Osv MCP

This project provides a Python - based MCP server for integrating OSV (open - source vulnerability) data with AI assistants or large - language models, and exposes tools and resources through the MCP protocol to enhance the workflows and capabilities of LLMs.

Security Developer tools #Vulnerability analysis #AI integration #MCP protocol #Python service .Python

rating : 2 points

downloads : 15

update time : 2025-04-29

What is the OSV MCP Server?

The OSV MCP Server is an intermediate service that enables AI assistants to query the open - source software vulnerability database (OSV). Through the standardized Model Context Protocol (MCP), AI can obtain the latest security vulnerability information to enhance the accuracy of responses.

How to use the OSV MCP Server?

Simply configure the connection information of the AI assistant (such as Claude), and the AI can automatically acquire the vulnerability query capability. Users do not need to operate the server directly, and all interactions are completed through the AI interface.

Applicable scenarios

When you need AI to help analyze the security risks of software dependencies, check for known vulnerabilities, or obtain repair suggestions, an AI integrated with the OSV MCP Server can provide professional - level security analysis.

Main features

Vulnerability data queryProvides full query capabilities for the OSV database, supporting multi - condition retrieval by software package, version, etc.

Standard protocol integrationAdopts the MCP protocol and is compatible with various AI assistants and large - language models that support this protocol.

Easy deploymentImplemented in Python, with simple dependencies, and can be quickly deployed locally or on a server.

Advantages and limitations

Advantages

Add professional - level security analysis capabilities to AI

Obtain authoritative open - source vulnerability data in real - time

Simple configuration and seamless integration with existing AI workflows

Limitations

Requires the AI assistant to support the MCP protocol

Only provides vulnerability data and does not include automatic generation of repair solutions

Requires simple configuration for first - time use

How to use

Installation preparation

Ensure that Python 3.8+ and the uv package manager are installed on the system.

Get the project code

Clone the repository to the local machine.

Create a virtual environment

Create an independent Python environment for the project to avoid conflicts.

Install dependencies

Install all the Python packages required by the project.

Start the service

Run the server program.

Usage examples

Security audit assistanceWhen developers evaluate the security of project dependencies, they can query known vulnerabilities of specific libraries through AI.

Vulnerability repair decision - makingWhen the security team evaluates the severity of a vulnerability, they can quickly obtain detailed vulnerability information.

Frequently Asked Questions

Which AI assistants support the MCP protocol?

Does it need to be used online?

What is the data update frequency?

Related resources

OSV project official website

Official website of the open - source vulnerability database

MCP protocol description

Technical specification of the Model Context Protocol

uv package manager

Python package management tool used in the project

🚀 OSV MCP Server

This project offers a server based on the MCP (Model Context Protocol) for integrating OSV (Open Source Vulnerabilities) data and tools, and integrating with AI assistants or Large Language Models (LLMs). The server is implemented in Python and exposes tools and resources that can be used by LLMs to enhance their workflows and capabilities.

Claude Desktop Using OSV MCP Server

✨ Features

Exposes OSV-related data through the MCP protocol.
Facilitates connection to MCP-supported AI assistants or LLMs.
Simple Python-based setup.

📋 Prerequisites

Python 3.8+ installed on your system.
uv (Python package manager, Installation Instructions).

📦 Installation

1. Clone the Repository

Clone this repository to your local machine:

git clone https://github.com/your-org/osv-mcp.git
cd osv-mcp

2. Create a Virtual Environment (Recommended)

To prevent dependency conflicts, it is recommended to use a virtual environment:

curl -LsSf https://astral.sh/uv/install.sh | sh
uv venv

3. Install Dependencies

Install the required Python packages using uv:

uv sync

4. Start the MCP Server

Run the following command to start the server:

uv run vulns.py

💻 Usage Examples

Using the MCP Server with AI Assistants and LLMs

The MCP server exposes tools and resources through a locally or network-accessible API. MCP-supported AI assistants or LLMs can connect to one or more MCP servers to extend their capabilities. Once connected, the assistant can call the query_vulnerabilities tool.

Refer to your AI assistant or LLM's documentation for specific instructions on adding or configuring an MCP server.

Using the OSV MCP Server with Claude Desktop

Add the OSV MCP server to the claude_desktop_config.json file.

Edit on Mac or Linux: ~/Library/Application\ Support/Claude/claude_desktop_config.json. Edit on Windows: env:AppData\Claude\claude_desktop_config.json.

Add the OSV MCP server to the configuration file as follows:

{
    "mcpServers": {
        "vulns": {
            "command": "uv",
            "args": [
                "--directory",
                "/ABSOLUTE/PATH/TO/PARENT/FOLDER/osv-mcp",
                "run",
                "vulns.py"
            ]
        }
    }
}