Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Look up the known vulnerabilities affecting exact package versions in the public OSV database (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex), 1 to 50 packages per call. Per package: every OSV advisory for that version with its id, CVE/GHSA aliases, summary, severity (database label, CVSS vectors, v3 base scores), the versions that fix it or "no fix published", published/modified dates and a link. Plus a summary: packages checked, packages vulnerable, total advisories and the highest severity. Evidence, not advice: absence from OSV does not prove safety.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Look up the known vulnerabilities affecting exact package versions in the public OSV database (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex), 1 to 50 packages per call. Per package: every OSV advisory for that version with its id, CVE/GHSA aliases, summary, severity (database label, CVSS vectors, v3 base scores), the versions that fix it or "no fix published", published/modified dates and a link. Plus a summary: packages checked, packages vulnerable, total advisories and the highest severity. Evidence, not advice: absence from OSV does not prove safety.
| Argument | Type | Description |
|---|
| packages* | array |
{
"type": "object",
"required": [
"packages"
],
"properties": {
"packages": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name",
"version"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"minLength": 1,
"description": "As the ecosystem names it: lodash, requests, github.com/gin-gonic/gin, org.apache.logging.log4j:log4j-core."
},
"version": {
"type": "string",
"maxLength": 128,
"minLength": 1,
"description": "The exact version, not a range."
},
"ecosystem": {
"enum": [
"npm",
"PyPI",
"Go",
"Maven",
"crates.io",
"RubyGems",
"NuGet",
"Packagist",
"Pub",
"Hex"
],
"type": "string",
"description": "OSV's ecosystem name, case-sensitive."
}
}
},
"maxItems": 50,
"minItems": 1
}
}
}