Connection check
verified live · 27h ago
osv-advisory-mcp-server
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Tools
4
GitHub stars
1
Installs / wk
271
Licence
Apache-2.0
Transport
streamable-http, stdio
Last checked
27h ago
Tools & capabilities
4 toolsRead from the running server on 27h ago.
osv_get_vulnerability
read-only
id*
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix vers… Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance.
osv_list_ecosystems
read-only
Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch. Ecosystem strings are case-sensitive exact matches — passing "pypi" in… Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static (maintained from the OSV schema spec) and may occasionally lag newly added ecosystems.
osv_query_batch
read-only
packages*
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tu… Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring.
osv_query_package
read-only
name*version*ecosystem*