Port has written a competitor explainer that is more useful than most. In What does the JFrog Agent Skills Registry do?, the internal developer portal company describes JFrog’s new registry fairly: it “stores, scans, signs, and versions the agent skills your developers write, so every skill an agent picks up is vetted before it runs.” JFrog calls it the first enterprise-grade private skills registry, holding skills, MCP servers and models in one system of record, with NVIDIA NemoClaw as the first runtime integration. Port’s argument is about scope: “That governs the skill at rest. How that skill is certified for use, scoped to an owner, and cleared to production is governed by an Agentic SDLC Platform, and a maturing organization runs both.”
There are no figures, and the post defines three metrics a team could actually track: skill inventory coverage, “the share of running skills that are registered and owned”; the share of skills “scanned and signed before an agent can use them”; and the time “to trace the offending skill version, its source, and its approver.” It credits JFrog where it is stronger, malware and CVE scanning, signing and immutable versioning, and breadth across agent frameworks, and claims for Port what a registry leaves out: mapping a skill to owners, dependencies and permissions, catching duplicates against the existing catalog, and deciding whether it “fits your models and budget.” It is a vendor comparison written by one of the vendors, and it says so; the useful idea that survives is the split between the artifact and its place in the engineering estate.
The catalog holds Port’s own surface. The Port provider page lists API pages including the Port Blueprints API and Port Entities API, where the post’s ownership and dependency map lives, the Port Scorecards API for certification gates, and the Port Actions API and Port Action Runs API that an agent would trigger and follow. On the Agent Readiness score, spec presence, agentic access, auth clarity and the rate limit signal are lit.
The Kin Score is 26.0, emerging band, with discoverability at 73.2 against contract quality and contract governance at 0.0, and Agent Readiness is 17.9, agent-aware. The record does not match the surface the post describes, and that may be on our side: a portal with ten API pages and contract quality at zero suggests the contracts were not read, not that they are missing. The unlit dimensions include agent skills and the MCP server, on a company arguing it should govern both. Port has drawn the right line between storing a skill and governing its use. The record should be re-read before it is held against the company that drew it.