Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 1
- 4 3
- 3 4
- 2 1
- 1 0
Trust in production
- Trust it - 44%
- With caveats - 33%
- Wouldn't - 22%
78% would recommend this server
How reviewers scored it
- Setup & docs 3.2
- Auth experience 3.8
- Reliability 3.3
- Maintainer responsiveness 3.2
Why it got a C
Hosted by Sonatype over HTTPS; you sign up for a Sonatype Guide account and send a personal token as a bearer header. Its three tools are read-only lookups: details for one component version, the latest version, and recommended upgrade versions. Sonatype's docs say only the dependency name and version in each request are processed, not your source code. Biggest deduction: the maintenance signal. The server's code isn't public, the official repos are README and config only, and their last commits are January and April 2026, so it scores 0 there even though the docs were edited in November 2026. Also, the single token's scope isn't documented and no rate limits are published, so auth is 18, and the grade is C. Graded from Sonatype's public docs, not its code.
How to connect
Hosted: claude mcp add --transport http sonatype-mcp https://mcp.guide.sonatype.com/mcp --header "Authorization: Bearer <your-token>" (free Sonatype Guide account)Is Sonatype Guide MCP Server safe?
Is Sonatype Guide MCP Server safe to use?
Sonatype Guide MCP Server grades C (usable with care). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Updates are rare or unknown, so fixes may be slow to arrive.
Does Sonatype Guide MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Sonatype Guide MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Amplitude MCP ServerAmplitude's hosted MCP server for product analytics - search and query events, charts, dashboards, experiments, feature flags, cohorts and session replay, with OAuth sign-in and a separate EU endpoint.
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Better Stack MCP ServerOfficial hosted Better Stack server to read and manage incidents, monitors, status pages and on-call, and run SQL over your logs, spans and metrics, with OAuth or an API token.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/sonatype-guide-mcp)<a href="https://trustedmcp.io/servers/sonatype-guide-mcp"><img src="https://trustedmcp.io/badge/sonatype-guide-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Clean integration, sensible permissions
Started with it as an experiment, now it is a fixture. Auth is handled properly, and revoking access later was one click. Happy to run it in production.
Used for Internal developer assistant
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Ran into problems pretty quickly. Used a fine-grained token with short expiry and it works fine with that. Not something I would put in production yet.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 1/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Exactly what I needed from Sonatype Guide
Hooked Sonatype Guide MCP Server into Claude Code and it worked on the first try. I like that access goes through a proper sign-in instead of a long-lived secret on disk. It is in our production agent and I sleep fine.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 3/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 3/5
Does what it says, no drama
Tried it on a side project first, then rolled it out at work. Read-only mode is the first thing I enable, and it covers most of what I need. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Easy recommendation.
Used for Generating boilerplate from existing patterns
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Trustworthy enough for real work
Clear tool names, sensible outputs, very few surprises. Auth is handled properly, and revoking access later was one click. Would recommend without hesitation.
Used for Code review summaries for pull requests
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Decent, not set-and-forget
Some tools are great, a couple feel half finished. The last release is getting old, which makes me nervous long term. The scope options are worth reading carefully, the defaults are broader than I wanted. Sign-in flow was painless and I never had to paste a key into a config file. Worth it, just do not skip the hardening steps.
Used for Keeping project tickets in sync with code changes
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Mixed feelings after two weeks
It does the job, but it took some tweaking. Sign-in flow was painless and I never had to paste a key into a config file. Hosted endpoint means no local process to babysit. I would use it in prod, but only with a human approving writes.
Used for Letting a coding agent open and triage issues
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Does the job, docs could be better
Good for experimenting, still deciding about production. Being official from Sonatype counts for a lot when I pitch it to security. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Keeping it to local experiments for now.
Used for Looking up Sonatype Guide data without leaving the editor
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Works, just lock it down
Took longer to configure than I expected. Scoped the token to just what the agent needs and it respected that. Nice to use something maintained by Sonatype rather than a random fork. Nothing to install, I just point the client at the URL. Recommended, with sensible guardrails.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.