How do I run the server on a different port?

Set the MCP_PORT environment variable to a valid port number before starting the server. Defaults to 8080 if unset or invalid.

What transport protocols does the server support?

It supports SSE (Server-Sent Events) by default and can be configured to use streamable-http via MCP_TRANSPORT environment variable.

Is there a way to query multiple packages at once?

Yes, the server provides a batch query tool that accepts an array of package or commit queries.

How do I get detailed info about a specific vulnerability?

Use the get_vulnerability tool with the OSV vulnerability ID to retrieve detailed information.

Osv MCP

securityvulnerabilitiesosvmcpsse

SSE-based MCP server to query the OSV database for open source vulnerability info by package or commit.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

One-click editor setup isn’t available for this listing yet — we don’t have a confirmed install command, and we’d rather show nothing than point your editor at the wrong package or host. Follow the project’s own setup instructions, linked above.

Manual Client & Custom JSON ConfigExpand JSON ▾

No confirmed setup config for this listing yet. We only publish a config block when the install details come from the project itself — its README, its docs, or a verified owner. We haven’t found those for StacklokLabs/osv-mcp, and we’d rather show nothing than a guess you’d paste into your client. Follow the project’s own setup instructions for the current steps.

Overview

This MCP server provides access to the Open Source Vulnerabilities (OSV) database, enabling LLM-powered applications to query vulnerability data. It supports querying vulnerabilities for specific package versions or commits, batch queries for multiple packages, and retrieving detailed vulnerability information by ID. Use it when you need programmatic vulnerability data integration in your AI agents or security tooling.

Use cases

Query vulnerabilities for a specific package version

Query vulnerabilities for a specific commit hash

Batch query vulnerabilities for multiple packages or commits

Retrieve detailed information about a vulnerability by its OSV ID

Key features

SSE transport mode with optional streamable-http

Query by package name, ecosystem, version, or commit hash

Batch querying multiple vulnerability queries in one request

Fetch detailed vulnerability data by OSV vulnerability ID

Configurable server port via environment variable

Capabilities & Tool Schemas

Inspect callable tools, capabilities, and parameters exposed to AI agents by Osv MCP.

Extracted Tool Capabilities

SSE transport mode with optional streamable-http

Query by package name, ecosystem, version, or commit hash

Batch querying multiple vulnerability queries in one request

Fetch detailed vulnerability data by OSV vulnerability ID

Configurable server port via environment variable

Documentation Overview

OSV MCP Server

An MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database.

Overview

This project implements an SSE-based MCP server that allows LLM-powered applications to query the OSV database for vulnerability information. The server provides tools for:

Querying vulnerabilities for a specific package version or commit
Batch querying vulnerabilities for multiple packages or commits
Getting detailed information about a specific vulnerability by ID

Installation

Prerequisites

Go 1.21 or later
Task (optional, for running tasks)
ko (optional, for building container images)

Building from source

bash

# Clone the repository
git clone https://github.com/StacklokLabs/osv-mcp.git
cd osv-mcp

# Build the server
task build

Usage

Running with ToolHive (Recommended)

The easiest way to run the OSV MCP server is using ToolHive, which provides secure, containerized deployment of MCP servers:

bash

# Install ToolHive (if not already installed)
# See: https://docs.stacklok.com/toolhive/guides-cli/install

# Register a supported client so ToolHive can auto-configure your environment
thv client setup

# Run the OSV MCP server (packaged as 'osv' in ToolHive)
thv run osv

# List running servers
thv list

# Get detailed information about the server
thv registry info osv

The server will be available to your MCP-compatible clients and can query the OSV database for vulnerability information.

Running from Source

Server Configuration

The server can be configured using environment variables:

MCP_PORT: The port number to run the server on (default: 8080)
- Must be a valid integer between 0 and 65535
- If invalid or not set, the server will use port 8080
MCP_TRANSPORT: The transport mode for the server (default: sse)
- Supported values: sse, streamable-http
- If invalid or not set, the server will use SSE transport mode

