OSV.dev Security Analyzer

by gleicon

11 stars

153 downloads

Not rated

GitHub

About

Integrates with OSV.dev to identify and analyze potential vulnerabilities in codebases, providing dependency checking and code security analysis with optional Semgrep-enhanced static analysis.

Details

Author: gleicon
Repository: gleicon/mcp-osv
GitHub stars: 11
Downloads: 153
Categories: Productivity, AI, Developer Tools, File Management, Security, Infrastructure
Tags: #integration

Supply Chain Vulnerability Analysis: Integration with OSV.dev API for dependency vulnerability assessment
Secret Detection: Gitleaks v8 integration with 100+ built-in detection rules for credentials and API keys
Static Code Analysis: AST-based Go code analysis for security anti-patterns
Pattern Matching: Regex-based detection for common security vulnerabilities
MCP Protocol Support: Standard protocol implementation for AI assistant integration
Community-Vetted Rules: Gitleaks patterns maintained by the security community

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name OSV.dev Security Analyzer

Command (node, npx, python, etc.) /usr/local/bin/mcp-osv

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

JSON

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

From the repository

make deps     # Install Go module dependencies
make build    # Compile binary
make install  # Install to /usr/local/bin
make run       # Build and execute server
make clean     # Remove build artifacts

pre-built releases

The mcp-osv binary communicates via stdin/stdout using the MCP protocol.

`check_vulnerabilities`

Query OSV.dev database for known vulnerabilities in specific package versions. Parameters: package_name (string, required), version (string, required)

`analyze_security`

Comprehensive security analysis combining multiple detection engines. Parameters: file_path (string, required)

`scan_secrets`

Dedicated secret detection using Gitleaks v8 with 100+ community-maintained detection rules. Parameters: path (string, required), scan_git_history (boolean, optional)

The server exposes three MCP tools for security analysis:

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "osv.dev security analyzer": {
            "cwd": "string (optional)",
            "env": {},
            "args": [],
            "shell": false,
            "command": "/usr/local/bin/mcp-osv"
        }
    }
}

Linux

{
    "cwd": "string (optional)",
    "env": [],
    "args": [],
    "shell": false,
    "command": "/usr/local/bin/mcp-osv"
}

Macos

{
    "cwd": "string (optional)",
    "env": [],
    "args": [],
    "shell": false,
    "command": "/usr/local/bin/mcp-osv"
}

Windows

{
    "cwd": "string (optional)",
    "env": [],
    "args": [],
    "shell": false,
    "command": "/usr/local/bin/mcp-osv"
}

MCP Security Analyst

A Model Context Protocol (MCP) server providing comprehensive security analysis capabilities through integration with OSV.dev vulnerability database and native Go-based code analysis and secret detection engines.

Features

Requirements

Core Requirements

make deps
make install

Build Dependencies

Go 1.25.4 or later github.com/mark3labs/mcp-go github.com/zricethezav/gitleaks/v8
Installation

make deps # Install Go module dependencies make build # Compile binary make install # Install to /usr/local/bin make run # Build and execute server make clean # Remove build artifacts

pre-built releases

The mcp-osv binary communicates via stdin/stdout using the MCP protocol.

IDE Configuration

Cursor IDE

Navigate to Configuration > MCP and add:

{ "mcpServers": { "security_analyst": { "name": "Security Analyst", "type": "stdio", "command": "/usr/local/bin/mcp-osv" } } }

Claude Desktop

Edit the MCP configuration file at Settings > Developer:

{ "mcpServers": { "mcp_osv": { "command": "/usr/local/bin/mcp-osv", "args": [] } } }

Available Tools

The server exposes three MCP tools for security analysis:

check_vulnerabilities

Query OSV.dev database for known vulnerabilities in specific package versions.

Parameters:
package_name (string, required): Package identifier
version (string, required): Version string

Functionality:
Rate-limited API requests (1 request/second)
HTTP timeout protection (10 seconds)
JSON response parsing
Vulnerability detail extraction

analyze_security

Comprehensive security analysis combining multiple detection engines.

Parameters:
file_path (string, required): Target file or directory path

Analysis Components:
Native Go AST-based code analysis
Gitleaks v8 secret detection with 100+ rules
OSV.dev vulnerability checks for dependencies (go.mod files)
Pattern-based vulnerability detection

Detected Issues:
Command injection vectors
Deserialization vulnerabilities
SQL injection patterns
Hardcoded credentials
API keys and tokens
Private keys and certificates
Database connection strings

scan_secrets

Dedicated secret detection using Gitleaks v8 with 100+ community-maintained detection rules.

Parameters:
path (string, required): Target file, directory, or repository path
scan_git_history (boolean, optional): Enable git history scanning (default: false)

Detection Capabilities (100+ patterns):
AWS Access Keys, Secret Keys, Session Tokens
GitHub Personal Access Tokens, OAuth tokens
Google Cloud Platform API keys
Azure credentials and connection strings
Slack tokens and webhooks
Stripe API keys
Private SSH/PGP/RSA keys
JWT tokens
Database connection strings (PostgreSQL, MySQL, MongoDB)
Generic API keys with entropy analysis
And 90+ more patterns maintained by the security community

Output: Partial secret redaction for secure display (first 4 + last 4 characters)

Integration Patterns

The MCP server enables AI assistants to perform security analysis through natural language requests:

Dependency Vulnerability Scanning:
```

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

check_vulnerabilities

analyze_security

scan_secrets

Claude Desktop / Cursor

Linux

Macos

Windows

MCP Security Analyst

Features

Requirements

Core Requirements

Build Dependencies

Installation

IDE Configuration

Cursor IDE

Claude Desktop

Available Tools

check_vulnerabilities

analyze_security

scan_secrets

Integration Patterns

Install

More like this

Time

Sentry

Github

Git

GitLab

Context 7

`check_vulnerabilities`

`analyze_security`

`scan_secrets`