# OSV MCP

Vendor: OSV  
Category: developer-tools  
Auth: NONE  
Composio slug: `osv`

OSV provides an open vulnerability database and API for querying vulnerabilities by package, version, commit, or vulnerability identifier.

## Verdict

OSV surfaces known vulnerabilities in your dependencies by querying the Open Source Vulnerabilities database. @mention it to check a package name, version, commit hash, or PURL against 20+ ecosystems (npm, PyPI, Maven, Go, Rust, and more). Developers get instant CVE lookups during code review or incident response; security teams audit entire manifests in batch. The API is free and requires no key, but experimental endpoints (version detection, import diagnostics) may return incomplete data or change without notice.

## Tools

- **Determine Version** — Experimentally rank probable versions of an OSS-Fuzz C/C++ library from relative source-file paths and base64-encoded MD5 hashes. Results may be empty or change because the API is experimental.
- **Get Import Findings** — Experimentally list OSV records from one exact import source that failed import-time quality checks; intended for OSV source maintainers and may return no records.
- **Get Vulnerability** — Return the complete OSV record for one case-sensitive vulnerability ID, including affected versions, ranges, severity, references, and aliases.
- **Query Vulnerabilities** — Find full OSV vulnerability records affecting one package, package version, package URL, or commit. Use next_cursor to continue a large result set.
- **Query Vulnerabilities Batch** — Check up to 1,000 packages, package versions, package URLs, or commits in one request and return position-matched compact vulnerability IDs. Continue unfinished items with their individual page tokens.

## Setup

1. Create or open a Switchy Project.
2. Open Integrations and connect OSV.
3. Authorise through none.
4. Teammates can now @-mention OSV tools in chat.

---
Last verified: 2026-10-17T02:00:10.360Z  
Canonical URL: https://switchy.build/directory/mcps/osv