Use this MCP server to OSV open source vulnerability data and package security checks. Tools...
Runs on your machine from its package; the steps are below.
At most: only reads or looks up information.
Odel charges nothing per call. The publisher may charge for its own service.
Runs locally over stdio
This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).
Run
npx -y osv-mcp
MCP client config
{
"mcpServers": {
"osv": {
"command": "npx",
"args": [
"-y",
"osv-mcp"
]
}
}
}Open source vulnerability checks for coding agents. It uses the public OSV.dev API and needs no API key.
check_package checks an ecosystem, package name, and optional versionscan_packages checks several package references in one request; parse lockfiles in your client and pass the package listget_vulnerability retrieves a CVE, GHSA, or OSV recordnpm install
npm run build
node dist/index.js
The server is read only and uses stdio MCP transport.