OSV MCP Server

What is OSV MCP Server?

The OSV MCP Server is an MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database. It allows LLM-powered applications to query vulnerability information for packages, commits, and specific vulnerability IDs. The server uses SSE or Streamable HTTP transport and is intended for developers integrating vulnerability checks into MCP-compatible clients.

How to use OSV MCP Server?

Install with Go 1.21+ or use the recommended ToolHive containerized deployment. Configure with environment variables MCP_PORT (default 8080) and MCP_TRANSPORT (default sse, also supports streamable-http). The server exposes three MCP tools: query_vulnerability (single package/commit), query_vulnerabilities_batch (multiple queries), and get_vulnerability (by OSV ID). Invoke via any MCP client after running the server.

Key features of OSV MCP Server

• Query vulnerabilities by package name, ecosystem, and version or commit hash
• Batch query multiple packages or commits in a single call
• Get detailed information about a specific vulnerability by OSV ID
• Supports SSE and Streamable HTTP transport modes
• Configurable port and transport via environment variables
• Runs natively or via secure ToolHive container deployment

Use cases of OSV MCP Server

• Check if a specific package version (e.g., lodash 4.17.15) has known vulnerabilities
• Query vulnerabilities affecting a codebase by commit hash
• Batch scan your project’s dependencies for security issues
• Retrieve full details of a known vulnerability ID (e.g., GHSA-vqj2-4v8m-8vrq)