sonatype-guide Claude Code Plugin
Claude Code PluginClaude CodeSecuritySecurity, Auth & ComplianceAI Agents & AI App DevelopmentThe explanation below is AI-generated. Please verify it against the sources.
This plugin connects Claude Code to the Sonatype Guide MCP server, giving Claude access to open-source dependency intelligence during coding sessions. It lets Claude check packages for known vulnerabilities, suggest safer version upgrades, and flag license or policy issues in a project's dependency files. A built-in skill triggers this checking automatically whenever Claude installs or updates a dependency, and users can also ask for comparisons between competing libraries. Using it requires a Sonatype Guide account and a personal API token supplied through an environment variable.
About the service
Sonatype Guide is a hosted service from Sonatype, the company behind the Nexus Repository and related supply-chain security products. It aggregates data on open-source components (vulnerability records, quality signals, and trust indicators) and exposes this intelligence through an API so that AI coding assistants can make safer dependency decisions. Access requires signing up for an account and generating an API token on the Sonatype Guide site.
What you can do with sonatype-guide
- Have Claude automatically review new or updated dependencies for security issues before they are added
- Get vulnerability details for existing dependencies, including whether risk comes from a direct or transitive package
- Receive suggested upgrade versions ranked by trust and safety metrics, along with notes on possible breaking changes
- Scan a project's dependency manifest for security, license, or policy violations
- Ask Claude to compare two candidate libraries side by side before choosing one