Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.
One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include "GHSA-" (GitHub), "PYSEC-" (PyPI), "RUSTSEC-" (Rust), "GO-" (Go), "DSA-"/"DLA-" (Debian), "USN-" (Ubuntu), "RHSA-" (Red Hat), and "CVE-". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: "GHSA-29mw-wpgm-hmr9".
Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.
| Argument | Type | Description |
|---|---|---|
| id* | string | One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include "GHSA-" (GitHub), "PYSEC-" (PyPI), "RUSTSEC-" (Rust), "GO-" (Go), "DSA-"/"DLA-" (Debian), "USN-" (Ubuntu), "RHSA-" (Red Hat), and "CVE-". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: "GHSA-29mw-wpgm-hmr9". |
| page | object | Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$",
"description": "One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."
},
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.",
"additionalProperties": false
}
},
"additionalProperties": false
}Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {},
"additionalProperties": false
}Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
| Argument | Type | Description |
|---|---|---|
| page | object | Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision. |
| packages* | array | Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i]. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"packages"
],
"properties": {
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision.",
"additionalProperties": false
},
"packages": {
"type": "array",
"items": {
"anyOf": [
{
"type": "object",
"required": [
"name",
"ecosystem",
"version"
],
"properties": {
"name": {
"type": "string",
"pattern": "\\S",
"description": "Exact package name in its ecosystem."
},
"purl": {
"type": "string",
"description": "Use purl instead of the tuple, never together with name or ecosystem."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact package version, never a range."
},
"ecosystem": {
"type": "string",
"pattern": "\\S",
"description": "Case-sensitive ecosystem identifier from osv_list_ecosystems."
}
},
"description": "Exact package tuple."
},
{
"type": "object",
"required": [
"purl"
],
"properties": {
"purl": {
"type": "string",
"description": "Complete Package URL, such as pkg:pypi/[email protected]. Supply its version either here or separately, exactly once."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact version only when the PURL does not embed one."
}
},
"description": "PURL alternative with exactly one version source.",
"additionalProperties": false
}
],
"description": "One package to audit."
},
"maxItems": 1000,
"minItems": 1,
"description": "Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i]."
}
},
"additionalProperties": false
}Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
| Argument | Type | Description |
|---|---|---|
| page | object | Repeat the original commit with page: overflow.page first, then select path, offset: page.nextOffset and revision: page.revision. |
| commit* | string | Full Git commit hash: 40 SHA-1 or 64 SHA-256 hex characters, case-insensitive. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"commit"
],
"properties": {
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original commit with page: overflow.page first, then select path, offset: page.nextOffset and revision: page.revision.",
"additionalProperties": false
},
"commit": {
"type": "string",
"pattern": "^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$",
"description": "Full Git commit hash: 40 SHA-1 or 64 SHA-256 hex characters, case-insensitive."
}
},
"additionalProperties": false
}Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
| Argument | Type | Description |
|---|---|---|
| name | string | Exact package name in its ecosystem. |
| page | object | Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set. |
| purl | string | PURL alternative to name and ecosystem; supply one embedded or separate version. |
| version | string | Exact package version, never a range. |
| ecosystem |
| string |
| Case-sensitive ecosystem identifier from osv_list_ecosystems. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"name": {
"type": "string",
"pattern": "\\S",
"description": "Exact package name in its ecosystem."
},
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
},
"advisoryId": {
"type": "string",
"maxLength": 1024,
"description": "ID from this query’s advisory list. Retain this ID when continuing its fields with fixes and severity for the original package."
}
},
"description": "Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set.",
"additionalProperties": false
},
"purl": {
"type": "string",
"description": "PURL alternative to name and ecosystem; supply one embedded or separate version."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact package version, never a range."
},
"ecosystem": {
"type": "string",
"pattern": "\\S",
"description": "Case-sensitive ecosystem identifier from osv_list_ecosystems."
}
},
"additionalProperties": false
}