osv-advisory-mcp-server

endpoint

https://osv-advisory.caseyjhand.com/mcp

protocol

http-sse ·2025-06-18

authentication

none observed

public key

none — nobody has proven they own this listing · is it yours? claim it

karma

0 · newcomer

Is osv-advisory-mcp-server live?

Yes — it answered the hub's last check (checked 2h ago). It answered 100% of checks over the last 30 days.

Is osv-advisory-mcp-server free to use?

Yes — the hub reached it with no key and no payment.

What tools does osv-advisory-mcp-server have?

4 tools: osv_query_batch, osv_query_package, osv_get_vulnerability, osv_list_ecosystems.

Is osv-advisory-mcp-server safe to connect?

The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

• osv_list_ecosystems reads open 6h ago

  Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.

  mcp-tool

  123456

  {
    "type": "object",
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "properties": {},
    "additionalProperties": false
  }

  arguments 6 lines copy
• osv_query_batch reads unknown 23h ago

  Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass an array of {name, ecosystem, version} tuples (up to 1000). Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring.

  mcp-tool

  123456789101112131415161718192021222324252627282930313233343536373839404142

  {
    "type": "object",
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "required": [
      "packages"
    ],
    "properties": {
      "packages": {
        "type": "array",
        "items": {
          "type": "object",
          "required": [
            "name",
            "ecosystem",
            "version"
          ],
          "properties": {
            "name": {
              "type": "string",
              "pattern": "\\S",
              "description": "Package name as it appears in the ecosystem."
            },
            "version": {
              "type": "string",
              "pattern": "\\S",
              "description": "Exact version string to check."
            },
            "ecosystem": {
              "type": "string",
              "pattern": "\\S",
              "description": "Ecosystem identifier. Case-sensitive exact match. Use osv_list_ecosystems to validate."
            }
          },
          "description": "One package to audit."
        },
        "maxItems": 1000,
        "minItems": 1,
        "description": "Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i]."
      }
    },
    "additionalProperties": false
  }

  arguments 42 lines copy
• osv_query_package reads unknown 6h ago

  Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.

  mcp-tool

  123456789101112131415161718192021222324252627

  {
    "type": "object",
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "required": [
      "name",
      "ecosystem",
      "version"
    ],
    "properties": {
      "name": {
        "type": "string",
        "pattern": "\\S",
        "description": "Package name as it appears in the ecosystem (e.g. \"express\", \"requests\", \"serde\"). Case-sensitive."
      },
      "version": {
        "type": "string",
        "pattern": "\\S",
        "description": "Package version to check (e.g. \"4.17.1\", \"3.1.4\", \"1.0.0\"). Must be an exact version string, not a range."
      },
      "ecosystem": {
        "type": "string",
        "pattern": "\\S",
        "description": "Ecosystem identifier. Must be an exact match (case-sensitive). Use osv_list_ecosystems to see valid values. Examples: \"npm\", \"PyPI\", \"crates.io\", \"Go\", \"Maven\", \"NuGet\"."
      }
    },
    "additionalProperties": false
  }

  arguments 27 lines copy
• osv_get_vulnerability reads unknown 6h ago

  Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — eligibility criteria, scope of affected packages, or remediation guidance.

  mcp-tool

  123456789101112131415

  {
    "type": "object",
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "required": [
      "id"
    ],
    "properties": {
      "id": {
        "type": "string",
        "pattern": "^[A-Za-z][A-Za-z0-9_]*-\\S(.*\\S)?$",
        "description": "One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include \"GHSA-\" (GitHub), \"PYSEC-\" (PyPI), \"RUSTSEC-\" (Rust), \"GO-\" (Go), \"DSA-\"/\"DLA-\" (Debian), \"USN-\" (Ubuntu), \"RHSA-\" (Red Hat), and \"CVE-\". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: \"GHSA-29mw-wpgm-hmr9\"."
      }
    },
    "additionalProperties": false
  }

  arguments 15 lines copy

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

0 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.

Served from the same domain, which is what was measured. Not a claim that one owner runs them: ownership is what a passport proves, and each of these says for itself.

• brapi.caseyjhand.com brapi-mcp-server mcp · 22 tools
• usaspending.caseyjhand.com usaspending-mcp-server mcp · 18 tools
• onebusaway.caseyjhand.com onebusaway-mcp-server mcp · 16 tools
• secedgar.caseyjhand.com secedgar-mcp-server mcp · 16 tools
• courtlistener.caseyjhand.com courtlistener-mcp-server mcp · 14 tools
• openfda.caseyjhand.com openfda-mcp-server mcp · 14 tools
• gbif-biodiversity.caseyjhand.com gbif-biodiversity-mcp-server mcp · 13 tools
• openfec.caseyjhand.com openfec-mcp-server mcp · 12 tools

101 more sit on this domain. All of them.