JFrog Runtime

API transport: Prefer jf api (JFrog CLI 2.100.0+). See jf-api-patterns.md (path-only URLs; auth from jf config). Examples using curl with $JFROG_URL + bearer token are fallback when the CLI is missing or below 2.100.0.

JFrog Runtime Skill

Authentication

All requests require an access token via the Authorization header:

Authorization: Bearer $JFROG_ACCESS_TOKEN

Base URL: https://$JFROG_URL/runtime/api/v1/...

When authentication is needed, follow the login-flow.md procedure to resolve the active JFrog environment. The jf CLI is required and will be installed automatically if missing. The agent checks saved credentials via jf config show and asks which environment to use if multiple are saved. If none exist, the agent drives the web login flow and saves credentials via jf config add.

Core Concepts

List Runtime Clusters

Returns all runtime clusters with node counts and controller status.

Note: This endpoint uses POST with a body, not GET.

curl -s -X POST "$JFROG_URL/runtime/api/v1/clusters" \
  -H "Authorization: Bearer $JFROG_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"limit": 50}' | jq .

Response contains total_count, pagination, and a clusters array. Each cluster has:

• id, name, provider, regions
• controller_status (running or stopped), controller_version
• nodes_count, running_nodes_count, failed_nodes_count, disabled_nodes_count

Get Specific Cluster

Returns detailed info including the full list of nodes.

curl -s -X GET "$JFROG_URL/runtime/api/v1/clusters/${CLUSTER_ID}/" \
  -H "Authorization: Bearer $JFROG_ACCESS_TOKEN" | jq .

Note the trailing slash after the cluster ID.

Response includes a cluster object with all cluster fields plus a nodes array. Each node has:

• id, name, hostname, architecture
• internal_ip, internal_dns, region
• status, sensor_installed, sensor_version

List Running Images

Lists all running container images across clusters with security and operational status.

curl -s -X GET "$JFROG_URL/runtime/api/v1/live/images?num_of_rows=100&statistics=true&timePeriod=now&page_num=1" \
  -H "Authorization: Bearer $JFROG_ACCESS_TOKEN" | jq .

Query parameters:

Response contains:

• images array — each image has name, registry, repositoryPath, status, clustersCount, workloadsCount, cloudProviders, and vulnerability info via riskiestTagVulns (counts by severity)
• statistics array — aggregate stats with key/value pairs
• totalCount — total matching images

Common Workflows

Monitor Cluster Health

1. List all clusters to get an overview
2. Check for clusters with controller_status: "stopped" or high failed_nodes_count
3. Get specific cluster details to inspect individual nodes

Identify Vulnerable Running Images

1. List running images with statistics=true
2. Check each image's riskiestTagVulns for critical/high vulnerability counts
3. Use the jfrog-security skill to get detailed vulnerability information for specific packages

Official Documentation

• Runtime Security
• Runtime APIs