Osv Advisory Mcp Server
Let your agent query OSV.dev and batch-audit dependency lists before you ship or cut a release candidate.
Overview
io.github.cyanheads/osv-advisory-mcp-server is a MCP server for the Ship phase that queries OSV.dev and batch-audits dependency lists for known vulnerabilities.
What is this MCP server?
- Query OSV.dev for package-version vulnerability advisories through MCP tools
- Batch-audit dependency lists in one agent pass instead of manual CVE tab hopping
- Configurable OSV_REQUEST_TIMEOUT_MS default 10000 ms for API calls
- stdio and streamable-http transports including hosted osv-advisory.caseyjhand.com
- npm @cyanheads/osv-advisory-mcp-server v0.1.4 with Bun-oriented stdio startup
- Catalog version 0.1.4
- npm identifier @cyanheads/osv-advisory-mcp-server
- Default OSV_REQUEST_TIMEOUT_MS 10000
Community signal: 1 GitHub stars.
What problem does it solve?
Shipping with a stale dependency list is easy when CVE hunting is manual and your agent cannot reach a structured advisory API.
Who is it for?
Pre-release agent reviews of package.json, requirements.txt, go.mod, or other manifests against OSV records.
Skip if: Runtime intrusion detection, secrets scanning, or compliance attestations that need enterprise GRC tooling alone.
What do I get? / Deliverables
You get OSV.dev-aligned vulnerability findings on packages and versions so you can patch or pin before release.
- Per-package OSV vulnerability matches with affected and fixed version guidance
- Batch audit summary across a dependency list
- Actionable patch or upgrade notes the agent can turn into PR tasks
Recommended MCP Servers
Journey fit
How it compares
OSV.dev advisory MCP bridge, not a full container image scanner or WAF.
Common Questions / FAQ
Who is io.github.cyanheads/osv-advisory-mcp-server for?
Indie developers and agent users who want OSV.dev vulnerability checks embedded in Ship-phase security reviews.
When should I use io.github.cyanheads/osv-advisory-mcp-server?
Use it before tagging releases or deploying when you need to audit dependencies individually or in batch against OSV advisories.
How do I add io.github.cyanheads/osv-advisory-mcp-server to my agent?
Install @cyanheads/osv-advisory-mcp-server from npm, run stdio with bun start:stdio, set OSV_REQUEST_TIMEOUT_MS if needed, register MCP in your client, or use the streamable-http remote endpoint.