# StacklokLabs/osv-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/StacklokLabs/osv-mcp  
**GitHub Stars:** 44  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/stackloklabs-osv-mcp

## Description
Access the OSV (Open Source Vulnerabilities) database for vulnerability information. Query vulnerabilities by package version or commit, batch query multiple packages, and get detailed vulnerability information by ID.

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/StacklokLabs/osv-mcp), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
git clone https://github.com/StacklokLabs/osv-mcp.git
```

2. Run:

```sh
cd osv-mcp
```

3. Install:

```sh
task build
```

4. Start the server:

```sh
thv run osv
```

5. Start the server:

```sh
MCP_PORT=3000 ./build/osv-mcp-server
```

6. Start the server:

```sh
./build/osv-mcp-server
```

## Documentation

## What StacklokLabs/osv-mcp MCP server does

StacklokLabs/osv-mcp MCP server connects MCP-compatible applications to the OSV database for open-source vulnerability lookups. It belongs in the Security category and is suited to agents that need to inspect dependency versions, source commits, or known vulnerability records without implementing OSV request handling themselves.

The server exposes three tools:

- `query_vulnerability` checks one package version or commit. A package can be identified with `package_name` and `ecosystem`, or with a `purl`. Version and commit are alternative query inputs.
- `query_vulnerabilities_batch` accepts an array of package or commit queries, allowing several lookups in one tool call.
- `get_vulnerability` retrieves details for a vulnerability using its OSV vulnerability ID.

## How it works

The server implements an SSE-based MCP service. SSE is the default transport, and streamable HTTP is also available through configuration. MCP clients connect to the running service and invoke the exposed tools with structured inputs.

For package checks, provide a version together with the package identity, such as a package name and ecosystem. The documented ecosystems include examples such as npm, PyPI, and Go. A package URL can be used instead of the package name and ecosystem. Commit queries use a commit hash and should not be combined with a version. Batch requests follow the same input rules for each item in the `queries` array.

## Setup and configuration

Building from source requires Go 1.21 or later. The repository documents `Task` as optional for running project tasks and `ko` as optional for building container images. The documented source build command is `task build`.

StacklokLabs/osv-mcp MCP server can also be run through ToolHive. The documented flow is to install ToolHive, run `thv client setup` to register a supported client, and start the packaged server with `thv run osv`. ToolHive then makes the server available to MCP-compatible clients.

Configuration uses these environment variables:

- `MCP_PORT` selects the listening port. It defaults to `8080` and must be an integer from 0 through 65535.
- `MCP_TRANSPORT` selects `sse` or `streamable-http`. It defaults to `sse` when missing or invalid.

For example, setting `MCP_PORT=3000` starts the compiled server on port 3000.

## Tools and capabilities

The tools support three common workflows: checking whether a dependency version is affected, checking a source commit, and retrieving a vulnerability record after an ID is known. Batch input is useful when an agent needs to assess multiple packages or commits in one operation. The vulnerability detail tool accepts an `id` field, while the batch tool requires `queries`.

The server can be tested, linted, and formatted with the repository's documented Task commands: `task test`, `task lint`, and `task fmt`. These commands describe development workflows rather than additional MCP capabilities.

## Limitations and notes

It also does not document a client-specific configuration file. Use the transport and port settings supplied by the server, and verify that the chosen client supports MCP and the selected transport.

The project is licensed under the Apache v2 License.

_Full upstream README: https://allmcps.com/mcp/stackloklabs-osv-mcp/readme_