OSV Dependency Vulnerability Check MCP Server

Overview Schema Source Related Servers Discussions Admin

Get vulnerability advisory details (free)

get_vulnerability_details

Read-onlyIdempotent

Retrieve full OSV vulnerability records for known advisory or CVE IDs to view summaries, severity, affected ranges, references, and fixed versions.

Instructions

WHAT: Fetch the full OSV record for one or more known vulnerability IDs (e.g. GHSA-35jh-r3h4-6jhm, PYSEC-2021-9, GO-2022-0969, RUSTSEC-2021-0078, CVE-2021-44228) directly from the public OSV.dev API. WHEN TO USE: you already have an advisory/CVE ID (e.g. from check_dependency_vulnerabilities or a security report) and need its summary, details, affected ranges, fixed versions, severity vectors or references. WHEN NOT TO USE: to find which vulnerabilities affect given package versions or a manifest use check_dependency_vulnerabilities (paid). COST/BEHAVIOR: free; read-only HTTP GET to api.osv.dev, no token, no rate limit documented by OSV (be reasonable: max 25 IDs per call). CVE IDs only resolve if OSV indexes them directly; prefer GHSA/ecosystem IDs. RETURNS: {count, items}: one row per ID with type="vulnerability" and the raw OSV schema fields (id, summary, details, aliases, severity, affected, references, published, modified, osv_url), or type="error" with code VULN_NOT_FOUND (404) or OSV_FETCH_FAILED (retryable). EXAMPLE: {"ids":["GHSA-35jh-r3h4-6jhm"]} -> 1 vulnerability row (lodash command injection, fixed in 4.17.21).

Input Schema

TableJSON Schema

Name	Required	Description	Default
`ids`	Yes	Required. 1-25 advisory IDs (3-100 chars each): GHSA-xxxx-xxxx-xxxx, PYSEC-YYYY-N, GO-YYYY-NNNN, RUSTSEC-YYYY-NNNN or CVE-YYYY-NNNNN. Example: ["GHSA-35jh-r3h4-6jhm"]

Output Schema

TableJSON Schema

Name	Required	Description	Default
`count`	Yes	Number of rows returned
`items`	Yes	Result rows; each has a "type" field (data rows or machine-readable "error" rows)

Schema Changelog

Changes observed during successful MCP inspections.

Addedv1.1.1Oct 17, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, open-world, non-destructive, but the description adds real behavioral context beyond them: no token required, no documented rate limit but a 25-ID-per-call cap, the caveat that CVE IDs only resolve if OSV indexes them directly, and the error codes VULN_NOT_FOUND (404) and OSV_FETCH_FAILED (retryable).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded WHAT/WHEN/COST/RETURNS/EXAMPLE structure makes scanning trivial, and each block carries non-redundant information. Despite its length, no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists (so return values need not be spelled out), the description still previews the {count, items} shape and error rows. Auth, cost, limits, ID caveats, and routing are all covered for a single-parameter read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description goes further by enumerating accepted ID formats (GHSA/PYSEC/GO/RUSTSEC/CVE), restating the 25-ID ceiling, and warning that CVE IDs may not resolve. That is genuine added meaning about which values will succeed, though the per-ID length bounds remain schema-only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Fetch) and resource (full OSV record) with scope (one or more known vulnerability IDs) and example ID families. It explicitly names the sibling tool it is not (check_dependency_vulnerabilities) and the distinguishing condition, so an agent can separate the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Has explicit WHEN TO USE (you already hold an advisory/CVE ID) and WHEN NOT TO USE (to find which vulnerabilities affect package versions or a manifest, use check_dependency_vulnerabilities). The alternative and the selecting condition are both stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server