OSS Index Migration to Sonatype Guide

OSS Index provides trusted open source vulnerability data to developers, security teams, and integrated tooling. It enables users to identify known vulnerabilities in open source components and supports automation through public APIs and ecosystem integrations.

OSS Index is migrating to Sonatype Guide, with key milestones on March 31, 2026 and April 28, 2026. This page outlines what is changing, what remains the same, and how to prepare.

What is Changing?

The OSS Index API is transitioning to Sonatype Guide.

The OSS Index will remain available through the OSS Index Compatibility API within Sonatype Guide
New OSS Index registrations will no longer be accepted. New users should register directly through Sonatype Guide.
Existing OSS Index-style endpoint traffic will be authenticated and routed through the Sonatype Guide platform.
The OSS Index website will redirect to Sonatype Guide as part of the migration.

Beginning April 28, 2026, API usage will be governed by Sonatype Guide plans and applicable credit limits.

This migration ensures continuity for existing users while enabling access to expanded capabilities within Sonatype Guide.

What Stays the Same?

Sonatype is preserving compatibility for supported OSS Index-style integrations and workflows during this transition.

OSS Index functionality will be accessible via a OSS Index Compatibility API within Sonatype Guide.
Supported OSS Index-style endpoints will retain their historical request and response formats.
Component coordinate formats, including purl, remain supported.
Vulnerability data structures remain aligned with OSS Index-style responses.
Existing integrations such as Dependency-Track and Dependency-Check continue to operate with supported endpoints.
Vulnerability intelligence remains continuously curated and trusted.

This approach preserves existing integration logic and response parsing behavior for supported endpoints while moving to a more scalable platform.

Why is Sonatype Making This Change?

Modern software development has evolved to include extensive automation, CI/CD pipelines, and AI-assisted coding. As a result, open-source risk is introduced earlier and at machine speed.

Transitioning from OSS Index to Sonatype Guide allows Sonatype to provide a scalable, modern platform designed to support both human and machine-driven development environments, while preserving continuity for existing OSS Index users.

Sonatype Guide delivers open source intelligence optimized for the following:

CI/CD pipelines
Developer workflows
AI coding assistants
Automated policy enforcement

What is New in Sonatype Guide?

In addition to compatibility support, Sonatype Guide provides expanded capabilities through its native Guide APIs.

Expanded Intelligence Capabilities

Enhanced vulnerability detail
Version intelligence
Deeper component metadata
Improved component search

MCP Server Integration for AI Coding Assistants

Sonatype Guide includes MCP Server integration, enabling AI coding assistants to access trusted vulnerability and component intelligence in real time. This allows organizations to:

Embed open source intelligence directly into AI development workflows
Prevent vulnerable components from being introduced at code creation time
Enable policy-aware AI-assisted development

These expanded capabilities are designed to support modern, automation-first workflows and AI-assisted development practices.

What is the Timeline for This Change?

Key dates surrounding this transition are outlined below:

March 25, 2026

No new OSS Index registrations. New users must register for Sonatype Guide directly.
No new OSS Index tokens or token regeneration. Existing OSS Index tokens will be migrated to Sonatype Guide on March 31, 2026.

March 31, 2026

Users can sign in to Sonatype Guide using existing OSS Index credentials.
Users may review account settings, explore available plans, and begin using Compatibility APIs in Guide.

April 28, 2026

Migration cutover date.
The OSS Index API will be fully routed through Sonatype Guide.
The OSS Index site will redirect to Guide.
Credit limits under Sonatype Guide plans begin enforcement.

Additional technical migration details will be shared prior to the cutover date.

How to Transition

No action is required before March 31.

Between March 31 and April 28, 2026, users should:

Sign in to Sonatype Guide using OSS Index credentials.
Update their API Base URL to the Sonatype Guide Compatibility endpoint

For technical instructions and configuration examples, see OSS Migration Index Steps.

Using OSS Index with Dependency - Track or Dependency - Check

Dependency - Track and Dependency - Check remain compatible with supported OSS Index-style endpoints through the Sonatype Guide Compatibility API.

No user action is required for the April 28 cutover, and existing integrations will continue to function without interruption.

To minimize the risk of future disruption and ensure long-term compatibility, users are strongly encouraged to review and follow the recommended migration steps outlined in the OSS Index Migration Steps.

Compatibility Considerations

Sonatype is preserving compatibility for supported OSS Index-style integrations and workflows during this transition. The following behaviors apply when using the Sonatype Guide Compatibility API for OSS Index:

Version ranges in purl coordinates are not supported and should be replaced with specific component versions. When a version range is submitted, the API treats it as a string rather than evaluating it as a range, which may prevent a valid component match.
If a submitted component cannot be matched, the API may return an empty vulnerabilities array. This can be a signal that no matching component record was found, but it does not necessarily mean the component has no known vulnerabilities.
The description field is not currently available in Compatibility API responses.
For unsupported or unmatched component queries, reference URL links may not resolve to a valid component page.

These behaviors do not affect supported OSS Index-style endpoint access, but they may impact workflows that rely on version range queries or on fields not currently populated in Sonatype Guide.