OSV MCP

A lightweight MCP server for querying software package vulnerability information in the OSV database.

Security Developer tools #Vulnerability Query #CVE Analysis #Security Tool .Python

rating : 2 points

downloads : 7.4K

update time : 2025-04-28

Open Site

What is the OSV MCP Server?

The OSV MCP Server is a lightweight tool based on the Model Context Protocol (MCP) for querying vulnerability information in the OSV (Open Source Vulnerabilities) database. It helps developers quickly understand the impact scope of specific software packages or vulnerabilities.

How to use the OSV MCP Server?

Through simple command - line operations, you can easily query the vulnerability list of software packages, the affected versions or fixed versions of specific vulnerabilities. Just install and run the server to start using it.

Applicable Scenarios

Suitable for development teams to integrate security checks into the CI/CD process, or for individual developers to quickly assess the security of dependencies during project maintenance.

Main Features

Query vulnerabilities of a software package

Enter the name or version of a software package to get all vulnerability IDs and their details of the package.

Query the affected versions of a vulnerability

Enter a vulnerability ID to get the list of affected software versions.

Query the fixed versions of a vulnerability

Enter a vulnerability ID to get the software versions that have fixed this vulnerability.

Query supported ecosystems

Get all ecosystems supported by the current server and their corresponding programming languages or operating systems.

Advantages

Quickly locate vulnerability information of software packages

Support multiple ecosystems with strong scalability

Easy to integrate into existing workflows

Limitations

Requires Python 3.11 or higher

Has certain dependence on the network environment

How to Use

Install the OSV MCP Server

Ensure that your system has Python 3.11 or higher installed, and then install the server via pip.

Start the server

After entering the server directory, run the following command to start the service.

Execute queries

Use the provided command - line tools to perform vulnerability queries.

Usage Examples

Query vulnerabilities of the numpy software package

Enter numpy as the software package name to get all its vulnerability IDs.

Query the affected versions of the Log4j vulnerability

Enter CVE - 2021 - 44228 to view the affected versions.

Frequently Asked Questions

How to install the OSV MCP Server?

Which ecosystems are supported?

What should I do if I encounter a network connection failure?

Related Resources

GitHub Repository

The official GitHub repository containing source code and documentation.

VibeApp Reviews

User reviews and feedback.

🚀 OSV Database MCP Server

A lightweight MCP (Model Context Protocol) server for the OSV database API, which helps users query CVE information and ecosystem data.

Demo

✨ Features

Overview

Name	Description
query_package_cve	List all CVE IDs for a specific package. You can specify a particular version to get a narrower range of CVE IDs.
query_for_cve_affected	Query a CVE in the OSV database and return all affected versions.
query_for_cve_fix_versions	Query a CVE in the OSV database and return all versions that fix the vulnerability.
get_ecosystems	Query the MCP server to get the currently supported ecosystems.

Detailed Descriptions

query_package_cve
- Query a package in the OSV database and return its CVE IDs.
- Input parameters:
  - package (string, required): The name of the package to query.
  - version (string, optional): The version of the package to query. If not specified, all versions are queried by default.
  - ecosystem (string, optional): The ecosystem to which the package belongs, defaulting to "PyPI" (Python packages).
- Returns a list containing CVE IDs and their detailed information.
query_for_cve_affected
- Query a CVE in the OSV database and return all affected versions.
- Input parameters:
  - cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805").
- Returns a list of strings of affected versions.
query_for_cve_fix_versions
- Query a CVE in the OSV database and return all versions that fix the vulnerability.
- Input parameters:
  - cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805").
- Returns a list of strings of fixed versions.
get_ecosystems
- Query the MCP server to get all currently supported ecosystems.
- Returns a dictionary where the keys are ecosystem names and the values are programming languages / operating systems.

📦 Installation

Prerequisites

Python 3.11 or higher: This project requires Python 3.11 or higher.
```
# Check your Python version
python --version
```
Install uv: A fast Python package installer and resolver.
```
pip install uv
```
Or use Homebrew:
```
brew install uv
```

Installation Steps

Via Smithery:

npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude

Local installation:
1. Clone the repository: https://github.com/EdenYavin/OSV-MCP.git
2. Configure your MCP host (e.g., Cursor / Claude Desktop, etc.):

{
  "mcpServers": {
    "osv-mcp": {
      "command": "uv",
      "args": ["--directory", "path-to/OSV-MCP", "run", "osv-server"],
      "env": {}
    }
  }
}