OSV Database API

A lightweight MCP server for querying software package vulnerability information in the OSV database.

Security Developer tools #Vulnerability Query #Security Tool #CVE Database .Python

rating : 2.5 points

downloads : 7.2K

update time : 2025-04-28

Open Site

Feature Highlights

Supports querying specified Python packages to detect their related CVE (Common Vulnerabilities and Exposures) information and provides detailed vulnerability analysis results.

Use Cases

Suitable for software developers, security researchers, and DevOps engineers to help them quickly identify and manage dependency risks in projects.

Core Advantages

Completely open - source and free; Supports mainstream Python package ecosystems (such as PyPI); Provides detailed vulnerability context information and repair suggestions.

What system requirements do I need to run this server?

Which package ecosystems does this server support?

How can I get detailed vulnerability information?

🚀 OSV Database MCP Server

A lightweight MCP (Model Context Protocol) server for the OSV database API.

Demo

📚 Documentation

📋 Tools Provided

Overview

Property	Details
query_package_cve	List all CVE IDs for a specific software package. You can specify a specific version to get a narrower range of CVE IDs.
query_for_cve_affected	Query an OSV database for a CVE and return all affected versions.
query_for_cve_fix_versions	Query an OSV database for a CVE and return all versions that fix the vulnerability.
get_ecosystems	Query the MCP to get the currently supported ecosystems.

Detailed Description

query_package_cve
- Query an OSV database for a software package and return its CVE IDs.
- Input parameters:
  - package (string, required): The name of the software package to query.
  - version (string, optional): The version of the software package to query. If not specified, all versions are queried.
  - ecosystem (string, optional): The ecosystem to which the package belongs, defaulting to "PyPI" for Python packages.
- Returns a list containing CVE IDs and their detailed information.
query_for_cve_affected
- Query an OSV database for a CVE and return all affected versions.
- Input parameters:
  - cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805").
- Returns a list of strings containing the versions affected by the vulnerability.
query_for_cve_fix_versions
- Query an OSV database for a CVE and return all versions that fix the vulnerability.
- Input parameters:
  - cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805").
- Returns a list of strings containing the fixed versions.
get_ecosystems
- Query the MCP to get all currently supported ecosystems.
- Returns a dictionary with ecosystem names as keys and programming languages/operating systems as values.

⚙️ Prerequisites

Python 3.11 or higher: This project requires Python 3.11 or higher.
```
# Check your Python version
python --version
```
Install uv: A fast Python package installer and dependency manager.
```
pip install uv
```
Or use Homebrew:
```
brew install uv
```

🧪 Tested Environments

[X] Cursor
[X] Claude

📦 Installation

Install via Smithery

npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude

Local Installation

Clone the repository: https://github.com/EdenYavin/OSV-MCP.git
Configure your MCP host (Cursor / Claude Desktop, etc.):

{
  "mcpServers": {
    "osv-mcp": {
      "command": "uv",
      "args": ["--directory", "path-to/OSV-MCP", "run", "osv-server"],
      "env": {}
    }
  }
}