OSV MCP Server
An MCP (Model Context Protocol) server that provides access to the OSV (Open Source Vulnerabilities) database.
Overview
This project implements an SSE-based MCP server that allows LLM-powered applications to query the OSV database for vulnerability information. The server provides tools for:
- Querying vulnerabilities for a specific package version or commit
- Batch querying vulnerabilities for multiple packages or commits
- Getting detailed information about a specific vulnerability by ID
Installation
Prerequisites
Building from source
# Clone the repository
git clone https://github.com/StacklokLabs/osv-mcp.git
cd osv-mcp
# Build the server
task buildUsage
Running with ToolHive (Recommended)
The easiest way to run the OSV MCP server is using ToolHive, which provides secure, containerized deployment of MCP servers:
# Install ToolHive (if not already installed)
# See: https://docs.stacklok.com/toolhive/guides-cli/install
# Register a supported client so ToolHive can auto-configure your environment
thv client setup
# Run the OSV MCP server (packaged as 'osv' in ToolHive)
thv run osv
# List running servers
thv list
# Get detailed information about the server
thv registry info osv
