Skip to main content
Glama

Osv Query Batch

osv_query_batch
Read-onlyIdempotent

Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Submit up to 5000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. The first 1000 entries are processed. Follow summary.nextInputOffset to submit the remaining slice. Pass a row's nextCursor as cursor to osv_query_package with that row's identifier. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "packages": "<packages>"
    },
    "name": "osv_query_batch"
  }
}

Input Schema

NameRequiredDescriptionDefault
pageNoRepeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision.
packagesYesPackages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i].

Output Schema

NameRequiredDescriptionDefault
pageNoOne bounded page of an addressed normalized node.
errorNoPresent when the call failed. Absent on success.
noticeNoPresent on all-clean or all-errors batches — the aggregate outcome for content-only clients.
previewNoCompact view; overflow identifies omissions. This is not the complete record.
resultsNoPer-package results, positionally matching the input array.
summaryNoAggregate statistics across the full batch.
overflowNoTransmission overflow disclosure; independent of upstream truncation.
nextCursorNoResume this row through osv_query_package with its original identifier and this value as cursor.
effectiveQueryNoCompact scan summary (package and outcome counts), echoed on edge-case batches for content-only clients.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • changedInput schema / properties / packages / items / anyOf
      Previous value: -[
      -  {
      -    "description": "Exact package tuple.",
      -    "properties": {
      -      "ecosystem": {
      -        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      },
      -      "name": {
      -        "description": "Exact package name in its ecosystem.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      },
      -      "purl": {
      -        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
      -        "type": "string"
      -      },
      -      "version": {
      -        "description": "Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      }
      -    },
      -    "required": [
      -      "name",
      -      "ecosystem",
      -      "version"
      -    ],
      -    "type": "object"
      -  },
      -  {
      -    "additionalProperties": false,
      -    "description": "PURL alternative with exactly one version source.",
      -    "properties": {
      -      "purl": {
      -        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
      -        "type": "string"
      -      },
      -      "version": {
      -        "description": "Exact installed version only when the PURL does not embed one; the same ecosystem-specific version rules apply.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      }
      -    },
      -    "required": [
      -      "purl"
      -    ],
      -    "type": "object"
      -  }
      -]New value: +[
      +  {
      +    "description": "Exact package tuple.",
      +    "properties": {
      +      "ecosystem": {
      +        "description": "Ecosystem identifier from osv_list_ecosystems. Known base names are case-insensitive. Preserve suffix spelling.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "name": {
      +        "description": "Exact package name in its ecosystem.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "purl": {
      +        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "name",
      +      "ecosystem",
      +      "version"
      +    ],
      +    "type": "object"
      +  },
      +  {
      +    "additionalProperties": false,
      +    "description": "PURL alternative with exactly one version source.",
      +    "properties": {
      +      "purl": {
      +        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact installed version only when the PURL does not embed one; the same ecosystem-specific version rules apply.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "purl"
      +    ],
      +    "type": "object"
      +  }
      +]
    • changedOutput schema / properties / results / items / properties / ecosystem / description
      Previous value: -"Ecosystem from input."New value: +"Effective ecosystem when the identifier resolves."
    • changedOutput schema / properties / results / items / properties / name / description
      Previous value: -"Package name from input."New value: +"Effective package name when the identifier resolves."
    • changedOutput schema / properties / results / items / properties / purl / description
      Previous value: -"Original PURL when supplied; name, ecosystem and version show its effective coordinate on success."New value: +"Original PURL when supplied, including when the identifier cannot be resolved."
    • changedOutput schema / properties / results / items / properties / version / description
      Previous value: -"Version from input."New value: +"Effective version when the identifier resolves."
