# Sonatype MCP Server

> Sonatype's open source intelligence in your agent: vulnerabilities, licenses and the best version to pick or upgrade to.

Sonatype's own hosted MCP server, also called the Dependency Management MCP Server, is part of Sonatype Guide. It gives your coding agent Sonatype's open source component and vulnerability intelligence, so it can check a dependency before adding or upgrading it instead of picking a version from memory.

What you can do with it
- Get the details of a specific component version: known vulnerabilities with CVSS scores, license, categories, end-of-life status and catalog date
- Find the latest version of a component, with its security analysis, policy violations, licenses and risk scores
- Get recommended versions to upgrade to from the one you're on, or to start with when you add a component
- Find versions of a package without known vulnerabilities, or compare the security profiles of two packages

How it connects
Sonatype hosts it at https://mcp.guide.sonatype.com/mcp, so there's nothing to install. It needs a personal API token: sign up free for Sonatype Guide, create a token at guide.sonatype.com/settings/tokens, and send it as an Authorization: Bearer <your-token> header. Agents that only run local servers can reach it through mcp-remote.

Good to know
- Its tools only look up component information; they don't change anything.
- It doesn't read your source code, repositories or local files. Sonatype sees only the component names and versions in each request.
- Sonatype suggests adding a rule to your agent's instructions (such as CLAUDE.md or .cursorrules) so it checks dependencies with these tools first.
- Keep your token out of version control.

- Type: Plugin
- Made by: Sonatype
- Category: Security
- Formats: Remote MCP
- Version: 1.0.2
- Website: https://guide.sonatype.com/mcp
- Source: https://github.com/sonatype/dependency-management-mcp-server
- Page: https://pluginboard.ai/plugins/sonatype-mcp

## Works with

- ChatGPT
- Claude
- Muse
- Grok Bot
- Gemini
- Grok
- GitHub Copilot
- Cursor
- Claude Code
- Codex
- Antigravity
- Gemini CLI
- Replit
- OpenClaw
- OpenCode
- Hermes Agent

## Install

### ChatGPT

In ChatGPT on the web: Plugins → + → Add custom MCP server, then paste https://mcp.guide.sonatype.com/mcp under Connection. Business and Enterprise plans; Pro can add read-only servers.

### Claude

In Claude (web or desktop): Customize → Connectors → Add custom connector, then paste https://mcp.guide.sonatype.com/mcp

### Muse

In Muse: In a Muse chat, ask it to create a custom connector for the MCP server at https://mcp.guide.sonatype.com/mcp. Then tap Connect on the card it shows and sign in, or add your key.

### Grok Bot

In Grok Bot: In a chat with your Bot, say "Add this MCP server: https://mcp.guide.sonatype.com/mcp". It confirms the details with you and sets it up, and the tools are ready from your next message.

### Gemini

In Gemini: At gemini.google.com: Settings → Connected Apps → Add a custom app, then paste https://mcp.guide.sonatype.com/mcp

### Grok

In Grok on the web: At grok.com/connectors: New Connector → Custom, then enter https://mcp.guide.sonatype.com/mcp and sign in if it asks.

### GitHub Copilot

Add to VS Code: vscode:mcp/install?%7B%22name%22%3A%22sonatype-mcp-server%22%2C%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.guide.sonatype.com%2Fmcp%22%7D

Copilot CLI:

```shell
copilot mcp add --transport http sonatype-mcp-server https://mcp.guide.sonatype.com/mcp
```

### Cursor

Add to Cursor: cursor://anysphere.cursor-deeplink/mcp/install?name=sonatype-mcp-server&config=eyJ1cmwiOiJodHRwczovL21jcC5ndWlkZS5zb25hdHlwZS5jb20vbWNwIn0%3D

Add to .cursor/mcp.json:

```json
{
  "mcpServers": {
    "sonatype-mcp-server": {
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}
```

### Claude Code

Run in your terminal:

```shell
claude mcp add --transport http sonatype-mcp-server https://mcp.guide.sonatype.com/mcp
```

### Codex

Run in your terminal:

```shell
codex mcp add sonatype-mcp-server --url https://mcp.guide.sonatype.com/mcp
```

### Antigravity

Add to ~/.gemini/config/mcp_config.json:

```json
{
  "mcpServers": {
    "sonatype-mcp-server": {
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}
```

### Gemini CLI

Run in your terminal:

```shell
gemini mcp add --transport http sonatype-mcp-server https://mcp.guide.sonatype.com/mcp
```

### Replit

In Replit: At replit.com/integrations, open MCP Servers → + Add MCP server, paste https://mcp.guide.sonatype.com/mcp (add any headers under Advanced settings), then click Test & save.

### OpenClaw

Run in your terminal:

```shell
openclaw mcp add sonatype-mcp-server --url https://mcp.guide.sonatype.com/mcp --transport streamable-http
```

If it needs a key or sign-in: For https://mcp.guide.sonatype.com/mcp, add --header NAME=value for each header it needs, or --auth oauth and then run openclaw mcp login sonatype-mcp-server.

### OpenCode

Run in your terminal:

```shell
opencode mcp add sonatype-mcp-server --url https://mcp.guide.sonatype.com/mcp
```

If it needs a key: For https://mcp.guide.sonatype.com/mcp, add --header 'NAME=value' for each header it needs. Add --global to use it in every project.

### Hermes Agent

Run in your terminal:

```shell
hermes mcp add sonatype-mcp-server --url https://mcp.guide.sonatype.com/mcp
```

Add to ~/.hermes/config.yaml:

```json
{
  "mcp_servers": {
    "sonatype-mcp-server": {
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}
```

If it signs in with OAuth: If https://mcp.guide.sonatype.com/mcp asks you to sign in, add --auth oauth to the command, or auth: oauth to its entry.

---
From Pluginboard (https://pluginboard.ai).