maven-mcp

Name: maven-mcp
Author: Kirill Rozov

Maven and Gradle dependency lookups, upgrade checks, CVE scans and end-of-life status for JVM projects

By Kirill Rozov (individual) Python Local · stdio Developer tools Security

GitHub PyPI Website

44 popularity score ★ 37 ↓ 5.3k/mo

Connect your client

Local (PyPI)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

Claude CodeTerminal

claude mcp add maven -- uvx maven-mcp

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "maven": {
      "command": "uvx",
      "args": [
        "maven-mcp"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "maven": {
      "command": "uvx",
      "args": [
        "maven-mcp"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "maven": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "maven-mcp"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.maven]
command = "uvx"
args = ["maven-mcp"]

Gemini CLITerminal

gemini mcp add --scope user maven uvx -- maven-mcp

Settings 10

`GITHUB_TOKEN`	Optional: Raises the GitHub API limit from 60 to 5000 requests per hour for changelogs and health checks.
`MAVEN_MCP_OFFLINE`	Optional: Stops contact with public Maven, Google and Plugin Portal hosts and the enrichment APIs.
`MAVEN_MCP_REPOSITORY_BASE`	Optional: Internal Nexus or Artifactory group URL that replaces the public repositories.
`MAVEN_MCP_PUBLIC_FALLBACK`	Optional: Also query public repositories when the build declares its own.
`MAVEN_MCP_SETTINGS`	Optional: Path to a Maven settings.xml for mirrors and credentials.
`MAVEN_MCP_CACHE_DISABLE`	Optional: Turns off the on-disk response cache.
`MAVEN_MCP_GRADLE_TIMEOUT`	Optional: Seconds allowed for the Gradle wrapper run during a scan (default 300).
`MAVEN_MCP_TRANSPORT`	Optional: Set to http to serve POST /mcp instead of stdio.
`MAVEN_MCP_HTTP_HOST`	Optional: Bind address in HTTP mode (default 127.0.0.1).
`MAVEN_MCP_HTTP_PORT`	Optional: Port in HTTP mode (default 8765).

What it does

maven-mcp is a Python MCP server for JVM dependency work. It answers questions about Maven artifacts (latest stable version, whether a version exists, what changed between two releases) and scans a Gradle or Maven project to report outdated libraries, known vulnerabilities, license posture and version conflicts.

Version lookups go to the repositories the build file declares, falling back to Maven Central, Google Maven and the Gradle Plugin Portal when none are declared. Vulnerability data comes from OSV.dev, transitive graphs and licenses from deps.dev, release notes from AndroidX and AGP docs or GitHub releases, and JDK, Kotlin, Gradle and Spring Boot support dates from endoflife.date. Gradle projects are scanned by running the project's own wrapper once to read the resolved runtime classpaths; Maven projects are read from pom.xml.

It ships as a plugin for Claude Code, Grok Build, Cursor and Codex that bundles the server with slash-command skills and pre-edit hooks that can block a suspicious coordinate in a build file. Other clients run the published PyPI package with uvx over stdio, or start it in a stateless Streamable HTTP mode. For locked-down networks it has an offline mode, an internal repository base for Nexus or Artifactory, settings.xml mirror support and per-repository credentials.

What it needs

Runtime	Python 3.9+

Python 3.9 or newer (standard library only, no pip dependencies); uv when run as uvx maven-mcp outside the plugin. Scanning a Gradle project needs the project's Gradle wrapper and a JDK able to run it. Private repositories need credentials in environment variables, ~/.m2/settings.xml or ~/.gradle/gradle.properties. The plugin hooks need jq and timeout (gtimeout on macOS).

Limits

Without GITHUB_TOKEN, changelog and health lookups share GitHub's 60 requests per hour. In offline mode the checks that call OSV, GitHub, deps.dev, Android docs or endoflife.date return an unavailable marker, so an empty result there is not a clean bill. Gradle scans read production runtime classpaths only and time out after 300 seconds by default. EOL status covers JDK, Kotlin, Gradle and Spring Boot. The upgrade-closure comparison is advisory. The HTTP mode has no authentication. It is not distributed on npm or Homebrew. Under Codex, a hook's deny does not stop the edit.