    • addedOutput schema / properties / results / items / properties / vulns / items / properties / upstream
      Added value: +{
      +  "description": "IDs of upstream vulnerabilities covered by this advisory, in OSV order. Use CVE IDs for NVD lookup. Absent when OSV supplies no upstream list.",
      +  "items": {
      +    "description": "Upstream vulnerability ID.",
      +    "type": "string"
      +  },
      +  "type": "array"
      +}
  2. Changed9 schema fields changed
    • changedInput schema / properties / packages / maxItems
      Previous value: -1000New value: +5000
    • addedOutput schema / properties / nextCursor
      Added value: +{
      +  "description": "Resume this row through osv_query_package with its original identifier and this value as cursor.",
      +  "type": "string"
      +}
    • addedOutput schema / properties / results / items / properties / nextCursor
      Added value: +{
      +  "description": "Resume this row through osv_query_package with its original identifier and this value as cursor.",
      +  "type": "string"
      +}
    • changedOutput schema / properties / results / items / properties / truncated / description
      Previous value: -"True when OSV paginated beyond the fetch cap for this package — its result may be INCOMPLETE. A truncated row with no vulnerabilities is NOT confirmed clean."New value: +"True when upstream matching did not finish within the page cap or deadline. A truncated row with no vulnerabilities is not confirmed clean."
    • addedOutput schema / properties / summary / properties / inputRemainder
      Added value: +{
      +  "description": "Instructions to submit the unprocessed input separately.",
      +  "type": "string"
      +}
    • addedOutput schema / properties / summary / properties / nextInputOffset
      Added value: +{
      +  "description": "Zero-based start of the unprocessed input, or null when all input was processed.",
      +  "type": [
      +    "number",
      +    "null"
      +  ]
      +}
    • addedOutput schema / properties / summary / properties / submittedPackages
      Added value: +{
      +  "description": "Number of packages in the original submission.",
      +  "type": "number"
      +}
    • addedOutput schema / properties / summary / properties / unprocessedCount
      Added value: +{
      +  "description": "Submitted packages outside the processed prefix.",
      +  "type": "number"
      +}
    • changedOutput schema / properties / summary / required
      Previous value: -[
      -  "totalPackages",
      -  "vulnerableCount",
      -  "cleanCount",
      -  "truncatedCount",
      -  "errorCount",
      -  "vulnerableRows",
      -  "errorRows",
      -  "truncatedRows",
      -  "totalVulns",
      -  "worstSeverity"
      -]New value: +[
      +  "totalPackages",
      +  "submittedPackages",
      +  "unprocessedCount",
      +  "nextInputOffset",
      +  "vulnerableCount",
      +  "cleanCount",
      +  "truncatedCount",
      +  "errorCount",
      +  "vulnerableRows",
      +  "errorRows",
      +  "truncatedRows",
      +  "totalVulns",
      +  "worstSeverity"
      +]
  3. Changed5 schema fields changed
    • changedInput schema / properties / packages / items / anyOf
      Previous value: -[
      -  {
      -    "description": "Exact package tuple.",
      -    "properties": {
      -      "ecosystem": {
      -        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      },
      -      "name": {
      -        "description": "Exact package name in its ecosystem.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      },
      -      "purl": {
      -        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
      -        "type": "string"
      -      },
      -      "version": {
      -        "description": "Exact package version, never a range.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      }
      -    },
      -    "required": [
      -      "name",
      -      "ecosystem",
      -      "version"
      -    ],
      -    "type": "object"
      -  },
      -  {
      -    "additionalProperties": false,
      -    "description": "PURL alternative with exactly one version source.",
      -    "properties": {
      -      "purl": {
      -        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
      -        "type": "string"
      -      },
      -      "version": {
      -        "description": "Exact version only when the PURL does not embed one.",
      -        "pattern": "\\S",
      -        "type": "string"
      -      }
      -    },
      -    "required": [
      -      "purl"
      -    ],
      -    "type": "object"
      -  }
      -]New value: +[
      +  {
      +    "description": "Exact package tuple.",
      +    "properties": {
      +      "ecosystem": {
      +        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "name": {
      +        "description": "Exact package name in its ecosystem.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "purl": {
      +        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "name",
      +      "ecosystem",
      +      "version"
      +    ],
      +    "type": "object"
      +  },
      +  {
      +    "additionalProperties": false,
