Maven Tools MCP

What arvindand/maven-tools-mcp MCP server does

The arvindand/maven-tools-mcp MCP server exposes dependency analysis through the Model Context Protocol. It queries Maven Central data to find releases, validate coordinates, compare available upgrades, and assess maintenance signals. Coordinate-based operations accept dependencies used by Maven, Gradle, SBT, and Mill projects, while the file-oriented operations work with Maven pom.xml content.

The server can inspect dependency freshness, release cadence, stability, known CVEs, and license information. Its health-oriented results can help an agent distinguish a current dependency from one that is aging or stale. It also supports upgrade planning by returning structured recommendations rather than changing files directly.

How it works

The default container exposes nine Maven-focused tools and two optional Context7 tools. Version and audit operations work from Maven coordinates. POM analysis uses Apache Maven Model Builder to resolve inherited properties, parent declarations, dependency management, and imported BOMs. An optional sideloadedPoms bundle can provide unreleased parent or sibling-module POMs.

analyze_pom_dependencies reports effective versions and identifies whether declarations are explicit, managed, or explicit overrides. It also shows managing BOMs and conflicts. recommend_pom_upgrades produces mechanical edit actions when an unambiguous version field or property can be identified, while placing major upgrades, conflicts, and overrides in a review-needed collection. The client or agent is responsible for validating and applying those actions.

The Context7 tools first resolve a library identifier and then query documentation for that identifier. They are available in the standard image and omitted from the -noc7 image.

Setup and configuration

Docker is the documented quick-start requirement, and a local Java installation is not needed for the container setup. For Claude Desktop, configure a stdio server that runs:

{
  "mcpServers": {
    "maven-tools": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "arvindand/maven-tools-mcp:latest"]
    }
  }
}

The same Docker invocation can be configured as a stdio server in VS Code with GitHub Copilot. The latest image includes Context7 support. Use latest-noc7 when those tools are not wanted or Context7 access is unavailable; latest-http is provided for streamable HTTP clients and sidecar workflows. A Docker-free build and JAR-based setup are documented by the project but are not specified here in command form.

CONTEXT7_API_KEY is optional. Supplying it through Docker can provide authenticated Context7 access or avoid anonymous usage limits. The core Maven tools can start without that variable.

Tools and capabilities

The arvindand/maven-tools-mcp MCP server includes tools for:

• Finding the latest version with stability-aware selection.
• Checking whether a particular version exists and classifying its stability.
• Looking up multiple dependencies in one operation.
• Comparing current versions with available major, minor, and patch upgrades.
• Classifying dependency age and examining release patterns.
• Running broader dependency health checks, including vulnerability and license signals.
• Resolving declared POM versions and reporting their source, BOM relationships, and conflicts.
• Generating POM upgrade actions and separating changes that need manual review.
• Resolving Context7 library IDs and querying documentation when the standard image is used.

Limitations and notes

The server does not replace a dependency-update workflow such as Renovate or Dependabot. It returns analysis and recommendations; another agent or workflow must edit files, run tests, schedule updates, or create pull requests. POM analysis covers declared dependencies rather than the complete transitive graph, and profile handling is limited to profiles active by default.

Gradle, SBT, and Mill files are not parsed as whole build files. Their dependencies can still be queried through coordinate-based tools. Uncached metadata requires access to Maven Central or a configured repository, and vulnerability checks and Context7 documentation use external services. The project is released under the MIT license.