Osv Advisory MCP Server
io.github.cyanheads/osv-advisory-mcp-server
answering
Osv Advisory MCP Server is answering right now. Last checked 5 min ago. 108 installs a week from npm. It exposes 4 tools. Last commit 30 Jul 2026.
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Installs per day
peak 551 · avg 38 · -18% w/w
a month agotoday
Uptime history
40 hours of history · worst hour 75%
40 hours agonow
100.0%
Uptime 24h
91 of 91 checks
4
Tools
read from the server
364 ms
Response time
average over 24h
108
Installs / week
npm and PyPI
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 5 min ago.
run in your terminal
claude mcp add osv-advisory-mcp-server --transport http https://osv-advisory.caseyjhand.com/mcp~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"osv-advisory-mcp-server": {
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}~/.codex/config.toml
[mcp_servers.osv-advisory-mcp-server]
url = "https://osv-advisory.caseyjhand.com/mcp".cursor/mcp.json
{
"mcpServers": {
"osv-advisory-mcp-server": {
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}.vscode/mcp.json
{
"mcpServers": {
"osv-advisory-mcp-server": {
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}Available tools 4
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
osv
osv_get_vulnerability
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance.
osv_list_ecosystems
Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static (maintained from the OSV schema spec) and may occasionally lag newly added ecosystems.
osv_query_batch
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring.
osv_query_package
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and first safe version. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://osv-advisory.caseyjhand.com/mcp | streamable-http | answering | 203 ms | 5 min ago |
Osv Advisory MCP Server — questions
Answers built from our own checks of this server.
What can Osv Advisory MCP Server do?
It exposes 4 tools, read directly from the server on our last check. Among them: osv_get_vulnerability, osv_list_ecosystems, osv_query_batch, osv_query_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README.
How MCP servers expose tools in the first place →
Is Osv Advisory MCP Server working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 364 ms. The bar chart above shows every period we have measured.
How do I connect Osv Advisory MCP Server?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Osv Advisory MCP Server need an API key?
No. Osv Advisory MCP Server completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Osv Advisory MCP Server?
It answers our handshake in 364 ms on average, which is faster than 38% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
How many people use Osv Advisory MCP Server?
The npm package @cyanheads/osv-advisory-mcp-server was installed 108 times in the last week. Week over week that is -18%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.
Is Osv Advisory MCP Server open source?
Yes — it is published under the Apache-2.0 licence, written in TypeScript and 1 stars on GitHub. The source link is on this page, so you can read exactly what it does with your data before you connect it.