Sonatype MCP Server

Sonatype's own hosted MCP server, also called the Dependency Management MCP Server, is part of Sonatype Guide. It gives your coding agent Sonatype's open source component and vulnerability intelligence, so it can check a dependency before adding or upgrading it instead of picking a version from memory. What you can do with it - Get the details of a specific component version: known vulnerabilities with CVSS scores, license, categories, end-of-life status and catalog date - Find the latest version of a component, with its security analysis, policy violations, licenses and risk scores - Get recommended versions to upgrade to from the one you're on, or to start with when you add a component - Find versions of a package without known vulnerabilities, or compare the security profiles of two packages How it connects Sonatype hosts it at https://mcp.guide.sonatype.com/mcp, so there's nothing to install. It needs a personal API token: sign up free for Sonatype Guide, create a token at guide.sonatype.com/settings/tokens, and send it as an Authorization: Bearer <your-token> header. Agents that only run local servers can reach it through mcp-remote. Good to know - Its tools only look up component information; they don't change anything. - It doesn't read your source code, repositories or local files. Sonatype sees only the component names and versions in each request. - Sonatype suggests adding a rule to your agent's instructions (such as CLAUDE.md or .cursorrules) so it checks dependencies with these tools first. - Keep your token out of version control.