osv-advisory-mcp-server
An MCP server that queries OSV.dev to retrieve package vulnerability data, batch-audit dependency lists or SBOMs, and fetch complete advisory records including CVSS severity, CVE aliases, and affected version ranges.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
MCP endpoint (Streamable HTTP)
https://osv-advisory.caseyjhand.com/mcpWhat its tools do
5 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.
Checks and signals
Each line is separate evidence, not a trust score.
- Passed Endpoint answered the live check ·
- Availability 1 of 1 checks passed in 30 days
What you can do with it
- Query known vulnerabilities for a single package version
- Batch-audit up to 1000 package versions in one call
- Fetch full advisory records for specific OSV vulnerability IDs
- List supported ecosystem identifier strings for validation
Source and maintenance
Community listingRegistry 0.4.1
- Maintenance checked
Protocol and capabilities
- Server
- osv-advisory-mcp-server 0.4.1
- MCP protocol negotiated in check
- 2025-11-25
- Tools
- 5 advertised
- Resources
- 1 advertised
- Resource templates
- 1 advertised
- Prompts
- 0 advertised
Server-advertised capabilities
{
"tools": {
"listChanged": true
},
"logging": {},
"prompts": {
"listChanged": true
},
"resources": {
"subscribe": true,
"listChanged": true
},
"extensions": {
"io.modelcontextprotocol/skills": {
"directoryRead": true
}
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
5 advertised
osv_list_ecosystems — Osv List Ecosystems
Advertised read-only
Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-10-31. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.
osv_list_ecosystems input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {},
"additionalProperties": false
}osv_list_ecosystems output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
},
"required": [
"ecosystems",
"note"
]
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"note": {
"type": "string",
"description": "Advisory note about list currency and canonical source."
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"description": "Machine-readable failure mode."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"ecosystems": {
"type": "array",
"items": {
"type": "string",
"description": "A supported ecosystem identifier string."
},
"description": "Supported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query_package and osv_query_batch."
}
},
"additionalProperties": false
}osv_list_ecosystems annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}osv_query_package — Osv Query Package
Advertised read-only
Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
osv_query_package input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"name": {
"type": "string",
"pattern": "\\S",
"description": "Exact package name in its ecosystem."
},
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
},
"advisoryId": {
"type": "string",
"maxLength": 1024,
"description": "ID from this query’s advisory list. Retain this ID when continuing its fields with fixes and severity for the original package."
}
},
"description": "Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set.",
"additionalProperties": false
},
"purl": {
"type": "string",
"description": "PURL alternative to name and ecosystem; supply one embedded or separate version."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized."
},
"ecosystem": {
"type": "string",
"pattern": "\\S",
"description": "Case-sensitive ecosystem identifier from osv_list_ecosystems."
}
},
"additionalProperties": false
}osv_query_package output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
}
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"page": {
"type": "object",
"required": [
"path",
"type",
"offset",
"total",
"nextOffset",
"revision",
"notice"
],
"properties": {
"path": {
"type": "string",
"description": "Addressed JSON pointer."
},
"text": {
"type": "string",
"description": "Verbatim Unicode code-point slice for strings."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Addressed value kind."
},
"total": {
"type": "number",
"description": "Total entries or Unicode code points."
},
"notice": {
"type": "string",
"description": "Fresh re-fetch disclosure; no saved historical snapshot."
},
"offset": {
"type": "number",
"description": "Starting entry or code-point offset."
},
"entries": {
"type": "array",
"items": {
"type": "object",
"required": [
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Object key or original array index."
},
"value": {
"description": "Complete child value, unmodified."
},
"deferred": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "Retrievable child descriptor when its value does not fit.",
"additionalProperties": false
}
},
"description": "One source entry, complete or deferred.",
"additionalProperties": false
},
"description": "Source-order entries for arrays, objects and scalars."
},
"revision": {
"type": "string",
"description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order."
},
"nextOffset": {
"type": [
"number",
"null"
],
"description": "Next offset, strictly greater or null when finished."
}
},
"description": "One bounded page of an addressed normalized node.",
"additionalProperties": false
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"invalid_version",
"invalid_purl",
"unsupported_purl",
"invalid_purl_version",
"invalid_purl_query",
"invalid_page_path",
"stale_page_revision",
"advisory_not_found",
"invalid_ecosystem"
],
"description": "Machine-readable failure mode. Declared by this tool: `invalid_version`: The version is a constraint or is not a valid exact version for its ecosystem. `invalid_purl`: The PURL is malformed. `unsupported_purl`: OSV does not support this PURL type or namespace. `invalid_purl_version`: Both or neither version sources were supplied. `invalid_purl_query`: OSV rejected the PURL query. `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `advisory_not_found`: The selected advisory no longer exists. `invalid_ecosystem`: The ecosystem string is not recognized by OSV. Ecosystem names are case-sensitive exact matches. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"vulns": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"summary",
"aliases",
"severity",
"severityLabel",
"severitySource",
"fixedVersions",
"affectedRanges",
"cweIds",
"published",
"modified"
],
"properties": {
"id": {
"type": "string",
"description": "OSV vulnerability ID (e.g. \"GHSA-29mw-wpgm-hmr9\", \"PYSEC-2024-1\"). Pass to osv_get_vulnerability to retrieve the full advisory record."