Example:

bash

# Run on port 3000
MCP_PORT=3000 ./build/osv-mcp-server

# Run on default port 8080
./build/osv-mcp-server

MCP Tools

The server provides the following MCP tools:

query_vulnerability

Query for vulnerabilities affecting a specific package version or commit.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "commit": {
      "type": "string",
      "description": "The commit hash to query for. If specified, version should not be set."
    },
    "version": {
      "type": "string",
      "description": "The version string to query for. If specified, commit should not be set."
    },
    "package_name": {
      "type": "string",
      "description": "The name of the package."
    },
    "ecosystem": {
      "type": "string",
      "description": "The ecosystem for this package (e.g., PyPI, npm, Go)."
    },
    "purl": {
      "type": "string",
      "description": "The package URL for this package. If purl is used, package_name and ecosystem should not be set."
    }
  }
}

query_vulnerabilities_batch

Query for vulnerabilities affecting multiple packages or commits at once.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "queries": {
      "type": "array",
      "description": "Array of query objects",
      "items": {
        "type": "object",
        "properties": {
          "commit": {
            "type": "string",
            "description": "The commit hash to query for. If specified, version should not be set."
          },
          "version": {
            "type": "string",
            "description": "The version string to query for. If specified, commit should not be set."
          },
          "package_name": {
            "type": "string",
            "description": "The name of the package."
          },
          "ecosystem": {
            "type": "string",
            "description": "The ecosystem for this package (e.g., PyPI, npm, Go)."
          },
          "purl": {
            "type": "string",
            "description": "The package URL for this package. If purl is used, package_name and ecosystem should not be set."
          }
        }
      }
    }
  },
  "required": ["queries"]
}

get_vulnerability

Get details for a specific vulnerability by ID.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The OSV vulnerability ID"
    }
  },
  "required": ["id"]
}

Examples

Querying vulnerabilities for a package

config.json

{
  "package_name": "lodash",
  "ecosystem": "npm",
  "version": "4.17.15"
}

Querying vulnerabilities for a commit

config.json

{
  "commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"
}

Batch querying vulnerabilities

config.json

{
  "queries": [
    {
      "package_name": "lodash",
      "ecosystem": "npm",
      "version": "4.17.15"
    },
    {
      "package_name": "jinja2",
      "ecosystem": "PyPI",
      "version": "2.4.1"
    }
  ]
}

Getting vulnerability details

config.json

{
  "id": "GHSA-vqj2-4v8m-8vrq"
}

Development

Running tests

bash

task test

Linting

bash

task lint

Formatting code

bash

task fmt

Contributing

We welcome contributions to this MCP server! If you'd like to contribute, please review the CONTRIBUTING guide for details on how to get started.

If you run into a bug or have a feature request, please open an issue in the repository or join us in the #mcp-servers channel on our community Discord server.

License

This project is licensed under the Apache v2 License - see the LICENSE file for details.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

Last commit

16d ago

Most recent push to the default branch.

Directory activity

2 views

Config copies, upvotes, and views on AllMCPs.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Osv MCP

You can query by package name and ecosystem with a version, or by commit hash. Alternatively, use a package URL (purl) instead of name and ecosystem.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/stackloklabs-osv-mcp?style=directory)](https://allmcps.com/mcp/stackloklabs-osv-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/stackloklabs-osv-mcp"><img src="https://allmcps.com/api/badge/stackloklabs-osv-mcp?style=directory" alt="Osv MCP on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

PricingFree

8/9 checks healthy over the last 33d

48Quality signal: Fair · 48/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools19/30

Adoption & activity7/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Osv MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Osv MCP

securityvulnerabilitiesosvmcpsse

SSE-based MCP server to query the OSV database for open source vulnerability info by package or commit.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Manual Client & Custom JSON ConfigExpand JSON ▾

Overview

Use cases

Query vulnerabilities for a specific package version

Query vulnerabilities for a specific commit hash

Batch query vulnerabilities for multiple packages or commits

Retrieve detailed information about a vulnerability by its OSV ID

Key features

SSE transport mode with optional streamable-http

Query by package name, ecosystem, version, or commit hash

Batch querying multiple vulnerability queries in one request

Fetch detailed vulnerability data by OSV vulnerability ID

Configurable server port via environment variable

Capabilities & Tool Schemas

Inspect callable tools, capabilities, and parameters exposed to AI agents by Osv MCP.

Extracted Tool Capabilities

SSE transport mode with optional streamable-http

Query by package name, ecosystem, version, or commit hash

Batch querying multiple vulnerability queries in one request

Fetch detailed vulnerability data by OSV vulnerability ID

Configurable server port via environment variable

Documentation Overview

OSV MCP Server

An MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database.

Overview

This project implements an SSE-based MCP server that allows LLM-powered applications to query the OSV database for vulnerability information. The server provides tools for:

Querying vulnerabilities for a specific package version or commit
Batch querying vulnerabilities for multiple packages or commits
Getting detailed information about a specific vulnerability by ID

Installation

Prerequisites

Go 1.21 or later
Task (optional, for running tasks)
ko (optional, for building container images)

Building from source

bash

# Clone the repository
git clone https://github.com/StacklokLabs/osv-mcp.git
cd osv-mcp

# Build the server
task build

Usage

Running with ToolHive (Recommended)

The easiest way to run the OSV MCP server is using ToolHive, which provides secure, containerized deployment of MCP servers:

bash

# Install ToolHive (if not already installed)
# See: https://docs.stacklok.com/toolhive/guides-cli/install

# Register a supported client so ToolHive can auto-configure your environment
thv client setup

# Run the OSV MCP server (packaged as 'osv' in ToolHive)
thv run osv

# List running servers
thv list

# Get detailed information about the server
thv registry info osv

The server will be available to your MCP-compatible clients and can query the OSV database for vulnerability information.

Running from Source

Server Configuration

The server can be configured using environment variables:

MCP_PORT: The port number to run the server on (default: 8080)
- Must be a valid integer between 0 and 65535
- If invalid or not set, the server will use port 8080
MCP_TRANSPORT: The transport mode for the server (default: sse)
- Supported values: sse, streamable-http
- If invalid or not set, the server will use SSE transport mode

Example:

bash

# Run on port 3000
MCP_PORT=3000 ./build/osv-mcp-server

# Run on default port 8080
./build/osv-mcp-server

MCP Tools

The server provides the following MCP tools:

query_vulnerability

Query for vulnerabilities affecting a specific package version or commit.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "commit": {
      "type": "string",
      "description": "The commit hash to query for. If specified, version should not be set."
    },
    "version": {
      "type": "string",
      "description": "The version string to query for. If specified, commit should not be set."
    },
    "package_name": {
      "type": "string",
      "description": "The name of the package."
    },
    "ecosystem": {
      "type": "string",
      "description": "The ecosystem for this package (e.g., PyPI, npm, Go)."
    },
    "purl": {
      "type": "string",
      "description": "The package URL for this package. If purl is used, package_name and ecosystem should not be set."
    }
  }
}

query_vulnerabilities_batch

Query for vulnerabilities affecting multiple packages or commits at once.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "queries": {
      "type": "array",
      "description": "Array of query objects",
      "items": {
        "type": "object",
        "properties": {
          "commit": {
            "type": "string",
            "description": "The commit hash to query for. If specified, version should not be set."
          },
          "version": {
            "type": "string",
            "description": "The version string to query for. If specified, commit should not be set."
          },
          "package_name": {
            "type": "string",
            "description": "The name of the package."
          },
          "ecosystem": {
            "type": "string",
            "description": "The ecosystem for this package (e.g., PyPI, npm, Go)."
          },
          "purl": {
            "type": "string",
            "description": "The package URL for this package. If purl is used, package_name and ecosystem should not be set."
          }
        }
      }
    }
  },
  "required": ["queries"]
}

get_vulnerability

Get details for a specific vulnerability by ID.

Input Schema:

config.json

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The OSV vulnerability ID"
    }
  },
  "required": ["id"]
}

Examples

Querying vulnerabilities for a package

config.json

{
  "package_name": "lodash",
  "ecosystem": "npm",
  "version": "4.17.15"
}

Querying vulnerabilities for a commit

config.json

{
  "commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"
}

Batch querying vulnerabilities

config.json

{
  "queries": [
    {
      "package_name": "lodash",
      "ecosystem": "npm",
      "version": "4.17.15"
    },
    {
      "package_name": "jinja2",
      "ecosystem": "PyPI",
      "version": "2.4.1"
    }
  ]
}

Getting vulnerability details

config.json

{
  "id": "GHSA-vqj2-4v8m-8vrq"
}

Development

Running tests

bash

task test

Linting

bash

task lint

Formatting code

bash

task fmt

Contributing

We welcome contributions to this MCP server! If you'd like to contribute, please review the CONTRIBUTING guide for details on how to get started.

If you run into a bug or have a feature request, please open an issue in the repository or join us in the #mcp-servers channel on our community Discord server.

License

This project is licensed under the Apache v2 License - see the LICENSE file for details.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

Last commit

16d ago

Most recent push to the default branch.

Directory activity

2 views

Config copies, upvotes, and views on AllMCPs.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Osv MCP

You can query by package name and ecosystem with a version, or by commit hash. Alternatively, use a package URL (purl) instead of name and ecosystem.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/stackloklabs-osv-mcp?style=directory)](https://allmcps.com/mcp/stackloklabs-osv-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/stackloklabs-osv-mcp"><img src="https://allmcps.com/api/badge/stackloklabs-osv-mcp?style=directory" alt="Osv MCP on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

PricingFree

8/9 checks healthy over the last 33d

48Quality signal: Fair · 48/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools19/30

Adoption & activity7/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Osv MCP →Install in Claude Desktop Install in Cursor Install in VS Code