Osv Advisory MCP Server
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Connect it
Settings → Connectors → Add custom connector
URL: https://osv-advisory.caseyjhand.com/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://osv-advisory.caseyjhand.com/mcp{
"mcpServers": {
"osv-advisory-mcp-server": {
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}claude mcp add --transport http osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp{
"servers": {
"osv-advisory-mcp-server": {
"type": "http",
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}{
"mcpServers": {
"osv-advisory-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/osv-advisory-mcp-server@0.2.0"
]
}
}
}claude mcp add osv-advisory-mcp-server -- npx -y @cyanheads/osv-advisory-mcp-server@0.2.04 tools, verified live
osv_list_ecosystemsread-onlyReturn the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches â passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verif
osv_query_packageread-onlyQuery known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying â ecosystem strings are case-sensitive exact matches and an invalid value ret
osv_get_vulnerabilityread-onlyFetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context â eligibility criteria, scope of affected packages,
osv_query_batchread-onlyQuery vulnerabilities for multiple packages in one call â the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary and
Alternatives in Developer Tools
Compare →TLTldrawA
Draw and visually collaborate with your agents on tldraw's canvas.
KLKorean Law MCPA
Korean law: statutes, precedents, ordinances, treaties and citation verification (법제처 API).
EMemailmdA
Render markdown into email-safe HTML, lint drafts for deliverability problems, and preview emails.
SESemioticA
Verified React chart generation: select, validate, repair, render, and inspect charts through MCP.
RRReactive ResumeA
Free open-source resume builder with remote MCP tools for resumes and job applications.
PAPg AiguideA
Comprehensive PostgreSQL documentation and best practices, including ecosystem tools