sonatype-guide

Sonatype Guide MCP server for software supply chain intelligence and dependency security. Analyze dependencies for vulnerabilities, get secure version recommendations, and check component quality metrics.

Install

If the official marketplace isn’t added yet, run

Category: Security
GitHub: sonatype/sonatype-guide-claude-plugin

Good for

Check dependencies automatically before installing or upgrading packages
Surface CVEs with severity scores, separating direct and transitive risks
Get ranked secure upgrade paths with breaking change analysis
Audit manifests for security, license and policy issues, or compare alternative libraries

Getting started

Generate a token at guide.sonatype.com/settings/tokens and set it as SONATYPE_GUIDE_TOKEN
Run /plugin install sonatype-guide@claude-plugins-official
Run /mcp and check that sonatype-guide is connected
Ask, e.g. 'Scan my package.json for vulnerable dependencies'

Before you install

Requires a Sonatype Guide account and API token. Restart Claude Code after setting the variable, and never commit the token.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

semgrepOfficial plugin · Security
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
claude-securityOfficial plugin · Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
security-guidanceOfficial plugin · Security
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
42crunch-api-security-testingOfficial plugin · Security
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
auth0Official plugin · Security
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.