Dependency Management

The Sonatype MCP Server connects your AI assistant to Sonatype’s dependency management and security intelligence platform, enabling real-time insights into open source security vulnerabilities, license compliance, and dependency health directly within your development workflow.

How to use

You connect your MCP client to the Sonatype MCP Server and then perform dependency research, security checks, and upgrade recommendations from within your IDE or coding environment. Use the server to research versions, identify vulnerabilities, verify licenses, and receive remediation guidance before adding or updating dependencies.

How to install

Prerequisites you need before installing include Node.js and npm for any npm-based setup, or a compatible runtime if you plan to use stdio-based local servers. Install the MCP client interactions globally if your IDE requires a remote MCP bridge, then configure a server connection in your IDE or tool.

# If your environment supports stdio MCP servers or requires a bridge, install the remote MCP helper
npm install -g mcp-remote

# Start the server via your IDE configuration or a provided CLI (see configuration steps below)

Additional configuration and usage notes

The server is designed to be consumed as a remote MCP server. You specify the MCP URL and an authorization token in your client configuration. Ensure your token is kept secure and not committed to version control.

Configuring the MCP connection

You can connect using several client configurations shown below. Each configuration path uses the same MCP URL and token in the Authorization header.

Available tools and endpoints

The Sonatype MCP Server exposes the following capabilities to your AI assistant: getComponentVersion, getLatestComponentVersion, and getRecommendedComponentVersions. These tools let you retrieve component details for a specific version, fetch the latest version, and obtain recommended upgrade versions based on your current version.

Security and authentication

Authentication uses API tokens. Create a Sonatype Guide account and generate a personal API token, then include it in your MCP configuration using the Authorization: Bearer <token> header. Treat your token as a sensitive credential and do not expose it in code repositories.

Troubleshooting

If you encounter connectivity issues, verify that your MCP URL is reachable from your development environment and that the Authorization header is correctly set. Check that you are using the expected token format and that your IDE or assistant is configured to pass the header when making MCP requests.

Available tools

getComponentVersion

Retrieves information about a specific version of a component, including security data, licenses, and health indicators.

getLatestComponentVersion

Fetches information for the latest available version of a component, including security advisories and upgrade guidance.

getRecommendedComponentVersions

Provides a set of recommended upgrade versions for a component based on your current version, helping you plan secure and compliant updates.