Dependency Doctor

An MCP server that explains Maven dependency resolution.Ask your AI assistantwhya version is on your classpath — and get the actual answer: which rule decided, who requested what, and the full path of the dependency that dragged it in.

You:why do I have commons-lang3 3.9 in my project?

Claude (via dependency-doc):The chain isspring-boot-testcontainers → testcontainers 2.0.5 → commons-compress 1.28.0 → commons-lang3 3.20.0(test scope) — but Maven resolved to 3.9 anyway. Maven doesn't pick the newest version, it picks thenearestdeclaration in the tree, and your pom declares 3.9 directly. Your one-line declaration silently downgraded the whole project by eleven versions.

mvn dependency:tree -Dverboseshows youthata version was omitted. It never explainswhy— and the why involves rules most developers have never been taught: nearest-wins mediation, dependencyManagement pins, BOM imports, exclusion shadowing. A typical Spring Boot project inheritsover 1,900 managed versionsit never wrote. When an upgrade mysteriously doesn't take effect, the answer is buried in that machinery.

dependency-doc runs Maven's own resolution machinery (Maven Resolver + Model Builder) against your actual pom.xml and exposes the results as MCP tools, so an AI assistant can answer dependency questions with evidence instead of guesses.

analyzeDependencies(pomPath)— full-tree health check: node counts, direct dependencies, and every version conflict with its complete explanation.

explainVersion(pomPath, groupArtifact)— the core feature. For one library: the resolved version, the rule that decided it (direct declaration / dependencyManagement / nearest-wins), and every request with its path and outcome.

findDependencyPaths(pomPath, groupArtifact)— every chain by which a library enters your build. Useful for planning exclusions.

git clone https://github.com/sindhunaydu/dependency-doc.git cd dependency-doc ./gradlew bootJar

Add to Claude Desktop's config (~/Library/Application Support/Claude/claude_desktop_config.jsonon macOS):

{ "mcpServers": { "dependency-doc": { "command": "java", "args": ["-jar", "/absolute/path/to/dependency-doc/build/libs/dependency-doc-0.0.1-SNAPSHOT.jar"] } } }

Restart Claude Desktop fully, then ask it something like:"Analyze the dependencies of /path/to/my-project/pom.xml — why is jackson-databind at the version it's at?"

dependency-doc embeds the same libraries Maven itself is built on. The Model Builder turns your pom.xml into theeffective model— parents inherited, BOMs imported, properties interpolated. Maven Resolver then collects the full dependency graph with conflict-loser preservation enabled, so superseded requests stay in the graph, marked with what beat them. The analysis layer walks that graph and turns markings into explanations.

Analysis differs from a build in one important way: your project's own test and provided dependencies are part of the truth (a custom scope selector encodes Maven's exact semantics — direct test deps in, other libraries' test universes out).

A note on strict mode (a debugging saga)

This tool refuses to silently omit branches. During development, a stack of quiet defaults — a lenient artifact-descriptor policy plus an empty-looking exception list — produced a confident"Conflicts: 0"on a project that verifiably had conflicts. The cause: parent poms with JDK-activated profiles failed to build when the resolver session lacked system properties, and the lenient policy swallowed every failure, leaving childless nodes and a clean-looking report.

dependency-doc therefore runs with a strict descriptor policy and surfaces every collection problem in its responses. An analysis that fails loudly is useful; one that lies confidently is worse than none. If a response includes a "⚠ Analysis incomplete" section, believe it.

- Maven only, for now.Gradle resolution uses a genuinely different model (highest-wins, constraints, resolution rules) and is planned as v2 via the Gradle Tooling API.
- Single-module projects; multi-module reactor support is planned.
- Tree diffing (what changes if I bump X?) is on the roadmap.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

Provides seamless integration with SonarQube Server or Cloud, and enables analysis of code snippets directly within the agent context

AI-powered security scanning. Scans code, files, and git diffs for vulnerabilities in real-time using the Armis scanning API.

Access the Codacy API to analyze code quality, coverage, and security for your repositories.

A collection of MCP servers for Claude Desktop, providing access to network tools, code linters, and Proxmox virtualization management.

RepoFortify is a remote MCP server for production-readiness and security scanning. Connect it to your AI coding tool — Lovable, ChatGPT, Codex, Claude Code, Cursor, and other MCP clients — and scan your repository, review risk findings, and get AI fix plans without leaving where you build. Authentication required on every request; your data stays isolated to you.

Reverse-engineer architecture from source code (Go, TypeScript, Python) or markdown. 19 tools for architecture graphs, drift detection between git refs, and validation rules.

Fetch SonarCloud issues related to pull requests.

Integrates with SonarQube to provide AI assistants with access to code quality metrics, issues, and analysis results.