Osv Advisory MCP Server

by cyanheads Your server? Claim it

answering

Osv Advisory MCP Server is answering right now. Last checked 1 min ago. 286 installs a week from npm. It exposes 5 tools. Last commit 1 Nov 2026.

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Installs per day peak 227 · avg 38 · -8% w/w

a month agotoday

Uptime history 91 days of history · worst day 0%

91 days agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

579 ms

Response time

average over 24h

286

Installs / week

npm and PyPI

What changed 32

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 25 August 2026. No other catalogue keeps this.

1 Nov 2 tools changed the parameters they ask for osv_query_batch, osv_query_package

1 Nov a tool changed version

30 Oct a tool changed version

18 Oct 3 tools changed the parameters they ask for osv_get_vulnerability, osv_query_batch, osv_query_package

18 Oct 3 tool descriptions were rewritten osv_get_vulnerability, osv_query_batch, osv_query_package

18 Oct a tool appeared osv_query_commit

18 Oct a tool changed version

14 Oct 3 tool descriptions were rewritten osv_get_vulnerability, osv_query_batch, osv_query_package

14 Oct 3 tools changed the parameters they ask for osv_get_vulnerability, osv_query_batch, osv_query_package

14 Oct a tool changed version

and 13 more, back to 25 August 2026

What the code does

We read the source, 21 h ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command src/mcp-server/tools/definitions/osv-query-batch.tool.ts:357

      const match = /^\/results\/(0|[1-9]\d*)(\/.*)?$/.exec(input.page.path);

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 1 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add osv-advisory-mcp-server --transport http https://osv-advisory.caseyjhand.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://osv-advisory.caseyjhand.com/mcp

~/.codex/config.toml

[mcp_servers.osv-advisory-mcp-server]
url = "https://osv-advisory.caseyjhand.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "osv-advisory-mcp-server": {
      "type": "http",
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

osv

osv_get_vulnerability

Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.

osv_list_ecosystems

Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-10-31. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.

osv_query_batch

Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

osv_query_commit

Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

osv_query_package

Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

Endpoints

URL	Transport	State	Latency	Checked
https://osv-advisory.caseyjhand.com/mcp	streamable-http	answering	514 ms	1 min ago

Alternatives to Osv Advisory MCP Server

same job, measured the same way

OSV Advisories

by basitalisandhu

Query OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch.

local only

Dependency Vulnerability Check (OSV)

by brunckel

Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.

answering

Osv

by pipeworx-io

OSV.dev (Open Source Vulnerabilities) MCP.

48 tools answering

OSV Dependency Vulnerability Check

by fairquery

Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.

answering

AgentGuard — security checks for AI agents

by shuaicongxiaomai

Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev).

local only

Cve Intel MCP

by robertoyanguas-ops

Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and re

2 tools answering

Dependency Vulnerability Tracker — package security advisories ($0.01/query)

by a2awire

Dependency vulns & malicious-package advisories. Register in-session — free testnet funds.

16 tools answering

Package Health Check

by openkrill

Check an npm or Python package, or a package.json, for vulnerabilities and upkeep.

6 tools answering

Osv Advisory MCP Server — questions

Answers built from our own checks of this server.

What can Osv Advisory MCP Server do?

It exposes 5 tools, read directly from the server on our last check. Among them: osv_get_vulnerability, osv_list_ecosystems, osv_query_batch, osv_query_commit, osv_query_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Osv Advisory MCP Server working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 579 ms. The bar chart above shows every period we have measured.

How do I connect Osv Advisory MCP Server?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Osv Advisory MCP Server need an API key?

No. Osv Advisory MCP Server completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Osv Advisory MCP Server?

It answers our handshake in 579 ms on average, which is faster than 20% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use Osv Advisory MCP Server?

The npm package @cyanheads/osv-advisory-mcp-server was installed 286 times in the last week. Week over week that is -8%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Osv Advisory MCP Server open source?

The code is open source: it is published under the Apache-2.0 licence, written in TypeScript, 2 stars on GitHub and 2 open issues. The licence covers the code in the repository, not the hosted service at osv-advisory.caseyjhand.com, which runs on its operator's own terms.