# sonatype-guide

Wires the Sonatype Guide MCP server into Claude so the agent vets packages for vulnerabilities and suggests safer versions before you install them.

- plugin · `type=plugin` · Claude Code · ★ 4
- Author: sonatype
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sonatype/guide-claude-plugin
- Updated: 2026-04-02
- HTML: https://affpapa.org/en/nevibecode/plugins/sonatype-guide

## What it does

This plugin gives Claude access to Sonatype Guide, a service for software supply chain analysis. A skill fires on its own whenever the agent installs, adds or upgrades a dependency, so a package gets checked before it lands in your project. You can also ask outright: scan a manifest, list CVEs with severity, tell direct risks apart from transitive ones.

Beyond vulnerabilities, it surfaces Developer Trust Scores, upgrade options with breaking-change analysis, and side-by-side comparisons of libraries on security, licensing and policy compliance. For a full audit it walks your dependency manifests.

You need a Sonatype Guide account and an API token, generated under settings at `guide.sonatype.com/settings/tokens`. Put the token in the `SONATYPE_GUIDE_TOKEN` environment variable, either in your shell profile or under `env` in `.claude/settings.json`. Without that variable the MCP server won't connect and won't show up in `/mcp`. Keep the token out of version control.

## Install

### Claude Code (native platform)

**Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install sonatype-guide@claude-plugins-official
```
In the agent chat (not a shell):
```text
/plugin marketplace add anthropics/claude-plugins-official
```

## When to use it
- check a package for CVEs before it enters the project
- pick a safe library version when upgrading
- separate direct vulnerabilities from transitive ones
- scan manifests for license and policy violations
- compare two libraries on security before choosing

## Example prompts
- Scan my `package.json` for vulnerable dependencies
- Which version of `spring-core` is the safest right now?
- Should I use `axios` or `got` for HTTP requests?

## Similar
- [agent-security-scanner-mcp](https://affpapa.org/en/nevibecode/mcp/agent-security-scanner-mcp.md) — MCP server · ★ 124
- [hound](https://affpapa.org/en/nevibecode/mcp/hound.md) — MCP server · ★ 17
- [Analyze code scanning security issues and dependency updates if vulnerable](https://affpapa.org/en/nevibecode/prompts/analyze-code-scanning-security-issues-and-dependency-updates-if-vulnerable.md) — prompt · ★ 174676
- [Nekzus-npm-sentinel-mcp](https://affpapa.org/en/nevibecode/mcp/nekzus-npm-sentinel-mcp.md) — MCP server · ★ 19
- [mantis-chain](https://affpapa.org/en/nevibecode/skills/mantis-chain.md) — skill · 1500 installs
- [mantis-report](https://affpapa.org/en/nevibecode/skills/mantis-report.md) — skill · 1500 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md