      +    "description": "PURL alternative with exactly one version source.",
      +    "properties": {
      +      "purl": {
      +        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact installed version only when the PURL does not embed one; the same ecosystem-specific version rules apply.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "purl"
      +    ],
      +    "type": "object"
      +  }
      +]
    • addedOutput schema / properties / summary / properties / errorRows
      Added value: +{
      +  "description": "Ascending indices of errored rows; may overlap truncatedRows.",
      +  "items": {
      +    "description": "Zero-based original input index.",
      +    "maximum": 9007199254740991,
      +    "minimum": -9007199254740991,
      +    "type": "integer"
      +  },
      +  "type": "array"
      +}
    • addedOutput schema / properties / summary / properties / truncatedRows
      Added value: +{
      +  "description": "Ascending indices of upstream-truncated rows, including vulnerable and errored rows.",
      +  "items": {
      +    "description": "Zero-based original input index.",
      +    "maximum": 9007199254740991,
      +    "minimum": -9007199254740991,
      +    "type": "integer"
      +  },
      +  "type": "array"
      +}
    • addedOutput schema / properties / summary / properties / vulnerableRows
      Added value: +{
      +  "description": "Ascending indices of vulnerable rows; may overlap truncatedRows.",
      +  "items": {
      +    "description": "Zero-based original input index.",
      +    "maximum": 9007199254740991,
      +    "minimum": -9007199254740991,
      +    "type": "integer"
      +  },
      +  "type": "array"
      +}
    • changedOutput schema / properties / summary / required
      Previous value: -[
      -  "totalPackages",
      -  "vulnerableCount",
      -  "cleanCount",
      -  "truncatedCount",
      -  "errorCount",
      -  "totalVulns",
      -  "worstSeverity"
      -]New value: +[
      +  "totalPackages",
      +  "vulnerableCount",
      +  "cleanCount",
      +  "truncatedCount",
      +  "errorCount",
      +  "vulnerableRows",
      +  "errorRows",
      +  "truncatedRows",
      +  "totalVulns",
      +  "worstSeverity"
      +]
  4. Changed14 schema fields changed
    • addedInput schema / properties / packages / items / anyOf
      Added value: +[
      +  {
      +    "description": "Exact package tuple.",
      +    "properties": {
      +      "ecosystem": {
      +        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "name": {
      +        "description": "Exact package name in its ecosystem.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      },
      +      "purl": {
      +        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact package version, never a range.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "name",
      +      "ecosystem",
      +      "version"
      +    ],
      +    "type": "object"
      +  },
      +  {
      +    "additionalProperties": false,
      +    "description": "PURL alternative with exactly one version source.",
      +    "properties": {
      +      "purl": {
      +        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
      +        "type": "string"
      +      },
      +      "version": {
      +        "description": "Exact version only when the PURL does not embed one.",
      +        "pattern": "\\S",
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "purl"
      +    ],
      +    "type": "object"
      +  }
      +]
    • removedInput schema / properties / packages / items / properties
      Removed value: -{
      -  "ecosystem": {
      -    "description": "Ecosystem identifier. Case-sensitive exact match. Use osv_list_ecosystems to validate.",
      -    "pattern": "\\S",
      -    "type": "string"
      -  },
      -  "name": {
      -    "description": "Package name as it appears in the ecosystem.",
      -    "pattern": "\\S",
      -    "type": "string"
      -  },
      -  "version": {
      -    "description": "Exact version string to check.",
      -    "pattern": "\\S",
      -    "type": "string"
      -  }
      -}
    • removedInput schema / properties / packages / items / required
      Removed value: -[
      -  "name",
      -  "ecosystem",
      -  "version"
      -]
    • removedInput schema / properties / packages / items / type
      Removed value: -"object"
    • changedInput schema / properties / page / description
      Previous value: -"Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array."New value: +"Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision."
    • changedInput schema / properties / page / properties / offset / description
      Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
    • changedInput schema / properties / page / properties / path / description
      Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
    • changedInput schema / properties / page / properties / revision / description
      Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
    • changedOutput schema / properties / overflow / properties / page / description
      Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."
