io.github.cyanheads/osv-advisory-mcp-server · v0.2.0 · security
io.github.cyanheads/osv-advisory-mcp-server is healthy: it completed an MCP handshake in 233 ms and exposes 4 tools.
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Endpoint: https://osv-advisory.caseyjhand.com/mcp (streamable-http)
Repository · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 4 |
| Latency | 233 ms |
| Last checked (UTC) | 2026-10-16T07:20:35.203Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-10-16T07:20:35.203Z | Healthy | 233 | |
| 2026-10-15T03:25:44.611Z | Healthy | 2556 |
osv_list_ecosystems | Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an |
osv_query_package | Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem st |
osv_get_vulnerability | Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a v |
osv_query_batch | Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases f |