jfrog-package-curation

Query the Xray curation API endpoint /xray/api/v1/curation/package_status/all_repos with the package type, name, and version via the jf CLI. An exit code of 0 means allowed, while a 403 on stderr means blocked by a curation policy with the reason in the response body.

Use jf rt dl against the base remote repository name, stripping any -cache suffix, with a full target file path and the --flat flag. Targeting the base remote repo transparently triggers the remote fetch and caches the artifact if it is not yet cached.

ETARGET means the pinned version is newer than the version Curation approved, so it was filtered from the curated version list and the client cannot resolve it. Check the public catalog for version existence and the CVS audit events to find which policy blocked it and which version was selected.

No, the failure troubleshooting path requires the JFrog MCP curation tools (jfs_curation_*) and has no jf CLI equivalent. The check-and-download path works with only the JFrog CLI, but root-cause analysis needs Xray 3.153.0 or later with Curation entitled.

The curation package status API supports npm, pypi, maven, go, nuget, docker, and gradle as lowercase package type values. Other values return an error, and the public catalog covers only a subset of types for version existence checks.

Do not use it for pure CVE or vulnerability lookups, which are handled by the JFrog platform skill's security domain queries. Also do not use it for installing or managing MCP servers, even when they are named like packages.