Who it suits

Suits Java, Kotlin and Android developers who want an assistant to pick correct dependency versions, catch made-up coordinates and audit a Gradle or Maven build for updates, CVEs and licenses, including teams behind Nexus or Artifactory with no public internet. It runs locally, reads rather than edits the build, and needs no account. It is a community project, not from Sonatype or Gradle. Its Gradle scan runs the project's wrapper, so skip it for repositories whose build scripts you do not trust, or stick to the coordinate lookups.

Tools 21

get_latest_version: Latest version of an artifact, preferring stable releases
check_version_exists: Confirms one version exists and labels its stability
check_multiple_dependencies: Latest versions for several artifacts in one call
compare_dependency_versions: Compares current versions to latest and classes the bump as major, minor or patch
get_dependency_changes: Release notes between two versions from AndroidX/AGP docs, GitHub releases or CHANGELOG.md
scan_project_dependencies: Lists dependencies from Gradle, Maven and version-catalog files
expand_bom: Lists the versions a Maven BOM manages
get_transitive_graph: Resolved transitive graph for one coordinate from deps.dev
get_vulnerability_paths: Shortest path from a root coordinate to each vulnerable transitive dependency
detect_dependency_conflicts: Flags libraries resolved at more than one version
check_version_compatibility: Checks Spring Boot, AGP, Kotlin and javax-to-jakarta compatibility
get_dependency_vulnerabilities: Known CVEs and advisories for coordinates via OSV.dev
get_dependency_health: Maintenance, GitHub activity, issue, license and owner signals for a library
get_dependency_license: SPDX license and license category for direct dependencies
check_license_compliance: Rolls up transitive licenses and flags copyleft or policy breaches
search_artifacts: Keyword search on Maven Central, or Nexus/Artifactory in closed mode
audit_project_dependencies: One pass of scan, version comparison and vulnerability check
catalog_entry: Builds or validates a libs.versions.toml entry and proposes a minimal diff
verify_coordinates: Says whether a coordinate exists, and suggests close matches if not
get_eol_status: Support and end-of-life dates for JDK, Kotlin, Gradle and Spring Boot
compare_upgrade_closure: Shows what else changes when one dependency is upgraded

Popularity

44 popularity score, on our list (the bar is 36)

★ 37 ↓ 5.3k/mo

GitHub stars	37	19 points
PyPI downloads, last month	5,334	25 points

Measured 2026-11-07. How the score works.

Where it is published

Code	kirich1409/maven-mcp ★ 37
PyPI	maven-mcp 1.1.0, 2026-10-04

What it can reach

Runs	On your machine
Reaches	Files on your machine, The internet, Runs shell commands, Your code
Changes things	No: it reads only
Sign-in	None
Licence	MIT (PyPI)
Last code change	2026-10-04

Runs on your machine. It reads build files, ~/.m2/settings.xml, ~/.gradle/gradle.properties and Gradle init scripts, and scanning a Gradle project executes that project's gradlew wrapper, so build logic in the repository runs. Outbound calls go to the declared repositories, Maven Central, Google Maven, the Gradle Plugin Portal, OSV.dev, deps.dev, GitHub, Android docs and endoflife.date; offline mode limits this to declared or internal hosts. Tools return information and do not edit project files; the server writes only a response cache under ~/.cache. Repository credentials come from environment variables or local Maven/Gradle settings and are not printed; a name-keyed secret goes only to a pinned host. HTTP mode has no authentication.

Over time

GitHub stars 37 +1 (+3 %)

3736

13 Oct 20267 Nov 2026

PyPI downloads a month 5.3k +0

5.3k5.3k

14 Oct 20267 Nov 2026

Popularity score 44 +25 (+134 %)

4419

13 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-14.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![maven-mcp on EveryMCPServer](https://everymcpserver.com/badge/maven-mcp.svg)](https://everymcpserver.com/servers/maven-mcp)

Connect your client

Add in one click

Or add it by command or config

Settings 10

What it does

What it needs

Limits

Who it suits

Tools 21

Similar servers

jshookmcp

REA

Quill

SonarQube MCP Server

Socket MCP Server

Snyk Studio MCP