Osv MCP Server

Osv mcp mcp server connects Osv MCP to AI assistants that speak the Model Context Protocol. An MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database.

What Osv MCP does

An MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database.

This project implements an SSE-based MCP server that allows LLM-powered applications to query the OSV database for vulnerability information. The server provides tools for:

Tools it exposes

Once connected, the assistant can call these 5 tools directly:

• Prerequisites — The Prerequisites tool exposed by this server
• query_vulnerability — Query for vulnerabilities affecting a specific package version or commit
• query_vulnerabilities_batch — Query for vulnerabilities affecting multiple packages or commits at once
• get_vulnerability — The get_vulnerability tool exposed by this server
• Linting — The Linting tool exposed by this server

Installing the osv mcp mcp server

Setup follows the standard MCP pattern: clone or install the server, then register it in your client's configuration file and restart the client. The configuration snippets on this page cover Claude Desktop, Claude Code and Cursor.

Requirements

• Go 1.21 or later - Task (optional, for running tasks) - ko (optional, for building container images)

Where it fits

Database servers turn schema archaeology and ad-hoc reporting into conversation, which is why they tend to be the second or third server people install. Osv MCP sits in that group, and the shape of its toolset — Prerequisites, query_vulnerability, query_vulnerabilities_batch among others — tells you what it is really for. Worth comparing against the other databases servers in this directory before you commit to one, since several overlap in scope but differ sharply in setup cost and permissions.

Practical notes

• This server runs locally, so it operates with whatever access your machine and its credentials already have. Scope that deliberately rather than by default.
• Maintained by StacklokLabs, written in Go.
• MCP clients ask for confirmation before each tool call by default. Keep that on while you learn what the osv mcp mcp server actually does with your data.
• Every entry in this directory is reviewed by hand before it goes live, and details are checked against the project's own documentation.