A coding agent halfway through a refactor decides it needs an MCP server it has never used before. In JFrog's model that fetch is a procurement event, and the swampUP 2026 release [6] puts four refusal points in its path: Curation at the moment of the pull [8], Agent Guard's project-scoped allow list inside the developer's tool [2], Agent Package Manager's authentication of the agent itself [5], and Traffic Controller at the network layer [3]. Four chances to deny one dependency request [14].
The last one changes who has to be in the room. Curation, Agent Guard and APM are registry features a platform team can switch on. Traffic Controller works on the wire, which is why Cloudflare, Netskope and Zscaler appear in the same announcement [4]. The person with authority to change every developer's outbound path on a Tuesday usually does not report to the person who wants agent governance by Friday.
Worth separating what is being sold from what someone will be doing. Sold: zero-touch remediation that hands back a safe binary when a developer asks for a vulnerable one [7], policies-as-code written in plain English by an AI tool, prompt-to-release traceability [9], and a joint view with Google Cloud's Wiz of what is running and where it came from [10]. Done, on Monday, by the platform team at a company where agents already write code: somebody owns the list of approved skills, plugins and MCP servers, and somebody answers the developer whose agent stopped because a file was not on that list. JFrog CTO Yoav Landmann framed the goal as remediation without human intervention and without broken builds [11]. Catalog upkeep is the human intervention the goal rests on.
The scanning claim is the one to push on in a demo. The devops.com account describes semantic scanning of markdown files, skills scripts and instruction sets across models, plugins and MCP servers [1], and says nothing about how a file is judged malicious or how often that judgement holds [13]. A scanner pointed at prose has a different error profile from one pointed at compiled code, and a flagged README produces an argument rather than a fix. The same report notes it is unclear how quickly DevSecOps teams are moving to lock their supply chains at all [12], so this is a product bet, not a settled buying pattern.
Sort the assets your agents touch on two axes: whether the artifact carries instructions the agent will act on, and whether the agent can reach it without passing your proxy. Instruction-bearing and directly reachable is the quadrant this release aims at, and the only one where both the prose scanning and the network block do work. Instruction-bearing but already proxied is catalog labour you can start without a purchase order. Code-only and proxied, you handle today. Code-only and directly reachable is the old supply-chain problem with a faster client.
Before scoping any of it, pick one agent and write down where it got its last three dependencies. If nobody in the room can answer, the scanner is being priced against a surface you cannot yet see.
