OSV
About
Access the [OSV (Open Source Vulnerabilities) database](https://osv.dev/) for vulnerability information. Query vulnerabilities by package version or commit, batch query multiple packages, and get detailed vulnerability information by ID.
Details
- Author
- StacklokLabs
- GitHub stars
- 36
- Downloads
- 281
- Categories
- Database, Community, Other
Jump to
- Query vulnerabilities by package name, ecosystem, and version or commit hash
- Batch query multiple packages or commits in a single call
- Get detailed information about a specific vulnerability by OSV ID
- Supports SSE and Streamable HTTP transport modes
- Configurable port and transport via environment variables
- Runs natively or via secure ToolHive container deployment
Install with Go 1.21+ or use the recommended ToolHive containerized deployment. Configure with environment variables MCP_PORT (default 8080) and MCP_TRANSPORT (default sse, also supports streamable-http). The server exposes three MCP tools: query_vulnerability (single package/commit), query_vulnerabilities_batch (multiple queries), and get_vulnerability (by OSV ID). Invoke via any MCP client after running the server.
OSV MCP Server
An MCP (Model Context Protocol) server that provides access to the
OSV (Open Source Vulnerabilities) database.
Overview
This project implements an SSE-based MCP server that allows LLM-powered
applications to query the OSV database for vulnerability information. The server
provides tools for:
1. Querying vulnerabilities for a specific package version or commit
2. Batch querying vulnerabilities for multiple packages or commits
3. Getting detailed information about a specific vulnerability by ID
Installation
Prerequisites
- Go 1.21 or later
- Task (optional, for running tasks)
- ko (optional, for building container images)
Building from source
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
