Labsco
MCP SERVER

Ask whether a package version or a commit has known vulnerabilities, and get the answer from OSV rather than from a model's memory.

Package Registries & Dependency Supply Chain
Summary
A vulnerability answer with a database behind it.

Models are confidently wrong about CVE status, and OSV is the public record that settles it for a given package version or commit. The batch call is what makes it practical on a real lockfile.

What it is

A Go MCP server that puts the OSV (Open Source Vulnerabilities) database at osv.dev in front of an assistant, over SSE or streamable HTTP.

What you get
  • Vulnerability lookup for a specific package version or a specific commit, answered from the OSV database
  • Batch lookup, so a whole dependency list can be checked in one call instead of one call per package
  • A choice of transport — SSE by default, or streamable HTTP, selected in the environment
  • A listening port set in the environment, with a default if you leave it alone
Requirements

Nothing to authenticate — OSV is public. Building from source needs Go 1.21 or later; the maintainers' recommended path is `thv run osv` under ToolHive, which runs it containerised.

Setup effort

One command — thv run osv