dependency-management-mcp-server — Claude Code MCP server
Connects an AI assistant to Sonatype data on dependency versions, vulnerabilities, and licenses. Useful when reviewing or changing project packages.
claude mcp add --transport http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcpWhat dependency-management-mcp-server does
This remote MCP server gives an AI coding assistant access to Sonatype dependency intelligence. It can help choose a component version, scan project packages for known vulnerabilities, check license compliance, and assess dependency health. When an issue is found, the server provides remediation guidance.
It supports Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, and Zed. Access uses a personal Sonatype Guide API token passed as a Bearer credential in the MCP configuration. Requests will not authenticate without that token.
What it helps with
- choose a dependency version before adding it
- scan project packages for known vulnerabilities
- check package licenses against policy
- get remediation advice for dependency risks
Example prompts for the agent
- Use Sonatype to review this project's dependencies for known security issues.
- Compare the available versions in
package.jsonand recommend the one with the best Trust Score. - Check the licenses of every package added in this change before editing
package.json.
How to install dependency-management-mcp-server
Platform CLI: remote server
claude mcp add --transport http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcpPlatform CLI: remote server
codex mcp add dependency-management-mcp-server --url https://mcp.guide.sonatype.com/mcpConfig file
{
"mcpServers": {
"dependency-management-mcp-server": {
"url": "https://mcp.guide.sonatype.com/mcp"
}
}
}Config file
{
"servers": {
"dependency-management-mcp-server": {
"type": "http",
"url": "https://mcp.guide.sonatype.com/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about dependency-management-mcp-server
How do I install dependency-management-mcp-server in Claude Code?
Run claude mcp add --transport http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcp. A personal Sonatype Guide API token is also required for server requests.
What does dependency-management-mcp-server do?
It connects Claude Code and other supported tools to Sonatype information about component versions, vulnerabilities, licenses, and dependency health. The assistant can use that information to recommend versions and remediation steps.
What is required to use the MCP server?
You need a personal Sonatype Guide API token, supplied in the configuration with Authorization: Bearer <your-token>. The server uses the remote endpoint https://mcp.guide.sonatype.com/mcp.
