kirich1409/maven-mcp

Agent plugin for Claude Code, Grok Build, Cursor, and Codex that provides Maven dependency intelligence via an MCP server — query artifact versions, scan projects for outdated dependencies, check for vulnerabilities, and fetch changelogs.
How it works
The plugin bundles a single-file Python 3 MCP server (plugin/server/server.py) that speaks MCP over stdio (JSON-RPC 2.0 on stdin/stdout) or over a stateless Streamable HTTP endpoint. It uses the Python standard library only — zero pip dependencies. The plugin registers the server via .mcp.json (Claude Code, Grok Build) and mcp.json (Cursor, Codex), both command: python3, so it installs with no extra runtime setup. The server can also be run standalone and connected to any MCP-compatible agent — see Use with any MCP client.
Version lookups use the repositories the build file declares. Maven Central, Google Maven, and the Gradle Plugin Portal are used when that scope declares none. Private repositories need credentials — see Configuration.
**Gradle scanning** runs the project's wrapper once and reads production runtime classpaths (*RuntimeClasspath), then merges declared provenance from build files and version catalogs. **Maven scanning** reads pom.xml locally.
Tools
| Tool | Description |
|------|-------------|
| get_latest_version | Find latest version of an artifact with stability-aware selection |
| check_version_exists | Verify if a specific version exists and classify its stability |
| check_multiple_dependencies | Bulk lookup of latest versions for multiple dependencies |
| compare_dependency_versions | Compare current versions against latest (major/minor/patch) |
| get_dependency_changes | Show changes between versions (AndroidX docs, then AGP docs, then GitHub releases; CHANGELOG.md on the default branch when no release body is usable) |
| scan_project_dependencies | Scan Gradle/Maven build files and Gradle version catalogs (gradle/libs.versions.toml) for dependencies |
| expand_bom | Expand a Maven BOM into managed dependency versions |
| get_transitive_graph | Resolved transitive dependency graph for a GAV via deps.dev |
| get_vulnerability_paths | Shortest dependency path from a project root GAV to each transitively vulnerable node (deps.dev graph + OSV.dev) |
| detect_dependency_conflicts | Flag GAs resolved at multiple versions (Gradle: from resolved scan usages; Maven: deps.dev per-root graphs with nearest-wins) |
| check_version_compatibility | Check Spring Boot / AGP / Kotlin / javax→jakarta compatibility |
| get_dependency_vulnerabilities | Check for known CVEs via OSV.dev |
| get_dependency_health | Assess adoption-worthiness: version/stability, GitHub activity, issue dynamics, license, owner — raw signals for a verdict |
| get_dependency_license | SPDX / category license intelligence for direct dependencies |
| check_license_compliance | Aggregate transitive licenses via deps.dev; flag copyleft/risky vs project policy |
| search_artifacts | Search artifacts (Maven Central Solr; Nexus/Artifactory in closed mode) |
| audit_project_dependencies | Full audit: scan + version compare + vulnerability check |
| catalog_entry | Generate/validate Gradle version-catalog entries (libs.versions.toml) with rule-correct aliases and minimal diffs |
| verify_coordinates | Tri-state existence check + did-you-mean for hallucinated coordinates |
| get_eol_status | End-of-life / support status for JDK (vendor-specific), Kotlin, Gradle, and Spring Boot via endoflife.date |
| compare_upgrade_closure | Compare an upgrade's closure. Gradle when a wrapper exists; deps.dev is the single-upgrade fallback |
Skills
Claude Code keeps a listing of every installed skill's name and description in context, on a
budget of ~1% of the model's context window; when the listing overflows, descriptions get
dropped. Twenty-two entries from one plugin consume that budget on their own, so only the