sonatype-guide — Claude Code plugin: dependency security checks
Wires the Sonatype Guide MCP server into Claude so the agent vets packages for vulnerabilities and suggests safer versions before you install them.
/plugin install sonatype-guide@claude-plugins-official
/plugin marketplace add anthropics/claude-plugins-officialWhat sonatype-guide does
This plugin gives Claude access to Sonatype Guide, a service for software supply chain analysis. A skill fires on its own whenever the agent installs, adds or upgrades a dependency, so a package gets checked before it lands in your project. You can also ask outright: scan a manifest, list CVEs with severity, tell direct risks apart from transitive ones.
Beyond vulnerabilities, it surfaces Developer Trust Scores, upgrade options with breaking-change analysis, and side-by-side comparisons of libraries on security, licensing and policy compliance. For a full audit it walks your dependency manifests.
You need a Sonatype Guide account and an API token, generated under settings at guide.sonatype.com/settings/tokens. Put the token in the SONATYPE_GUIDE_TOKEN environment variable, either in your shell profile or under env in .claude/settings.json. Without that variable the MCP server won't connect and won't show up in /mcp. Keep the token out of version control.
What it helps with
- check a package for CVEs before it enters the project
- pick a safe library version when upgrading
- separate direct vulnerabilities from transitive ones
- scan manifests for license and policy violations
- compare two libraries on security before choosing
Example prompts for the agent
- Scan my
package.jsonfor vulnerable dependencies - Which version of
spring-coreis the safest right now? - Should I use
axiosorgotfor HTTP requests?
How to install sonatype-guide
Plugin marketplace
/plugin install sonatype-guide@claude-plugins-official/plugin marketplace add anthropics/claude-plugins-officialStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about sonatype-guide
How do I install sonatype-guide in Claude Code?
Add the marketplace first: /plugin marketplace add anthropics/claude-plugins-official, then install the plugin: /plugin install sonatype-guide@claude-plugins-official.
What does sonatype-guide do?
It connects the Sonatype Guide MCP server, which checks dependencies for vulnerabilities, recommends secure versions and compares libraries on security and licensing.
What do I need before using it?
A Sonatype Guide account and an API token stored in the SONATYPE_GUIDE_TOKEN environment variable. Restart Claude after setting it.
