Proxy for the JFrog Artifactory REST API through the managed gateway. All
operations are gated by PBAC policy.
Authentication
Artifactory authenticates REST calls with a bearer token. This connector
supports two auth modes, chosen per managed resource at install time via the
Authentication field:
- Per-user identity token (
user_secret, default, recommended) — each user
links their own JFrog identity token once, through a PolicyArc-hosted browser
page reached by MCP URL elicitation on the first call. The token posts only to
the AS (never through the MCP client or the model), is stored encrypted per
(subject, resource), and is sent as Authorization: Bearer <token> on that
user's calls — so Artifactory attributes every action to the real user, with
that user's own repository permissions. If the token later expires, the
upstream 401 triggers a re-link prompt.
- Shared admin token (
static) — every call uses one operator-held bearer
admin token from the admin_token_env secret. Artifactory attributes all
calls to that one identity.
Either way, PolicyArc enforces per-user authorization at the gateway via policy
before the request reaches Artifactory. See
Per-user upstream credentials for how the user_secret
collection flow works.
Setup
base_url — your Artifactory base URL, e.g. https://example.jfrog.io.upstream_auth.type — user_secret (default) or static.admin_token_env — static mode only — a secret holding a bearer admin
token. Hidden when user_secret is selected.
Creating a JFrog identity token
JFrog Platform → Edit Profile → Identity Tokens → generate a token. In
user_secret mode each user does this for themselves on the collection page; in
static mode the operator provisions the shared token once.
Troubleshooting
- 401 from Artifactory — the token is missing, wrong, or expired. In
user_secret mode the gateway re-prompts the user to reconnect; in static
mode check the admin_token_env secret.
- 403 from the gateway — the caller lacks the scope the route requires.
- 403 from Artifactory — the authenticated user lacks permission on that
repository or path.
Manifest reference
- ID:
identos.artifactory
- Version:
1.0.0
- Resource type:
urn:connector:identos:artifactory
- Capabilities:
mcp
Supported auth modes
| Type | Details |
|---|
user_secret | — |
static | scheme bearer; setup fields: admin_token_env |
Setup fields
| ID | Label | Default | Secret? | Notes |
|---|
base_url | Artifactory base URL | — | no | placeholder: https://example.jfrog.io |
upstream_auth.type | Authentication | user_secret | no | user_secret (recommended) has each user link their own JFrog identity token, so actions are attributed to the real user. static uses one shared admin token for everyone. |
admin_token_env | Admin token | — | yes | Used only for the static method. A secret holding a bearer admin token with permission to mint scoped tokens. / shown when upstream_auth.type == 'static' |
Scopes
Routes
| Method | Pattern | Scope | Resource template |
|---|
POST | /artifactory/api/security/token | artifactory:read | — |
| Name | Scope | Description |
|---|
create_scoped_token | artifactory:read | Create a short-lived, scoped Artifactory access token (e.g. for Maven/Gradle dependency resolution). |