Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "type": "http",
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

claude mcp add --transport http osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp

[mcp_servers.osv-advisory-mcp-server]
url = "https://osv-advisory.caseyjhand.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "osv-advisory-mcp-server": {
      "type": "remote",
      "url": "https://osv-advisory.caseyjhand.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "type": "http",
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=osv-advisory-mcp-server&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vb3N2LWFkdmlzb3J5LmNhc2V5amhhbmQuY29tL21jcCJ9"
}

{
  "servers": {
    "osv-advisory-mcp-server": {
      "type": "http",
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "httpUrl": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

extensions:
  "osv-advisory-mcp-server":
    enabled: true
    name: "osv-advisory-mcp-server"
    type: streamable_http
    uri: "https://osv-advisory.caseyjhand.com/mcp"
    timeout: 300

Quality 70 / 100needs work

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene79 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length2 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations5 of 5 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: osv_list_ecosystems (destructiveHint); osv_get_vulnerability (destructiveHint); osv_query_commit (destructiveHint); …
pass
tools.token_costabout 2,922 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes11 tool changes in 30 days
fail
stability.rug_pull2 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvabledeps.dev does not know @cyanheads/[email protected], @cyanheads/[email protected]

5 tools, about 2,922 tokens to load them all · tool set 907bc2470fc7 · tools last changed 2026-10-18 · checked 2026-10-20 16:30 UTC

Tool changes

2026-10-18osv_query_commitadded
Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
2026-10-18osv_query_batchchangeddescription, input schema, output schema
before
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary and announce page retrieval. Reuse packages with /results or an original-index descendant; fresh row pages do not recompute aggregate counts.
after · 51% of words in common
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
2026-10-18osv_get_vulnerabilitychangeddescription, input schema, output schemameaning changed
before
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance. Large records return overflow with same-tool page pointers; every omitted field remains retrievable.
after · 50% of words in common
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.
2026-10-18osv_query_packagechangeddescription, input schema, output schemameaning changed
before
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. Large replies carry overflow and a compact advisory list when it fits; retrieve fields with page, using advisoryId for one package-scoped advisory GET.
after · 46% of words in common
Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
2026-10-14osv_query_batchchangeddescription, input schema, output schema
before
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring.
after · 67% of words in common
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary and announce page retrieval. Reuse packages with /results or an original-index descendant; fresh row pages do not recompute aggregate counts.
2026-10-14osv_get_vulnerabilitychangeddescription, input schema, output schema
before
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance.
after · 78% of words in common
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance. Large records return overflow with same-tool page pointers; every omitted field remains retrievable.
2026-10-14osv_query_packagechangeddescription, input schema, output schema
before
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.
after · 75% of words in common
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. Large replies carry overflow and a compact advisory list when it fits; retrieve fields with page, using advisoryId for one package-scoped advisory GET.
2026-09-24osv_query_batchchangedinput schema, output schema
2026-09-24osv_get_vulnerabilitychangedinput schema, output schema
2026-09-24osv_query_packagechangeddescription, input schema, output schema
before
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and first safe version. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.
after · 89% of words in common
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance80

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +reachable +uptime-99% +updated-2d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@cyanheads/[email protected] npmthis version is not known to the dependency resolver

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://osv-advisory.caseyjhand.com/mcp` streamable-http	none	yes	99%	166 ms	2026-07-28	2026-10-20

package	registry	version	runtime	secrets
`@cyanheads/osv-advisory-mcp-server`	npm	0.3.0	npx
`@cyanheads/osv-advisory-mcp-server`	npm	0.3.0	npx

Tools (5)

`osv_get_vulnerability`read-only	Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.
`osv_list_ecosystems`read-only	Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.
`osv_query_batch`read-only	Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
`osv_query_commit`read-only	Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
`osv_query_package`read-only	Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

Schemas: list_tools.

Similar MCP servers

More from io.github.cyanheads

And 140 more from this publisher.

Official server.json

{
  "name": "io.github.cyanheads/osv-advisory-mcp-server",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://osv-advisory.caseyjhand.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.3.0",
  "packages": [
    {
      "version": "0.3.0",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@cyanheads/osv-advisory-mcp-server",
      "runtimeHint": "npx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "OSV_REQUEST_TIMEOUT_MS",
          "format": "string",
          "default": "10000",
          "description": "HTTP request timeout in milliseconds for OSV.dev API calls."
        },
        {
          "name": "OSV_BATCH_CONCURRENCY",
          "format": "string",
          "default": "10",
          "description": "Maximum number of concurrent OSV.dev requests issued by osv_query_batch."
        },
        {
          "name": "OSV_QUERY_MAX_PAGES",
          "format": "string",
          "default": "10",
          "description": "Maximum number of OSV.dev result pages followed per package or commit before marking a result truncated."
        },
        {
          "name": "MCP_LOG_LEVEL",
          "format": "string",
          "default": "info",
          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
        }
      ]
    },
    {
      "version": "0.3.0",
      "transport": {
        "url": "http://localhost:3010/mcp",
        "type": "streamable-http"
      },
      "identifier": "@cyanheads/osv-advisory-mcp-server",
      "runtimeHint": "npx",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "MCP_TRANSPORT_TYPE",
          "value": "http",
          "format": "string",
          "description": "Selects the HTTP transport."
        },
        {
          "name": "OSV_REQUEST_TIMEOUT_MS",
          "format": "string",
          "default": "10000",
          "description": "HTTP request timeout in milliseconds for OSV.dev API calls."
        },
        {
          "name": "OSV_BATCH_CONCURRENCY",
          "format": "string",
          "default": "10",
          "description": "Maximum number of concurrent OSV.dev requests issued by osv_query_batch."
        },
        {
          "name": "OSV_QUERY_MAX_PAGES",
          "format": "string",
          "default": "10",
          "description": "Maximum number of OSV.dev result pages followed per package or commit before marking a result truncated."
        },
        {
          "name": "MCP_HTTP_HOST",
          "format": "string",
          "default": "127.0.0.1",
          "description": "The hostname for the HTTP server."
        },
        {
          "name": "MCP_HTTP_PORT",
          "format": "string",
          "default": "3010",
          "description": "The port to run the HTTP server on."
        },
        {
          "name": "MCP_HTTP_ENDPOINT_PATH",
          "format": "string",
          "default": "/mcp",
          "description": "The endpoint path for the MCP server."
        },
        {
          "name": "MCP_AUTH_MODE",
          "format": "string",
          "default": "none",
          "description": "Authentication mode to use: 'none', 'jwt', or 'oauth'."
        },
        {
          "name": "MCP_SESSION_MODE",
          "format": "string",
          "default": "stateless",
          "description": "HTTP session mode. This server deploys stateless because its tools do not use multi-round input."
        },
        {
          "name": "MCP_LOG_LEVEL",
          "format": "string",
          "default": "info",
          "description": "Sets the minimum log level for output (e.g., 'debug', 'info', 'warn')."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/cyanheads/osv-advisory-mcp-server",
    "source": "github"
  },
  "description": "Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP."
}