Kodus OSV

Name: Kodus OSV
Author: kodustech

@kodustech

Repository

About Kodus OSV

Kodus MCP HTTP server exposing OSV (v1) for open source vulnerability lookup via osv_query/osv_query_batch tools.

#devtools #security #code-quality #code-review

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-osv-kodustech": {
      "command": "bun",
      "args": [
        "run",
        "index.ts"
      ],
      "env": {
        "PORT": "3000",
        "HOST": "0.0.0.0",
        "OSV_API_URL": "https://api.osv.dev/v1"
      }
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Kodus OSV?

Kodus OSV is an HTTP MCP (Model Context Protocol) server that wraps the OSV v1 API for on‑demand open‑source vulnerability lookups. It exports MCP tools so AI agents can query the OSV vulnerability feed directly. The server uses a Streamable HTTP MCP endpoint and is intended for developers and security teams integrating vulnerability data into their MCP‑aware workflows.

How to use Kodus OSV?

Install dependencies with bun install, set environment variables (PORT, HOST, OSV_API_URL), and run bun run index.ts. The MCP endpoint is http://<host>:<port>/mcp. Clients can connect via Claude Code CLI (claude mcp add --transport http mcp-osv http://localhost:3000/mcp), VS Code (code --add-mcp), or the MCP Inspector.

Key features of Kodus OSV

Streamable HTTP MCP endpoint at /mcp
Two tools: osv_query (single) and osv_query_batch (multiple)
Configurable base URL via OSV_API_URL environment variable
Clear validation rules (commit XOR version, purl or name+ecosystem)
Supports pagination with pageToken field

Use cases of Kodus OSV

Query vulnerabilities for a specific package version (e.g., PyPI, npm)
Batch query multiple packages or commits in a single request
Perform commit‑based vulnerability lookups for Go or other ecosystems
Integrate real‑time OSV checks into MCP‑enabled IDEs or CLI agents

FAQ from Kodus OSV

What runtime does Kodus OSV require?

Bun is required. No other runtime is supported according to the README.

How can I change the OSV API endpoint?

Set the OSV_API_URL environment variable. It defaults to https://api.osv.dev/v1.

What tools does Kodus OSV provide?

Two tools: osv_query for a single vulnerability query and osv_query_batch for multiple queries in one request.

What are the rules for the `package` parameter in queries?

You must use either a purl string or the combination of name and ecosystem. If you use purl, do not include the @version part; provide the version separately in the version field.

How can I debug the server or test the tools?

The server logs a confirmation message on startup. You can use curl with a JSON‑RPC initialize request or a tools/list call against the /mcp endpoint to see available tools.

Comments

More Other MCP servers

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

Codelf

unbug

A search tool helps dev to solve the naming things problem.

14.2K

🚀 Model Context Protocol (MCP) Curriculum for Beginners

microsoft

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,

16.7K