osv-advisory-mcp-server

Osv Get Vulnerability

osv_get_vulnerability

Read-onlyIdempotent

Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "id": "<id>"
    },
    "name": "osv_get_vulnerability"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes	One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include "GHSA-" (GitHub), "PYSEC-" (PyPI), "RUSTSEC-" (Rust), "GO-" (Go), "DSA-"/"DLA-" (Debian), "USN-" (Ubuntu), "RHSA-" (Red Hat), and "CVE-". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: "GHSA-29mw-wpgm-hmr9".
`page`	No	Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.

Output Schema

Name	Required	Description
`id`	No	OSV vulnerability ID.
`page`	No	One bounded page of an addressed normalized node.
`error`	No	Present when the call failed. Absent on success.
`cweIds`	No	CWE weakness classifications (e.g. ["CWE-79"]). Present on GitHub Advisory Database records; empty otherwise.
`aliases`	No	Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score and CISA KEV status.
`details`	No	Full advisory text, typically in Markdown. May include proof-of-concept, reproduction steps, or remediation guidance.
`preview`	No	Compact view; overflow identifies omissions. This is not the complete record.
`related`	No	OSV IDs of related vulnerabilities. Absent when OSV supplies no related list.
`summary`	No	One-line advisory description.
`affected`	No	All affected packages and their version ranges. An advisory may span multiple packages or ecosystems.
`modified`	No	ISO 8601 timestamp of last modification.
`overflow`	No	Transmission overflow disclosure; independent of upstream truncation.
`severity`	No	Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for unscored advisories and for advisories that score each affected package separately.
`upstream`	No	IDs of upstream vulnerabilities covered by this advisory, in OSV order. Use CVE IDs for NVD lookup. Absent when OSV supplies no upstream list.
`published`	No	ISO 8601 timestamp when published.
`withdrawn`	No	ISO 8601 timestamp when this advisory was withdrawn. Present ONLY on withdrawn advisories — a withdrawn record has been retracted and must not be treated as an active vulnerability.
`references`	No	Advisory references — NVD links, patches, vendor advisories, PoC reports.
`schemaVersion`	No	OSV schema version this record conforms to (e.g. "1.7.3").
`severityLabel`	No	Severity label ("LOW", "MODERATE", "HIGH", "CRITICAL") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses every affected package severity entry when the record-level list is empty. Null when no source yields a label.
`severitySource`	No	The severity entry severityLabel was derived from. Null exactly when the label is.

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedNov 14, 2026

addedOutput schema / properties / affected / items / properties / database_specific

Added value: +{
+  "additionalProperties": {},
+  "description": "Affected package metadata published by the advisory database, including nested JSON values.",
+  "type": "object"
+}

addedOutput schema / properties / affected / items / properties / ecosystem_specific

Added value: +{
+  "additionalProperties": {},
+  "description": "Affected package metadata published by the ecosystem, including nested JSON values.",
+  "type": "object"
+}

addedOutput schema / properties / related

Added value: +{
+  "description": "OSV IDs of related vulnerabilities. Absent when OSV supplies no related list.",
+  "items": {
+    "description": "Related vulnerability ID.",
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / upstream

Added value: +{
+  "description": "IDs of upstream vulnerabilities covered by this advisory, in OSV order. Use CVE IDs for NVD lookup. Absent when OSV supplies no upstream list.",
+  "items": {
+    "description": "Upstream vulnerability ID.",
+    "type": "string"
+  },
+  "type": "array"
+}

Changed9 schema fields changedOct 19, 2026

changedInput schema / properties / page / description

Previous value: -"Retrieve an announced pointer; repeat id and continue with nextOffset and revision."New value: +"Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision."

changedInput schema / properties / page / properties / offset / description

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

changedInput schema / properties / page / properties / path / description

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

changedInput schema / properties / page / properties / revision / description

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

changedOutput schema / properties / aliases / description

Previous value: -"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score, EPSS exploitation probability, and CISA KEV status."New value: +"Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score and CISA KEV status."

changedOutput schema / properties / overflow / properties / page / description

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

changedOutput schema / properties / overflow / properties / page / properties / offset / description