    • changedOutput schema / properties / overflow / properties / page / properties / offset / description
      Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
    • changedOutput schema / properties / overflow / properties / page / properties / path / description
      Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
    • changedOutput schema / properties / overflow / properties / page / properties / revision / description
      Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
    • addedOutput schema / properties / results / items / properties / purl
      Added value: +{
      +  "description": "Original PURL when supplied; name, ecosystem and version show its effective coordinate on success.",
      +  "type": "string"
      +}
    • changedOutput schema / properties / results / items / properties / vulns / items / properties / aliases / description
      Previous value: -"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS/KEV/EPSS context."New value: +"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."
  5. Changed7 schema fields changed
    • addedInput schema / properties / page
      Added value: +{
      +  "additionalProperties": false,
      +  "description": "Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array.",
      +  "properties": {
      +    "offset": {
      +      "default": 0,
      +      "description": "Entry offset, or Unicode code-point offset for text.",
      +      "maximum": 9007199254740991,
      +      "minimum": 0,
      +      "type": "integer"
      +    },
      +    "path": {
      +      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
      +      "maxLength": 1024,
      +      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
      +      "type": "string"
      +    },
      +    "revision": {
      +      "description": "Revision returned for this node; omit on first retrieval.",
      +      "pattern": "^[a-f0-9]{64}$",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "path"
      +  ],
      +  "type": "object"
      +}
    • changedOutput schema / anyOf
      Previous value: -[
      -  {
      -    "not": {
      -      "required": [
      -        "error"
      -      ]
      -    },
      -    "required": [
      -      "results",
      -      "summary"
      -    ]
      -  },
      -  {
      -    "required": [
      -      "error"
      -    ]
      -  }
      -]New value: +[
      +  {
      +    "not": {
      +      "required": [
      +        "error"
      +      ]
      +    }
      +  },
      +  {
      +    "required": [
      +      "error"
      +    ]
      +  }
      +]
    • changedOutput schema / properties / error / properties / data / properties / reason / description
      Previous value: -"Machine-readable failure mode."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node or input order changed. Other values are possible when a failure originates below the handler."
    • addedOutput schema / properties / error / properties / data / properties / reason / examples
      Added value: +[
      +  "invalid_page_path",
      +  "stale_page_revision"
      +]
    • addedOutput schema / properties / overflow
      Added value: +{
      +  "additionalProperties": false,
      +  "description": "Transmission overflow disclosure; independent of upstream truncation.",
      +  "properties": {
      +    "complete": {
      +      "description": "Complete top-level fields retained in this response.",
      +      "items": {
      +        "type": "string"
      +      },
      +      "type": "array"
      +    },
      +    "notice": {
      +      "description": "Transmission omission and fresh re-fetch semantics.",
      +      "type": "string"
      +    },
      +    "omitted": {
      +      "description": "Omitted values, all addressable through page.path.",
      +      "items": {
      +        "additionalProperties": false,
      +        "description": "An oversized child; parent offset advances past this descriptor.",
      +        "properties": {
      +          "path": {
      +            "description": "Exact child pointer to retrieve separately.",
      +            "type": "string"
      +          },
      +          "total": {
      +            "description": "Number of child entries or Unicode code points; one for scalars.",
      +            "type": "number"
      +          },
      +          "type": {
      +            "description": "Child value kind.",
      +            "enum": [
      +              "array",
      +              "object",
      +              "string",
      +              "scalar"
      +            ],
      +            "type": "string"
      +          }
      +        },
      +        "required": [
      +          "path",
      +          "type",
      +          "total"
      +        ],
      +        "type": "object"
      +      },
      +      "type": "array"
      +    },
      +    "page": {
      +      "additionalProperties": false,
      +      "description": "First retrieval arguments; repeat the original tool input.",
      +      "properties": {
      +        "offset": {
      +          "default": 0,
      +          "description": "Entry offset, or Unicode code-point offset for text.",
      +          "maximum": 9007199254740991,
      +          "minimum": 0,
      +          "type": "integer"
      +        },
      +        "path": {
      +          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
      +          "maxLength": 1024,
