JFrog
DevSecOps platform with JFrog ML for managing and securing ML model artifacts.
About
JFrog, the Nasdaq-listed company behind Artifactory, extended its software supply chain platform into ML with JFrog ML, launched in March 2025 following the Qwak acquisition. A format-agnostic Machine Learning repository type stores Hugging Face models alongside PyTorch, ONNX, pickle, and joblib artifacts, with FrogML SDK and Xet protocol support.
In September 2025 JFrog added the AI Catalog, letting platform teams curate governed access to OpenAI, Anthropic, NVIDIA NIM, and Hugging Face models with scanning, lineage, and model cards. Xray scans model files for embedded code-execution payloads, and native integrations with MLflow and Amazon SageMaker make Artifactory the system of record for models.
What it can do
- Machine Learning repository type for Hugging Face, ONNX, and pickle models
- AI Catalog curates governed access to frontier and open models
- Xray scans models for malicious payloads and license issues
Setup
Use JFrog Cloud or self-hosted Artifactory, then create a Machine Learning repository type.
Prerequisites
An Artifactory instance and ML models or Hugging Face artifacts to manage.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 103; Trending score 84/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.