io.github.cyanheads/osv-advisory-mcp-server

up checked 2026-11-11T09:37:26.245Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided description

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Summary by lookupd

Queries OSV.dev for package and commit vulnerabilities, fetches advisory records, and batch-audits dependency lists for known issues.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http osv-advisory-mcp-server https://osv-advisory.caseyjhand.com/mcp

Claude Code, npm package (stdio)

claude mcp add osv-advisory-mcp-server -- npx -y @cyanheads/osv-advisory-mcp-server

Claude Code, npm package (stdio)

claude mcp add osv-advisory-mcp-server -- npx -y @cyanheads/osv-advisory-mcp-server

Codex, remote (streamable-http)

codex mcp add osv-advisory-mcp-server --url https://osv-advisory.caseyjhand.com/mcp

Codex, npm package (stdio)

codex mcp add osv-advisory-mcp-server -- npx -y @cyanheads/osv-advisory-mcp-server

Codex, npm package (stdio)

codex mcp add osv-advisory-mcp-server -- npx -y @cyanheads/osv-advisory-mcp-server

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/osv-advisory-mcp-server"
      ]
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "osv-advisory-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/osv-advisory-mcp-server"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (5 tools)

Publisher-provided text

• osv_list_ecosystems Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query
• osv_query_package Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version.
• osv_get_vulnerability Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and vers
• osv_query_batch Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {nam
• osv_query_commit Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are r

Changes

Newest first, as lookupd saw them

• 2026-11-11: version 0.4.1 → 0.5.0

Details

• Version: 0.5.0
• Transports: streamable-http, stdio
• Uptime (7 days): 100%
• Median latency: 620 ms
• First indexed: 2026-11-01T09:26:31.091Z
• Last seen in registry: 2026-11-11T13:17:24.130Z
• Repository: https://github.com/cyanheads/osv-advisory-mcp-server

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.cyanheads/osv-advisory-mcp-server.svg)](https://lookupd.com/servers/io.github.cyanheads/osv-advisory-mcp-server)

• 62141 servers
• Last crawl: 2026-11-11T18:17:25.333Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp