Software Development Platforms

JFrog Xray

Software composition analysis for vulnerabilities, licenses, and supply-chain risk.

Overview

JFrog Xray provides deep recursive scanning to identify security vulnerabilities, license compliance issues, and operational risks in open-source dependencies, binaries, and ML models. It integrates with CI/CD pipelines and artifact repositories to ensure continuous security and compliance from development to runtime.

Updated Oct 26, 2026

7 things

What JFrog Xray has

For developers

Run the software on your own servers instead of the vendor's cloud. One of 10 Software Development platforms you can self-host.
A command-line interface that lets you run the tool from a terminal or scripts. One of 17 Software Development platforms with CLI.

Hosting and storage

A vendor-operated service that runs and maintains software on its own infrastructure.

Support

Help from the vendor at any hour, every day of the week. One of 7 Software Development platforms with 24/7 support.
Faster answers from the support team than customers get as standard. One of 4 Software Development platforms with priority support.
Real people you can contact when you need help with the tool. One of 20 Software Development platforms with human support.

Pricing

A product demonstration available to prospective customers who want to evaluate the tool. One of 14 Software Development platforms with public demo.

10 features

Key Features

Dependency scanning
More importantly, it enables you to scan your builds, containers, and stored artifacts, identifying potential security risks and vulnerabilities arising from open-source dependencies.
Continuous scanning
Easily identify, prioritize and remediate vulnerabilities in your open source packages and binaries by performing continuous scanning of repositories, build packages, and container images throughout the development cycle.
Software bill of materials
Get full visibility into direct and indirect dependencies with automatically-generated software bill of materials (SBOMs).
License compliance
Detect and resolve open source licensing issues before they manifest in production, and easily create policies to enforce regulations and generate compliance reports of all your OSS licenses.
Operational risk policies
Access additional data on OSS components to evaluate operational risk. Create custom policies to block packages based on risk factors such as version age, number of contributors, maintenance cadence, number of commits, and end-of-life.
CVE research
Proactively drive security posture with in-depth CVE findings and vulnerability data from JFrog's dedicated Security Research Team.
Malicious package detection
Automatically discover and eliminate malicious packages and components using JFrog’s extended database of over 4M OSS packages, sourced with information from public advisories and JFrog’s Security Research Team.
Docker image scanning
Yes, Xray performs deep, recursive scans to analyze all layers of an image, identifying every component within each layer.
Artifact scanning
Yes, Xray can scan both your images and built artifacts as they are uploaded to Artifactory.
Automatic database updates
Yes, updates happen automatically, typically once a day.

Pros and cons

Pros

Comprehensive scanning of open-source dependencies, binaries, and ML models for security and compliance.
Strong integration with CI/CD pipelines for automated security enforcement.
Enterprise-grade access control and federation capabilities for multi-site organizations.
Supports scalable artifact management with replication and distribution features.
Offers optional advanced security features including runtime protection and secret detection.

Cons

Pricing details are complex and may require contacting sales for custom enterprise plans.
Advanced security features are optional and may increase total cost.
Primarily designed for enterprise-scale usage, which may be excessive for small teams.
Setup and configuration can be complex due to extensive features and integrations.
Limited public information on a free or low-cost tier for smaller organizations.

Developer features

IDE vulnerability context
View vulnerable dependencies with remediation options and context directly in your IDE/CLI.

You?

Be the first to rate JFrog Xray

Your review helps others make better decisions. No account needed. Takes about 10 seconds.

Featured Video

See JFrog Xray at work before you try it.

Watch on YouTube

0 questions

Frequently Asked Questions

No reviews yet

Community reviews

Sort:Write a review

No written reviews yet. Be the first to share your experience.

Tried this tool? Share your experience.

Write a review

No reviews yet

Community reviews

Sort:Write a review

No written reviews yet. Be the first to share your experience.

Tried this tool? Share your experience.

