Sonatype is Poor to agents.
Discry independently scored how well an AI agent can discover and understand the Sonatype API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 26/100Comprehension
55% of score · 78/100What we found
- An AI agent crawling sonatype.com is actively turned away: robots.txt Disallows ClaudeBot, GPTBot, Google-Extended, CCBot and Amazonbot outright and sets Content-Signal ai-train=no, so agents relying on pre-crawled knowledge won't have Sonatype's docs at all.
- Positive: once an agent reaches help.sonatype.com the docs read well for machines — endpoint pages lead with the HTTP method + URL, use realistic values (real Maven coordinates, real checksums, base64 component IDs), and document pagination (continuationToken, 100-item cap) and rate limits (429 handling). Comprehension grades B.
- There is no llms.txt, llms-full.txt, or .well-known/mcp.json on either the marketing or docs domain — zero agent-native discovery affordances, so an agent has no machine-readable map or entry point to the API.
- Positive: Sonatype ships an official MCP server (listed on Glama and in the OSS MCP registry), letting agents query dependency and security intelligence through a supported tool — a strong signal most peer APIs lack.
- The OpenAPI 3 spec is real and importable, but only retrievable from a running instance at /service/rest/swagger.json; there is no publicly downloadable spec URL, and the docs lean heavily on the in-product Swagger UI, which an agent cannot reach without deploying Nexus.
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Unblock AI crawlers — at minimum allow ClaudeBot, GPTBot and Google-Extended on help.sonatype.com and set Content-Signal search=yes. This is the single biggest lever; the current blanket block is what zeroes the Discovery score.
- 02Publish an llms.txt (and llms-full.txt) at sonatype.com and help.sonatype.com linking the REST API reference, authentication, pagination, and MCP server pages so agents get a machine-readable index of the API surface.
- 03Host the OpenAPI 3 spec at a stable, public URL (e.g. help.sonatype.com/openapi.json) so agents can fetch the API contract without standing up a Nexus instance or opening the in-product Swagger UI.
- 04Add an AGENTS.md to the flagship public repos (nexus-public, dependency-management-mcp-server) to give coding agents build, auth, and usage context.
- 05Add multi-language examples (Python/JS/Java clients already exist on GitHub) and 2-3 end-to-end workflow guides (e.g. authenticate → create repository → upload component → verify) to lift comprehension from B toward A.
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
Auth is well documented (basic, user tokens, PATs, and CSRF-token handling for reverse-proxy setups). Rate limits are explicit for Cloud (1,500 requests/IP/5-min → 429 with a wait-5-minutes message) and pagination is documented via continuationToken with a fixed 100-item page size. No formal machine-parseable error-response schema and no idempotency-key support are documented.