# Osv [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-osv  
**GitHub Stars:** 0  
**npm Downloads (last month):** 436  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/osv

## Description
OSV.dev (Open Source Vulnerabilities) MCP.

## Tools
Capabilities this server exposes over MCP:

- **query_package_vulns** — Find all known vulnerabilities for an open-source package, optionally at a specific version, via the OSV.dev database. Omit version to get every vuln known for the package. Returns a compact summary array (id, summary, aliases, severity, references). Keyless.
- **get_vulnerability** — Get full detail for a single vulnerability by its OSV ID — e.g. "GHSA-jf85-cpcp-j695", "CVE-2021-23337", "PYSEC-2021-XXX". Returns summary, details, aliases, severity, affected packages/ranges, and references. Keyless.
- **query_by_commit** — Find vulnerabilities affecting a specific source-repository git commit via OSV.dev. Useful when you have a pinned commit hash rather than a released version. Returns the same compact vuln summary array. Keyless.
- **query_batch** — Batch vulnerability query against OSV.dev (up to 1000 entries per call) — for SBOM-style "scan every dependency in this lockfile" workflows. Pass an array of {package:{name,ecosystem}, version?} or {commit} entries. Returns the vuln IDs matched per query (use get_vulnerability for full detail per ID). Keyless.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "osv": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-osv"]
  }
}
```

## Documentation

## What Osv does

Osv MCP server exposes OSV.dev vulnerability data to MCP-compatible clients. It is intended for checking whether packages, package versions, or source commits are associated with known vulnerabilities, then retrieving the details needed to assess a finding.

The integration is keyless at the OSV tool level. It can return compact findings for scanning workflows or full records for investigating one vulnerability. The project is an independent, unofficial integration and is not affiliated with the upstream OSV.dev provider.

## How it works

You can connect an MCP client to the hosted endpoint at `https://gateway.pipeworx.io/osv/mcp`. The endpoint serves the Osv tools together with shared Pipeworx gateway tools. A full gateway connection at `https://gateway.pipeworx.io/mcp` exposes the broader catalog directly; both endpoints can use `ask_pipeworx` to route questions across the catalog.

For local process-based setups, `@pipeworx/mcp-osv` runs through `npx` as a stdio bridge. It forwards requests to the hosted gateway, so network access is required and there is no offline mode. The HTTP API also permits direct calls such as `POST /v1/tools/query_package_vulns`.

## Setup and configuration

Hosted MCP configuration:

```json
{
  "mcpServers": {
    "osv": {
      "url": "https://gateway.pipeworx.io/osv/mcp"
    }
  }
}
```

For the npm bridge, configure the client to start the package with `npx`:

```json
{
  "mcpServers": {
    "osv": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-osv"]
    }
  }
}
```

Anonymous calls are capped at 50 per day. A free Pipeworx account raises the allowance to 200 calls per day; provide its key as `PIPEWORX_API_KEY`. Set `PIPEWORX_META_TOOLS=1` if the local bridge should list shared gateway tools in addition to the Osv tools. When using an HTTPS proxy, newer Node.js releases can honor the proxy environment setting when `NODE_USE_ENV_PROXY=1` is enabled.

## Tools and capabilities

- `query_package_vulns` checks a package across an OSV ecosystem, optionally at a specific version. Leaving out the version returns all known vulnerabilities for that package.
- `get_vulnerability` retrieves full information for an OSV identifier, including aliases, severity, affected package ranges, and references.
- `query_by_commit` checks a source repository commit, which is useful when a dependency is pinned to a commit rather than a release.
- `query_batch` accepts up to 1,000 package or commit entries for dependency inventories and SBOM-style checks. It returns matched vulnerability IDs; call `get_vulnerability` to inspect individual records.

## Limitations and notes

The npm bridge depends on the hosted Pipeworx gateway and cannot operate offline. Anonymous usage has a daily call limit, while authenticated calls use a Bearer token and are metered according to the gateway account. Pack endpoints also list shared gateway meta-tools, so the visible tool count can exceed the four Osv-specific tools.

_Full upstream README: https://allmcps.com/mcp/osv/readme_