NanoClaw and JFrog Route AI Agents Through Vetted Registries to Cut Off Supply-Chain Attacks

Autonomous agents silently install packages without human review. A new integration forces them through JFrog's scanned registries — and blocks the download if something looks wrong.

Written by Mara Voss · Bureau Tech · Jun 19, 2026

The problem: agents install packages you never approved

When a NanoClaw agent receives a task it can't handle natively — say, transcribing a voice note — it doesn't stop and ask for help. It identifies a package that can do the job, downloads it, installs it, and runs it. That autonomy is the point. It's also the attack surface.

Software supply-chain attacks work by poisoning open-source registries with malicious packages that mimic legitimate ones. A human developer might pause before installing an unfamiliar library. An autonomous agent won't. And the person operating the agent — who may have no development background — is unlikely to notice that anything happened at all.

"The people who are operating the agents are not necessarily developers, and they are not even aware of the implications," said Gavriel Cohen, CEO and co-founder of NanoCo AI, in an interview with VentureBeat.

How the integration works

NanoCo AI, the commercial entity behind NanoClaw — an enterprise-oriented, open-source variant of the OpenClaw agent framework — has partnered with JFrog, whose platform manages software artifact storage, distribution, and security scanning across the supply chain.

Under the integration, NanoClaw agents no longer reach out to arbitrary public registries. Every request for a package, CLI tool, or Model Context Protocol (MCP) server — MCP being the emerging standard for connecting AI agents to external tools and data sources — is routed through a JFrog registry first.

If JFrog's scanning flags a package as malicious or policy-violating, it returns a 403 security-policy error to the agent. Critically, the system doesn't just block and stop: it notifies the agent of the vulnerability and steers it toward an approved, clean version of the same dependency. That correction loop keeps the agent functional without requiring a human to intervene.

Visibility as a compliance requirement

For enterprises, the value isn't only threat prevention. "We need a system of record, we need somewhere to track what agents are running by whom and consuming what packages and using what skills and using what MCPs," JFrog Chief Strategy Officer Gal Marder told VentureBeat.

Routing agent activity through an internal JFrog registry gives security and compliance teams a full audit trail — something that's effectively impossible when agents pull dependencies from arbitrary public sources.

Licensing and access

The integration uses a dual-track model. Open-source NanoClaw users get free access to JFrog's vetted public registry. Community-contributed agent "skills" are uploaded, scanned, and cleared before they're available to other users — directly addressing the poisoned-repository threat.

Enterprise users point their NanoClaw agents at their own internal JFrog registries, keeping all agent activity inside existing security perimeters and subject to existing commercial-license governance.

The partnership follows NanoCo's recent moves to add permissions dialogs via Vercel and to support isolated agent execution inside Docker containers — a pattern of layering environmental controls around agents rather than relying solely on the agent's own judgment about what's safe to run.

Key takeaways

NanoClaw agents are hardwired to route all dependency requests through JFrog registries, which scan and either approve or block each package.
A blocked request triggers a correction loop: the agent receives a 403 security-policy error and is guided to find an approved substitute automatically.
The integration is free for open-source NanoClaw users; enterprise deployments route through an organization's existing, commercially licensed JFrog instance.
The core problem the partnership addresses is that autonomous agents install packages in the background, often without the knowledge of operators who may not be developers.
JFrog's registry also functions as a system of record, giving enterprises visibility into which agents are running, which packages they consume, and which MCP servers they invoke.

FAQ

What is a software supply-chain attack, and why are AI agents vulnerable?

A supply-chain attack involves placing malicious code inside a package hosted on a public registry, hoping developers or automated systems will download it. AI agents are particularly vulnerable because they autonomously identify and install packages to extend their capabilities, often without any human review of what's being installed.

What is MCP, and why does it matter here?

Model Context Protocol (MCP) is an emerging standard that lets AI agents connect to external tools and data sources. Because agents can fetch and run MCP servers dynamically, those servers represent another vector for malicious code — one the JFrog integration now covers alongside traditional software packages.

Does the integration stop the agent entirely when it blocks a package?

No. When JFrog's registry rejects a request with a 403 security-policy error, the agent is notified of the specific vulnerability and guided to find an approved alternative. The goal is to keep the agent operational while preventing the malicious dependency from being installed.

Is this available now, and what does it cost?

Yes, the integration is available immediately. It is free for open-source NanoClaw users, who are given complimentary access to JFrog's vetted public registry. Enterprise organizations use their existing, commercially licensed JFrog environments — no separate purchase is required for the integration itself.

How does this differ from NanoClaw's other recent security moves?

NanoClaw has recently added permissions dialogs through a Vercel partnership and container isolation through a Docker partnership. The JFrog integration addresses a different layer: it controls what software the agent is allowed to fetch from the internet, rather than what the agent is allowed to do on the local system.

Citations

NanoClaw and JFrog launch 'immune system' to block AI agents from downloading malicious codeNanoClaw agents are now configured to route requests for packages, CLI tools, and MCP servers exclusively through JFrog's registries; blocked requests trigger a correction loop directing the agent to an approved alternative.
NanoClaw and JFrog launch 'immune system' to block AI agents from downloading malicious codeGal Marder, JFrog CSO, stated enterprises need 'a system of record' to track which agents are running, which packages they consume, and which MCP servers they use.
NanoClaw and JFrog launch 'immune system' to block AI agents from downloading malicious codeGavriel Cohen, NanoCo AI CEO, stated that operators of autonomous agents are not necessarily developers and are often unaware of the security implications of background package installations.