# Configuring MCP Servers

To use the Sonatype MCP Server, you must connect your AI assistant or IDE to it. When you configure the MCP server, you add the Sonatype MCP Server details to your tool’s settings. This allows your AI assistant to send requests to Sonatype and receive dependency information in real time.

## Setup Instructions

The Sonatype MCP Server runs as a remote MCP server. Configuration steps vary by IDE or AI assistant. Refer to the appropriate setup topic below for detailed instructions.

**Note**

MCP server configuration varies by IDE. Refer to your IDE's official product documentation to configure the MCP server.

## Supported IDEs and AI Assistants

Sonatype MCP Server supports the following IDEs/AI assistants:

### Gemini Code Assist

1. **Add MCP Server Configuration**  
   Add the following to the global `mcp.json` or create a `/.gemini/mcp.json` in your workspace.
   
   ```
   {
        "mcpServers": {
          "sonatype-mcp": {
            "httpUrl": "https://mcp.guide.sonatype.com/mcp",
            "headers": {
              "Authorization": "Bearer <your-token>"
            }
          }
        }
   }
   ```

2. **Configure AI Assistant Rules (Recommended)**  
   To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
   
   Create or update one of the following files:
   
   - **Global (all projects):** Create `~/.gemini/GEMINI.md`
   - **Project (specific repository):** Create `GEMINI.md` in your project root (project-level)
   
   Add the following instruction:
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Gemini CLI

1. **Add MCP Server Configuration**  
   The Gemini CLI provides a simple command-line approach to configure the MCP server.
   
   1. Set your personal access token as an environment variable:
   
      ```
      export TOKEN="sonatype_pat_YOUR_TOKEN_HERE"
      ```
   
      Replace `YOUR_TOKEN_HERE` with your actual personal access token.

2. Add the following MCP Server configuration.
      ```
      gemini mcp add \
          --transport http \
          --scope user \
          --header "Authorization: Bearer $TOKEN" \
      sonatypeGuide \
      https://mcp.guide.sonatype.com/mcp
      ```

### Claude Code

1. **Add MCP Server Configuration**  
   For detailed setup instructions, see the [Claude Code MCP](https://docs.anthropic.com/en/docs/claude-code/mcp) documentation.
   
   ```
   claude mcp add sonatype-mcp \
        https://mcp.guide.sonatype.com/mcp \
        --transport http \
        --scope user \
        --header "Authorization: Bearer <your-token>"
   ```

2. **Configure AI Assistant Rules (Recommended)**  
   To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
   
   Create custom instructions using CLAUDE.md files:
   
   - **Global (all projects):** Create `~/.claude/CLAUDE.md`
   - **Project (specific repository):** Create `.claude/CLAUDE.md` in your project root
   
   Add the following instruction:
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### GitHub Copilot

1. **Add MCP Server Configuration**  
   GitHub Copilot supports MCP servers across multiple IDEs including Visual Studio Code, Visual Studio, JetBrains IDEs, Eclipse, and Xcode. Choose your IDE below for specific setup instructions. For comprehensive documentation, see the [GitHub Copilot MCP](https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp/extend-copilot-chat-with-mcp?tool=vscode) documentation.

- **Visual Studio Code**
   
     Add the following to the global VS Code `mcp.json` or create a `.vscode/mcp.json` in your workspace. For more detailed setup instructions, see the [VS Code MCP](https://code.visualstudio.com/docs/copilot/customization/mcp-servers) documentation.
   
     ```
     {
       "servers": {
         "sonatype-mcp": {
           "url": "https://mcp.guide.sonatype.com/mcp",
           "type": "http",
           "headers": {
             "Authorization": "Bearer <your-token>"
           }
         }
       }
     }
     ```
   
     Switch to Agent mode in Copilot chat to access MCP tools.

- **Visual Studio**
   
     In Copilot Chat (Agent mode), click the _Tools_ icon and add a new server:
   
     | Field | Value |
     | --- | --- |
     | Server ID | `sonatype-mcp` |
     | Type | `stdio` |
     | Command | `npx -y mcp-remote https://mcp.guide.sonatype.com/mcp --header "Authorization: Bearer <your-token>"` |

- **JetBrains IDEs**
   
     Open Copilot Chat, make sure you are in Agent mode, then click the tools icon, and either browse the registry to install Sonatype MCP Server, or manually add the below configuration in `mcp.json`.
   