      +          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
      +          "type": "string"
      +        },
      +        "revision": {
      +          "description": "Revision returned for this node; omit on first retrieval.",
      +          "pattern": "^[a-f0-9]{64}$",
      +          "type": "string"
      +        }
      +      },
      +      "required": [
      +        "path",
      +        "offset"
      +      ],
      +      "type": "object"
      +    }
      +  },
      +  "required": [
      +    "complete",
      +    "omitted",
      +    "page",
      +    "notice"
      +  ],
      +  "type": "object"
      +}
    • addedOutput schema / properties / page
      Added value: +{
      +  "additionalProperties": false,
      +  "description": "One bounded page of an addressed normalized node.",
      +  "properties": {
      +    "entries": {
      +      "description": "Source-order entries for arrays, objects and scalars.",
      +      "items": {
      +        "additionalProperties": false,
      +        "description": "One source entry, complete or deferred.",
      +        "properties": {
      +          "deferred": {
      +            "additionalProperties": false,
      +            "description": "Retrievable child descriptor when its value does not fit.",
      +            "properties": {
      +              "path": {
      +                "description": "Exact child pointer to retrieve separately.",
      +                "type": "string"
      +              },
      +              "total": {
      +                "description": "Number of child entries or Unicode code points; one for scalars.",
      +                "type": "number"
      +              },
      +              "type": {
      +                "description": "Child value kind.",
      +                "enum": [
      +                  "array",
      +                  "object",
      +                  "string",
      +                  "scalar"
      +                ],
      +                "type": "string"
      +              }
      +            },
      +            "required": [
      +              "path",
      +              "type",
      +              "total"
      +            ],
      +            "type": "object"
      +          },
      +          "key": {
      +            "description": "Object key or original array index.",
      +            "type": "string"
      +          },
      +          "value": {
      +            "description": "Complete child value, unmodified."
      +          }
      +        },
      +        "required": [
      +          "key"
      +        ],
      +        "type": "object"
      +      },
      +      "type": "array"
      +    },
      +    "nextOffset": {
      +      "description": "Next offset, strictly greater or null when finished.",
      +      "type": [
      +        "number",
      +        "null"
      +      ]
      +    },
      +    "notice": {
      +      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
      +      "type": "string"
      +    },
      +    "offset": {
      +      "description": "Starting entry or code-point offset.",
      +      "type": "number"
      +    },
      +    "path": {
      +      "description": "Addressed JSON pointer.",
      +      "type": "string"
      +    },
      +    "revision": {
      +      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
      +      "type": "string"
      +    },
      +    "text": {
      +      "description": "Verbatim Unicode code-point slice for strings.",
      +      "type": "string"
      +    },
      +    "total": {
      +      "description": "Total entries or Unicode code points.",
      +      "type": "number"
      +    },
      +    "type": {
      +      "description": "Addressed value kind.",
      +      "enum": [
      +        "array",
      +        "object",
      +        "string",
      +        "scalar"
      +      ],
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "path",
      +    "type",
      +    "offset",
      +    "total",
      +    "nextOffset",
      +    "revision",
      +    "notice"
      +  ],
      +  "type": "object"
      +}
    • addedOutput schema / properties / preview
      Added value: +{
      +  "additionalProperties": {},
      +  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
      +  "propertyNames": {
      +    "type": "string"
      +  },
      +  "type": "object"
      +}
  6. Changed6 schema fields changed
    • removedInput schema / properties / packages / items / properties / ecosystem / minLength
      Removed value: -1
    • removedInput schema / properties / packages / items / properties / name / minLength
      Removed value: -1
    • removedInput schema / properties / packages / items / properties / version / minLength
      Removed value: -1
    • changedOutput schema / properties / results / items / properties / vulns / items / properties / fixedVersions / description
      Previous value: -"First safe version(s) to upgrade to. Empty if no fix exists."New value: +"Every fixed version the advisory lists for this row's package, in record order — one per affected interval, typically one per release line. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."
    • changedOutput schema / properties / results / items / properties / vulns / items / properties / fixedVersions / items / description
      Previous value: -"A first-safe version string."New value: +"A version that fixes the vulnerability for this package."