},
"cweIds": {
"type": "array",
"items": {
"type": "string",
"description": "A CWE ID string."
},
"description": "CWE weakness IDs (e.g. [\"CWE-79\", \"CWE-94\"]). Populated on GHSA-sourced records; empty otherwise."
},
"aliases": {
"type": "array",
"items": {
"type": "string",
"description": "A CVE ID or other alias."
},
"description": "Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."
},
"summary": {
"type": "string",
"description": "One-line vulnerability description."
},
"modified": {
"type": "string",
"description": "ISO 8601 timestamp of last modification."
},
"severity": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"type": "string",
"description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."
},
"score": {
"type": "string",
"description": "CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"), or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."
}
},
"description": "One record-level severity entry.",
"additionalProperties": false
},
"description": "Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for advisories not yet scored and for advisories that score each affected package separately — severitySource then carries the queried package entry used."
},
"published": {
"type": "string",
"description": "ISO 8601 timestamp when the advisory was published."
},
"fixedVersions": {
"type": "array",
"items": {
"type": "string",
"description": "A version that fixes the vulnerability for the queried package."
},
"description": "Every fixed version the advisory lists for the queried package, in record order. A multi-interval range contributes one per interval (typically one per release line); affectedRanges shows which interval each one closes. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."
},
"severityLabel": {
"type": [
"string",
"null"
],
"description": "Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses the queried package's affected-level severity entries when the record-level list is empty. Null when no source yields a label."
},
"affectedRanges": {
"type": "array",
"items": {
"type": "object",
"required": [
"packageName",
"ecosystem",
"rangeType"
],
"properties": {
"repo": {
"type": "string",
"description": "Source repository URL for GIT ranges. Absent on version ranges."
},
"fixed": {
"type": "string",
"description": "The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."
},
"events": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"value"
],
"properties": {
"type": {
"type": "string",
"description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\"."
},
"value": {
"type": "string",
"description": "Version string or commit identifier at this boundary."
}
},
"description": "One ordered range event.",
"additionalProperties": false
},
"description": "Ordered event boundaries for this range — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse."
},
"versions": {
"type": "array",
"items": {
"type": "string",
"description": "An explicitly-listed affected version."
},
"description": "Explicit affected versions listed on this package entry. Absent or empty when affected versions are expressed only as ranges."
},
"ecosystem": {
"type": "string",
"description": "Affected package ecosystem. Empty for source-only advisory ranges."
},
"rangeType": {
"type": "string",
"description": "\"SEMVER\", \"ECOSYSTEM\", or \"GIT\"."
},
"introduced": {
"type": "string",
"description": "First affected version (convenience view — see events[])."
},
"packageName": {
"type": "string",
"description": "Affected package name (may differ from queried name for umbrella advisories). Empty for source-only advisory ranges."
},
"lastAffected": {
"type": "string",
"description": "Last affected version. Present when no fix exists (convenience view — see events[])."
}
},
"description": "One affected version range.",
"additionalProperties": false
},
"description": "Version ranges affected by this vulnerability."
},
"severitySource": {
"anyOf": [
{
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"enum": [
"database_specific",
"Ubuntu",
"CVSS_V3",
"CVSS_V4"
],
"type": "string",
"description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector."
},
"score": {
"type": "string",
"description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector."
},
"computedScore": {
"type": "number",
"description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources."
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "The severity entry severityLabel was derived from. Null exactly when the label is."
}
},
"description": "One vulnerability record.",
"additionalProperties": false
},
"description": "Vulnerabilities matching this package version. An empty array means no known vulnerabilities ONLY when truncated is false."
},
"notice": {
"type": "string",
"description": "Present on the clean path — confirms no known vulnerabilities for the queried package."
},
"preview": {
"type": "object",
"description": "Compact view; overflow identifies omissions. This is not the complete record.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"overflow": {
"type": "object",
"required": [
"complete",
"omitted",
"page",
"notice"
],
"properties": {
"page": {
"type": "object",
"required": [
"path",
"offset"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Transmission omission and fresh re-fetch semantics."
},
"omitted": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "An oversized child; parent offset advances past this descriptor.",
"additionalProperties": false
},
"description": "Omitted values, all addressable through page.path."
