Package vuln advisories from OSV.dev: CVEs, severity, fixes, manifest audit. Pay per call via x402.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.
This tool takes no arguments.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
claude mcp add --transport http package-advisories https://x402-package-advisories.microtools-x402.workers.dev/mcp
Free health check. Returns service status, version, tool prices, network and the plain-HTTP x402 endpoints.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Audit up to 50 dependencies in one call (OSV.dev querybatch). Input: items [{ecosystem,name,version}], or packages "npm:[email protected],PyPI:[email protected]", or a manifest: package.json text (dependencies, devDependencies, optionalDependencies; range minimum used) or requirements.txt text (name==version lines). You can also POST the raw package.json or requirements.txt as the body. Returns per-package vulnerable flag, vuln count, max severity, max CVSS v3, recommended upgrade and advisory list (id, CVE, severity, score, summary, fix), plus totals by severity, unique vulns and skipped entries. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Bad input and upstream errors are not charged. Costs $0.01 USDC per call via x402.
| Argument | Type | Description |
|---|---|---|
| items | array | Array of {ecosystem, name, version} (max 50) |
| manifest | string | package.json or requirements.txt text |
| packages | string | Comma list Ecosystem:name@version, e.g. npm:[email protected],PyPI:[email protected] |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"pattern": "^[^\\s]+$",
"maxLength": 214,
"minLength": 1
},
"version": {
"type": "string",
"pattern": "^[^\\s]+$",
"maxLength": 100,
"minLength": 1
},
"ecosystem": {
"type": "string",
"maxLength": 30,
"minLength": 1,
"description": "Package ecosystem: npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex, CRAN, Hackage, SwiftURL, ConanCenter (aliases like pip, cargo, gem, composer accepted)"
}
},
"additionalProperties": false
},
"maxItems": 50,
"minItems": 1,
"description": "Array of {ecosystem, name, version} (max 50)"
},
"manifest": {
"type": "string",
"maxLength": 60000,
"minLength": 2,
"description": "package.json or requirements.txt text"
},
"packages": {
"type": "string",
"maxLength": 8000,
"minLength": 3,
"description": "Comma list Ecosystem:name@version, e.g. npm:[email protected],PyPI:[email protected]"
}
}
}Security advisories for one open-source package version (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex...). Returns a verdict (vulnerable yes/no, vuln count, max severity, max CVSS v3 score, counts by severity, recommended upgrade version re-checked against OSV, latest stable version and whether it is affected) plus every advisory: OSV/GHSA id, CVE aliases, summary, severity label, CVSS v3 score (computed from the vector) and v4 vector, affected ranges, fixed versions, the fix for this version, published/modified dates and references. Duplicate records (GHSA vs PYSEC/GO ids with the same CVE) are merged. Also returns the version's licenses, publish date, deprecation and dependency counts from deps.dev. Omit version to check the latest stable release. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown packages/versions, bad input and upstream errors are not charged. Costs $0.003 USDC per call via x402.
| Argument | Type | Description |
|---|---|---|
| name* | string | Package name, e.g. lodash, django, golang.org/x/net, org.apache.logging.log4j:log4j-core |
| version | string | Exact version, e.g. 4.17.15 (default: latest stable) |
| ecosystem* | string | Package ecosystem: npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex, CRAN, Hackage, SwiftURL, ConanCenter (aliases like pip, cargo, gem, composer accepted) |
| include_withdrawn | boolean | Include withdrawn advisories (default false) |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"pattern": "^[^\\s]+$",
"maxLength": 214,
"minLength": 1,
"description": "Package name, e.g. lodash, django, golang.org/x/net, org.apache.logging.log4j:log4j-core"
},
"version": {
"type": "string",
"pattern": "^[^\\s]+$",
"maxLength": 100,
"minLength": 1,
"description": "Exact version, e.g. 4.17.15 (default: latest stable)"
},
"ecosystem": {
"type": "string",
"maxLength": 30,
"minLength": 1,
"description": "Package ecosystem: npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex, CRAN, Hackage, SwiftURL, ConanCenter (aliases like pip, cargo, gem, composer accepted)"
},
"include_withdrawn": {
"type": "boolean",
"description": "Include withdrawn advisories (default false)"
}
}
}Paid connectivity test: returns ok and a server timestamp. Use it to check that your x402 payment flow works end to end. Costs $0.001 USDC per call via x402.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Full OSV record for one vulnerability id (GHSA-..., CVE-..., PYSEC-..., GO-..., RUSTSEC-..., OSV-...): details, aliases, related ids, every affected package with ranges and versions, references, credits, database_specific fields, plus a normalized severity label and computed CVSS v3 score. Vulnerability data from OSV.dev (CC-BY 4.0); package metadata from deps.dev. Unknown ids and upstream errors are not charged. Costs $0.001 USDC per call via x402.
| Argument | Type | Description |
|---|---|---|
| id* | string | OSV id or CVE alias |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9._:-]{2,80}$",
"description": "OSV id or CVE alias"
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 3, 2026.
No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.
Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.