     ```
     {
       "mcpServers": {
         "sonatype-mcp": {
           "command": "npx",
           "args": [\
             "-y",\
             "mcp-remote",\
             "https://mcp.guide.sonatype.com/mcp",\
             "--header",\
             "Authorization: Bearer <your-token>"\
           ]
         }
       }
     }
     ```

- **Eclipse**
   
     1. Open Copilot chat and ensure you are in Agent mode.  
     2. Click the _Configure Tools_ icon, then select _Model Context Protocol (MCP)_.  
     3. In the Server Configurations section, add the configuration provided below.
   
     ```
      {
         "sonatype-mcp": {
           "command": "/opt/homebrew/bin/npx",
           "args": [\
             "-y",\
             "mcp-remote",\
             "https://mcp.guide.sonatype.com/mcp",\
             "--header",\
             "Authorization: Bearer <your-token>"\
           ]
         }
       }
     }
     ```
   
     Click _Apply_ and restart Eclipse.
   
   - **Xcode**
   
     Xcode does not have built-in GitHub Copilot support. To use Sonatype MCP within Xcode, you must install and use the _GitHub Copilot for Xcode_ application, which runs separately from the IDE.
   
     1. Download and install GitHub Copilot for Xcode. Sign in and grant required permissions.
     2. In GitHub Copilot for Xcode, click tools, then select _MCP_.
     3. In _MCP Configuration_, click _Edit Config_, then add the below configuration:
   
     ```
     {
       "Servers": {
         "sonatype-mcp": {
           "command": "npx",
           "args": [\
             "-y",\
             "mcp-remote",\
             "https://mcp.guide.sonatype.com/mcp",\
             "--header",\
             "Authorization: Bearer <your-token>"\
           ]
         }
       }
     }
     ```
   
2. **Configure AI Assistant Rules (Recommended)**

To maximise effectiveness, configure GitHub Copilot to prioritize Sonatype MCP tools for dependency-related tasks.
   
   Create `.github/copilot-instructions.md` in your project root.
   
   Add the following instructions:
   
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Windsurf

1. **Add MCP Server Configuration**  
   Create or edit `~/.codeium/windsurf/mcp_config.json` in your workspace. For more detailed setup instructions, see the [Windsurf MCP](https://docs.windsurf.com/windsurf/cascade/mcp) Documentation.
   
   ```
   {
        "mcpServers": {
          "sonatype-mcp": {
            "command": "npx",
            "args": [\
              "-y",\
              "mcp-remote",\
              "https://mcp.guide.sonatype.com/mcp",\
              "--header",\
              "Authorization: Bearer <your-token>"\
            ]
          }
        }
   }
   ```

2. **Configure AI Assistant Rules (Recommended)**  
   To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
   
   Create rules using Windsurf's Customizations feature:
   
   **Global (all projects)**
   
   1. Click the _Actions_ icon in the top right of Cascade Code or search Rules in Windsurf Settings
   2. Navigate to _Configure Rules_.
   3. Click _\+ Global_ to create a new global rule
   
   **Project (specific repository):** Follow the instructions for Global but click " + Workspace" or create `/.windsurf/rules/sonatype.md` in your project root:
   
   Add the following instructions:
   
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### IntelliJ with Junie

1. **Add MCP Server Configuration**  
   **Global Scope**: Go to _IDE settings_ → _Tools_ → _Junie_ → _MCP Settings_. Select "+" and add the code below as JSON.
   
   **Project Scope**: Create `.junie/mcp/.mcp.json` in your project root and add the code below.
   
   ```
   {
        "mcpServers": {
          "sonatype-mcp": {
            "command": "npx",
            "args": [\
              "-y",\
              "mcp-remote",\
              "https://mcp.guide.sonatype.com/mcp",\
              "--header",\
              "Authorization: Bearer <your-token>"\
            ]
          }
        }
   }
   ```

2. **Configure AI Assistant Rules (Recommended)**  
   To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
   **Global (all projects):** Create custom guidelines using a `.junie/guidelines.md` file.
   **Project (specific repository):** Create `.junie/guidelines.md` in your project root
   
   Add the following instructions
   
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Kiro

1. **Add MCP Server Configuration**  
   Create or edit `~/.kiro/settings/mcp.json` in your workspace. For more detailed setup instructions, see the [Kiro MCP](https://kiro.dev/docs/mcp/configuration/) Documentation.
   
