MCP Server For OSV
About
An MCP server for querying the OSV (Open Source Vulnerability) database API.
Details
- Author
- EdenYavin
- GitHub stars
- 2
- Downloads
- 168
- Categories
- Other, Database
Jump to
- Query CVE IDs for any package by name and optional version.
- Retrieve all affected versions for a given CVE.
- List all versions that fix a specific CVE.
- Fetch the list of supported package ecosystems.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
MCP Server For OSVCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install it via Smithery (npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude) or clone the repo locally and configure your MCP host with the provided JSON snippet. The server exposes four tools: query_package_cve, query_for_cve_affected, query_for_cve_fix_versions, and get_ecosystems.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"mcp server for osv": {
"osv-mcp-edenyavin": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"@EdenYavin/OSV-MCP",
"--client",
"claude"
]
}
}
}
}McpServers
{
"osv-mcp-edenyavin": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"@EdenYavin/OSV-MCP",
"--client",
"claude"
]
}
}MCP Server For OSV
A lightweight MCP (Model Context Protocol) server for OSV Database API.
Example:
---
Tools Provided
Overview
|name|description| |---|---| |query_package_cve|List all the CVE IDs for a specific package. Specific version can be passed as well for more narrow scope CVE IDs.| |query_for_cve_affected|Query the OSV database for a CVE and return all affected versions of the package.| |query_for_cve_fix_versions|Query the OSV database for a CVE and return all versions that fix the vulnerability.| |get_ecosystems|Query the MCP for current supported ecosystems.Detailed Description
- query_package_cve
- Query the OSV database for a package and return the CVE IDs.
- Input parameters:
- package (string, required): The package name to query
- version (string, optional): The version of the package to query. If not specified, queries all versions
- ecosystem (string, optional): The ecosystem of the package. Defaults to "PyPI" for Python packages
- Returns a list of CVE IDs with their details
- query_for_cve_affected
- Query the OSV database for a CVE and return all affected versions.
- Input parameters:
- cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805")
- Returns a list of affected version strings
- query_for_cve_fix_versions
- Query the OSV database for a CVE and return all versions that fix the vulnerability.
- Input parameters:
- cve (string, required): The CVE ID to query (e.g., "CVE-2018-1000805")
- Returns a list of fixed version strings
- get_ecosystems
- Query for all current supported ecosystems by the MCP servers.
- Return a dict with the key being the ecosystem name and the value the programming language / OS.
---
Prerequisites
1. Python 3.11 or higher: This project requires Python 3.11 or newer.
# Check your Python version
python --version
2. Install uv: A fast Python package installer and resolver.
pip install uv
Or use Homebrew:
brew install uv
---
Tested on
- [X] Cursor
- [X] Claude
---
Installation
1. Via Smithery:
npx -y @smithery/cli install @EdenYavin/OSV-MCP --client claude
2. Locally:
1. Clone the repo: ``https://github.com/EdenYavin/OSV-MCP.git 2. Configure your MCP Host (Cusrsor / Claude Desktop etc.):
json
{
"mcpServers": {
"osv-mcp": {
"command": "uv",
"args": ["--directory", "path-to/OSV-MCP", "run", "osv-server"],
"env": {}
}
}
}
``
---
Leave a review on VibeApp
if you enjoyed it :)!
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
