Dependency Management MCP Server

A Model Context Protocol (MCP) server that connects AI assistants to Sonatype's dependency management and security intelligence platform. Empower your AI coding assistant with real-time insights into open source security vulnerabilities, license compliance, and dependency health. Its README documents 3 tools, including getComponentVersion, getLatestComponentVersion, getRecommendedComponentVersions. It is available as a remote MCP endpoint.

Teams that want a hosted security endpoint instead of running a local process.

VERIFIED ACTIVE

LAST COMMIT 2026-01-14 · ★ 73 · #155 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

how we verify → /methodology

01 · Install Dependency Management MCP Server

Claude Code

claude mcp add sonatype-dependency-management-mcp-serve --transport http https://mcp.guide.sonatype.com/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "sonatype-dependency-management-mcp-serve": {
      "url": "https://mcp.guide.sonatype.com/mcp"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://mcp.guide.sonatype.com/mcp

transport: streamable-http

endpoint alive - authentication required · probed 2026-09-17

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as remote - your agent's requests go to mcp.guide.sonatype.com

endpoint auth requires authentication - rejected our unauthenticated MCP initialize

license no standard license detected - usage rights unclear; check the repo before commercial use

registry vendor namespace com.sonatype - domain-verified with the official MCP registry

03 · What Dependency Management MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can get component information about a specific version of a component, and get component information about the latest version of a component.

The 3 tools it gives your agent

Extracted from the project's README - what dependency-management-mcp-server lets an agent do.

getComponentVersion: - Gets component information about a specific version of a component
getLatestComponentVersion: - Gets component information about the latest version of a component
getRecommendedComponentVersions: - Gets a set of recommended versions to upgrade to based on the current version of a component. If no version is provided, gets a set of recommended versions to s

04 · Who maintains Dependency Management MCP Server

dependency-management-mcp-server is maintained by sonatype. It's the only MCP server we track from this author; the repo dates to Oct 2025.

05 · Facts

repository: github.com/sonatype/dependency-management-mcp-server
category: security - ranked #155 of 204 actively-maintained security servers as of 2026-09-18.
registry: com.sonatype/dependency-management-mcp-server (active, first published 2025-10-17 · 2 versions)

06 · Dependency Management MCP Server FAQ

Is Dependency Management MCP Server still maintained?

Yes - as of 2026-09-18, its last commit was 2026-01-14. We re-verify nightly.

What can Dependency Management MCP Server do?

With this server connected, an agent can get component information about a specific version of a component, and get component information about the latest version of a component.

How do I install Dependency Management MCP Server?

Run `claude mcp add sonatype-dependency-management --transport http https://mcp.guide.sonatype.com/mcp`. You can also paste the ready-made client config above.

Does Dependency Management MCP Server require authentication?

Yes - when we probed the endpoint on 2026-09-17, it rejected an unauthenticated MCP initialize; you'll need credentials to connect.

07 · Alternatives to Dependency Management MCP Server

Alternatives to Dependency Management MCP Server

Maintained security servers if Dependency Management MCP Server isn't the fit.

Pairs well with

Servers that cover what Dependency Management MCP Server doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Interactive Leetcode MCP · Stackhawk · Starlog · Strac MCP DLP · AI AppSec