},
"complete": {
"type": "array",
"items": {
"type": "string"
},
"description": "Complete top-level fields retained in this response."
}
},
"description": "Transmission overflow disclosure; independent of upstream truncation.",
"additionalProperties": false
},
"queryMeta": {
"type": "object",
"required": [
"package",
"ecosystem",
"version",
"vulnCount"
],
"properties": {
"purl": {
"type": "string",
"description": "Original PURL when used instead of the package tuple."
},
"package": {
"type": "string",
"description": "Queried package name."
},
"version": {
"type": "string",
"description": "Queried version."
},
"ecosystem": {
"type": "string",
"description": "Queried ecosystem."
},
"vulnCount": {
"type": "number",
"description": "Number of vulnerabilities found."
}
},
"description": "Query parameters as submitted.",
"additionalProperties": false
},
"truncated": {
"type": "boolean",
"description": "True when OSV returned more result pages than the fetch cap could follow — the vulnerability list may be INCOMPLETE. A truncated empty list is NOT a clean result; raise OSV_QUERY_MAX_PAGES or narrow the query."
},
"effectiveQuery": {
"type": "string",
"description": "The package@version (ecosystem) tuple as queried, echoed for content-only clients."
}
},
"additionalProperties": false
}osv_query_package annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}osv_get_vulnerability — Osv Get Vulnerability
Advertised read-only
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.
osv_get_vulnerability input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$",
"description": "One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."
},
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.",
"additionalProperties": false
}
},
"additionalProperties": false
}osv_get_vulnerability output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
}
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"id": {
"type": "string",
"description": "OSV vulnerability ID."
},
"page": {
"type": "object",
"required": [
"path",
"type",
"offset",
"total",
"nextOffset",
"revision",
"notice"
],
"properties": {
"path": {
"type": "string",
"description": "Addressed JSON pointer."
},
"text": {
"type": "string",
"description": "Verbatim Unicode code-point slice for strings."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Addressed value kind."
},
"total": {
"type": "number",
"description": "Total entries or Unicode code points."
},
"notice": {
"type": "string",
"description": "Fresh re-fetch disclosure; no saved historical snapshot."
},
"offset": {
"type": "number",
"description": "Starting entry or code-point offset."
},
"entries": {
"type": "array",
"items": {
"type": "object",
"required": [
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Object key or original array index."
},
"value": {
"description": "Complete child value, unmodified."
},
"deferred": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "Retrievable child descriptor when its value does not fit.",
"additionalProperties": false
}
},
"description": "One source entry, complete or deferred.",
"additionalProperties": false
},
"description": "Source-order entries for arrays, objects and scalars."
},
"revision": {
"type": "string",
"description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order."
},
"nextOffset": {
"type": [
"number",
"null"
],
"description": "Next offset, strictly greater or null when finished."
}
},
"description": "One bounded page of an addressed normalized node.",
"additionalProperties": false
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"invalid_page_path",
"stale_page_revision",
"vulnerability_not_found"
],
"description": "Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node changed after its revision was announced. `vulnerability_not_found`: The requested OSV ID does not exist in the database. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"cweIds": {
"type": "array",
"items": {
"type": "string",
"description": "A CWE weakness ID."
},
"description": "CWE weakness classifications (e.g. [\"CWE-79\"]). Present on GitHub Advisory Database records; empty otherwise."
},
"aliases": {
"type": "array",
"items": {
"type": "string",
"description": "An alternative ID (usually a CVE ID)."
},
"description": "Alternative IDs — usually CVE IDs. Accepted by nvd_get_cve on nist-nvd-mcp-server for CVSS base score and CISA KEV status."
},
"details": {
"type": "string",
"description": "Full advisory text, typically in Markdown. May include proof-of-concept, reproduction steps, or remediation guidance."
},
"preview": {
"type": "object",
"description": "Compact view; overflow identifies omissions. This is not the complete record.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"summary": {
"type": "string",
"description": "One-line advisory description."
},
"affected": {
"type": "array",
"items": {
"type": "object",
"required": [
"packageName",
"ecosystem",
"ranges"
],
"properties": {
"purl": {
"type": "string",
"description": "Package URL (e.g. \"pkg:npm/lodash\")."
},
"ranges": {
"type": "array",
"items": {
"type": "object",
"required": [
"rangeType"
],
"properties": {
"repo": {
"type": "string",
"description": "Source repository URL for GIT ranges. Absent on version ranges."
},
"fixed": {
"type": "string",
"description": "The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."
},
"events": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"value"
],
"properties": {
"type": {
"type": "string",
"description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\"."
},
"value": {
"type": "string",
"description": "Version string or commit identifier at this boundary."
}
},
"description": "One ordered range event.",
"additionalProperties": false
},
"description": "Ordered event boundaries defining the affected interval(s) — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse."
},
"rangeType": {
"type": "string",
"description": "\"SEMVER\", \"ECOSYSTEM\", or \"GIT\"."
},
"introduced": {
"type": "string",
"description": "First affected version (convenience view — the last \"introduced\" event; see events[] for full interval order)."
},
"lastAffected": {
"type": "string",
"description": "Last affected version when no fix exists (convenience view — see events[])."
}
},
"description": "One version range.",
"additionalProperties": false
},
"description": "Version ranges affected."
},
"severity": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"type": "string",
"description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."
},
"score": {
"type": "string",
"description": "CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."
}
},
"description": "One package-level severity entry.",
"additionalProperties": false
},
"description": "Severity entries scoped to this package. Present only when the advisory scores packages separately; the record-level severity is then empty."
},
"versions": {
"type": "array",
"items": {
"type": "string",
"description": "An explicitly-listed affected version."
},
"description": "Explicit affected versions enumerated by the advisory. Absent or empty when affected versions are expressed only as ranges."
},
"ecosystem": {
"type": "string",
"description": "Affected package ecosystem. Empty for source-only advisories."
},
"packageName": {
"type": "string",
"description": "Affected package name. Empty for source-only advisories (GIT ranges with no package identity)."
}
},
"description": "One affected package entry.",
"additionalProperties": false
},
"description": "All affected packages and their version ranges. An advisory may span multiple packages or ecosystems."
},
"modified": {
"type": "string",
"description": "ISO 8601 timestamp of last modification."
},
"overflow": {
"type": "object",
"required": [
"complete",
"omitted",
"page",
"notice"
],
"properties": {
"page": {
"type": "object",
"required": [
"path",
"offset"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Transmission omission and fresh re-fetch semantics."
},
"omitted": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "An oversized child; parent offset advances past this descriptor.",
"additionalProperties": false
},
"description": "Omitted values, all addressable through page.path."
},
"complete": {
"type": "array",
"items": {
"type": "string"
},
"description": "Complete top-level fields retained in this response."
}
},
"description": "Transmission overflow disclosure; independent of upstream truncation.",
"additionalProperties": false
},
"severity": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"type": "string",
"description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."
},
"score": {
"type": "string",
"description": "CVSS vector string, or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."
}
},
"description": "One record-level severity entry.",
"additionalProperties": false
},
"description": "Record-level severity entries (CVSS vectors, Ubuntu priorities). Empty for unscored advisories and for advisories that score each affected package separately."
},
"published": {
"type": "string",
"description": "ISO 8601 timestamp when published."
},
"withdrawn": {
"type": "string",
"description": "ISO 8601 timestamp when this advisory was withdrawn. Present ONLY on withdrawn advisories — a withdrawn record has been retracted and must not be treated as an active vulnerability."
},
"references": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "URL of the reference."
},
"type": {
"type": "string",
"description": "Reference type: \"ADVISORY\", \"WEB\", \"PACKAGE\", \"REPORT\", \"FIX\", \"GIT\", etc."
}
},
"description": "One reference entry.",
"additionalProperties": false
},
"description": "Advisory references — NVD links, patches, vendor advisories, PoC reports."
},
"schemaVersion": {
"type": "string",
"description": "OSV schema version this record conforms to (e.g. \"1.7.3\")."
},
"severityLabel": {
"type": [
"string",
"null"
],
"description": "Severity label (\"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\") from the first source that yields one: database_specific.severity, an Ubuntu priority, then the highest CVSS v3/v4 score (0.1–3.9 LOW, 4.0–6.9 MODERATE, 7.0–8.9 HIGH, 9.0–10.0 CRITICAL). Uses every affected package severity entry when the record-level list is empty. Null when no source yields a label."
},
"severitySource": {
"anyOf": [
{
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"enum": [
"database_specific",
"Ubuntu",
"CVSS_V3",
"CVSS_V4"
],
"type": "string",
"description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector."
},
"score": {
"type": "string",
"description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector."
},
"computedScore": {
"type": "number",
"description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources."
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "The severity entry severityLabel was derived from. Null exactly when the label is."
}
},
"additionalProperties": false
}osv_get_vulnerability annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}osv_query_batch — Osv Query Batch
Advertised read-only
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
osv_query_batch input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"packages"
],
"properties": {
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision.",
"additionalProperties": false
},
"packages": {
"type": "array",
"items": {
"anyOf": [
{
"type": "object",
"required": [
"name",
"ecosystem",
"version"
],
"properties": {
"name": {
"type": "string",
"pattern": "\\S",
"description": "Exact package name in its ecosystem."
},
"purl": {
"type": "string",
"description": "Use purl instead of the tuple, never together with name or ecosystem."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact installed version from the lockfile, never a range. npm/crates.io require three numeric components with optional prerelease/build metadata or leading v; = and == exact pins are normalized."
