MCP server

Osv Advisory

io.github.cyanheads/osv-advisory-mcp-server

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

5

Token cost

About 3,313 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.osv-advisory-mcp-server]
url = "https://osv-advisory.caseyjhand.com/mcp"

Gemini CLI

{"mcpServers":{"osv-advisory-mcp-server":{"httpUrl":"https://osv-advisory.caseyjhand.com/mcp"}}}

Cursor

{"mcpServers":{"osv-advisory-mcp-server":{"url":"https://osv-advisory.caseyjhand.com/mcp"}}}

VS Code

{"servers":{"osv-advisory-mcp-server":{"type":"http","url":"https://osv-advisory.caseyjhand.com/mcp"}}}

Antigravity

agy mcp add osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"osv-advisory-mcp-server","server_url":"https://osv-advisory.caseyjhand.com/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"osv-advisory-mcp-server","server_url":"https://osv-advisory.caseyjhand.com/mcp"}

Tools

• osv_get_vulnerability ~707 tokens
  Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a v
• osv_list_ecosystems ~200 tokens
  Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an
• osv_query_batch ~987 tokens
  Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the re
• osv_query_commit ~602 tokens
  Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability
• osv_query_package ~817 tokens
  Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for th

Browse

• GitHub tools
• GitHub and code hosting
• Security scanning

Related MCP servers

• Dependency Vulnerability Tracker — package security advisories ($0.01/query)
  Dependency vulns & malicious-package advisories. Register in-session — free testnet funds.
• MCPFax Dev Package Intelligence
  Is this dependency current, licensed, deprecated, or already carrying a CVE?
• DepScout
  Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
• Osv
  OSV.dev (Open Source Vulnerabilities) MCP.
• Devstack
  Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
• Dependency Trust
  Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
• ContrastAPI
  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
• Security Intel MCP
  CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.cyanheads/osv-advisory-mcp-server.svg)](https://aptlynx.net/servers/io.github.cyanheads/osv-advisory-mcp-server)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents