JFrog's swampUP 2025 announcements respond to everyone using AI coding tools and needing infrastructure to handle the mess. Instead of slapping "AI" on existing features, they built useful stuff for managing AI-generated code.
JFrog Fly: Repository Automation That Actually Works
JFrog Fly makes repositories work better with AI coding tools. They call it an "agentic repository" but it's really just "does boring repository shit automatically so you don't have to."
It connects to:
- GitHub Copilot: The AI coding tool everyone uses
- Claude Code: Anthropic's coding assistant
- Cursor: That editor that's popular with AI enthusiasts
Handles boring repository management when AI generates code. No manual setup for releases and metadata on every AI component. Useful if you're drowning in AI-generated crap.
AppTrust: Automated Compliance Because Audits Suck
AppTrust automatically generates compliance docs that enterprise audit teams demand. When AI generates code faster than humans review, manual compliance is impossible.
It automatically:
- Creates audit trails: Tracks what happened and when, with crypto signatures
- Generates compliance reports: So you can satisfy auditors without manual work
- Sets up approval gates: Blocks releases that don't meet policies
- Integrates with enterprise tools: ServiceNow, SonarSource, and the usual suspects
Goal: ship AI code without drowning in paperwork. Probably saves more time than the AI tools.
Self-Healing Security (The Useful Part)
The most interesting feature is their auto-fixing security system. They call it "agentic remediation" because everything needs to be "agentic" now, because regular automation isn't marketing-friendly enough. But this actually seems useful - finds security vulnerabilities, generates patches, tests them, and applies them without you having to babysit it.
This includes:
- Auto vulnerability scanning: Checks everything in your dependency chain
- Smart patching: Fixes issues according to your security policies
- No human needed: Applies fixes directly to your codebase
- Continuous protection: Keeps fixing new issues as they appear
If it works as advertised, this could actually save my ass. I've spent too many Friday afternoons applying CVE patches manually because Dependabot flagged 47 vulnerable dependencies and half the "fixes" break the build. Automating that nightmare would be worth the JFrog license cost alone.
AI Model Management
They also added an AI Catalog for managing the various AI models your company uses. As teams adopt different AI tools (GPT-4, Claude, local models), you need a way to track what's being used where.
The catalog handles:
- Model discovery: See what AI models your teams are using
- Deployment tracking: Know where each model is running
- Compliance: Make sure model usage follows company policies
- One-click deployment: Deploy models to different cloud providers
Why This Actually Matters
JFrog is addressing real problems that emerge when AI coding becomes mainstream:
- AI-generated code needs better infrastructure - Current tools weren't designed for AI workflows
- Compliance becomes impossible - Manual review can't keep up with AI generation speed
- Security patches are too slow - Vulnerabilities need to be fixed at AI speed
Whether this works remains to be seen, but they're solving real problems instead of adding "AI" for marketing.