Sonatype MCP: dependency checks inside your coding assistant

Before your coding assistant adds a dependency, it can ask Sonatype which version to use. The Sonatype MCP server provides component intelligence: available versions, security analysis and Trust Score recommendations. ContextGate connects it to Claude Code, Cursor, Claude and ChatGPT with a Sonatype token, and every dependency check lands in Activity.

  • Ready to connect
  • Free

How to connect Sonatype to Cursor, Claude or ChatGPT

  1. 1Click Connect Sonatype free and paste an API token from your Sonatype account.
  2. 2Once connected, the tool list appears with everything on. Sonatype's tools return component intelligence, so most teams keep them all; switch off any you don't want your coding assistant calling.
  3. 3Add ContextGate to your AI app as a connector or MCP server. The steps for each app are on the Works with page.
  4. 4In Cursor, ask whether a library version in your package.json has known security issues and what Sonatype recommends instead, then open Activity to see the call.

Dependency questions for Sonatype

  • Check which versions of an open source component exist before you pin one.
  • Get Sonatype's security analysis of a component your AI app wants to add.
  • Ask for Trust Score recommendations when choosing between versions.
  • Review a dependency upgrade in Claude Code with Sonatype's data next to the diff.

A record of every dependency check

  • Activity records each component lookup, so you can see what informed an upgrade.
  • If a call carries an internal registry token, a policy can block it as a secret.
  • A Sonatype tool you switch off is removed from your coding assistant's list and refused if called.

What you get with Sonatype and ContextGate

  • Your AI apps can use SonatypeClaude, Cursor, ChatGPT and other AI apps reach Sonatype through the one ContextGate connection you add to them.
  • You choose which tools they can useSwitch off any Sonatype tool you don't want used. It's hidden from your AI apps and refused if called.
  • Every call is checked and recordedYour policies check each call (for example, personal data is hidden and secrets are blocked), and Activity keeps a record of it.

ContextGate sees only the tool calls that go through it, not your AI app's built-in tools or your chats.

Sonatype tools

Sonatype's own MCP server shows its tools once you sign in. When you connect it, they are listed and synced in your workspace.