    • changedOutput schema / properties / results / items / properties / vulns / items / properties / severityLabel / description
      Previous value: -"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null."New value: +"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null. Same derivation as osv_query_package: database_specific.severity, then an Ubuntu priority, then the highest CVSS v3/v4 score, using this row's package-level severity entries when the record has none."
  7. Changed6 schema fields changed
    • removedOutput schema / properties / results / items / properties / error / anyOf
      Removed value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]
    • addedOutput schema / properties / results / items / properties / error / type
      Added value: +[
      +  "string",
      +  "null"
      +]
    • removedOutput schema / properties / results / items / properties / vulns / items / properties / severityLabel / anyOf
      Removed value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]
    • addedOutput schema / properties / results / items / properties / vulns / items / properties / severityLabel / type
      Added value: +[
      +  "string",
      +  "null"
      +]
    • removedOutput schema / properties / summary / properties / worstSeverity / anyOf
      Removed value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]
    • addedOutput schema / properties / summary / properties / worstSeverity / type
      Added value: +[
      +  "string",
      +  "null"
      +]
  8. Changed6 schema fields changed
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • addedInput schema / additionalProperties
      Added value: +false
    • changedOutput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • addedOutput schema / anyOf
      Added value: +[
      +  {
      +    "not": {
      +      "required": [
      +        "error"
      +      ]
      +    },
      +    "required": [
      +      "results",
      +      "summary"
      +    ]
      +  },
      +  {
      +    "required": [
      +      "error"
      +    ]
      +  }
      +]
    • addedOutput schema / properties / error
      Added value: +{
      +  "additionalProperties": {},
      +  "description": "Present when the call failed. Absent on success.",
      +  "properties": {
      +    "code": {
      +      "description": "JSON-RPC error code for this failure.",
      +      "maximum": 9007199254740991,
      +      "minimum": -9007199254740991,
      +      "type": "integer"
      +    },
      +    "data": {
      +      "additionalProperties": {},
      +      "properties": {
      +        "reason": {
      +          "description": "Machine-readable failure mode.",
      +          "type": "string"
      +        },
      +        "recovery": {
      +          "additionalProperties": {},
      +          "description": "Actionable next step for the caller.",
      +          "properties": {
      +            "hint": {
      +              "type": "string"
      +            }
      +          },
      +          "required": [
      +            "hint"
      +          ],
      +          "type": "object"
      +        },
      +        "retryable": {
      +          "description": "Whether retrying may succeed.",
      +          "type": "boolean"
      +        }
      +      },
      +      "type": "object"
      +    },
      +    "message": {
      +      "description": "Human-readable description of what went wrong.",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "code",
      +    "message"
      +  ],
      +  "type": "object"
      +}
    • removedOutput schema / required
      Removed value: -[
      -  "results",
      -  "summary"
      -]
  9. Changed6 schema fields changed
    • addedInput schema / properties / packages / items / properties / ecosystem / minLength
      Added value: +1
    • addedInput schema / properties / packages / items / properties / ecosystem / pattern
      Added value: +"\\S"
    • addedInput schema / properties / packages / items / properties / name / minLength
      Added value: +1
    • addedInput schema / properties / packages / items / properties / name / pattern
      Added value: +"\\S"
    • addedInput schema / properties / packages / items / properties / version / minLength
      Added value: +1
    • addedInput schema / properties / packages / items / properties / version / pattern
      Added value: +"\\S"
  10. Changed5 schema fields changed
    • addedOutput schema / properties / results / items / properties / truncated
      Added value: +{
      +  "description": "True when OSV paginated beyond the fetch cap for this package — its result may be INCOMPLETE. A truncated row with no vulnerabilities is NOT confirmed clean.",
      +  "type": "boolean"
      +}
    • changedOutput schema / properties / results / items / required
      Previous value: -[
      -  "name",
      -  "ecosystem",
      -  "version",
      -  "vulnerable",
      -  "error",
      -  "vulnCount",
      -  "vulns"
      -]New value: +[
      +  "name",
      +  "ecosystem",
      +  "version",
      +  "vulnerable",
      +  "truncated",
      +  "error",
      +  "vulnCount",
      +  "vulns"
      +]
    • changedOutput schema / properties / summary / properties / cleanCount / description
      Previous value: -"Packages with no vulnerabilities."New value: +"Packages confirmed clean — no vulnerabilities, no error, and not truncated."
