REPORTED DEVELOPMENT
JFrog announced Local Shadow AI Detection to identify AI components installed directly on developers' computers, including components outside controlled corporate repositories. JFrog Agent Plugin detects skills, plugins, MCP servers and other agentic components, performs local deterministic checks, and sends metadata and analysis results to the platform.
Semantic scanning through Bring Your Own LLM Key uses the customer's chosen model account. Availability is declared for Unified Security and Ultimate Security customers. JFrog documents that checking whether a locally installed MCP component exactly matches the organisation-approved version is planned for a future release. Detecting an agent therefore does not establish that every action is authorised or non-compliant actions are technically blocked.
WHY IT MATTERS TO THE MARKET
Agent identification, component provenance, permissions, enforced restrictions and verifiable operations are distinct. BYOK also requires evaluation of API costs, model-provider data processing, retention and processing location.