Agentic Development Security (ADS) requires controlling both what AI coding agents consume (MCP servers, models, plugins, open-source packages) and what they produce (generated code, dependencies, releases) — not just detecting issues after the fact. The post argues that governance must be artifact-centric and policy-driven at every stage of the agentic development lifecycle. JFrog's platform addresses this through Curation (vetting packages and AI assets at point of request), AI Catalog (inventorying agent toolchains), Package Traffic Controller (intercepting direct registry pulls), Advanced Security and Xray (static analysis and SCA on generated code), Transitive Dependency Analysis with AI-powered CVE ranking, Agentic Remediation (multi-file fixes in developer workflows), and AppTrust (evidence-based release gates) — all unified under Artifactory as a single source of truth.
Table of contents
Control Both Sides of the Agentic Software Supply ChainJFrog’s Agentic Development Security in PracticeQuestions this post answers
What is the difference between detection and governance in agentic software supply chain security?
Detection identifies vulnerabilities after the fact — like a security camera — while governance controls what enters the supply chain in the first place, acting as the lock on the door. You can alert on a vulnerability in an asset you don't control, but you cannot block coding agents from using it. Governance requires holding and managing the artifacts themselves so policies can be enforced at the point of entry, not discovered downstream. Teams shipping AI-generated code track the detection-vs-governance distinction on daily.dev to stay ahead of supply chain risk.