OSV Vulnerability Database

🚀 OSV MCP Server

An SSE-based MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database. This server allows LLM-driven applications to query vulnerability information for specific software package versions or commits.

🚀 Quick Start

✨ Features

This project implements an SSE-based MCP server with the following features:

1. Query vulnerability information for specific software package versions or commits.
2. Batch query vulnerability information for multiple software packages or commits.
3. Retrieve detailed information about a specific vulnerability by its ID.

📦 Installation

Prerequisites

• Go 1.21 or higher
• Task (Optional, for running tasks)
• ko (Optional, for building container images)

Build from Source

# Clone the repository
git clone https://github.com/StacklokLabs/osv-mcp.git
cd osv-mcp

# Build the server
task build

💻 Usage Examples

MCP Tools

The server provides the following MCP tools:

query_vulnerability

Query vulnerability information for a specific software package version or commit.

Input schema:

{
  "type": "object",
  "properties": {
    "commit": {
      "type": "string",
      "description": "The commit hash to query. If commit is specified, version should not be set."
    },
    "version": {
      "type": "string",
      "description": "The version string to query. If version is specified, commit should not be set."
    },
    "package_name": {
      "type": "string"
    }
  }
}