Write a review

7 things

What JFrog Xray has

For developers

Run the software on your own servers instead of the vendor's cloud. One of 10 Software Development platforms you can self-host.
A command-line interface that lets you run the tool from a terminal or scripts. One of 17 Software Development platforms with CLI.

Hosting and storage

A vendor-operated service that runs and maintains software on its own infrastructure.

Support

Help from the vendor at any hour, every day of the week. One of 7 Software Development platforms with 24/7 support.
Faster answers from the support team than customers get as standard. One of 4 Software Development platforms with priority support.
Real people you can contact when you need help with the tool. One of 20 Software Development platforms with human support.

Pricing

A product demonstration available to prospective customers who want to evaluate the tool. One of 14 Software Development platforms with public demo.

10 features

Key Features

Dependency scanning
More importantly, it enables you to scan your builds, containers, and stored artifacts, identifying potential security risks and vulnerabilities arising from open-source dependencies.
Continuous scanning
Easily identify, prioritize and remediate vulnerabilities in your open source packages and binaries by performing continuous scanning of repositories, build packages, and container images throughout the development cycle.
Software bill of materials
Get full visibility into direct and indirect dependencies with automatically-generated software bill of materials (SBOMs).
License compliance
Detect and resolve open source licensing issues before they manifest in production, and easily create policies to enforce regulations and generate compliance reports of all your OSS licenses.
Operational risk policies
Access additional data on OSS components to evaluate operational risk. Create custom policies to block packages based on risk factors such as version age, number of contributors, maintenance cadence, number of commits, and end-of-life.
CVE research
Proactively drive security posture with in-depth CVE findings and vulnerability data from JFrog's dedicated Security Research Team.
Malicious package detection
Automatically discover and eliminate malicious packages and components using JFrog’s extended database of over 4M OSS packages, sourced with information from public advisories and JFrog’s Security Research Team.
Docker image scanning
Yes, Xray performs deep, recursive scans to analyze all layers of an image, identifying every component within each layer.
Artifact scanning
Yes, Xray can scan both your images and built artifacts as they are uploaded to Artifactory.
Automatic database updates
Yes, updates happen automatically, typically once a day.

Pros and cons

Pros

Comprehensive scanning of open-source dependencies, binaries, and ML models for security and compliance.
Strong integration with CI/CD pipelines for automated security enforcement.
Enterprise-grade access control and federation capabilities for multi-site organizations.
Supports scalable artifact management with replication and distribution features.
Offers optional advanced security features including runtime protection and secret detection.

Cons

Pricing details are complex and may require contacting sales for custom enterprise plans.
Advanced security features are optional and may increase total cost.
Primarily designed for enterprise-scale usage, which may be excessive for small teams.
Setup and configuration can be complex due to extensive features and integrations.
Limited public information on a free or low-cost tier for smaller organizations.

Developer features

IDE vulnerability context
View vulnerable dependencies with remediation options and context directly in your IDE/CLI.

You?

Be the first to rate JFrog Xray

Your review helps others make better decisions. No account needed. Takes about 10 seconds.

Featured Video

See JFrog Xray at work before you try it.

Watch on YouTube

0 questions

JFrog Xray

Overview

What JFrog Xray has

For developers

Hosting and storage

Support

Pricing

Key Features

Dependency scanning

Continuous scanning

Software bill of materials

License compliance

Operational risk policies

CVE research

Malicious package detection

Docker image scanning

Artifact scanning

Automatic database updates

Pros and cons

Pros

Cons

Developer features

IDE vulnerability context

Be the first to rate JFrog Xray

Featured Video

Frequently Asked Questions

What JFrog Xray has

For developers

Hosting and storage

Support

Pricing

Key Features

Dependency scanning

Continuous scanning

Software bill of materials

License compliance

Operational risk policies

CVE research

Malicious package detection

Docker image scanning

Artifact scanning

Automatic database updates

Pros and cons

Pros

Cons

Developer features

IDE vulnerability context

Be the first to rate JFrog Xray

Featured Video

Frequently Asked Questions

More in Software Development Platforms

More in Software Development Platforms