Sonatype MCP Server – Dependency Security Guidance

Overview

Sonatype MCP Server is the official Model Context Protocol integration for Sonatype Guide. It gives AI coding assistants access to Sonatype's dependency intelligence so they can make better package and version choices while developers work in tools such as Claude Code, VS Code Copilot, Cursor, Windsurf, Kiro, Gemini Code Assist, IntelliJ Junie, and Codex.

The server is useful when an AI agent is adding dependencies, updating manifests, comparing package versions, or answering software supply chain questions. Instead of relying only on model training data, the agent can query Sonatype for current component metadata, security findings, license information, health signals, and recommended versions.

What the MCP server enables

Sonatype documents three MCP tools for AI assistants:

• getComponentVersion retrieves information about a specific component version, including metadata such as release date, license, known vulnerabilities, and dependency relationships.
• getLatestComponentVersion identifies the latest available version of a component and returns related security and quality context.
• getRecommendedComponentVersions returns curated upgrade or starting-version recommendations based on the current version, or on the component alone when no current version is provided.

These tools support dependency research, vulnerability review, license compliance checks, and upgrade planning. They are designed for dependency-related requests rather than general repository automation.

When to use it

Use Sonatype MCP Server when an AI assistant is asked to add a new package, choose a package version, modernize a dependency manifest, explain whether a dependency is safe, or suggest a secure upgrade. For example, an agent can check a specific version of React, identify the latest stable Spring Boot release, or compare a current library version with recommended alternatives before editing a project file.

Connection and authentication

Sonatype runs the MCP server as a remote HTTP service at https://mcp.guide.sonatype.com/mcp. Authentication uses a Sonatype Guide personal API token sent as an Authorization: Bearer header. The token is created from a Sonatype Guide account and should be stored as a secret, for example in SONATYPE_GUIDE_MCP_TOKEN, rather than committed to source control.

For clients that support remote HTTP MCP servers, configure the server URL and bearer header directly. For IDEs or tools that only support stdio MCP servers, Sonatype documents using mcp-remote as a local bridge to the same hosted endpoint.

Key considerations

Sonatype states that the MCP server does not access repositories, scan source code, read local files, or collect intellectual property. The AI assistant sends dependency-related requests, such as component names and versions, and Sonatype returns security, version, and compliance information. Organizations should still treat dependency names and usage context as operational data and configure assistant rules so agents consult Sonatype MCP tools before adding or updating dependencies.