osv-advisory-mcp-server

This server provides read-only access to the OSV.dev vulnerability database. - Use osv_list_ecosystems to discover valid ecosystem identifier strings before querying. - Use osv_query_package to check if a single package version is vulnerable. - Use osv_query_batch for dependency audits — pass a full lockfile as {name, ecosystem, version} tuples. - Use osv_get_vulnerability for the full advisory record when osv_query_package returns a vuln ID. - OSV results include aliases (CVE IDs) — chain these to nist-nvd-mcp-server for CVSS scoring, EPSS, and CISA KEV status. - No API key required. No rate limit published — prefer batch queries over repeated single queries.