JFrog Xray
JFrog Xray: Broad artifact and dependency risk analysis for teams built around JFrog. Ranked #19 of 65 in Software Composition Analysis Software by our editors (7.4/10); pricing: 30-day trial; best for JFrog-centered artifact environments.
At a glance
- Editor score7.4 / 10
- Pricing30-day trial
- Best forJFrog-centered artifact environments
- Free planNo
- SBOM generationYes
- Founded2008 · Netanya, Israel
- Facts checked22 Sep 2026
Where it wins
- Scans source, dependencies, binaries, builds, containers, and artifacts
- Combines CVE, license, malicious-package, SBOM, and policy analysis
- Adds reachability, continuous monitoring, and pull-request scanning
Where it doesn't
- Enterprise X includes 30 projects, which may limit larger environments
- Starts at $950 per month with no free plan
- Enterprise + uses custom pricing for advanced multisite capabilities
Our verdict on JFrog Xray
JFrog Xray is a software composition analysis tool for organizations managing open-source and third-party components across source code, dependency manifests, builds, binaries, container images, and stored artifacts. It is aimed at teams that need to identify and prioritize vulnerabilities, license issues, malicious packages, and operational risks, particularly within JFrog-centered artifact environments. Deployment options include web, API, and self-hosted use, with hybrid deployment listed for the category.
The published plans show a paid structure. Enterprise X costs $950 per month and includes vulnerability scanning, SBOM generation, code and binary SCA, 30 included projects, and 24/7 SLA support. Enterprise + uses custom pricing and adds advanced multisite management, higher uptime guarantees, and disaster recovery. JFrog Xray is presented within JFrog platform packages rather than as a separately priced standalone product, and regional taxes, consumption charges, and package configuration may apply. That makes the lower tier easier to understand, while the higher tier is oriented toward organizations with broader operational requirements.
Its main strength is breadth across the software supply chain. Xray supports source-code and dependency-manifest scanning alongside binary, build, artifact, and container analysis. It can generate and export SBOMs, detect CVEs and malicious packages, analyze license compliance, scan pull and merge requests, and enforce policies through watches. Continuous impact analysis and monitoring extend those controls beyond a single scan. Integrations with JFrog Artifactory, JFrog CLI, Frogbot, IDE plugins, GitHub, and CI/CD workflows support teams already invested in that ecosystem. Choose Xray when those controls and integrations justify the monthly cost; consider another option if you need a free plan, a lower entry price, or broader project coverage in the base tier.
Your product? Our editors can test JFrog Xray in depth and publish a review, labelled as paid · from $149/mo →
JFrog Xray pricing
All 2 JFrog Xray plans and prices →
JFrog Xray fact sheet
| Free plan | No |
|---|---|
| Paid from | Not verified |
| Supported ecosystems | Go, PHP, Java/Maven, Java/Gradle, Java/Ivy, Scala/SBT, JavaScript/npm, Bower, pnpm, Yarn, .NET/NuGet, Python/PyPI, Conda, RubyGems, CocoaPods, Conan, Rust/Cargo, R/CRAN, Swift/SwiftPM, Dart/Flutter/pub, Docker, OCI, Helm, Terraform State |
| SBOM generation | Yes |
| Reachability analysis | Yes |
| Pull request scanning | Yes |
| Monitored projects | 30 projects |
| Deployment options | Not verified |
| Free trial | 30 days |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Compliance & security | SOC 2, ISO 27001, GDPR, 2FA |
| Support | Community, Docs, Tickets · 24/7 |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 7 integrations: JFrog Artifactory, Frogbot, JFrog CLI, GitHub, Jira, CI/CD pipelines … See all → |
| Pricing | 30-day trial (source) |
| Website | jfrog.com |
| Facts checked | 22 Sep 2026 |
JFrog Xray integrations
JFrog Xray lists 7 integrations on its own site.
- JFrog Artifactory
- Frogbot
- JFrog CLI
- GitHub
- Jira
- CI/CD pipelines
- IDE plugins
See all JFrog Xray integrations →
Alternatives to JFrog Xray
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all JFrog Xray alternatives →
Also Ranked In
JFrog Xray is ranked in 3 of our directories.
Used JFrog Xray? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used JFrog Xray for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
JFrog Xray is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/jfrog-xray/"><img src="https://www.itechguides.com/best/badge/jfrog-xray.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update