osv-advisory-mcp-server

Osv List Ecosystems

osv_list_ecosystems

Read-onlyIdempotent

Return the supported ecosystem base names for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-10-31. Known base names are case-insensitive. Preserve suffix spelling. Alpine needs a release branch, such as Alpine:v3.17. The list is static and may lag ecosystems added after that date.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "osv_list_ecosystems"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Output Schema

Name	Required	Description
`note`	No	Advisory note about list currency and canonical source.
`error`	No	Present when the call failed. Absent on success.
`ecosystems`	No	Canonical ecosystem base names recognized by osv_query_package and osv_query_batch.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedNov 14, 2026

changedOutput schema / properties / ecosystems / description

Previous value: -"Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query_package and osv_query_batch."New value: +"Canonical ecosystem base names recognized by osv_query_package and osv_query_batch."

Changed6 schema fields changedAug 25, 2026

changedInput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedInput schema / additionalProperties
```
Added value: +false
```

changedOutput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

addedOutput schema / anyOf

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "ecosystems",
+      "note"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

addedOutput schema / properties / error

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode.",
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

removedOutput schema / required

Removed value: -[
-  "ecosystems",
-  "note"
-]

Changed1 schema field changedJun 30, 2026

changedOutput schema / properties / ecosystems / description

Previous value: -"Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query and osv_query_batch."New value: +"Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query_package and osv_query_batch."

First observedMay 31, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and openWorldHint=false, so the safety profile is covered. The description adds value beyond that by disclosing that the list is static, dated (verified 2026-10-31), and may lag newly added ecosystems — a real staleness caveat an agent needs. It does not describe the shape of the returned names beyond the naming rules, but the output schema exists to cover that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the core purpose before the caveats, and every clause carries usable information. There is minor redundancy between "as verified on 2026-10-31" and "The list is static and may lag ecosystems added after that date," which could be merged.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a zero-parameter, read-only enumeration tool with an output schema, so the description only needs to establish what the list is, which tools consume it, and its freshness limits — all of which are present. Nothing an agent needs in order to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; the naming rules given (case-insensitivity, suffix spelling, Alpine branch syntax) describe the returned values rather than inputs, which is useful but outside this dimension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Return the supported ecosystem base names") and immediately scopes it to the two sibling tools that consume it (osv_query_package, osv_query_batch). An agent can distinguish this from osv_get_vulnerability or osv_query_commit without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes clear this is the lookup source for ecosystem names used by the two query tools, and adds practical rules for using the values (case-insensitive base names, preserve suffix spelling, Alpine needs a release branch such as Alpine:v3.17). It stops short of an explicit "call this before querying if you are unsure of the ecosystem name" instruction, so the when-to-invoke decision is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All osv-advisory-mcp-server tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.