Dependency Management Mcp Server

com.sonatype由 sonatype.com 發布官方發布者v1.0.2更新於 Oct 24, 2026

Sonatype component intelligence: versions, security analysis, and Trust Score recommendations

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

Sonatype 遠端伺服器，讓 AI 助理查詢開源相依套件的版本、弱點、授權與升級建議。

可以做什麼
查詢指定元件版本，回傳 CVE 與 CVSS 分數、授權、分類、終止支援狀態和目錄日期（getComponentVersion）。取得元件最新版本，附完整安全分析、政策違規、授權與風險分數（getLatestComponentVersion）。依目前版本提供建議升級版本，未提供版本時給出起始版本建議（getRecommendedComponentVersions）。將目前相依套件與最新版本比對，並提供弱點修補與授權合規建議。
適用情境
適合助理在新增、升級或檢視開源相依套件時，先取得弱點、授權與健康度資訊再決定版本。也適合需要在 IDE 工作流程內完成軟體供應鏈安全檢查的團隊。
執行需求
透過 HTTP 存取的遠端 MCP 端點，不需本機套件；僅支援 stdio 的用戶端（如 IntelliJ）需透過 npm 的 mcp-remote 橋接。需要 Sonatype Guide 帳號與個人 API 權杖，以 Authorization Bearer 標頭送出（Codex 中可用 SONATYPE_GUIDE_MCP_TOKEN 環境變數）。需能連線 Sonatype 端點。
安裝前請注意
個人 API 權杖用於驗證所有請求，請勿提交到版本控制，支援時優先使用環境變數形式。關於相依套件的查詢會傳送到 Sonatype 遠端服務。查詢本身為唯讀，但助理建議的升級仍應在套用前人工確認。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Dependency Management Mcp Server，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.sonatype%2Fdependency-management-mcp-server/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "dependency-management": {
      "type": "http",
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}

README

Sonatype MCP Server

A Model Context Protocol (MCP) server that connects AI assistants to Sonatype's dependency management and security intelligence platform. Empower your AI coding assistant with real-time insights into open source security vulnerabilities, license compliance, and dependency health.

Overview

The Sonatype MCP Server enables AI assistants to access Sonatype's comprehensive dependency intelligence directly within your development workflow. By integrating with the Model Context Protocol, your AI assistant can help you make informed decisions about dependencies, identify security risks, and maintain compliance — all without leaving your IDE.

Key Features

  • Component Version Selection - Select the best version the first time, without the side quest
  • Security Vulnerability Scanning - Identify known vulnerabilities in your project dependencies
  • License Compliance Checking - Ensure your dependencies meet your organization's license policies
  • Dependency Health Analysis - Get insights into dependency quality, maintenance status, and risk factors
  • Real-time Security Advisories - Stay informed about the latest security threats affecting your dependencies
  • Remediation Guidance - Receive actionable recommendations to fix vulnerabilities and compliance issues

Prerequisites

  • For IDEs or tools that only support stdio MCP servers (like IntelliJ), install mcp-remote:
    bash
    npm install -g mcp-remote

Setup

The Sonatype MCP Server runs as a remote MCP server. Choose the setup instructions for your IDE or AI assistant:

Gemini Code Assist

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "mcpServers": {    "discoveredServer": {      "httpUrl": "https://mcp.guide.sonatype.com/mcp",      "headers": {        "Authorization": "Bearer <your-token>"      }    }  }}

Claude Code

Add the server using the Claude CLI:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

bash
claude mcp add --transport http --scope user sonatype-mcp https://mcp.guide.sonatype.com/mcp --header "Authorization: Bearer <your-token>"

VS Code Copilot

Add the following configuration to your global VS Code mcp.json or create a .vscode/mcp.json file in your workspace:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "servers": {		"sonatype-mcp": {			"url": "https://mcp.guide.sonatype.com/mcp",			"type": "http",			"headers": {				"Authorization": "Bearer <your-token>"			}		}	}}

Windsurf

Create or edit ~/.codeium/windsurf/mcp_config.json:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "mcpServers": {    "sonatype-mcp": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.guide.sonatype.com/mcp",        "--header",        "Authorization: Bearer <your-token>"      ]    }  }}

IntelliJ with Junie

Global Scope: Go to IDE settings → Tools → Junie → MCP Settings. Click "+" and add:

Project Scope: Create .junie/mcp/.mcp.json in your project root:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "mcpServers": {    "sonatype-mcp": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.guide.sonatype.com/mcp",        "--header",        "Authorization: Bearer <your-token>"      ]    }  }}

Kiro

Create or edit ~/.kiro/settings/mcp.json:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "mcpServers": {    "sonatype-mcp": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.guide.sonatype.com/mcp",        "--header",        "Authorization: Bearer <your-token>"      ]    }  }}

Cursor

Cursor supports remote servers directly. Add to your ~/.cursor/mcp.json:

Replace <your-token> with your personal API token generated at https://guide.sonatype.com/settings/tokens

json
{  "mcpServers": {    "sonatype-mcp": {      "type": "http",      "url": "https://mcp.guide.sonatype.com/mcp",      "headers": {        "Authorization": "Bearer <your-token>"      }    }  }}

Codex (IDE Plugin & CLI)

For both methods below, define an environment variable SONATYPE_GUIDE_MCP_TOKEN for your personal API token generated at https://guide.sonatype.com/settings/tokens.

