query_vulnerabilityLABSCO SUMMARY
A vulnerability answer with a database behind it.
Models are confidently wrong about CVE status, and OSV is the public record that settles it for a given package version or commit. The batch call is what makes it practical on a real lockfile.
What it is
A Go MCP server that puts the OSV (Open Source Vulnerabilities) database at osv.dev in front of an assistant, over SSE or streamable HTTP.
What you get
- Vulnerability lookup for a specific package version or a specific commit, answered from the OSV database
- Batch lookup, so a whole dependency list can be checked in one call instead of one call per package
- A choice of transport — SSE by default, or streamable HTTP, selected in the environment
- A listening port set in the environment, with a default if you leave it alone
Requirements
Nothing to authenticate — OSV is public. Building from source needs Go 1.21 or later; the maintainers' recommended path is thv run osv under ToolHive, which runs it containerised.
Setup effort
Follow the published steps — thv client setup
USE CASES
01
Checking a dependency before you add it
Name the package and the version you are about to pin and see what OSV has on record for exactly that version.
02
Auditing a lockfile in one pass
Send the whole dependency set at once and get back the entries that have advisories, instead of walking the list package by package.
03
Judging whether an upgrade is worth it
Compare the advisories on the version you are running against the version you would move to, and decide from the difference.
04
Vetting a pinned commit
Some dependencies are pinned to a commit rather than a release; ask OSV about the commit itself.
3 tools
Listed in project docs. Your client may show a different list.
query_vulnerabilities_batchget_vulnerabilityBEFORE YOU INSTALL
What to know first
Tools you get
3 tools named in the project's documentation.
Requires
- ToolHive (thv CLI)
- A container runtime: Docker, Podman, Colima or Rancher Desktop
INSTALLATION
Connect your client
Server setup
TERMINAL
# Install ToolHive (if not already installed)
# See: https://docs.stacklok.com/toolhive/guides-cli/install
# Register a supported client so ToolHive can auto-configure your environment
thv client setup
# Run the OSV MCP server (packaged as 'osv' in ToolHive)
thv run osv
