Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Most file and storage access work still happens through a UI a human drives. Osv MCP server moves it into the conversation instead. Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
The server publishes 6 tools. What each one is for:
osv_query_package — Query known vulnerabilities for a single package version by name, ecosystem, and versionosv_query_batch — Batch vulnerability query for an array of package tuples — one call for a full dependency list or SBOM auditosv_get_vulnerability — Fetch the full advisory record for a single OSV vulnerability IDosv_list_ecosystems — Return the list of supported ecosystem identifier stringsPrerequisites — The Prerequisites tool exposed by this serverInstallation — The Installation tool exposed by this serverConfiguration is passed through the environment: MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, MCP_HTTP_ENDPOINT_PATH, MCP_PUBLIC_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
This sits in the file and storage access group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Osv's toolset — osv_query_package, osv_query_batch, osv_get_vulnerability and 3 more — is a fair guide to whether it matches your workflow. It is maintained by cyanheads; worth a glance at recent repository activity before you build anything load-bearing on it.
We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.
| Tool | What it does |
|---|---|
| osv_query_package | Query known vulnerabilities for a single package version by name, ecosystem, and version |
| osv_query_batch | Batch vulnerability query for an array of package tuples — one call for a full dependency list or SBOM audit |
| osv_get_vulnerability | Fetch the full advisory record for a single OSV vulnerability ID |
| osv_list_ecosystems | Return the list of supported ecosystem identifier strings |
| Prerequisites | The Prerequisites tool exposed by this server. |
| Installation | The Installation tool exposed by this server. |
{
"mcpServers": {
"osv-advisory-mcp-server": {
"type": "streamable-http",
"url": "https://osv-advisory.caseyjhand.com/mcp"
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| MCP_TRANSPORT_TYPE | Configuration value read at startup. | Optional |
| MCP_LOG_LEVEL | Configuration value read at startup. | Optional |
| MCP_HTTP_ENDPOINT_PATH | Filesystem location the server is allowed to use. | Optional |
| MCP_PUBLIC_URL | Endpoint or connection string the server talks to. | Yes |
Scoped local file access — read, write, search and reorganise files in directories you explicitly allow.
Search and read your Drive — Docs, Sheets and files become context your assistant can actually use.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Chat with your second brain — search, read and write vault notes through the Local REST API.
Connects AI models to an Obsidian knowledge base for direct access and manipulation of notes and folders.