Sonatype MCP Server

The Sonatype MCP Server extends Sonatype Guide’s automation capabilities by connecting AI coding assistants and IDEs to Sonatype’s trusted open-source intelligence.

With the MCP Server configured, you get real-time security scanning, version guidance, and compliance checks directly in your AI chat. As you write code or ask about dependencies, your AI assistant checks components instantly and recommends secure, policy-aligned versions and safe upgrade options.

What Can You Do with Sonatype MCP Server?

Sonatype MCP Server provides three powerful tools for AI assistants:

• getComponentVersion - Gets component information about a specific version of a component
• getLatestComponentVersion - Gets component information about the latest version of a component
• getRecommendedComponentVersions - Gets a set of recommended versions to upgrade to based on the current version of a component. If no version is provided, gets a set of recommended versions to start with for the component

With these tools, you can use Sonatype MCP Server and your preferred AI assistant to do the following:

• Research a specific component version – Use getComponentVersion to retrieve detailed information about a particular version of a component. Your AI assistant can display metadata such as release date, license, known vulnerabilities, and dependency relationships.
• Check for the most recent version – Use getLatestComponentVersion to identify the latest available release of a component. This helps ensure your projects stay up to date with the most secure, stable, and actively maintained versions.
• Get upgrade recommendations – Use getRecommendedComponentVersions to receive curated upgrade options based on Sonatype’s data. The AI assistant can suggest optimal versions that minimize breaking changes, improve security posture, or align with your organization’s policies.

Getting Started

To use the Sonatype MCP Server, follow these steps:

1. Generate an MCP API token
   Create a personal token from your Sonatype Guide account. Your AI assistant uses this token to connect securely. For detailed instructions on creating and managing tokens, see Manage Guide User Tokens.

Important
Keep this token secure and avoid committing it to version control or sharing it in project files.

2. Configure the MCP server connection
   Add the Sonatype MCP Server URL and your token to your IDE or AI assistant settings. For detailed instructions on configuring the MCP Server, see

3. Set up your IDE or AI assistant
   Complete the tool-specific configuration so your assistant can use the MCP tools.

Data Access and Privacy

The Sonatype MCP Server connects your AI assistant to Sonatype’s open-source intelligence. It does not access or retrieve your application source code.

When you use the MCP Server:

• Your AI assistant sends a dependency-related request (such as a component name and version).
• The MCP Server processes that request and returns security, version, and compliance information.
• Sonatype can see the tool request, but does not receive your application source code.

This is similar to how Sonatype can see that a customer called a policy evaluation API, but does not have access to the customer’s application source code. The MCP Server operates in the same way. It processes specific dependency information provided in the request, without visibility into your codebase.

The MCP Server does not access your repositories, scan your codebase, read local files, or collect your intellectual property. It only processes the specific dependency information included in a tool request.

You maintain control of your source code and development environment at all times.