    • addedOutput schema / properties / summary / properties / truncatedCount
      Added value: +{
      +  "description": "Packages whose OSV results were truncated (may be incomplete). A truncated package with no findings is NOT counted as clean.",
      +  "type": "number"
      +}
    • changedOutput schema / properties / summary / required
      Previous value: -[
      -  "totalPackages",
      -  "vulnerableCount",
      -  "cleanCount",
      -  "errorCount",
      -  "totalVulns",
      -  "worstSeverity"
      -]New value: +[
      +  "totalPackages",
      +  "vulnerableCount",
      +  "cleanCount",
      +  "truncatedCount",
      +  "errorCount",
      +  "totalVulns",
      +  "worstSeverity"
      +]
  11. Changed2 schema fields changed
    • addedOutput schema / properties / effectiveQuery
      Added value: +{
      +  "description": "Compact scan summary (package and outcome counts), echoed on edge-case batches for content-only clients.",
      +  "type": "string"
      +}
    • addedOutput schema / properties / notice
      Added value: +{
      +  "description": "Present on all-clean or all-errors batches — the aggregate outcome for content-only clients.",
      +  "type": "string"
      +}
  12. Changed2 schema fields changed
    • removedInput schema / properties / canvas_id
      Removed value: -{
      -  "description": "Reuse an existing DataCanvas table token to append results. Omit to create a new canvas. Only relevant when package count >= 200.",
      -  "type": "string"
      -}
    • removedOutput schema / properties / canvas_id
      Removed value: -{
      -  "description": "DataCanvas table token. Present when the package count is >= 200 or a canvas_id was provided. Use to run SQL queries across the full result set via the canvas tools.",
      -  "type": "string"
      -}
  13. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnly/openWorld/idempotent already declared, the description adds substantial non-obvious behavior: only the first 1000 of up to 5000 entries are processed, continuation follows summary.nextInputOffset, pages are fresh lookups that do not recompute the initial summary, deferred child paths must start at offset zero without a revision, and transmission overflow is distinct from upstream truncation and neither implies a clean result. That last point is a genuinely important epistemic caveat an agent could not infer from the schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and limits are correctly front-loaded, but the pagination and overflow sentences become a dense run-on that partially duplicates the page object's own schema descriptions, and lines like "Transmission overflow and upstream truncated are separate; neither confirms clean" are terse to the point of ambiguity. Every fact is relevant, but the ordering mixes caller instructions with internal implementation notes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter but deeply nested batch tool with an output schema and full annotation coverage, the description covers limits, pagination, continuation, positional mapping, and cross-server chaining. Concepts like overflow, deferred paths, and truncated upstreams are named but not defined, leaving an agent to infer what triggers each from the response payload.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is already 100%, so the schema carries most weight, but the description adds real semantics: up to 5000 mixed {name, ecosystem, version} tuples or {purl, version?} forms with exactly one version source per PURL, the 1000-entry processing cap, and the positional guarantee that /results/17 maps to original input row 17 even when earlier rows failed. The offset/revision mechanics are restated rather than extended beyond the page schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ("Query vulnerabilities for multiple packages in one call") and immediately frames the batch scope against the single-package sibling, adding named use cases (dependency audits, SBOM scanning, lockfile triage). An agent can distinguish this from osv_query_package without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear situational context (bulk audits) and an explicit routing rule to the sibling: pass a row's nextCursor as cursor to osv_query_package with that row's identifier. It also names a downstream alternative for CVSS work (nist-nvd-mcp-server). It never states the inverse rule ("use osv_query_package for a single package"), so it falls short of full when/when-not symmetry.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.