How do I install the osv mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `MCP_TRANSPORT_TYPE`, `MCP_LOG_LEVEL`, `MCP_HTTP_ENDPOINT_PATH`, `MCP_PUBLIC_URL` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Osv MCP Server

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Remote serverstreamable-httpPython

What is the Osv MCP Server?

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

The short version

Declarative tool definitions — single file per tool, framework handles registration and validation
Unified error handling — handlers throw, framework catches, classifies, and formats
Pluggable auth: none, jwt, oauth
Swappable storage backends: in-memory, filesystem, Supabase, Cloudflare KV/R2/D1
Structured logging with optional OpenTelemetry tracing
STDIO and Streamable HTTP transports

What it needs from you

Bun v1.3.0 or higher (or Node.js v24+). - No API key required — OSV.dev is fully public.

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
osv_query_package	Query known vulnerabilities for a single package version by name, ecosystem, and version
osv_query_batch	Batch vulnerability query for an array of package tuples — one call for a full dependency list or SBOM audit
osv_get_vulnerability	Fetch the full advisory record for a single OSV vulnerability ID
osv_list_ecosystems	Return the list of supported ecosystem identifier strings

How to install the Osv MCP Server

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "type": "streamable-http",
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

Bun v1.3.0 or higher (or Node.js v24+). - No API key required — OSV.dev is fully public.

Variable	Description	Required
MCP_TRANSPORT_TYPE	Configuration value read at startup.	Optional
MCP_LOG_LEVEL	Configuration value read at startup.	Optional
MCP_HTTP_ENDPOINT_PATH	Filesystem location the server is allowed to use.	Optional
MCP_PUBLIC_URL	Endpoint or connection string the server talks to.	Yes

Example prompts to try

“Use Osv to osv query package.”
“Use Osv to osv query batch.”
“Use Osv to osv get vulnerability.”

Frequently asked questions

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.

Alternatives to the Osv MCP Server

NVD Database

Queries the NIST National Vulnerability Database (NVD) via its API.

DatabasesPython★ 14

Cursor Trivy

Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.

Security & IdentityPython★ 10

3ilm-mcp

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Security & Identity

A2adependencyinspector-mcp

Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi

Security & IdentityRemote

A2areplayreceipt-mcp

Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.