← Back to search

io.github.cyanheads/osv-advisory-mcp-server

cyanheads streamable_http Scanned 24d ago

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

MCP Registry ↗
B
89.5 / 100

Versions

0.1.0latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 4

osv_query_package
annotations: verified low

Query known vulnerabilities for a single package version across any supported ecosystem.

input object output object package string ecosystem string
readOnlyHint true openWorldHint false idempotentHint true
osv_get_vulnerability
annotations: verified low

Fetch the full advisory record for an OSV vulnerability ID.

id string input object output object summary string modified string published string
readOnlyHint true openWorldHint false idempotentHint true
osv_query_batch
annotations: verified low

Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits,

input object output object totalPackages number vulnerableCount number
readOnlyHint true openWorldHint false idempotentHint true
osv_list_ecosystems
annotations: verified low

Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch.

note string input object output object
readOnlyHint true openWorldHint false idempotentHint true

Permissions 2

shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 17

info
Tool 'osv_query_package' annotations are consistent annotation_checker · 80%
info
Tool 'osv_get_vulnerability' annotations are consistent annotation_checker · 80%
info
Tool 'osv_query_batch' annotations are consistent annotation_checker · 80%
info
Tool 'osv_list_ecosystems' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: osv_query_package manifest_parser · 75%
info
Tool: osv_get_vulnerability manifest_parser · 75%
info
Tool: osv_query_batch manifest_parser · 75%
info
Tool: osv_list_ecosystems manifest_parser · 75%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 11 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-osv-advisory-mcp-server-4ac1889/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%