Back to Browse

Osv MCP Server

Developer ToolsModerate7.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Use this MCP server to OSV open source vulnerability data and package security checks. Tools...

About

Use this MCP server to OSV open source vulnerability data and package security checks. Tools...

Security Report

7.2
Moderate7.2Low Risk

This is a well-designed MCP server for querying OSV vulnerability data with no authentication required (appropriate for a public API). Code is clean, properly validates inputs via Zod, and safely handles API responses. Permissions are narrowly scoped to network HTTP calls to a legitimate public API, matching the server's stated purpose perfectly. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

5 files analyzed · 5 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-mrfentmen-osv-mcp": {
      "args": [
        "-y",
        "osv-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

OSV MCP

Open source vulnerability checks for coding agents. It uses the public OSV.dev API and needs no API key.

Tools

  • check_package checks an ecosystem, package name, and optional version
  • scan_packages checks several package references in one request; parse lockfiles in your client and pass the package list
  • get_vulnerability retrieves a CVE, GHSA, or OSV record

Run

npm install
npm run build
node dist/index.js

The server is read only and uses stdio MCP transport.

Reviews

No reviews yet

Be the first to review this server!