# dependency-management-mcp-server

Connects an AI assistant to Sonatype data on dependency versions, vulnerabilities, and licenses. Useful when reviewing or changing project packages.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 74
- Author: sonatype
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sonatype/dependency-management-mcp-server
- Updated: 2026-01-14
- HTML: https://affpapa.org/en/nevibecode/mcp/dependency-management-mcp-server

## What it does

This remote MCP server gives an AI coding assistant access to Sonatype dependency intelligence. It can help choose a component version, scan project packages for known vulnerabilities, check license compliance, and assess dependency health. When an issue is found, the server provides remediation guidance.

It supports Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, and Zed. Access uses a personal Sonatype Guide API token passed as a Bearer credential in the MCP configuration. Requests will not authenticate without that token.

## Requirements
- Remote server: `https://mcp.guide.sonatype.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add dependency-management-mcp-server --url https://mcp.guide.sonatype.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "dependency-management-mcp-server": {
            "url": "https://mcp.guide.sonatype.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "dependency-management-mcp-server": {
            "type": "http",
            "url": "https://mcp.guide.sonatype.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http dependency-management-mcp-server https://mcp.guide.sonatype.com/mcp
```

## When to use it
- choose a dependency version before adding it
- scan project packages for known vulnerabilities
- check package licenses against policy
- get remediation advice for dependency risks

## Example prompts
- Use Sonatype to review this project's dependencies for known security issues.
- Compare the available versions in `package.json` and recommend the one with the best Trust Score.
- Check the licenses of every package added in this change before editing `package.json`.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74559
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89433

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md