},
"ecosystem": {
"type": "string",
"pattern": "\\S",
"description": "Case-sensitive ecosystem identifier from osv_list_ecosystems."
}
},
"description": "Exact package tuple."
},
{
"type": "object",
"required": [
"purl"
],
"properties": {
"purl": {
"type": "string",
"description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once."
},
"version": {
"type": "string",
"pattern": "\\S",
"description": "Exact installed version only when the PURL does not embed one; the same ecosystem-specific version rules apply."
}
},
"description": "PURL alternative with exactly one version source.",
"additionalProperties": false
}
],
"description": "One package to audit."
},
"maxItems": 1000,
"minItems": 1,
"description": "Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i]."
}
},
"additionalProperties": false
}osv_query_batch output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
}
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"page": {
"type": "object",
"required": [
"path",
"type",
"offset",
"total",
"nextOffset",
"revision",
"notice"
],
"properties": {
"path": {
"type": "string",
"description": "Addressed JSON pointer."
},
"text": {
"type": "string",
"description": "Verbatim Unicode code-point slice for strings."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Addressed value kind."
},
"total": {
"type": "number",
"description": "Total entries or Unicode code points."
},
"notice": {
"type": "string",
"description": "Fresh re-fetch disclosure; no saved historical snapshot."
},
"offset": {
"type": "number",
"description": "Starting entry or code-point offset."
},
"entries": {
"type": "array",
"items": {
"type": "object",
"required": [
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Object key or original array index."
},
"value": {
"description": "Complete child value, unmodified."
},
"deferred": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "Retrievable child descriptor when its value does not fit.",
"additionalProperties": false
}
},
"description": "One source entry, complete or deferred.",
"additionalProperties": false
},
"description": "Source-order entries for arrays, objects and scalars."
},
"revision": {
"type": "string",
"description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order."
},
"nextOffset": {
"type": [
"number",
"null"
],
"description": "Next offset, strictly greater or null when finished."
}
},
"description": "One bounded page of an addressed normalized node.",
"additionalProperties": false
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"invalid_page_path",
"stale_page_revision"
],
"description": "Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node or input order changed. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"notice": {
"type": "string",
"description": "Present on all-clean or all-errors batches — the aggregate outcome for content-only clients."
},
"preview": {
"type": "object",
"description": "Compact view; overflow identifies omissions. This is not the complete record.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"results": {
"type": "array",
"items": {
"type": "object",
"required": [
"name",
"ecosystem",
"version",
"vulnerable",
"truncated",
"error",
"vulnCount",
"vulns"
],
"properties": {
"name": {
"type": "string",
"description": "Package name from input."
},
"purl": {
"type": "string",
"description": "Original PURL when supplied; name, ecosystem and version show its effective coordinate on success."
},
"error": {
"type": [
"string",
"null"
],
"description": "Per-package error message (e.g. invalid ecosystem). Null on success."
},
"vulns": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"summary",
"aliases",
"severityLabel",
"fixedVersions"
],
"properties": {
"id": {
"type": "string",
"description": "OSV vulnerability ID."
},
"aliases": {
"type": "array",
"items": {
"type": "string",
"description": "A CVE ID or other alias."
},
"description": "CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."
},
"summary": {
"type": "string",
"description": "One-line advisory description."
},
"fixedVersions": {
"type": "array",
"items": {
"type": "string",
"description": "A version that fixes the vulnerability for this package."
},
"description": "Every fixed version the advisory lists for this row's package, in record order — one per affected interval, typically one per release line. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."
},
"severityLabel": {
"type": [
"string",
"null"
],
"description": "Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null. Same derivation as osv_query_package: database_specific.severity, then an Ubuntu priority, then the highest CVSS v3/v4 score, using this row's package-level severity entries when the record has none."
}
},
"description": "One vulnerability found for this package.",
"additionalProperties": false
},
"description": "Vulnerabilities found. Empty array when clean."
},
"version": {
"type": "string",
"description": "Version from input."
},
"ecosystem": {
"type": "string",
"description": "Ecosystem from input."
},
"truncated": {
"type": "boolean",
"description": "True when OSV paginated beyond the fetch cap for this package — its result may be INCOMPLETE. A truncated row with no vulnerabilities is NOT confirmed clean."
},
"vulnCount": {
"type": "number",
"description": "Number of vulnerabilities found. 0 when not vulnerable or on error."
},
"vulnerable": {
"type": "boolean",
"description": "True if any vulnerabilities were found."
}
},
"description": "Result for one package.",
"additionalProperties": false
},
"description": "Per-package results, positionally matching the input array."