Method 1: Using CLI command: codex mcp add sonatype-mcp --url https://mcp.guide.sonatype.com/mcp --bearer-token-env-var SONATYPE_GUIDE_MCP_TOKEN

Method 2: Create or edit ~/.codex/config.toml:

toml
[mcp_servers.sonatype-mcp]url = "https://mcp.guide.sonatype.com/mcp"bearer_token_env_var = "SONATYPE_GUIDE_MCP_TOKEN"

Authentication

The Sonatype MCP Server uses API token authentication:

  1. Create a Sonatype Guide account and generate your personal API token at https://guide.sonatype.com/settings/tokens
  2. Add the token to your MCP configuration using the Authorization: Bearer <your-token> header format
  3. Replace <your-token> with your actual token in the configuration examples above

Your API token authenticates all requests automatically. Keep your token secure and never commit it to version control.

Configuring AI Assistant Rules

To maximize the effectiveness of the Sonatype MCP Server, configure your AI assistant to prioritize using Sonatype MCP tools when working with dependencies, packages, or software supply chain security. Below are instructions for each supported IDE or tool.

Claude Code

Create custom instructions using CLAUDE.md files:

Global (all projects): Create ~/.claude/CLAUDE.md

Project (specific repository): Create .claude/CLAUDE.md in your project root

Add the following instruction:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Cursor

Create a .cursorrules file in your project root:

Project (specific repository): Create .cursorrules in your project root

Add the following instruction:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

VS Code Copilot

Create custom instructions using a .github/copilot-instructions.md file:

Project (specific repository): Create .github/copilot-instructions.md in your project root

Add the following instruction:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Windsurf

Create rules using Windsurf's Customizations feature:

Global (all projects):

  1. Click the "Rules, Memories & Workflows" icon in the top right of Cascade Code or search Rules in Windsurf Settings
  2. Navigate to "Rules"
  3. Click "+ Global" to create a new global rule
  4. Add the following content:
markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Project (specific repository): Follow the instructions for Global but click "+ Workspace" or create .windsurf/rules/sonatype.md in your project root:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

IntelliJ with Junie

Create custom guidelines using a .junie/guidelines.md file:

Project (specific repository): Create .junie/guidelines.md in your project root

Add the following instruction:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Kiro

Create steering files in the .kiro/steering/ directory:

Project (specific repository): Create .kiro/steering/sonatype.md in your project root

Add YAML front matter to make it always included:

markdown
---inclusion: always---
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Gemini Code Assist

Create custom instructions using GEMINI.md files:

Global (all projects): Create ~/.gemini/GEMINI.md

Project (specific repository): Create GEMINI.md in your project root

Add the following instruction:

markdown
## Sonatype MCP
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Example Use Cases

In the normal course of development, LLMs will decide to use or upgrade dependencies. Our MCP tools will be used transparently, offering better suggestions with more up-to-date information, eliminating the side quest of validating component and version choices.

Here are some ways to leverage the Sonatype MCP Server explicitly in your development workflow:

Analyze a Specific Version

Ask your AI assistant:

"Get detailed security information for react 18.2.0"

The assistant will return comprehensive details including CVEs with CVSS scores, license information, categories, end-of-life status, and catalog date.

Find the Latest Stable Version

Ask your AI assistant:

"What's the latest stable version of spring-boot?"

The assistant will return the latest version with full security analysis, policy violations, licenses, risk scores, and upgrade recommendations.

Security Assessment Workflow

The assistant can use both tools to compare your current version with the latest and provide actionable security guidance.

Available Tools

The Sonatype MCP Server provides three powerful tools for AI assistants:

  • getComponentVersion - Gets component information about a specific version of a component
  • getLatestComponentVersion - Gets component information about the latest version of a component
  • getRecommendedComponentVersions - Gets a set of recommended versions to upgrade to based on the current version of a component. If no version is provided, gets a set of recommended versions to start with for the component

Support & Feedback

About Sonatype

Sonatype is the leader in software supply chain security, providing solutions that help organizations manage open source risk throughout the development lifecycle. Learn more at sonatype.com.

Built with ❤️ for developers who care about secure software supply chains.

來源：README.md，提交 6ce32d1

工具

0
該伺服器需要 API 金鑰等憑證，因此 SourceWeft 無法在沒有憑證的情況下讀取其工具，也未收錄。

版本歷史

1
  1. v1.0.2最新Sep 16, 2026

評分

已滿足適用檢查項的 75%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Sonatype 整合

Sonatype Nexus

由 GitHub 帳號 oomchiller 發布

以唯讀優先方式對 Sonatype Nexus Repository 3 進行檢查、審計和文件記錄。AI 翻譯

STDIO僅桌面
未驗證 · 該軟體包類型無法在沙箱中執行Nov 4, 2026