Overview
What is MCP Server For OSV?
MCP Server For OSV is a lightweight MCP server that wraps the OSV (Open Source Vulnerabilities) Database API, letting you query CVEs for specific packages, find affected and fixed versions, and list supported ecosystems. It is designed for developers and security researchers who need vulnerability data inside AI-powered tools like Cursor and Claude Desktop.
How to use MCP Server For OSV?
Install it via Smithery (npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude) or clone the repo locally and configure your MCP host with the provided JSON snippet. The server exposes four tools: query_package_cve, query_for_cve_affected, query_for_cve_fix_versions, and get_ecosystems.
Key features of MCP Server For OSV
- Query CVE IDs for any package by name and optional version.
- Retrieve all affected versions for a given CVE.
- List all versions that fix a specific CVE.
- Fetch the list of supported package ecosystems.
Use cases of MCP Server For OSV
- Check if a Python (or other ecosystem) package has known vulnerabilities.
- Determine which versions of a library are affected by a CVE.
- Find the exact versions that patch a security issue.
- Discover which ecosystems (e.g., PyPI, npm) are currently queryable.
FAQ from MCP Server For OSV
What dependencies does MCP Server For OSV need?
Python 3.11 or higher and the uv package manager (installable via pip install uv or brew install uv).
How do I install MCP Server For OSV?
You can install it via Smithery (npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude) or clone the repository and add the server configuration to your MCP host’s JSON file.
Which clients is MCP Server For OSV tested on?
Cursor and Claude Desktop.
What is the default ecosystem for package queries?
If no ecosystem is specified, the query_package_cve tool defaults to "PyPI".
How can I see all supported ecosystems?
Use the get_ecosystems tool; it returns a dictionary mapping ecosystem names to their programming language or operating system.
