This OSV MCP server allows querying the OSV database for software vulnerabilities with the following capabilities:
Query for all CVE IDs associated with a specific package, optionally filtered by version and ecosystem (default: PyPI for Python packages)
Retrieve all affected versions of a package for a given CVE
Find all versions that fix a given CVE
Get a list of supported ecosystems and their corresponding programming languages or operating systems
Enables querying for package vulnerabilities in the PyPI ecosystem, fetching CVEs associated with packages and identifying affected and fixed versions
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@OSV show me CVEs for requests package version 2.28.0"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A lightweight MCP (Model Context Protocol) server for OSV Database API.
Example:
name | description |
query_package_cve | List all the CVE IDs for a specific package. Specific version can be passed as well for more narrow scope CVE IDs. |
query_for_cve_affected | Query the OSV database for a CVE and return all affected versions of the package. |
query_for_cve_fix_versions | Query the OSV database for a CVE and return all versions that fix the vulnerability. |
get_ecosystems | Query the MCP for current supported ecosystems. |
query_package_cve
Query the OSV database for a package and return the CVE IDs.
Input parameters:
package (string, required): The package name to query
version (string, optional): The version of the package to query. If not specified, queries all versions
ecosystem (string, optional): The ecosystem of the package. Defaults to "PyPI" for Python packages
Returns a list of CVE IDs with their details
query_for_cve_affected
Query the OSV database for a CVE and return all affected versions.
Input parameters:
cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805")
Returns a list of affected version strings
query_for_cve_fix_versions
Query the OSV database for a CVE and return all versions that fix the vulnerability.
Input parameters:
cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805")
Returns a list of fixed version strings
get_ecosystems
Query for all current supported ecosystems by the MCP servers.
Return a dict with the key being the ecosystem name and the value the programming language / OS.
Related MCP server: MCP Vulnerability Checker Server
Python 3.11 or higher: This project requires Python 3.11 or newer.
# Check your Python version
python --versionInstall uv: A fast Python package installer and resolver.
pip install uvOr use Homebrew:
brew install uvCursor
Claude
Via Smithery:
npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claudeLocally:
Clone the repo: https://github.com/EdenYavin/OSV-MCP.git
Configure your MCP Host (Cusrsor / Claude Desktop etc.):
{
"mcpServers": {
"osv-mcp": {
"command": "uv",
"args": ["--directory", "path-to/OSV-MCP", "run", "osv-server"],
"env": {}
}
}
}
Leave a review on VibeApp if you enjoyed it :)!
Get all supported ecosystems. An ecosystem is a package manager or repository for a specific language.
Returns:
Dictionary of ecosystems with the key being the ecosystem name and the value being the programming language / OS.
To use the ecosystem name in the query_package_cve function, you must use the exact ecosystem name as it is in the dictionary.
Inputs: no named parameters.
Query the OSV database for a CVE and return the affected versions.
Args:
cve: The CVE ID to query
Returns:
A list of affected versions
Inputs: cve (required).
Query the OSV database for a CVE and return the fix versions.
Args:
cve: The CVE ID to query
Returns:
A list of fix versions
Inputs: cve (required).
Query the OSV database for a package and return the CVE ID.
You can use this tool to get the CVE ID for a package.
ALWAYS use it before installing packages to check if the package is vulnerable. For example in requirements.txt, pyproject.toml, uv.lock, etc.
You can also use it to check if the package is vulnerable before updating the package.
Args:
package: The package name to query
version: The version of the package to query, can be None if you want to query all versions
ecosystem: The ecosystem of the package to query, can be None if you want to query all ecosystems.
* For supported ecosystems, see the get_ecosystems tool.
Returns:
A list of CVE IDs
Inputs: package (required), version, ecosystem.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 4 tools
Each tool has a clearly distinct purpose with no overlap: get_ecosystems retrieves ecosystem metadata, query_for_cve_affected and query_for_cve_fix_versions handle CVE-specific queries for affected and fixed versions respectively, and query_package_cve checks packages for vulnerabilities. The descriptions make it easy to differentiate between them, especially the two CVE-related tools that focus on different aspects of vulnerability data.
All tool names follow a consistent verb_noun pattern with snake_case: get_ecosystems, query_for_cve_affected, query_for_cve_fix_versions, and query_package_cve. The naming is predictable and readable, with 'query' used for database lookups and 'get' for metadata retrieval, maintaining a coherent style throughout the set.
With 4 tools, the count is reasonable for a vulnerability database server, covering core operations like ecosystem listing, CVE queries, and package checks. It feels slightly thin but well-scoped, as each tool serves a specific function without redundancy. A few more tools (e.g., for batch queries or detailed vulnerability info) could enhance it, but the current set is functional and appropriate.
The tool surface covers essential workflows for OSV database interactions: retrieving ecosystems, querying CVEs for affected and fixed versions, and checking packages for vulnerabilities. Minor gaps exist, such as no tool for listing all CVEs or querying by date/severity, but agents can work around this by combining existing tools. The set provides a solid foundation for vulnerability assessment tasks.
CVEs, affected versions and fix versions for your dependencies, from an affected-version ledger.
Actively exploited? End of life? Which version fixes it? CVE verdicts for server software.
Software vulnerabilities (CVEs) from the US NVD and package downloads for npm, PyPI and crates
Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports.