   ```
   {
        "mcpServers": {
          "sonatype-mcp": {
            "command": "npx",
            "args": [\
              "-y",\
              "mcp-remote",\
              "https://mcp.guide.sonatype.com/mcp",\
              "--header",\
              "Authorization: Bearer <your-token>"\
            ]
          }
        }
   }
   ```

2. **Configure AI Assistant Rules (Recommended)**
   
   **Global (all projects):** Create steering files in the `.kiro/steering/` directory.
   **Project (specific repository):** Create `.kiro/steering/sonatype.md` in your project root.
   
   Add YAML front matter to make it always included:
   
   ```
      ---
   inclusion: always
      ---
   
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Cursor

1. **Add MCP Server Configuration**  
   Cursor supports remote servers directly. Add to your `~/.cursor/mcp.json`. For more detailed setup instructions, see the [Cursor MCP Server](https://cursor.com/docs/cookbook/building-mcp-server) documentation.
   
   ```
   {
        "mcpServers": {
          "sonatype-mcp": {
            "type": "http",
            "url": "https://mcp.guide.sonatype.com/mcp",
            "headers": {
              "Authorization": "Bearer <your-token>"
            }
          }
        }
   }
   ```

2. **Configure AI Assistant Rules (Recommended)**  
   **Project (specific repository):** Create `.cursorrules` in your project root.
   
   Add the following instructions
   
   ```
   ## Sonatype MCP
   
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Codex (IDE Plugin and CLI)

1. **Add MCP Server Configuration**  
   **Method 1:** Using CLI Command
   
   ```
   codex mcp add sonatype-mcp \
      --url https://mcp.guide.sonatype.com/mcp \
      --bearer-token-env-var SONATYPE_GUIDE_MCP_TOKEN
   ```
   
   **Method 2**: Manual Configuration
   Create or edit `~/.codex/config.toml`:
   
   ```
   [mcp_servers.sonatype-mcp]
   url = "https://mcp.guide.sonatype.com/mcp"
   bearer_token_env_var = "SONATYPE_GUIDE_MCP_TOKEN"
   ```

2. **Configure AI Assistant Rules (Recommended)**
   
   Create `~/.codex/AGENTS.md`
   
   Add the following instructions
   
   ```
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

### Tabnine

1. **Add MCP Server Configuration**  
   Tabnine supports MCP server configuration through a `mcp_servers.json` file located in the .tabnine directory. For more detailed setup instructions, see the [Tabnine MCP Server Configuration](https://docs.tabnine.com/main/getting-started/tabnine-agent/mcp-intro-and-setup) documentation.

You can configure this file in:

- **Project Scope:** `.tabnine/mcp_servers.json` (recommended for shared configuration)
   - **User Scope:** `~/.tabnine/mcp_servers.json` (applies to all projects)
   
   Add the following configuration:
   
   ```
   {
     "mcpServers": {
       "sonatypeguide": {
         "url": "https://mcp.guide.sonatype.com/mcp",
         "requestInit": {
           "headers": {
             "Authorization": "Bearer <your-token>"
           }
         }
       }
     }
   }
   ```
   
   Replace `<your-token>` with your Sonatype MCP bearer token.
   
   After saving the configuration, open Tabnine in Agentic mode in your IDE to access the Sonatype MCP tools.
   
2. **Configure AI Assistant Rules (Recommended)**  
   To maximise effectiveness, configure Tabnine to prioritize Sonatype MCP tools for dependency-related tasks.
   
   If your Tabnine setup supports shared project instructions, add the following instructions to your project-level AI instructions or repository documentation:
   
   ```
   When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
   ```

## Verify the Setup

Verify the setup by asking your AI assistant a dependency-related question, such as requesting the latest version of a commonly used library. A valid response confirms that the MCP server is functioning correctly.

**Try These Example Prompts**

| Use Case | Prompt | What You Get |
| --- | --- | --- |
| View security for a version | Get detailed security information for react 18.2.0 | Vulnerabilities, advisories, risk scores |
| Find latest stable release | What's the latest stable version of spring-boot? | Latest version and release date |
| Find safe versions | Show me versions of lodash without known vulnerabilities | Vulnerability-free versions |
| Compare packages | Compare security profiles of express vs fastify | Side-by-side security analysis |