query_package_cveLABSCO SUMMARY
From CVE to the version that fixes it.
Most vulnerability lookups stop at this package is affected. The two CVE tools here close the loop — the affected range and the fixed range, which is the number that ends the conversation.
What it is
A lightweight client for the OSV vulnerability database. Give it a package and it returns the CVE identifiers against it, optionally narrowed to one version; give it a CVE and it returns the affected versions and the versions that fix it.
What you get
- Every CVE for a package, with an optional version to narrow the scope
- The affected version list for a CVE
- The versions that fix a CVE — the number you actually have to upgrade to
- The ecosystems OSV covers, each mapped to its language or operating system
- PyPI assumed by default, with any other ecosystem named per call
Requirements
A recent Python and uv. OSV's data is public, so no account and no key. Run it from a local clone.
Setup effort
Build from source
USE CASES
01
Deciding what version to upgrade to
The fixed versions and the affected ones together, so the target is a number rather than the latest release and hope.
02
Checking whether the version you run is actually affected
Query the package at your pinned version, and read the affected range for anything that comes back.
03
Auditing a dependency before you add it
The CVE history against a package, before it is in the lockfile.
04
Working outside Python
Check which ecosystems are covered, then name yours on the query rather than taking the default.
4 tools
Listed in project docs. Your client may show a different list.
query_for_cve_affectedquery_for_cve_fix_versionsget_ecosystemsBEFORE YOU INSTALL
What to know first
Tools you get
4 tools named in the project's documentation.
Requires
uv on PATH
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
MCP Clients
Claude Desktop — local build, Cursor — local build
Runs from a local clone, with Python 3.11+ and uv installed. First: git clone https://github.com/EdenYavin/OSV-MCP.git
JSON
{
"mcpServers": {
"osv-mcp": {
"command": "uv",
"args": [
"--directory",
"<YOUR_PATH_TO_OSV_MCP>",
"run",
"osv-server"
],
"env": {}
}
}
}<YOUR_PATH_TO_OSV_MCP> is the full path of the folder the clone created. Uv sets up the environment on first run.
