Sonatype Dependency Intelligence

sonatype

Look up open-source component versions, security vulnerabilities, license compliance, and upgrade recommendations via the hosted Sonatype dependency-management MCP server.

Installs: 72
Namespace: sonatype
Version: hosted
Last attach: reviewed1 months ago

Add to your mcp.json

{
  "mcpServers": {
    "sonatype": {
      "type": "sse",
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}

Open in VS CodeDon't have it? Install FrootAI for VS Code

Attach in a FrootAI play (fai-manifest)

mcp_scope:
  attached:
    - sonatype

Authentication

api-token

create a Sonatype Guide account, generate a personal API token at guide.sonatype.com/settings/tokens, then send it as an `Authorization: Bearer` header (clients that read env use SONATYPE_GUIDE_MCP_TOKEN).

Required credential: SONATYPE_GUIDE_MCP_TOKEN

Environment variables

Variable	Required	Auth mode	Description
SONATYPE_GUIDE_MCP_TOKEN	yes	api-token	Sonatype Guide personal API token (from guide.sonatype.com/settings/tokens). Sent as an `Authorization: Bearer <token>` header; pass via env, never inline in args (doctrine #6).

Sample tools

sonatype.getComponentVersion
Get component intelligence (CVEs, CVSS, licenses, EOL status) for a specific version of a component.
sonatype.getLatestComponentVersion
Get intelligence for the latest version of a component, with security analysis and upgrade guidance.
sonatype.getRecommendedComponentVersions
Get recommended versions to upgrade to from a component's current version.

Destructive-action audit

No destructive tools — audited read-only

Destructive-action audit (X2.18): no destructive tools — all three tools are read-only dependency lookups.

Known limitations

Requires a Sonatype Guide personal API token (SONATYPE_GUIDE_MCP_TOKEN) sent as an `Authorization: Bearer` header; without it every request is unauthenticated and rejected.
Hosted remote endpoint (https://mcp.guide.sonatype.com/mcp) — requires outbound network access; no local subprocess. stdio-only clients (e.g. IntelliJ) bridge via `mcp-remote`.
Read-only dependency intelligence — component-version, security, license, and upgrade-recommendation lookups; no resource is modified.
No package version to pin — `version_pin.package` is null and `version_range` is `hosted`; drift is tracked via the snapshot tools-list rather than a semver range.

Spec contributors

Maintainers who landed commits onmcp-specs/sonatype.json.

pspsbali

Freshness

When this spec was last reviewed by a maintainer and last machine-validated against the live server.

Spec last reviewed: 1 months ago(2026-06-25)
Auto-validated: never