Configuring MCP Servers

To use the Sonatype MCP Server, you must connect your AI assistant or IDE to it. When you configure the MCP server, you add the Sonatype MCP Server details to your tool’s settings. This allows your AI assistant to send requests to Sonatype and receive dependency information in real time.

Setup Instructions

The Sonatype MCP Server runs as a remote MCP server. Configuration steps vary by IDE or AI assistant. Refer to the appropriate setup topic below for detailed instructions.

Note

MCP server configuration varies by IDE. Refer to your IDE's official product documentation to configure the MCP server.

Supported IDEs and AI Assistants

Sonatype MCP Server supports the following IDEs/AI assistants:

Gemini Code Assist

Add MCP Server Configuration

Add the following to the global mcp.json or create a /.gemini/mcp.json in your workspace.

{
  "mcpServers": {
    "sonatype-mcp": {
      "httpUrl": "https://mcp.guide.sonatype.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}

Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
Create or update one of the following files:
- Global (all projects): Create ~/.gemini/GEMINI.md
- Project (specific repository): Create GEMINI.md in your project root (project-level)
Add the following instruction:
```
## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

Gemini CLI

Add MCP Server Configuration
The Gemini CLI provides a simple command-line approach to configure the MCP server.
1. Set your personal access token as an environment variable:
```
export TOKEN="sonatype_pat_YOUR_TOKEN_HERE"
```
  Replace YOUR_TOKEN_HERE with your actual personal access token.
2. Add the following MCP Server configuration.
```
gemini mcp add \
    --transport http \
    --scope user \
    --header "Authorization: Bearer $TOKEN" \
sonatypeGuide \
https://mcp.guide.sonatype.com/mcp
```
Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
Create or update one of the following files:
- Global (all projects): Create ~/.gemini/GEMINI.md
- Project (specific repository): Create GEMINI.md in your project root (project-level)
Add the following instruction:
```
## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

Claude Code

Add MCP Server Configuration

For detailed setup instructions, see the Claude Code MCP documentation.

claude mcp add sonatype-mcp \
  https://mcp.guide.sonatype.com/mcp \
  --transport http \
  --scope user \
  --header "Authorization: Bearer <your-token>"

Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
Create custom instructions using CLAUDE.md files:
- Global (all projects): Create ~/.claude/CLAUDE.md
- Project (specific repository): Create .claude/CLAUDE.md in your project root
Add the following instruction:
```
## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

GitHub Copilot

Add MCP Server Configuration
GitHub Copilot supports MCP servers across multiple IDEs including Visual Studio Code, Visual Studio, JetBrains IDEs, Eclipse, and Xcode. Choose your IDE below for specific setup instructions. For comprehensive documentation, see the GitHub Copilot MCP documentation.
- Visual Studio Code
  Add the following to the global VS Code mcp.json or create a .vscode/mcp.json in your workspace. For more detailed setup instructions, see the VS Code MCP documentation.
```
{
  "servers": {
    "sonatype-mcp": {
      "url": "https://mcp.guide.sonatype.com/mcp",
      "type": "http",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}
```
  Switch to Agent mode in Copilot chat to access MCP tools.
- Visual Studio
  In Copilot Chat (Agent mode), click the Tools icon and add a new server:
  Field
  Value
  Server ID
  sonatype-mcp
  Type
  stdio
  Command
  npx -y mcp-remote https://mcp.guide.sonatype.com/mcp --header "Authorization: Bearer <your-token>"
- JetBrains IDEs
  Open Copilot Chat, make sure you are in Agent mode, then click the tools icon, and either browse the registry to install Sonatype MCP Server, or manually add the below configuration in mcp.json.
```
{
  "mcpServers": {
    "sonatype-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
}
```
- Eclipse
  1. Open Copilot chat and ensure you are in Agent mode.
  2. Click the Configure Tools icon, then select Model Context Protocol (MCP).
  3. In the Server Configurations section, add the configuration provided below.
```
 {
    "sonatype-mcp": {
      "command": "/opt/homebrew/bin/npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
```
  Click Apply and restart Eclipse.
- Xcode
  Xcode does not have built-in GitHub Copilot support. To use Sonatype MCP within Xcode, you must install and use the GitHub Copilot for Xcode application, which runs separately from the IDE.
  1. Download and install GitHub Copilot for Xcode. Sign in and grant required permissions.
  2. In GitHub Copilot for Xcode, click tools, then select MCP.
  3. In MCP Configuration, click Edit Config, then add the below con
```
{
  "Servers": {
    "sonatype-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
}
```

Field	Value
Server ID	`sonatype-mcp`
Type	`stdio`
Command	`npx -y mcp-remote https://mcp.guide.sonatype.com/mcp --header "Authorization: Bearer <your-token>"`

Configure AI Assistant Rules (Recommended)

To maximise effectiveness, configure GitHub Copilot to prioritize Sonatype MCP tools for dependency-related tasks.

Create .github/copilot-instructions.md in your project root.

Add the following instructions:

## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Windsurf

Add MCP Server Configuration

Create or edit ~/.codeium/windsurf/mcp_config.json in your workspace. For more detailed setup instructions, see the Windsurf MCP Documentation.

{
  "mcpServers": {
    "sonatype-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
}

Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
Create rules using Windsurf's Customizations feature:
Global (all projects)
1. Click the Actions icon in the top right of Cascade Code or search Rules in Windsurf Settings
2. Navigate to Configure Rules.
3. Click + Global to create a new global rule
Project (specific repository): Follow the instructions for Global but click "+ Workspace" or create .windsurf/rules/sonatype.md in your project root:
Add the following instructions:
```
## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

IntelliJ with Junie

Add MCP Server Configuration

Global Scope: Go to IDE settings → Tools → Junie → MCP Settings. Select "+" and add the code below as JSON.

