All servers · Security · Code & repositories

io.github.cyanheads/osv-advisory-mcp-server

io.github.cyanheads/osv-advisory-mcp-server · v0.3.0

Measured by MCP Station

Description written by the publisher, not verified

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Connect

claude mcp add --transport http osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

Tools as reported by the server

• osv_list_ecosystems
  Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an
• osv_query_package
  Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for th
• osv_get_vulnerability
  Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a v
• osv_query_batch
  Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the re
• osv_query_commit
  Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability

Tool changes

• 2026-10-19: osv_list_ecosystems, osv_query_package, osv_get_vulnerability, osv_query_batch, osv_query_commit
• 2026-10-16: osv_list_ecosystems, osv_query_package, osv_get_vulnerability, osv_query_batch

Repository · JSON · Text for agents · Registry updated 2026-10-18