},
"summary": {
"type": "object",
"required": [
"totalPackages",
"vulnerableCount",
"cleanCount",
"truncatedCount",
"errorCount",
"vulnerableRows",
"errorRows",
"truncatedRows",
"totalVulns",
"worstSeverity"
],
"properties": {
"errorRows": {
"type": "array",
"items": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Zero-based original input index."
},
"description": "Ascending indices of errored rows; may overlap truncatedRows."
},
"cleanCount": {
"type": "number",
"description": "Packages confirmed clean — no vulnerabilities, no error, and not truncated."
},
"errorCount": {
"type": "number",
"description": "Packages that returned an error (e.g. invalid ecosystem)."
},
"totalVulns": {
"type": "number",
"description": "Total vulnerability instances across all packages (may double-count shared advisories)."
},
"totalPackages": {
"type": "number",
"description": "Total packages queried."
},
"truncatedRows": {
"type": "array",
"items": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Zero-based original input index."
},
"description": "Ascending indices of upstream-truncated rows, including vulnerable and errored rows."
},
"worstSeverity": {
"type": [
"string",
"null"
],
"description": "Highest severity label seen across all findings, or null if no severity data available."
},
"truncatedCount": {
"type": "number",
"description": "Packages whose OSV results were truncated (may be incomplete). A truncated package with no findings is NOT counted as clean."
},
"vulnerableRows": {
"type": "array",
"items": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "Zero-based original input index."
},
"description": "Ascending indices of vulnerable rows; may overlap truncatedRows."
},
"vulnerableCount": {
"type": "number",
"description": "Packages with at least one vulnerability."
}
},
"description": "Aggregate statistics across the full batch.",
"additionalProperties": false
},
"overflow": {
"type": "object",
"required": [
"complete",
"omitted",
"page",
"notice"
],
"properties": {
"page": {
"type": "object",
"required": [
"path",
"offset"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Transmission omission and fresh re-fetch semantics."
},
"omitted": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "An oversized child; parent offset advances past this descriptor.",
"additionalProperties": false
},
"description": "Omitted values, all addressable through page.path."
},
"complete": {
"type": "array",
"items": {
"type": "string"
},
"description": "Complete top-level fields retained in this response."
}
},
"description": "Transmission overflow disclosure; independent of upstream truncation.",
"additionalProperties": false
},
"effectiveQuery": {
"type": "string",
"description": "Compact scan summary (package and outcome counts), echoed on edge-case batches for content-only clients."
}
},
"additionalProperties": false
}osv_query_batch annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}osv_query_commit — Osv Query Commit
Advertised read-only
Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.
osv_query_commit input schema
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"commit"
],
"properties": {
"page": {
"type": "object",
"required": [
"path"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original commit with page: overflow.page first, then select path, offset: page.nextOffset and revision: page.revision.",
"additionalProperties": false
},
"commit": {
"type": "string",
"pattern": "^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$",
"description": "Full Git commit hash: 40 SHA-1 or 64 SHA-256 hex characters, case-insensitive."
}
},
"additionalProperties": false
}osv_query_commit output schema
{
"type": "object",
"anyOf": [
{
"not": {
"required": [
"error"
]
}
},
{
"required": [
"error"
]
}
],
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"page": {
"type": "object",
"required": [
"path",
"type",
"offset",
"total",
"nextOffset",
"revision",
"notice"
],
"properties": {
"path": {
"type": "string",
"description": "Addressed JSON pointer."
},
"text": {
"type": "string",
"description": "Verbatim Unicode code-point slice for strings."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Addressed value kind."
},
"total": {
"type": "number",
"description": "Total entries or Unicode code points."
},
"notice": {
"type": "string",
"description": "Fresh re-fetch disclosure; no saved historical snapshot."
},
"offset": {
"type": "number",
"description": "Starting entry or code-point offset."
},
"entries": {
"type": "array",
"items": {
"type": "object",
"required": [
"key"
],
"properties": {
"key": {
"type": "string",
"description": "Object key or original array index."
},
"value": {
"description": "Complete child value, unmodified."
},
"deferred": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "Retrievable child descriptor when its value does not fit.",
"additionalProperties": false
}
},
"description": "One source entry, complete or deferred.",
"additionalProperties": false
},
"description": "Source-order entries for arrays, objects and scalars."
},
"revision": {
"type": "string",
"description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order."
},
"nextOffset": {
"type": [
"number",
"null"
],
"description": "Next offset, strictly greater or null when finished."
}
},
"description": "One bounded page of an addressed normalized node.",
"additionalProperties": false
},
"error": {
"type": "object",
"required": [
"code",
"message"
],
"properties": {
"code": {
"type": "integer",
"maximum": 9007199254740991,
"minimum": -9007199254740991,
"description": "JSON-RPC error code for this failure."