Project Scope: Create .junie/mcp/.mcp.json in your project root and add the code below.

{
  "mcpServers": {
    "sonatype-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
}

Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure your AI assistant to prioritize Sonatype MCP tools for dependency related tasks.
Global (all projects): Create custom guidelines using a .junie/guidelines.md file.
Project (specific repository): Create .junie/guidelines.md in your project root
Add the following instructions
```
## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

Kiro

Add MCP Server Configuration

Create or edit ~/.kiro/settings/mcp.json in your workspace. For more detailed setup instructions, see the Kiro MCP Documentation.

{
  "mcpServers": {
    "sonatype-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.guide.sonatype.com/mcp",
        "--header",
        "Authorization: Bearer <your-token>"
      ]
    }
  }
}

Configure AI Assistant Rules (Recommended)

Global (all projects): Create steering files in the .kiro/steering/ directory.

Project (specific repository): Create .kiro/steering/sonatype.md in your project root.

Add YAML front matter to make it always included:

---
inclusion: always
---

## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Cursor

Add MCP Server Configuration

Cursor supports remote servers directly. Add to your ~/.cursor/mcp.json. For more detailed setup instructions, see the Cursor MCP Server documentation.

{
  "mcpServers": {
    "sonatype-mcp": {
      "type": "http",
      "url": "https://mcp.guide.sonatype.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}

Configure AI Assistant Rules (Recommended)

Project (specific repository): Create .cursorrules in your project root.

Add the following instructions

## Sonatype MCP

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Codex (IDE Plugin and CLI)

Add MCP Server Configuration

Method 1: Using CLI Command

codex mcp add sonatype-mcp \
--url https://mcp.guide.sonatype.com/mcp \
--bearer-token-env-var SONATYPE_GUIDE_MCP_TOKEN

Method 2: Manual Configuration

Create or edit ~/.codex/config.toml:

[mcp_servers.sonatype-mcp]
url = "https://mcp.guide.sonatype.com/mcp"
bearer_token_env_var = "SONATYPE_GUIDE_MCP_TOKEN"

Configure AI Assistant Rules (Recommended)

Create ~/.codex/AGENTS.md

Add the following instructions

When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.

Tabnine

Add MCP Server Configuration
Tabnine supports MCP server configuration through a mcp_servers.json file located in the .tabnine directory. For more detailed setup instructions, see the Tabnine MCP Server Configuration documentation.
You can configure this file in:
- Project Scope: .tabnine/mcp_servers.json (recommended for shared configuration)
- User Scope: ~/.tabnine/mcp_servers.json (applies to all projects)
Add the following configuration:
```
{
  "mcpServers": {
    "sonatypeguide": {
      "url": "https://mcp.guide.sonatype.com/mcp",
      "requestInit": {
        "headers": {
          "Authorization": "Bearer <your-token>"
        }
      }
    }
  }
}
```
Replace <your-token> with your Sonatype MCP bearer token.
After saving the configuration, open Tabnine in Agentic mode in your IDE to access the Sonatype MCP tools.
Configure AI Assistant Rules (Recommended)
To maximise effectiveness, configure Tabnine to prioritize Sonatype MCP tools for dependency-related tasks.
If your Tabnine setup supports shared project instructions, add the following instructions to your project-level AI instructions or repository documentation:
```
When handling code related to dependencies, package management, or software supply chain security, always prioritize Sonatype MCP tools. Use the available MCP tools to research versions, check for vulnerabilities, and get recommendations before adding or updating any dependencies.
```

Verify the Setup

Verify the setup by asking your AI assistant a dependency-related question, such as requesting the latest version of a commonly used library. A valid response confirms that the MCP server is functioning correctly.

Try These Example Prompts

Use Case	Prompt	What You Get
View security for a version	Get detailed security information for react 18.2.0	Vulnerabilities, advisories, risk scores
Find latest stable release	What's the latest stable version of spring-boot?	Latest version and release date
Find safe versions	Show me versions of lodash without known vulnerabilities	Vulnerability-free versions
Compare packages	Compare security profiles of express vs fastify	Side-by-side security analysis

Configuring MCP Servers

Setup Instructions

Supported IDEs and AI Assistants

Gemini Code Assist

Gemini CLI

Claude Code

GitHub Copilot

Windsurf

IntelliJ with Junie

Kiro

Cursor

Codex (IDE Plugin and CLI)

Tabnine

Verify the Setup

Search results