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

changedOutput schema / properties / overflow / properties / page / properties / path / description

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

changedOutput schema / properties / overflow / properties / page / properties / revision / description

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Changed7 schema fields changedOct 14, 2026

addedInput schema / properties / page

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve an announced pointer; repeat id and continue with nextOffset and revision.",
+  "properties": {
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

changedOutput schema / anyOf

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "severitySource",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

changedOutput schema / properties / error / properties / data / properties / reason / description

Previous value: -"Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."

changedOutput schema / properties / error / properties / data / properties / reason / examples

Previous value: -[
-  "vulnerability_not_found"
-]New value: +[
+  "invalid_page_path",
+  "stale_page_revision",
+  "vulnerability_not_found"
+]

addedOutput schema / properties / overflow

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / page

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / preview

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Changed12 schema fields changedSep 24, 2026

changedInput schema / properties / id / description

Previous value: -"OSV vulnerability ID. Accepts any prefix: \"GHSA-\" (GitHub), \"PYSEC-\" (Python), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"CVE-\" (fallback direct lookups). Example: \"GHSA-29mw-wpgm-hmr9\"."New value: +"One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."

removedInput schema / properties / id / minLength
```
Removed value: -1
```

changedInput schema / properties / id / pattern

Previous value: -"\\S"New value: +"^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$"

changedOutput schema / anyOf

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "id",
-      "summary",
-      "details",
-      "aliases",
-      "published",
-      "modified",
-      "severity",
-      "severityLabel",
-      "affected",
-      "cweIds",
-      "references",
-      "schemaVersion"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "severitySource",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

changedOutput schema / properties / affected / items / properties / ranges / items / properties / fixed / description

Previous value: -"First safe version (convenience view — the last \"fixed\" event; see events[])."New value: +"The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."

addedOutput schema / properties / affected / items / properties / severity

Added value: +{
+  "description": "Severity entries scoped to this package. Present only when the advisory scores packages separately; the record-level severity is then empty.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One package-level severity entry.",
+    "properties": {
+      "score": {
+        "description": "CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\".",
+        "type": "string"
+      },
+      "type": {
+        "description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\".",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "score"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / properties / severity / description

Previous value: -"CVSS severity entries. Empty for unscored advisories."New value: +"Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for unscored advisories and for advisories that score each affected package separately."

changedOutput schema / properties / severity / items / description

Previous value: -"One CVSS severity entry."New value: +"One record-level severity entry."

changedOutput schema / properties / severity / items / properties / score / description

Previous value: -"CVSS vector string."New value: +"CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."

changedOutput schema / properties / severity / items / properties / type / description

Previous value: -"CVSS version: \"CVSS_V3\", \"CVSS_V4\", or \"CVSS_V2\"."New value: +"Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."

changedOutput schema / properties / severityLabel / description

Previous value: -"Human-readable severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\"). Present on GHSA-sourced records; null when not available."New value: +"Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses every affected package severity entry when the record-level list is empty. Null when no source yields a label."

addedOutput schema / properties / severitySource

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "computedScore": {
+          "description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources.",
+          "type": "number"
+        },
+        "score": {
+          "description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector.",
+          "enum": [
+            "database_specific",
+            "Ubuntu",
+            "CVSS_V3",
+            "CVSS_V4"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "score"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "The severity entry severityLabel was derived from. Null exactly when the label is."
+}

Changed2 schema fields changedSep 20, 2026
- removedOutput schema / properties / severityLabel / anyOf
```
Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]
```
- addedOutput schema / properties / severityLabel / type
```
Added value: +[
+  "string",
+  "null"
+]
```

Changed6 schema fields changedAug 25, 2026

changedInput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedInput schema / additionalProperties
```
Added value: +false
```

changedOutput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedOutput schema / anyOf

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "id",
+      "summary",
+      "details",
+      "aliases",
+      "published",
+      "modified",
+      "severity",
+      "severityLabel",
+      "affected",
+      "cweIds",
+      "references",
+      "schemaVersion"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

addedOutput schema / properties / error

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode. Declared by this tool: `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler.",
+          "examples": [
+            "vulnerability_not_found"
+          ],
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

removedOutput schema / required

Removed value: -[
-  "id",
-  "summary",
-  "details",
-  "aliases",
-  "published",
-  "modified",
-  "severity",
-  "severityLabel",
-  "affected",
-  "cweIds",
-  "references",
-  "schemaVersion"
-]

