product?
The cost. Especially for the smaller internal teams, where the free tier is not quite enough for our use cases. I also personally found it quite a steep learning curve to use and integrate into my workflows.
What problems is the product solving and how is that benefiting you?
It is our universal artefact support. Our teams work with Maven, npm, Docker etc and having a single source of truth we can all access is needed. We have it integrated into our CICD pipelines making automated releases more robust.
Anonymous
Smooth Artifact Management, but UI Navigation Needs Work
Reviewed on Nov 02, 2026
Review provided by G2
What do you like best about the product?
I like JFrog's smooth integration. It helps me build artifacts across different projects and store and manage Docker images. The initial setup was pretty straightforward.
What do you dislike about the product?
I find JFrog's user interface could be easier to navigate.
What problems is the product solving and how is that benefiting you?
JFrog helps me build artifacts across different projects.