Sonatype Guide: Fixing AI Coding Assistants’ Package Problems
Sonatype launched Guide on December 9, 2025, a developer tool that plugs into AI coding assistants. It steers them toward secure, high-quality open-source packages and handles dependency updates on its own. As SiliconANGLE reports, Guide acts like a backbone for these tools, making development quicker and less risky.
Why AI Coding Assistants Need This
AI tools like GitHub Copilot speed up coding, but they pull from old training data. That leads to bad suggestions: vulnerable packages, junk ones, or ones that don’t exist. Sonatype’s upcoming study, cited across reports, shows top generative AI models powering these assistants hallucinate packages 27% of the time. Developers end up fixing messes, wasting time and tokens.
Developer Tech points out this creates rework cycles that slow teams down and open security holes, while Channel Insider notes boosts to coding accuracy. Sonatype’s own tests on the same packages produced zero hallucinations.
How Guide Works
It runs as a Model Context Protocol server, sitting between the AI assistant and Sonatype’s data. When an AI suggests a package, Guide catches it live and swaps in a safe version before code hits the repo. It draws from Sonatype Intelligence, real-time info on open-source security, quality, and health.
Enterprises testing it saw security results jump over 300%, per The Manila Times. They also cut security fixes and dependency upgrade costs by more than 5x, counting money spent and hours worked.
Key Parts
- MCP server: Real-time intercepts and fixes for package picks.
- OSS search: Quick views of risks, health, and better options.
- API: Full access to Sonatype’s Nexus One Platform data, works with old setups.
What It Plugs Into
Guide fits with GitHub Copilot, Google Antigravity, Claude Code, Windsurf, IntelliJ with Junie, AWS Kiro, and Cursor. Keep your workflow; it just makes suggestions smarter.
Sonatype CEO Bhagwat Swaroop said it lets teams “move faster and safer” without trading off security. Chief Product Officer Mitchell Johnson added developers get “real-time intelligence” that skips hours of fixes.
