← Back to search

maven-indexer-mcp

tangcent Scanned 13d ago

MCP server for indexing local Maven repository

C
66.4 / 100

Versions

1.1.0latest
Feb 28, 2026
1.0.9
Jan 7, 2026
1.0.8
Dec 23, 2025
1.0.7
Dec 18, 2025
1.0.6
Dec 16, 2025
+ show 6 moreshow less
1.0.5
Dec 15, 2025
1.0.4
Dec 15, 2025
1.0.3
Dec 15, 2025
1.0.2
Dec 15, 2025
1.0.1
Dec 14, 2025
1.0.0
Dec 14, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 13

get_class_details
annotations: none low

Retrieve the source code for a class from the local Maven/Gradle cache (containing internal company libraries). This tool identifies the containing artifact and returns the source code. It prefers actual source files but will fall back to decompilation if necessary. Use this primarily for internal company libraries that are not present in the current workspace. IMPORTANT: Even if the code compiles and imports work, the source code might not be in the current workspace (it comes from a compiled internal library). Use this tool to see the actual implementation of those internal libraries. Supports batch queries.

search_artifacts
annotations: none low

Search for internal company artifacts and libraries in the local Maven repository and Gradle caches by coordinate (groupId, artifactId), keyword, or class name. Use this primarily for internal company packages or to find available versions of internal projects that are locally built. Also supports searching third-party libraries in the local cache. Supports batch queries.

search_classes
annotations: none low

Search for Java classes in internal company libraries found in the local Maven/Gradle caches. Essential for finding classes in internal company libraries that are not part of the current workspace source code. Use this when you see an import (e.g., 'com.company.util.Helper') but cannot find the definition. Do not assume that because the code compiles or the import exists, the source is local. It often comes from a compiled internal library. This tool helps locate the defining artifact. Supports batch queries.

search_implementations
annotations: none low

Search for internal implementations of an interface or base class. This is particularly useful for finding implementations of SPIs or base classes within internal company libraries in the local Maven/Gradle cache. Supports batch queries.

search_resources
annotations: none low

Search for text resources (non-class files) inside indexed JARs. Supports .properties, .xml, .json, .yaml/.yml, and META-INF/services/* entries up to 64KB. Use 'glob:' prefix for glob patterns, 'regex:' prefix for regex, otherwise substring match on the path.

search_methods
annotations: none low

Search for Java methods by name across indexed artifacts in the local Maven/Gradle caches. Returns matching method names with their declaring class and the artifacts that contain them. Requires method indexing to be enabled (INDEX_METHODS=1). Supports batch queries.

refresh_index
annotations: none low

Trigger a re-scan of the Maven repository. Re-indexes all artifacts into shadow tables and atomically swaps on success. Returns an error result if the refresh fails.

info
annotations: none low

Get detailed info about one or more artifacts matching a Maven coordinate. Returns the artifact path, layout, hasSource flag, indexed class count, indexed resource count, and whether the main JAR file still exists on disk. If version is omitted, returns info for every known version of the artifact.

stats
annotations: none low

Return aggregate statistics about the local Maven/Gradle index: total artifact count, indexed class count, indexed resource count, the SQLite DB file path and size in bytes, and the last-indexed timestamp (ISO string). Useful for sanity-checking index health and freshness.

list_classes
annotations: none low

List all distinct Java/protobuf class names indexed for a specific Maven artifact coordinate. Useful for inspecting what classes an internal company library exposes. The coordinate MUST include the version.

get_resource
annotations: none low

Retrieve the content of a single indexed text resource (proto file, XML, properties, JSON, YAML, META-INF/services/*) inside an artifact JAR. The coordinate MUST include the version. Returns the resource content, type label, and path. Resources larger than 64KB are not stored and will report as not found.

get_dependencies
annotations: none low

Return the parsed Maven `<dependencies>` of an artifact (groupId:artifactId:version). Each entry includes groupId, artifactId, version (empty string when the POM omits it), scope (defaults to 'compile'), and the optional flag. Useful for understanding what an internal company library transitively pulls in. Requires the full coordinate including version.

find_dependents
annotations: none low

Find indexed artifacts that declare a dependency on the given coordinate. Matching is by groupId:artifactId only — version is optional in the input. Returns each dependent artifact's full coordinate and the declared scope (defaults to 'compile'). Useful for impact analysis when changing an internal library.

Permissions 4

filesystem low
Server uses filesystem capabilities via: fs sync ops
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
database medium
Server uses database capabilities via: better-sqlite3
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 41

low
Tool 'get_class_details' has no annotations annotation_checker · 100%
low
Tool 'search_artifacts' has no annotations annotation_checker · 100%
low
Tool 'search_classes' has no annotations annotation_checker · 100%
low
Tool 'search_implementations' has no annotations annotation_checker · 100%
low
Tool 'search_resources' has no annotations annotation_checker · 100%
low
Tool 'search_methods' has no annotations annotation_checker · 100%
low
Tool 'refresh_index' has no annotations annotation_checker · 100%
low
Tool 'info' has no annotations annotation_checker · 100%
low
Tool 'stats' has no annotations annotation_checker · 100%
low
Tool 'list_classes' has no annotations annotation_checker · 100%
low
Tool 'get_resource' has no annotations annotation_checker · 100%
low
Tool 'get_dependencies' has no annotations annotation_checker · 100%
low
Tool 'find_dependents' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.24.3 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.24.3 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: yauzl@3.2.0 (GHSA-gmq8-994r-jv83) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.0.15 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: get_class_details manifest_parser · 85%
info
Tool: search_artifacts manifest_parser · 85%
info
Tool: search_classes manifest_parser · 85%
info
Tool: search_implementations manifest_parser · 85%
info
Tool: search_resources manifest_parser · 85%
info
Tool: search_methods manifest_parser · 85%
info
Tool: refresh_index manifest_parser · 85%
info
Tool: info manifest_parser · 85%
info
Tool: stats manifest_parser · 85%
info
Tool: list_classes manifest_parser · 85%
info
Tool: get_resource manifest_parser · 85%
info
Tool: get_dependencies manifest_parser · 85%
info
Tool: find_dependents manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (13) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 224 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%