},
"data": {
"type": "object",
"properties": {
"reason": {
"type": "string",
"examples": [
"invalid_commit_query",
"invalid_page_path",
"stale_page_revision"
],
"description": "Machine-readable failure mode. Declared by this tool: `invalid_commit_query`: OSV rejects the complete commit query. `invalid_page_path`: The requested field is unknown or cannot fit a bounded page. `stale_page_revision`: The freshly retrieved node changed. Other values are possible when a failure originates below the handler."
},
"recovery": {
"type": "object",
"required": [
"hint"
],
"properties": {
"hint": {
"type": "string"
}
},
"description": "Actionable next step for the caller.",
"additionalProperties": {}
},
"retryable": {
"type": "boolean",
"description": "Whether retrying may succeed."
}
},
"additionalProperties": {}
},
"message": {
"type": "string",
"description": "Human-readable description of what went wrong."
}
},
"description": "Present when the call failed. Absent on success.",
"additionalProperties": {}
},
"vulns": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"summary",
"aliases",
"severity",
"severityLabel",
"severitySource",
"affectedRanges",
"cweIds",
"published",
"modified"
],
"properties": {
"id": {
"type": "string",
"description": "OSV vulnerability ID (e.g. \"GHSA-29mw-wpgm-hmr9\", \"PYSEC-2024-1\"). Pass to osv_get_vulnerability to retrieve the full advisory record."
},
"cweIds": {
"type": "array",
"items": {
"type": "string",
"description": "A CWE ID string."
},
"description": "CWE weakness IDs (e.g. [\"CWE-79\", \"CWE-94\"]). Populated on GHSA-sourced records; empty otherwise."
},
"aliases": {
"type": "array",
"items": {
"type": "string",
"description": "A CVE ID or other alias."
},
"description": "Alternative IDs — typically CVE IDs (e.g. [\"CVE-2020-28500\"]). Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."
},
"summary": {
"type": "string",
"description": "One-line vulnerability description."
},
"modified": {
"type": "string",
"description": "ISO 8601 timestamp of last modification."
},
"severity": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"type": "string",
"description": "Severity type: \"CVSS_V3\", \"CVSS_V4\", \"CVSS_V2\", or \"Ubuntu\"."
},
"score": {
"type": "string",
"description": "CVSS vector string (e.g. \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"), or the Ubuntu priority (e.g. \"medium\") for type \"Ubuntu\"."
}
},
"description": "One record-level severity entry.",
"additionalProperties": false
},
"description": "Record-level severity entries. Empty when severity is available only on affected entries; severitySource identifies the derived label basis."
},
"published": {
"type": "string",
"description": "ISO 8601 timestamp when the advisory was published."
},
"severityLabel": {
"type": [
"string",
"null"
],
"description": "Record-wide severity label, using every affected entry when record-level severity is empty. Null when no source yields a label."
},
"affectedRanges": {
"type": "array",
"items": {
"type": "object",
"required": [
"packageName",
"ecosystem",
"rangeType"
],
"properties": {
"repo": {
"type": "string",
"description": "Source repository URL for GIT ranges. Absent on version ranges."
},
"fixed": {
"type": "string",
"description": "The last \"fixed\" event of this range (convenience view — a multi-interval range carries several; see events[])."
},
"events": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"value"
],
"properties": {
"type": {
"type": "string",
"description": "Event boundary type: \"introduced\", \"fixed\", \"last_affected\", or \"limit\"."
},
"value": {
"type": "string",
"description": "Version string or commit identifier at this boundary."
}
},
"description": "One ordered range event.",
"additionalProperties": false
},
"description": "Ordered event boundaries for this range — the loss-free view preserving multiple introduced/fixed pairs the scalar fields collapse."
},
"versions": {
"type": "array",
"items": {
"type": "string",
"description": "An explicitly-listed affected version."
},
"description": "Explicit affected versions listed on this package entry. Absent or empty when affected versions are expressed only as ranges."
},
"ecosystem": {
"type": "string",
"description": "Affected package ecosystem. Empty for source-only advisory ranges."
},
"rangeType": {
"type": "string",
"description": "\"SEMVER\", \"ECOSYSTEM\", or \"GIT\"."
},
"introduced": {
"type": "string",
"description": "First affected version (convenience view — see events[])."
},
"packageName": {
"type": "string",
"description": "Affected package name (may differ from queried name for umbrella advisories). Empty for source-only advisory ranges."
},
"lastAffected": {
"type": "string",
"description": "Last affected version. Present when no fix exists (convenience view — see events[])."
}
},
"description": "One affected version range.",
"additionalProperties": false
},
"description": "Version ranges affected by this vulnerability."
},
"severitySource": {
"anyOf": [
{
"type": "object",
"required": [
"type",
"score"
],
"properties": {
"type": {
"enum": [
"database_specific",
"Ubuntu",
"CVSS_V3",
"CVSS_V4"
],
"type": "string",
"description": "Source kind: the database_specific.severity label, an Ubuntu priority, or a CVSS vector."
