# Sonatype Guide

Searchable database of open source components and vulnerabilities, with an MCP server that suggests safe dependency versions to AI tools

- Website: https://guide.sonatype.com/
- Listing: https://openack.co/p/sonatype-guide
- Not evaluated. Listed by OpenACK: its 7 claimed capabilities are OpenACK's reading of the product's public site, not the maker's word, and nobody has checked them yet.

OpenACK's description (not checked):

> Sonatype Guide lets developers search open source components and CVEs across ecosystems such as Maven, npm and PyPI, review vulnerability details and follow curated security events. It also provides an MCP server and API so AI coding assistants can check dependencies for security and licensing issues.

## Capabilities

- **not evaluated**: Search open source components or CVEs by name
- **not evaluated**: Filter components by ecosystem and vulnerability severity
- **not evaluated**: Browse and filter vulnerabilities
- **not evaluated**: Browse recent open source security events filtered by ecosystem and severity
- **not evaluated**: See which components and versions a security event affects
- **not evaluated**: Generate a personal access token
- **not evaluated**: Connect an AI assistant over MCP

## What the statuses mean

- **confirmed** (ACK): a person from OpenACK signed in with a test account and saw it work.
- **not confirmed** (NAK or ?): it was tried and didn't work, or we couldn't reach or check it. Not proof it's missing, but not verified.
- **not evaluated** (—): nobody has checked it. It's the founder's word only.

Treat only "confirmed" as verified. A result is a record of one evaluation on the date shown, not a guarantee.