Changed2 schema fields changedJul 11, 2026
- addedInput schema / properties / id / minLength
```
Added value: +1
```
- addedInput schema / properties / id / pattern
```
Added value: +"\\S"
```

Changed9 schema fields changedJul 11, 2026

changedOutput schema / properties / affected / items / properties / ecosystem / description

Previous value: -"Affected package ecosystem."New value: +"Affected package ecosystem. Empty for source-only advisories."

changedOutput schema / properties / affected / items / properties / packageName / description

Previous value: -"Affected package name."New value: +"Affected package name. Empty for source-only advisories (GIT ranges with no package identity)."

addedOutput schema / properties / affected / items / properties / ranges / items / properties / events

Added value: +{
+  "description": "Ordered event boundaries defining the affected interval(s) — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse.",
+  "items": {
+    "additionalProperties": false,
+    "description": "One ordered range event.",
+    "properties": {
+      "type": {
+        "description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\".",
+        "type": "string"
+      },
+      "value": {
+        "description": "Version string or commit identifier at this boundary.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "value"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedOutput schema / properties / affected / items / properties / ranges / items / properties / fixed / description

Previous value: -"First safe version."New value: +"First safe version (convenience view — the last \"fixed\" event; see events[])."

changedOutput schema / properties / affected / items / properties / ranges / items / properties / introduced / description

Previous value: -"First affected version."New value: +"First affected version (convenience view — the last \"introduced\" event; see events[] for full interval order)."

changedOutput schema / properties / affected / items / properties / ranges / items / properties / lastAffected / description

Previous value: -"Last affected version when no fix exists."New value: +"Last affected version when no fix exists (convenience view — see events[])."

addedOutput schema / properties / affected / items / properties / ranges / items / properties / repo

Added value: +{
+  "description": "Source repository URL for GIT ranges. Absent on version ranges.",
+  "type": "string"
+}

addedOutput schema / properties / affected / items / properties / versions

Added value: +{
+  "description": "Explicit affected versions enumerated by the advisory. Absent or empty when affected versions are expressed only as ranges.",
+  "items": {
+    "description": "An explicitly-listed affected version.",
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / withdrawn

Added value: +{
+  "description": "ISO 8601 timestamp when this advisory was withdrawn. Present ONLY on withdrawn advisories — a withdrawn record has been retracted and must not be treated as an active vulnerability.",
+  "type": "string"
+}

First observedMay 31, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and open-world, so safety is covered; the description goes further by disclosing that every page is a fresh lookup, that a changed node must be restarted without a revision, and that overflow and upstream truncation are distinct conditions that do not imply a clean result. The remaining deduction is for jargon-heavy phrasing ("Transmission overflow and upstream truncation are separate") that an agent may struggle to operationalize without more context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose and the when-to-use clause are front-loaded in the first two sentences, with pagination mechanics relegated to the tail. The tail is dense and a few clauses are compressed to the point of ambiguity, but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with a full output schema and complete annotations, the description covers the decision context (when to fetch a full record) and the non-obvious multi-call continuation protocol. Its only redundancy is re-listing return fields, which the output schema already carries.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description exceeds that by specifying an ordering protocol across the two parameters — repeat the original id with page: overflow.page first, then step path/offset/revision together, and start deferred child paths at offset zero without a revision. That sequencing is not spelled out in the schema beyond per-field hints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Fetch the full advisory record for an OSV vulnerability ID") and enumerates the record contents. It also positions itself against siblings by naming osv_query_package and osv_query_batch as the producers of the ID, so an agent can distinguish lookup from discovery without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger condition ("Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context") plus the goal that motivates it (affected packages or remediation guidance). It also supplies concrete continuation rules for pagination and deferred child paths, including a clear prohibition ("Do not pass the output page object as input").

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All osv-advisory-mcp-server tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.