},
"score": {
"type": "string",
"description": "The published value the label came from: the database_specific.severity text, the Ubuntu priority, or the CVSS vector."
},
"computedScore": {
"type": "number",
"description": "CVSS score computed from the vector as published: a CVSS 4.0 vector over every metric group it carries (threat and environmental included), a CVSS 3.x vector with its temporal metrics. Present only for CVSS sources."
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "The severity entry severityLabel was derived from. Null exactly when the label is."
}
},
"description": "One commit-matching advisory, without package-specific fixedVersions.",
"additionalProperties": false
},
"description": "Matching advisories. Empty confirms no known vulnerabilities only when truncated is false."
},
"preview": {
"type": "object",
"description": "Compact view; overflow identifies omissions. This is not the complete record.",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
},
"overflow": {
"type": "object",
"required": [
"complete",
"omitted",
"page",
"notice"
],
"properties": {
"page": {
"type": "object",
"required": [
"path",
"offset"
],
"properties": {
"path": {
"type": "string",
"pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
"maxLength": 1024,
"description": "Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."
},
"offset": {
"type": "integer",
"default": 0,
"maximum": 9007199254740991,
"minimum": 0,
"description": "Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."
},
"revision": {
"type": "string",
"pattern": "^[a-f0-9]{64}$",
"description": "Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."
}
},
"description": "Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object.",
"additionalProperties": false
},
"notice": {
"type": "string",
"description": "Transmission omission and fresh re-fetch semantics."
},
"omitted": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"type",
"total"
],
"properties": {
"path": {
"type": "string",
"description": "Exact child pointer to retrieve separately."
},
"type": {
"enum": [
"array",
"object",
"string",
"scalar"
],
"type": "string",
"description": "Child value kind."
},
"total": {
"type": "number",
"description": "Number of child entries or Unicode code points; one for scalars."
}
},
"description": "An oversized child; parent offset advances past this descriptor.",
"additionalProperties": false
},
"description": "Omitted values, all addressable through page.path."
},
"complete": {
"type": "array",
"items": {
"type": "string"
},
"description": "Complete top-level fields retained in this response."
}
},
"description": "Transmission overflow disclosure; independent of upstream truncation.",
"additionalProperties": false
},
"queryMeta": {
"type": "object",
"required": [
"commit",
"vulnCount"
],
"properties": {
"commit": {
"type": "string",
"description": "Full queried Git commit hash."
},
"vulnCount": {
"type": "number",
"description": "Number of advisories retrieved."
}
},
"description": "Effective commit query and retrieved count.",
"additionalProperties": false
},
"truncated": {
"type": "boolean",
"description": "More OSV pages remain beyond the fetch cap; an empty truncated list is not confirmed clean."
}
},
"additionalProperties": false
}osv_query_commit annotations
{
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true
}Prompts
0 advertised
Resources
1 advertised
osv-advisory-guide
Use osv_* tools to audit resolved dependencies or Git commits, retrieve oversized advisory results, and choose package-scoped remediation without mistaking incomplete coverage for a clean scan.
osv-advisory-guide URI
skill://osv-advisory-guide/SKILL.mdio.modelcontextprotocol/skills
io.modelcontextprotocol/skills URI template
skill://{+path}30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 736 ms
- 95th percentile latency
- 736 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 736 ms · metadata changed · 5 tool(s), 1 resource(s), 1 resource template(s), 0 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
Claude Code configuration
claude mcp add --transport http osv-advisory-mcp-server-caseyjhand https://osv-advisory.caseyjhand.com/mcpCodex
Codex configuration
codex mcp add osv-advisory-mcp-server-caseyjhand --url https://osv-advisory.caseyjhand.com/mcpCursor
Cursor configuration
{
"mcpServers": {
"osv-advisory-mcp-server-caseyjhand": {
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}Cline
Cline configuration
{
"mcpServers": {
"osv-advisory-mcp-server-caseyjhand": {
"type": "streamableHttp",
"url": "https://osv-advisory.caseyjhand.com/mcp",
"disabled": false
}
}
}VS Code
VS Code configuration
{
"servers": {
"osv-advisory-mcp-server-caseyjhand": {
"type": "http",
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}Gemini CLI
Gemini CLI configuration
gemini mcp add --transport http osv-advisory-mcp-server-caseyjhand https://osv-advisory.caseyjhand.com/mcpClaude Desktop
Claude Desktop configuration
https://osv-advisory.caseyjhand.com/mcpWindsurf
Windsurf configuration
{
"mcpServers": {
"osv-advisory-mcp-server-caseyjhand": {
"serverUrl": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}Let your agent find its tools
Find servers like osv-advisory-mcp-server from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.