Osv Advisory Mcp Server

cyanheads/osv-advisory-mcp-server

Wraps the OSV.dev vulnerability database for querying package security advisories via MCP. Exposes four tools: single package lookups by name/ecosystem/version, batch audits for entire dependency lists (up to 1000 packages per call), full advisory retrieval by OSV ID, and ecosystem enumeration. Every vulnerability result includes CVE aliases, CVSS severity vectors, affected version ranges, and fix versions. The batch tool runs parallel queries to preserve full records that OSV's native batch endpoint omits. No API key required. Useful for triaging lockfiles, auditing SBOMs, or checking a dependency before adding it. The CVE aliases in each result chain cleanly to NIST NVD servers for EPSS scores and KEV status.

GitHub stars: 2
tools: 5
transport: STDIO, HTTP
env vars: 11
last updated: Nov 11, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://osv-advisory.caseyjhand.com/mcp --name osv-advisory

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http osv-advisory https://osv-advisory.caseyjhand.com/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 5 tools

Verified live against the running server on Nov 6, 2026.

osv_list_ecosystemsReturn the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-10-31. Ecosystem strings are case-sensitive exact matches — passing "pypi" instea...

Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-10-31. Ecosystem strings are case-sensitive exact matches — passing "pypi" instea...

No parameters. Call it with no arguments.

osv_query_packageQuery known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed...5 params

Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed...

Parameters* required

ecosystemstring

Case-sensitive ecosystem identifier from osv_list_ecosystems.

namestring

Exact package name in its ecosystem.

pageobject

Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set.

purlstring

PURL alternative to name and ecosystem; supply one embedded or separate version.

versionstring

Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized.

osv_get_vulnerabilityFetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_...2 params

Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_...

Parameters* required

id*string

One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include "GHSA-" (GitHub), "PYSEC-" (PyPI), "RUSTSEC-" (Rust), "GO-" (Go), "DSA-"/"DLA-" (Debian)...

pageobject

Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.

osv_query_batchQuery vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PUR...2 params

Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PUR...

Parameters* required

packages*array

Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i].

pageobject

Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start defer...

osv_query_commitQuery known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; us...2 params

Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; us...

Parameters* required

commit*string

Full Git commit hash: 40 SHA-1 or 64 SHA-256 hex characters, case-insensitive.

pageobject

Repeat the original commit with page: overflow.page first, then select path, offset: page.nextOffset and revision: page.revision.

Configuration

OSV_REQUEST_TIMEOUT_MSdefault: 40000

HTTP request timeout in milliseconds for OSV.dev API calls.

OSV_BATCH_CONCURRENCYdefault: 10

Maximum number of concurrent OSV.dev requests issued by osv_query_batch.

OSV_QUERY_MAX_PAGESdefault: 10

Maximum number of OSV.dev result pages followed per package or commit before marking a result truncated.

MCP_LOG_LEVELdefault: info

Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').

OSV_BATCH_SERVE_OVER_CAPdefault: true

Accept up to 5000 packages and process the first 1000. Set false to reject submissions over 1000.

MCP_TRANSPORT_TYPEdefault: http

Selects the HTTP transport.

MCP_HTTP_HOSTdefault: 127.0.0.1

The hostname for the HTTP server.

MCP_HTTP_PORTdefault: 3010

The port to run the HTTP server on.

MCP_HTTP_ENDPOINT_PATHdefault: /mcp

The endpoint path for the MCP server.

MCP_AUTH_MODEdefault: none

Authentication mode to use: 'none', 'jwt', or 'oauth'.

MCP_SESSION_MODEdefault: stateless

HTTP session mode. This server deploys stateless because its tools do not use multi-round input.

Readme

@cyanheads/osv-advisory-mcp-server

Query OSV.dev for package vulnerabilities, batch-audit dependency lists, and fetch full advisory records via MCP. STDIO or Streamable HTTP.

5 Tools · 1 Skill

View the full README on GitHub

Details

Repository: github.com/cyanheads/osv-advisory-mcp-server
Package: @cyanheads/osv-advisory-mcp-server
Transport: STDIO, HTTP
Registry: MCP registry, active
Resources: 1
Tools verified: Nov 6, 2026

Osv Advisory Mcp Server

Install

Tools

Configuration

Readme

@cyanheads/osv-advisory-mcp-server

Details

More from cyanheads