Installs the JFrog CLI (jf), pre-wired to your JFrog Platform, so agents can run Xray security & license scans (jf audit / jf scan / jf docker scan) against dependencies, binaries, and container images. Xray is a core component of the JFrog Platform and shares package metadata with Artifactory, so a scan reports not just a CVE but its full impact path through your dependency graph.
| Name | Required | Default | Description |
|---|---|---|---|
jfrog_host | Optional | example.jfrog.io | Your JFrog Platform host, e.g. mycompany.jfrog.io (SaaS) or artifactory.internal.example.com (self-hosted). Hostname only — no scheme, no path, no port. |
| Name | Service | Required | Description |
|---|---|---|---|
JF_ACCESS_TOKEN | jfrog | Optional | JFrog Platform access token (needs Xray read + scan scopes). Stored on the host; the sandbox only ever sees a placeholder, and the proxy injects the real value on outbound requests to your JFrog host. |
releases.jfrog.io
releases-cdn.jfrog.io
${{ kit.args.jfrog_host }}
sbx run <agent> --kit docker.io/ajeetraina777/jfrog-xray-kit:0.1.2-smokeRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbx