Osv Ui

What toan203/osv-ui MCP server does

toan203/osv-ui MCP server connects an MCP-compatible client to a local dependency vulnerability audit workflow. It scans project directories and detects supported package manifests for npm, Python, Go, Rust, Java/Maven, PHP/Composer, and Ruby/Bundler projects. The scan uses OSV.dev to look up current vulnerability data and returns a structured report containing vulnerability details, severity totals, a risk score, and suggested fixes.

The server is intended for audits where an agent should collect findings without immediately changing files. It can start the osv-ui browser dashboard for a person to inspect the results, including CVE details, severity charts, and upgrade guidance. This human review step is important before changing dependency files.

How it works

The scan tool reads dependency metadata from project files such as lockfiles, requirements files, pyproject.toml, pom.xml, composer.json, and Ruby manifest files. It sends package information to OSV.dev for vulnerability matching.

The workflow is deliberately split into discovery, review, and modification:

1. Call scan_project to find vulnerabilities and recommended versions.
2. Call open_dashboard to provide a browser-based review interface.
3. Call get_fix_commands to show the package commands that would be run.
4. Ask the user for confirmation before calling apply_fixes.

apply_fixes is destructive: it executes upgrade commands and modifies package files. The server returns command output for each applied fix. If the dashboard is already running for the requested path, open_dashboard returns its existing URL.

Setup and configuration

toan203/osv-ui MCP server can be configured as a local stdio server with the osv-ui-mcp npm package. The documented setup uses npx with the -y option:

{
  "mcpServers": {
    "osv-ui": {
      "command": "npx",
      "args": ["-y", "osv-ui-mcp"]
    }
  }
}

The README identifies Claude Desktop and Cursor as supported AI-agent clients. No API key, account, or other credential is required. Vulnerability data comes from OSV.dev, which aggregates sources including NVD, GitHub Advisory, PyPI Advisory, npm advisories, RustSec, and the Go vulnerability database.

Tools and capabilities

• scan_project: Detect supported manifests and return vulnerability findings, severity counts, risk score, and fix recommendations.
• open_dashboard: Launch the local visual dashboard and return its URL for human review.
• get_fix_commands: Produce package upgrade commands without executing them, grouped by ecosystem.
• apply_fixes: Execute approved upgrade commands and return their output.

The supported package ecosystems include npm, pip, Go, Cargo, Maven, Composer, and Bundler. The broader osv-ui project also provides command-line reporting options, but the MCP listing specifically exposes the four tools above.

Limitations and notes

toan203/osv-ui MCP server depends on the supported manifest formats and OSV.dev lookups for its vulnerability data. Use --offline only with the command-line application; the listed MCP tools are described around live OSV.dev scanning. Fix application changes package files, so an agent should present the generated commands and obtain confirmation before execution. The dashboard is a local browser interface rather than a hosted review service.