Osv Advisory MCP Server

@cyanheads/osv-advisory-mcp-server Query OSV.dev for package vulnerabilities, batch-audit dependency lists, and fetch full advisory records via MCP. STDIO or Streamable HTTP. Its README documents 4 tools, including osv_query_package, osv_query_batch, osv_get_vulnerability.

People who work with cyanheads, devsecops and osv and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-08-25 · ★ 2 · #78 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

Apache-2.0 · TypeScript servers · how we verify → /methodology

01 · Install Osv Advisory MCP Server

before you install - you'll need

Set MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL before connecting.

Claude Code

claude mcp add cyanheads-osv-advisory-mcp-server --transport http https://osv-advisory.caseyjhand.com/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "cyanheads-osv-advisory-mcp-server": {
      "url": "https://osv-advisory.caseyjhand.com/mcp"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://osv-advisory.caseyjhand.com/mcp

transport: streamable-http

endpoint alive - responded to MCP initialize · probed 2026-09-17

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions · remote - your agent's requests go to osv-advisory.caseyjhand.com

endpoint auth accepted our unauthenticated MCP initialize - no credentials needed to connect

license Apache-2.0 - declared in the repository

npm package @cyanheads/osv-advisory-mcp-server - published under the repo owner's npm scope (@cyanheads)

registry namespace io.github.cyanheads is GitHub-verified and matches the repo owner

03 · What Osv Advisory MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can query known vulnerabilities for a single package version by name, ecosystem, and version, and fetch the full advisory record for a single OSV vulnerability ID.

The 4 tools it gives your agent

Extracted from the project's README - what osv-advisory-mcp-server lets an agent do.

osv_query_package: - Query known vulnerabilities for a single package version by name, ecosystem, and version
osv_query_batch: - Batch vulnerability query for an array of package tuples - one call for a full dependency list or SBOM audit
osv_get_vulnerability: - Fetch the full advisory record for a single OSV vulnerability ID
osv_list_ecosystems: - Return the list of supported ecosystem identifier strings

Latest releases

v0.1.13 · 2026-08-25

MCP 2026 protocol and resilient OSV requests · Serves MCP 2026-07-28 alongside the sessionful 2025 protocol arm and rejects undeclared top-level tool keys before handlers run. · Uses explicit stateless HTTP deployment…

v0.1.12 · 2026-07-11

Canonical OSV ecosystem set, blank-input rejection · Corrects the osv_list_ecosystems static catalog and hardens input validation across the query and lookup tools. · Changed: · osv_list_ecosystems now returns the…

v0.1.11 · 2026-07-11

Affected-range data, withdrawn status, and paginated queries · Three data-fidelity fixes: complete affected-range data, withdrawn-advisory disclosure, and OSV pagination handling. · Fixed: · osv_get_vulnerability…

04 · Who maintains Osv Advisory MCP Server

osv-advisory-mcp-server is maintained by cyanheads. We track 125 MCP servers from cyanheads - 119 actively maintained, 1,816 combined GitHub stars, oldest repo from Dec 2024. Full record: all servers from cyanheads.

05 · Facts

repository: github.com/cyanheads/osv-advisory-mcp-server
category: security - ranked #78 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 8 releases in the last 90 days (latest 2026-08-25)
registry: io.github.cyanheads/osv-advisory-mcp-server (active, first published 2026-05-30 · 14 versions)
packages: npm:@cyanheads/osv-advisory-mcp-server · npm:@cyanheads/osv-advisory-mcp-server

06 · Osv Advisory MCP Server FAQ

Is Osv Advisory MCP Server still maintained?

Yes - as of 2026-09-18, its last commit was 2026-08-25 and it shipped 8 releases in the last 90 days. We re-verify nightly.

What can Osv Advisory MCP Server do?

How do I install Osv Advisory MCP Server?

Run `npx -y @cyanheads/osv-advisory-mcp-server`. The README documents 2 environment variables (MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL) to set first. Set MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL before connecting. You can also paste the ready-made client config above.

Does Osv Advisory MCP Server require authentication?

No - the endpoint accepted our unauthenticated MCP initialize when probed on 2026-09-17; you can connect without credentials.

07 · Alternatives to Osv Advisory MCP Server

Alternatives to Osv Advisory MCP Server

Maintained security servers if Osv Advisory MCP Server isn't the fit.

Pairs well with

Servers that cover what Osv Advisory MCP Server doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Cybercentry Verification · Clipboard History MCP · Google Ads MCP · Excalidraw

More TypeScript MCP servers · Paleobiology MCP Server · Pixoo MCP Server · Protein MCP Server · Pubchem MCP Server · Pubmed MCP Server · see all