JFrog on Wednesday, Oct. 21, 2026, said Shadow AI Detection now reaches developer workstations , closing a gap that registry and pipeline controls never covered: AI skills, plugins and MCP servers that land on laptops from Git, Slack, marketplaces or zip files.

In a product blog post, Ohad Shalev, product marketing manager for AI security, wrote that the JFrog Agent Plugin discovers skills, MCP servers, plugins, hooks, commands and monitors, runs a deterministic rules-based scan on each workstation and reports metadata, findings and risk analysis to the JFrog Platform. The Business Wire release said the plugin is deployed via mobile device management (MDM) or agent harness settings.

A same-day Business Wire release from swampUP Europe folded the workstation capability into a broader JFrog AI Security package that also adds Bring Your Own LLM Key (BYOK) scanning and Agent Guard policy enforcement.

“Developers are already running AI agents organizations can’t see.…