ZBS Index What actually exists in applied AI, with the source next to it

mcp server

osv-advisory-mcp-server

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Description as published by the maintainer. Source

  • version 0.1.12
  • active

active — Most recent push to the repository was 2026-07-30.

What this server can do

4 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.

osv_get_vulnerability(id)
Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance. Required: id.
osv_list_ecosystems
Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static (maintained from the OSV schema spec) and may occasionally lag newly added ecosystems.
osv_query_batch(packages)
Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Required: packages.
osv_query_package(name, version, ecosystem)
Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and first safe version. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. Required: name, ecosystem, version.

Last successful function declaration observed on . Source: https://osv-advisory.caseyjhand.com/mcp. We list what the server declared; we do not call any of these functions.

Endpoint status observed on . Source: https://osv-advisory.caseyjhand.com/mcp.

Signals

These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.

Signal Value What it measures Window Observed Source
GitHub stars 1 Number of GitHub accounts that bookmarked this repository since it was created. It is a bookmark count, not installs, not active users and not quality. cumulative, all time GitHub
Last commit 2026-07-30 Date of the most recent push to any branch. This is the strongest cheap indicator of whether the project is still maintained. point in time GitHub
Open issues 0 Open issues plus open pull requests, as GitHub counts them together. A high number can mean an active project or an abandoned one. as of fetch GitHub
Latest published version 0.1.12 Latest version string the maintainer published to the registry. as of fetch Model Context Protocol
Registry record last updated 2026-07-11 When the registry record was last updated by its maintainer. point in time Model Context Protocol
License Apache-2.0 Licence GitHub detected in the repository. Detection can be wrong; the LICENSE file is authoritative. as of fetch GitHub
First listed in the MCP Registry 2026-07-11 Date this server was first published to the official MCP Registry. Not a usage or quality measure. point in time Model Context Protocol
repository status active The repository exists on GitHub and is not archived. This says nothing about how recently it was worked on. as of fetch GitHub
mcp tools declared 4 tools Number of functions the server itself declared when asked to list them. This is what the server offers an agent, not a measure of how well any of them work. as of probe osv-advisory.caseyjhand.com
mcp endpoint status ok The server listed 4 functions when asked. as of probe osv-advisory.caseyjhand.com

Where to get it

Related, by what their authors tagged them

  • Closeread Verify — last commit 2026-06-11, shares osv, security, vulnerability
    A verified dependency-audit verdict any AI agent can call over MCP, not a raw scan.
  • Bomly — last commit 2026-08-03, shares devsecops, osv, sbom
    Give your coding agent the dependency graph it is about to change: scan, diff, explain, audit
  • io.github.cyanheads/nist-nvd-mcp-server — last commit 2026-07-31, shares security, vulnerability
    Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
  • TridentChain Security — last commit 2026-07-29, shares osv, security
    Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.
  • Fetter MCP — last commit 2026-02-26, shares vulnerability
    Real-time Python package and vulnerability data for AI coding agents.
  • io.github.CSOAI-ORG/sbom-cyclonedx-mcp — last commit 2026-06-26, shares sbom, security
    Software Bill of Materials generation + validation in CycloneDX 1.6 and SPDX 2.3 formats. Requir...
  • io.github.CSOAI-ORG/ai-bom-mcp — last commit 2026-06-26, shares sbom
    AI Bill of Materials (AI-BOM) generator + auditor MCP — CycloneDX ML-BOM, SPDX 3.0 AI profile, E...
  • io.github.CSOAI-ORG/cra-compliance-mcp — last commit 2026-06-26, shares sbom
    EU Cyber Resilience Act (Regulation 2024/2847) compliance for AI agents. Product classification...
  • Draugr — last commit 2026-08-06, shares devsecops, security
    Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
  • emisar — last commit 2026-08-06, shares devsecops, security
    Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.

These share tags the maintainers applied themselves, such as osv, security, vulnerability, devsecops. Common tags like "mcp" or "ai" are ignored for this: agreeing with six hundred other projects is not a similarity.

This is not a recommendation and not a test result. It is a map of what the authors said their work is about.

Also from cyanheads

How the author describes it

Topics the maintainer set on GitHub: ai-agents, ai-tools, cyanheads, devsecops, mcp, mcp-server, model-context-protocol, osv, sbom, security, typescript, vulnerability.

This record as data

Every field on this page, with its source and observation date, is in the catalog JSON. Fetch the whole kind at once instead of parsing this HTML.

GET /api/v1/entries/mcp_server.json

Sources

  1. cyanheads/osv-advisory-mcp-server on GitHub — GitHub, observed , trust tier 3.
  2. Tools declared by the MCP server at https://osv-advisory.caseyjhand.com/mcp — osv-advisory.caseyjhand.com, observed , trust tier 4.
  3. Official MCP Registry — Model Context Protocol, observed , trust tier 1.