Advertise
MCP.so
Sign In
K

Kodus OSV MCP Server

@kodustech

Repository

Basic information

Category

Other

Transports

stdio

Author

kodustech

Submitted by

Gabriel Malinosqui

About Kodus OSV MCP Server

Kodus MCP HTTP server exposing OSV (v1) for open source vulnerability lookup via osv_query/osv_query_batch tools.

#devtools#security#code-quality#code-review

Kodus OSV MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-osv-kodustech": {
      "command": "bun",
      "args": [
        "run",
        "index.ts"
      ],
      "env": {
        "PORT": "3000",
        "HOST": "0.0.0.0",
        "OSV_API_URL": "https://api.osv.dev/v1"
      }
    }
  }
}

Kodus OSV MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Kodus OSV?

Kodus OSV is an HTTP MCP (Model Context Protocol) server that wraps the OSV v1 API for on‑demand open‑source vulnerability lookups. It exports MCP tools so AI agents can query the OSV vulnerability feed directly. The server uses a Streamable HTTP MCP endpoint and is intended for developers and security teams integrating vulnerability data into their MCP‑aware workflows.

How to use Kodus OSV?

Install dependencies with bun install, set environment variables (PORT, HOST, OSV_API_URL), and run bun run index.ts. The MCP endpoint is http://<host>:<port>/mcp. Clients can connect via Claude Code CLI (claude mcp add --transport http mcp-osv http://localhost:3000/mcp), VS Code (code --add-mcp), or the MCP Inspector.

Key features of Kodus OSV

  • Streamable HTTP MCP endpoint at /mcp
  • Two tools: osv_query (single) and osv_query_batch (multiple)
  • Configurable base URL via OSV_API_URL environment variable
  • Clear validation rules (commit XOR version, purl or name+ecosystem)
  • Supports pagination with pageToken field

Use cases of Kodus OSV

  • Query vulnerabilities for a specific package version (e.g., PyPI, npm)
  • Batch query multiple packages or commits in a single request
  • Perform commit‑based vulnerability lookups for Go or other ecosystems
  • Integrate real‑time OSV checks into MCP‑enabled IDEs or CLI agents

Frequently asked questions

1

What runtime does Kodus OSV require?

Bun is required. No other runtime is supported according to the README.

2

How can I change the OSV API endpoint?

Set the `OSV_API_URL` environment variable. It defaults to `https://api.osv.dev/v1`.

3

What tools does Kodus OSV provide?

Two tools: `osv_query` for a single vulnerability query and `osv_query_batch` for multiple queries in one request.

4

What are the rules for the `package` parameter in queries?

You must use either a `purl` string or the combination of `name` and `ecosystem`. If you use `purl`, do not include the `@version` part; provide the version separately in the `version` field.

5

How can I debug the server or test the tools?

The server logs a confirmation message on startup. You can use `curl` with a JSON‑RPC initialize request or a `tools/list` call against the `/mcp` endpoint to see available tools.

Comments

More Other MCP servers

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

Volley.sh

Volley

A good sequence diagram can solve almost any communication problem in engineering. Volley lets your agent write them as plain text, with the real request and response payloads on every arrow. It checks its own syntax wi

Glasswarp

Glasswarp

See and control a real Windows PC you own — from any MCP client, locally or remotely. Observe (UIA + screenshots), click/type/drag/scroll, launch apps, owner Live View. BYOH: your machine, your key.

Codelf

unbug

A search tool helps dev to solve the naming things problem.

14.2K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

Advertise