JFrog Brings Xray Security Data Into Amazon Kiro With a New Open-Source Power
Enterprise Developer PlatformsAmazon Kiro introduced AI-native development through MCP tool integration. JFrog’s new open-source Power puts security validation directly in that tool surface — retrieving CVE data from JFrog Xray against the artifacts a developer is actually working with.
What JFrog Built
JFrog Power for Kiro is an open-source package that bundles four capability layers into a single install for Kiro 0.7 and later:
Artifact search — AQL-aware queries against JFrog Artifactory, designed to prevent the timeout failures that naive queries produce on large instances.
Repository management — create and configure local, remote, and virtual repositories without leaving the IDE.
User and group administration — manage identity and permissions through REST APIs from within Kiro conversations.
Security metadata queries — retrieve vulnerability data from JFrog Xray tied to specific artifact paths — the CVE posture of a library version, inline, as the developer is working with it.
Authentication uses browser-based OAuth, meaning credentials are never stored in config files. The Power also includes steering guardrails that prevent destructive operations and unsafe API patterns, including safeguards against timeout-prone queries on large instances.
Why This Integration Matters
The security gap in AI-assisted development has been consistent: AI coding tools accelerate the generation of code that references libraries and packages, but they do not have visibility into whether those packages carry known vulnerabilities. The developer writes faster; the security review still happens downstream.
Kiro’s MCP architecture changes this by making security tooling a contextual participant in the conversation rather than a separate gate. When JFrog Xray data is exposed as MCP tools inside Kiro, the agent can surface CVE information in the same session where the developer is evaluating a dependency — not in a separate PR review hours later. The friction reduction is meaningful: a vulnerability flagged before a commit is addressed in minutes; one caught in a downstream security scan may require rework across multiple files.
The So What
JFrog Power for Kiro is a concrete example of what MCP-native development tooling enables: security validation as a contextual participant in the coding workflow, not a pipeline stage that runs after the work is done. The open-source release at github.com/jfrog/jfrog-kiro-power means this pattern is available to any team running JFrog Platform and Kiro 0.7+. As Kiro’s Power ecosystem grows, expect more platform vendors to publish similar integrations — the integration surface is well-defined and the developer value is immediate.
Source: JFrog Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →