SuperAPI AI Directory
Partner with us中文AI newsFavorites
All toolsAI developer platformsmaven-tools-mcp

maven-tools-mcp

Maven Tools MCP Server is a server for MCP clients that provides JVM dependency intelligence to AI assistants through real-time Maven Central data. It supports checking stable versions, comparing upgrades (distinguishing major/minor/patch), auditing dependency health and licenses, CVE checks, and optionally querying documentation through Context7. Coordinate-based tools are suitable for Maven, Gradle, SBT, and Mill projects, while POM analysis and upgrade planning tools handle Maven pom.xml. Usage requires Docker to run, with no local Java needed. The current release version is v3.2.3.

Open website

About this tool

Purpose

Maven Tools MCP Server enables MCP-capable clients to check JVM dependencies using real-time Maven Central data. It is aimed at developers and agents who need more than simple version queries, providing stability filtering, upgrade comparison, dependency health signals, license data, CVE checks, and optional Context7 documentation queries.

Main capabilities

  • Version checks: find stable versions and compare upgrades with major/minor/patch context.
  • Dependency audits: check dependency age, release cadence, known vulnerabilities, and license data.
  • POM analysis: resolve declared dependency versions through parent POMs and BOMs without building the project.
  • Upgrade planning: provide structured edit suggestions for agents to verify and apply, while flagging major upgrades, conflicts, and overrides that require manual review.
  • Documentation: query library documentation through optional Context7 tools.

Coordinate-based tools are suitable for Maven, Gradle, SBT, and Mill projects; POM analysis and upgrade planning tools target Maven pom.xml files.

Available tools and versions

The default image exposes 11 MCP tools; -noc7 exposes 9 core tools. The current release is v3.2.3, and to pin a version you can use :3.2.3, :3.2.3-noc7, or :3.2.3-http, each supporting Linux AMD64 and ARM64.

POM-aware dependency analysis

The two POM tools use Apache Maven Model Builder to handle parent inheritance, properties, and dependency management (including imported BOMs). They accept raw POM XML and an optional sideloadedPoms package for unpublished parent or sibling modules.

  • analyze_pom_dependencies returns effective versions, classifies declarations as EXPLICIT, MANAGED, or EXPLICIT_OVERRIDE, and identifies managed BOMs and conflicts.
  • recommend_pom_upgrades returns deterministicActions (for mechanical edits) and needsAttention (for major upgrades, BOM conflicts, and explicit overrides). Actions indicate the input PThe version fields or properties to edit in the POM.

It is recommended to cover editable parent/BOM versions, explicit dependencies, root dependency management entries, and direct build/plugin dependencies. Declarations in the input POM that do not have a clear edit location are skipped. The server returns suggestions, which the client or agent verifies and applies. The analysis scope is declared dependencies, not the full transitive dependency graph; Profile activation is limited to default-activated Profiles.

Usage

Prerequisites: Docker is installed and running; no local Java is required. For a Docker-free approach, refer to building and running the JAR.

  • Claude Desktop: Add the maven-tools entry to the configuration.
  • VS Code + GitHub Copilot: Add the server in the workspace's .vscode/mcp.json.
  • CONTEXT7_API_KEY is optional; most setups can start without it. If the environment requires Context7 authentication or you want to avoid anonymous limits, pass it via Docker using -e CONTEXT7_API_KEY.

Common prompt example: "Check the latest versions of all dependencies in my pom.xml and point out anything risky." The client can combine tool results to report: current version vs. latest version, whether the upgrade is major/minor/patch, whether the latest release is stable, whether the dependency looks fresh/aging/outdated, and whether there are notable known CVE or license issues. For broader questions like "which library should I choose," combine Maven metadata, Context7 documentation, and client-side web search to obtain ecosystem context.

Applicable Scenarios

  • Project dependency version checking and upgrade planning.
  • Dependency auditing, including age, release cadence, vulnerabilities, and licenses.
  • Analyzing effective dependency versions in a POM without building the project.
  • Providing structured upgrade edit suggestions for agents, which they verify and apply.

Limitations and Notes

  • Cannot work fully offline: uncached metadata queries require access to Maven Central or configured repositories; vulnerability checks and Context7 documentation also depend on external services.
  • Does not parse Gradle, SBT, or Mill build files; these projects should use coordinate-based tools, and whole-file analysis accepts only Maven POM XML.
  • Does not replace Renovate or Dependabot: The server provides dependency analysis and upgrade suggestions; file editing, testing, scheduling, and PR creation require a separate agent or workflow.
  • The analysis scope is limited to declared dependencies, not the full transitive dependency graph; Profile activation is limited to default-activated Profiles.

Other

The repository uses its own tools for a weekly dependency update workflow. A Python agent sends the POM to recommend_pom_upgrades, verifies and applies minor/patch operations, then opens a PR for review. Its XML editor checks the current version and preserves formatting. Manual major upgrade reviews use the GitHub Copilot SDK; routine updates do not require an LLM.

The project is licensed under the MIT License.

Related tools

Browse category