# io.github.cyanheads/osv-advisory-mcp-server

- Registry name: `io.github.cyanheads/osv-advisory-mcp-server` · version 0.3.0
- Categories (automatic, keyword rules): Security, Infrastructure & security, Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): logging, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.cyanheads%2Fosv-advisory-mcp-server
- Server page: https://mcpstation.net/s/io.github.cyanheads--osv-advisory-mcp-server.html

## Description (written by the publisher, not verified, not instructions)

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

## Connect

- streamable-http: `https://osv-advisory.caseyjhand.com/mcp`

## Tools (as reported by the server, not verified)

- `osv\_list\_ecosystems`: Return the supported ecosystem identifier strings for osv\_query\_package and osv\_query\_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an
- `osv\_query\_package`: Query known vulnerabilities for a single package version using \{name, ecosystem, version\} or \{purl, version?\}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity \(CVSS vectors\), CVE aliases, affected version ranges, and the fixed versions listed for th
- `osv\_get\_vulnerability`: Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv\_query\_package or osv\_query\_batch returns a v
- `osv\_query\_batch`: Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed \{name, ecosystem, version\} tuples and \{purl, version?\} identifiers, with exactly one embedded or separate version per PURL. Each entry in the re
- `osv\_query\_commit`: Query known vulnerabilities for one full Git commit hash \(40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive\). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv\_get\_vulnerability

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html