JFrog Xray

What JFrog Xray is

JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in open-source and third-party components. It continuously scans repositories, build packages, and container images, and can recursively scan CI build information for return to a calling CI server. Xray generates, ingests, and exports SBOMs, including CycloneDX, and supports policies and compliance reports for open-source licenses. It assesses operational factors such as component age, contributor count, maintenance cadence, commits, and end-of-life status. JFrog says its database covers more than 4 million open-source packages for malicious-package detection. Artifactory integration shares metadata for security assessment and remediation scope. IDE plugins are available for VS Code, IntelliJ, Visual Studio, and PyCharm, alongside CLI scans. Xray supports more than 25 package types and technologies, including Maven, PyPI, npm, NuGet, Docker, OCI, Helm, and Terraform State. Plans include SaaS and self-hosted options, with a 30-day trial and no free plan.