MCP Osv

🚀 MCP Security Analyst

A server that adheres to the Model Context Protocol (MCP), integrating the OSV.dev database and AI models to help identify and analyze potential vulnerabilities in code.

✨ Features

• Conduct vulnerability checks using the OSV.dev database.
• Provide basic code security analysis capabilities.
• Integrate with AI models to offer security insights.
• Support the MCP protocol for seamless connection with various AI tools.
• Optionally perform static code analysis (if Semgrep is installed).

📦 Installation

Core Requirements

make deps
make install

Optional: Semgrep Installation

To enhance the static code analysis capabilities, you can install Semgrep:

macOS

brew install semgrep

Linux

python3 -m pip install semgrep

Other Platforms

Please refer to the Semgrep Installation Guide for detailed instructions.

The MCP server can run normally even if Semgrep is not installed, but it will skip the static code analysis step when analyzing directories.

Installation Steps

make deps
make install

The mcp-osv command will be installed in the PATH and use the standard input-output method.

Configure your LLM to use mcp-osv as a proxy.

💻 Usage Examples

Tools Provided by the Server

check_vulnerabilities

Check for known vulnerabilities in dependencies using the OSV.dev database.

Parameters:

• package_name: The name of the package to check.
• version: The version of the package to check.

analyze_security

Analyze potential security issues in the code based on https://osv.dev.

Parameters:

• file_path: The path of the file to analyze.

Integration with AI Models

This server is designed to connect with AI models such as Claude and Cursor through the MCP protocol. AI models can use the provided tools to:

1. Check for known vulnerabilities in dependencies.
2. Analyze the security of the code.
3. Provide suggestions for security improvements.

Connection with Cursor

Example Output

Usage Method

Refer to mcp.json-template for an example of using it with the Cursor IDE.

After completing the setup, restart and perform operations like:

# Check for vulnerabilities in a package
"Check for vulnerabilities in the 'express' package version '4.17.1'"

# Analyze the security of a specific file
"Analyze the security of the 'file_name' file"

Connection with Claude

Here is a complete example of a configuration file:

{
    "mcp": {
        "servers": [
            {
                "name": "security_analyzer",
                "host": "localhost",
                "port": 5005,
                "secret": "your-secret-token"
            }
        ]
    }
}

Debugging

In VSCode, use the developer tools:

# Open the developer tools
Ctrl+Shift+I or Cmd+Shift+I

# Access the console
F12 or Cmd+Alt+I

Example bash commands to test the security analysis capabilities:

# Check for vulnerabilities
$ mcp check_vulnerabilities --package_name=example-package --version=1.0.0

# Analyze a file
$ mcp analyze_security --file_path=/path/to/your/file

Development

To add new security analysis features, follow these steps:

1. Create a new analyzer class in the analyzers folder.
2. Implement the required vulnerability detection and repair suggestion methods.
3. Update setup.py to include the new analyzer.

Refer to GitHub Link for more information.

📄 License

MIT