Software Supply Chain Memory: Connecting JFrog Artifactory to Cognee GraphRAG

In modern enterprise DevOps and platform engineering, the software supply chain is vast and complex. Binary artifact repositories like JFrog Artifactory store thousands of container images, language packages (npm, PyPI, Maven), and Helm charts alongside critical CI/CD build execution logs and SBOM dependencies.

When vulnerabilities arise (such as zero-day CVEs in upstream dependencies) or release rollbacks occur, platform engineers and security analysts need to rapidly answer connected questions:

• Which Docker images deployed in staging were compiled from Git commit 9f8a2b?
• What published modules declare dependencies on a specific vulnerable package version?
• What is the SHA-256 cryptographic checksum and build timeline for our payment microservice release?

Because software supply chains are intrinsically hierarchical and relational (Repository $\rightarrow$ Artifact $\rightarrow$ Module $\rightarrow$ Build Run $\rightarrow$ Dependencies), flat text search often misses the full dependency context.

As part of the WeMakeDevs × Cognee Mergetober Hackathon, I developed and submitted the JFrog Artifactory data-source connector (cognee-community-connector-artifactory) for Cognee.

Here is an architectural deep dive into how we bridge Artifactory repository topologies and build provenance into Cognee's GraphRAG engine.

---

Architecture: Supply Chain Knowledge Graph

The connector extracts repository topologies, artifact metadata, and build provenance directly from Artifactory's REST and AQL (Artifactory Query Language) endpoints:

flowchart TD
    subgraph ArtifactoryAPI ["JFrog Artifactory REST & AQL"]
        A["/api/repositories (Local, Remote, Virtual)"]
        B["/api/search/aql (Artifact Metadata & Checksums)"]
        C["/api/build/{name}/{number} (Build Runs & SBOM)"]
    end

    subgraph ConnectorCore ["Security & Normalization Layer"]
        D["Pre-Ingestion Credential Scrubbing (Tokens & API Keys)"]
        E["Zero Code Execution (Passive JSON AST Parsing)"]
        F["Selective Scoping Filter (repo_keys, repo_type, ecosystems)"]
        G["Structured Markdown Document Serializer"]
    end

    subgraph CogneeEngine ["Cognee GraphRAG Ingestion"]
        H["dlt Source (DOCUMENT_SOURCE_ATTR='artifactory')"]
        I["Cognify Pipeline (LLM Relationship Extraction)"]
        J["Software Supply Chain Knowledge Graph (FalkorDB / NetworkX)"]
        K["Vector Store (Semantic Memory)"]
        L["write_disposition='replace' (Orphan Cleanup)"]
    end

    A & B & C --> D --> E --> F --> G --> H
    H --> I --> J & K
    H --> L

---

1. Multi-Resource Ingestion: Repositories, Artifacts, & Build Runs

The connector captures three synchronized levels of the software supply chain:

A. Repository Topologies (artifactory_repositories)

Ingests local, remote, and virtual repositories across container and package ecosystems (Docker, Maven, npm, PyPI, Helm, etc.), capturing package types, descriptions, repository layouts, and governance notes.

B. Cryptographic Artifact Integrity (artifactory_artifacts)

Serializes artifact coordinates, repository paths, file sizes, creation/modification timestamps, and cryptographic checksums:

# Artifactory Artifact: services/auth-service/v1.4.0/manifest.json
- **Repository:** docker-prod-local (docker / local)
- **File Size:** 2,048 bytes
- **Created At:** 2026-09-15T08:30:00Z
- **Checksums:**
  - `SHA-256`: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
  - `SHA-1`: `da39a3ee5e6b4b0d3255bfef95601890afd80709`
  - `MD5`: `d41d8cd98f00b204e9800998ecf8427e`

C. CI/CD Build Provenance & SBOM (artifactory_builds)

Captures CI/CD execution metadata, build agent details, VCS commit SHAs, published modules, and declared dependency trees for end-to-end provenance.

---

2. Invariants & Security Standards

To meet Cognee's strict maintainer standards, the connector enforces key architectural invariants:

Zero Code Execution

Ingesting binary artifact metadata must never risk code execution. The connector parses REST API responses and AQL structures strictly as passive JSON data.

Pre-Ingestion Credential Masking

Authentication headers (X-JFrog-Art-Api, Bearer access tokens, basic auth credentials) are scrubbed before any records reach Cognee memory:

def redact_credentials(text: str) -> str:
    for pattern, replacement in REDACTION_PATTERNS:
        text = pattern.sub(replacement, text)
    return text

"Forget-on-Delete" via Snapshot Sync

When obsolete packages are cleaned up by Artifactory retention policies, their graph nodes must not persist as ghost references in AI memory:

setattr(source, DOCUMENT_SOURCE_ATTR, "artifactory")

@dlt.resource(name="artifactory_artifacts", write_disposition="replace")
def artifacts_resource():
    ...

With write_disposition="replace", Cognee's native orphan cleanup prunes deleted packages on each resync while preserving active dependency links.

---

3. Querying Supply Chain Memory in Python

Connecting Artifactory to Cognee requires only a few lines of asynchronous code:

import asyncio
import os
import cognee
from cognee_community_connector_artifactory import artifactory_source

async def main():
    # 1. Initialize Artifactory source
    source = artifactory_source(
        base_url=os.environ.get("ARTIFACTORY_URL", "https://company.jfrog.io/artifactory"),
        token=os.environ["ARTIFACTORY_TOKEN"],
        repo_keys=["docker-prod-local", "libs-release-local"],
        include_artifacts=True,
        include_builds=True,
    )

    # 2. Add to Cognee memory and build Knowledge Graph
    print("Ingesting software supply chain metadata...")
    await cognee.add(source)

    print("Running Cognify: Constructing Supply Chain Knowledge Graph...")
    await cognee.cognify()

    # 3. Ask natural language supply chain questions
    query = "Which Docker image was built from commit 9f8a2b and what are its declared dependencies?"
    print(f"\nQuerying Cognee: '{query}'")

    results = await cognee.search(query)
    for res in results:
        print(f"\n[Supply Chain Insight]:\n{res}")

if __name__ == "__main__":
    asyncio.run(main())

---

Verification & Code Quality

• 100% Offline Passing Tests: 18/18 unit tests pass offline with zero network calls (tests/test_artifactory.py).
• Dependency Hygiene: Configured with flexible dependency ranges (cognee>=1.6.3,<2 and dlt>=1.9,<2) avoiding exact pins.
• DCO Certified: Verified Developer Certificate of Origin (Signed-off-by).

---

Pull Request & Resources

• Pull Request: topoteretes/cognee-community#601
• Upstream Discussion: topoteretes/cognee#5728

How is your team indexing software supply chain artifacts and SBOM metadata for AI agents? Share your thoughts below!