Sonatype: MCP server, CLI and agent surfaces
Not counted. The endpoint listed for Sonatype at mcp.guide.sonatype.com asks for credentials and publishes no OAuth metadata, so it looks like any other protected API. Checked on 4 November 2026. A credential prompt without OAuth metadata is what any protected web API returns.
Fact sheet
| Company | Sonatype (registry title: Sonatype Dependency Management) |
|---|---|
| Domain | sonatype.com |
| Category | Developer Tools (Ora leaderboard category) |
| MCP server | Credential wall |
| Ora score | 65, grade C; Ora scanned the domain on 29 October 2026 and the cached score was read on 5 November 2026 from Ora's leaderboard (Ora's score page for sonatype.com, a vendor-published score) |
| Company found through | the GitHub MCP Registry; the official MCP Registry; Ora's public leaderboard |
| Last verified | 4 November 2026 |
MCP server
| Endpoint | https://mcp.guide.sonatype.com/mcp |
|---|---|
| How it was found | listed in the GitHub MCP Registry; the official MCP Registry; Ora's public leaderboard |
| Transport | streamable-http |
| HTTP status | 401 |
| Connected | 4 November 2026, 20:04 UTC |
| Handshake time | 1,940 ms over 1 attempt |
The endpoint asked for credentials without publishing OAuth metadata. It is not counted as an MCP server, because the same answer is what any protected API gives.
Connector log
2 connections on 4 November 2026, read-only methods only
- 19:59:37Z https://mcp.guide.sonatype.com/mcp sent initialize result auth-required-no-oauth (HTTP 401) 1623 ms
- 20:04:37Z https://mcp.guide.sonatype.com/mcp sent initialize result auth-required-no-oauth (HTTP 401) 1940 ms
Authentication
| Auth type | API key |
|---|---|
| What the challenge said | Bearer error="invalid_request", error_description="No Sonatype access token was supplied, so this MCP server is not authenticated. Add an 'Authorization: Bearer <your-token>' header to your MCP client configuration, using a token from your Sonatype account settings." |
The sign-in route, step by step
- Request
https://mcp.guide.sonatype.com/mcpwithout a token. It answers with a credential challenge but no OAuth metadata. - Create a key or token in the company's own settings; the metadata gives an agent no way to do that itself.
- Send the key in the header the vendor documents and retry. The connector sends no key.
See OAuth for MCP: client ID metadata documents and dynamic registration for how each route works.
CLI
No CLI is on record for Sonatype. The directory checks a package only where a source names one, so this is a floor: a company can ship a command line that no source read for this edition mentions. See shipping a CLI agents can use.
Other agent surfaces
| Surface | Result |
|---|---|
| OpenAPI file | Not read: the site's robots.txt disallows the path for this crawler. |
| WebMCP in the initial HTML | Not detected on the home page by the shared crawl. |
| MCP discovery file | Not found (the crawl got a non-200 answer). |
| A2A agent card | Not found (the crawl got a non-200 answer). |
| A2A agent card (older path) | Not found (the crawl got a non-200 answer). |
| agents.json | Not found (the crawl got a non-200 answer). |
| OAuth authorization server metadata | Not found (the crawl got a non-200 answer). |
| NLWeb endpoint | Not checked in this edition. |
Registry listings
| Registry | Listed |
|---|---|
| Official MCP Registry | Yes: com.sonatype/dependency-management-mcp-server |
| GitHub MCP Registry | Yes |
| awesome-remote-mcp-servers | No |
| Smithery | Not checked: Smithery's listing pages and search API were unavailable on 4 November 2026. |
| Glama | Not checked: Glama's API needs a key and attribution terms. |