boost

skill
Security Audit
Fail
Health Pass
  • License — License: NOASSERTION
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 97 GitHub stars
Code Fail
  • rm -rf — Recursive force deletion command in install.sh
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool is a CLI utility designed to accelerate build commands, tests, and coding agents. It wraps existing commands to speed up execution and reduce noisy output in local terminals, CI pipelines, and AI editors.

Security Assessment
Risk: Medium. The tool executes shell commands by design, acting as a wrapper for your existing workflows. The primary security concern is its installation method: piping a remote curl script directly to bash. The automated scan flagged a recursive force deletion (`rm -rf`) command inside this `install.sh` script, which requires careful manual review to ensure it doesn't accidentally delete critical system files. While no hardcoded secrets or dangerous repository permissions were detected, the tool collects OpenTelemetry telemetry. Because it routes your build and execution data through its proprietary framework, users should verify exactly what data is being tracked and where it is sent.

Quality Assessment
Quality is High. The project is actively maintained, with repository activity as recent as today. It enjoys a solid community footprint with 97 GitHub stars and is sponsored by JFrog, a well-established software company. However, it operates under a "NOASSERTION" / proprietary beta license, meaning it is not a standard open-source tool. Developers must review the specific terms of use before integrating it into commercial pipelines.

Verdict
Use with caution: While the project is professionally backed and actively maintained, the proprietary license, telemetry tracking, and potentially destructive installation script warrant a manual code review before deploying in sensitive environments.
SUMMARY

Make your agents leaner and faster. It’s not just about saving time; it’s about the feeling of not wasting it.

README.md

Boost

Boost — faster agents, faster CI

For coding agents, their commands, and the CI that runs them.

Website Release Go 1.25 Platforms Downloads Stars

Agent-native OpenTelemetry License: proprietary (beta)

Sponsored by JFrog


Humans and coding agents spend too much time waiting for commands to finish and sifting through noisy output. Boost is a single binary that drops into three places at once:

  • your terminal — prefix any command with boost
  • your coding agentboost init wires up Cursor, Claude Code, Codex, Gemini CLI, and more
  • your CI — one line: uses: jfrog/boost@v0

Same binary, same acceleration, same telemetry — wherever your builds run.

Quick Start

CLI — prefix any command with boost

Install:

curl -fsSL https://raw.githubusercontent.com/jfrog/boost/main/install.sh | bash

Use:

boost docker build -t myapp .
boost npm ci
boost pytest

Coding agent — auto-wire Cursor, Claude Code, Codex, and more

Run the interactive setup in any project:

boost init

It detects your installed editors and CI providers and registers hooks so every tool call the agent makes gets wrapped by boost. Re-run it any time your editor / agent list changes.

CI — one line in your workflow

steps:
  - uses: jfrog/boost@v0
  - uses: actions/checkout@v4
  ...

The action pins to the rolling v0 major; see releases for the latest tag.

Why Boost

  • One binary, three surfaces — CLI, coding agent, and CI all share the same runtime and behave identically.
  • 60–90% fewer log tokens — strips noise from command output before it reaches your agent's context window.
  • Deep OTel context — every wrapped command emits OpenTelemetry traces and metrics your agents can reason about.

Before / after

Same npm ci, same result. What changes:

  • ~15× fewer tokens in your agent's context — 9.8k → 640 on a typical install.
  • Faster reruns via content-addressed cache — seconds instead of minutes.
  • Deep OTel trace of every command — timing, cache hits, exit code — routable to your backend.
# Without boost — ~9,800 tokens of log noise in your agent's context
$ npm ci
npm warn deprecated [email protected] / [email protected] / [email protected] …
added 1285 packages, audited 1286 in 45s
found 0 vulnerabilities

# With boost — ~640 tokens, same result, cache-backed
$ boost npm ci
[OK] npm ci · 1,285 packages restored from boost cache in 2.4s · 0 vulnerabilities

Supported tools

Coding agents: Cursor · Claude Code · GitHub Copilot · Codex CLI · Gemini CLI · OpenCode · Windsurf · Cline

CI platforms: GitHub Actions · GitLab CI (coming soon) · Jenkins (coming soon) · CircleCI (coming soon) · Azure Pipelines (coming soon)

Usage examples

Prefix any command with boost — anywhere you'd normally run it.

  • boost docker build ... — compressed build log, layer-cache summary, Docker metrics in OTel
  • boost npm ci — dependency summary, local package cache, retry-safe output
  • boost pytest — per-test pass/fail/duration stored locally, quiet output on green runs
  • boost gh run view --log — CI log stream condensed to top failures plus summary

Update

boost update

Documentation

See the full documentation for commands, configuration, OpenTelemetry export, and CI recipes.

Security & Privacy

  • Local-first. Command history and raw OTel traces stay on your machine.
  • Only metadata leaves. Exported spans carry timing, exit code, and cache stats — never raw logs, file contents, or env values. Secrets matching patterns like *_TOKEN, *_SECRET, AWS_*, DATABASE_URL are redacted before write or export.
  • Open protocol, signed binaries. OpenTelemetry-native; point BOOST_OTEL_ENDPOINT at your own backend. Binaries ship signed via GitHub Releases.

Full policy, supported versions, and how to report a vulnerability: see SECURITY.md.

License

Copyright © 2026 JFrog Ltd. All rights reserved. See LICENSE and BETA_AGREEMENT.md.


Dedicated to the memory of Dima Gershovich — a brilliant engineer, a talented musician, and a dear friend. Read Dima's story

Reviews (0)

No results found