Skip to main content

Connect an AI Coding Assistant

Note

All current self-hosted Sonatype Lifecycle customers are entitled to preview credits for AI Developer. Contact your Sonatype account representative to claim your credits and start bringing trusted open source intelligence and policy-aware guidance into your AI-assisted development workflow.

Note that AI Developer is currently in Preview. During this period, we will support your use of the solution while we finalize the user interface and user experience

AI coding assistant integration is not required to use AI Developer. However, connecting an assistant that supports the Model Context Protocol (MCP) brings Sonatype intelligence and Lifecycle policy context directly into AI-assisted development workflows.

Choose an MCP-Capable Assistant

Use an AI coding assistant that supports MCP and is approved by your organization. The following coding assistants can be integrated with AI Developer through an MCP:

  • claude_code.png Claude Code

  • codex_logo.png Codex

  • cursor.png Cursor

  • gemini_code_assist.jpg Gemini Code Assist

  • gemini_cli.png Gemini CLI

  • github_copilot.png GitHub Copilot in VS Code

  • junie.png IntelliJ with Junie

  • kiro.png Kiro

  • windsurf_.png Windsurf

  • tabnine.png Tabnine

Establish the Connection

To connect AI Developer to your coding assistant, you will first generate a user token, use that token to configure your MCP connection, and then update your coding assistant's rules to ensure it uses AI Developer when doing its work.

Generating a User Token

Use an IQ user token instead of exposing your login credentials to the coding assistant. A user token contains a user code and passcode that authenticate the user with the same access as the original account.

For instructions to generate a token, see User Tokens.

Configuring the MCP Connection

Compatibility, configuration syntax, and authentication behavior can vary by assistant. Follow your assistant vendor’s MCP configuration guidance, then use the AI Developer connection information supplied by your administrator.

In general, you can expect to use the following connection values when you configure your coding assistant:

Setting

Value

Server URL

https://<YOUR_IQ_SERVER_HOST>/mcp

Transport

HTTP

Authentication

HTTP Basic authentication

Credentials

Your IQ Server user token, encoded as Base64 (userCode:passCode) and sent in the Authorization header.

Configure your Assistant's Rules (Recommended)

Connecting the MCP server is only part of the setup. To get consistent value from AI Developer, update the project- or organization-level instruction file that tells the coding assistant how to work (e.g., CLAUDE.md, AGENTS.md, etc.). Depending on the assistant, this may be a Markdown instruction file, an assistant rule file, or another supported configuration mechanism.

Make the instructions explicit that the assistant must use AI Developer when it is making dependency-selection, dependency-upgrade, vulnerability-investigation, or policy-related recommendations. The instructions should also tell the assistant to:

  • Treat AI Developer results and your organization’s policy context as authoritative instructions.

  • Distinguish Sonatype findings from assumptions or general model knowledge.

  • Preserve the project’s current version unless there is a supported, reviewed reason to recommend a downgrade.

  • Identify when a suggested change is a major-version upgrade and may require compatibility review.

  • Present relevant policy or risk context so that the developer can review the decision.

Keep these instructions under version control where your organization’s workflow supports it. Review and update them whenever your dependency-management practices, policy expectations, or AI Developer integration change.

Why This Matters

Without clear instructions, an assistant can connect successfully but may not call AI Developer at the decision points where Sonatype intelligence is most valuable.

Verify the Connection

After configuring the connection, do the following:

  1. Restart or reload the assistant if it requires a restart to discover MCP servers.

  2. Confirm that your AI assistant reports the AI Developer MCP server as connected.

  3. Ask the assistant to investifate a known component or dependency.

  4. Confirm that the response includes current Sonatype intelligence or policy-aware guidance.

If the Connection Does Not Work

Check the following before contacting support:

  • The AI Developer entitlement is active and has available credits.

  • The MCP server URL and authentication configuration are correct.

  • The assistant supports the MCP transport and configuration method you are using.

  • The developer can reach the IQ Server or MCP endpoint through the organization’s network controls.