LabscoMCP early access ↗
kodustechMCP SERVER · OFFICIAL PROJECT

Kodus OSV

Look up open-source vulnerabilities against the OSV API from an agent — one package or a whole batch, over an HTTP endpoint.

by kodustech ↗Package Registries & Dependency Supply Chain✓ Official

LABSCO SUMMARY

The schema does the teaching.

OSV's query rules are the kind of thing a model gets subtly wrong — passing both a commit and a version, or leaving a version inside the purl while also passing one. Encoding those constraints in the tool schema, with the batch variant following the same shape, is what makes this reliable rather than merely present. No credential is involved, which makes it cheap to add to a security review workflow.

What it is

A remote MCP server wrapping the OSV v1 API so agents can query open-source vulnerability data directly. It runs as a Bun HTTP server exposing a Streamable HTTP MCP endpoint at /mcp, with schemas written to guide a model through OSV's argument rules rather than leaving it to guess.

What you get

  • osv_query — a vulnerability lookup for a single target, by commit or by version, with the package identified either as a purl or as a name and ecosystem pair, and an optional pageToken for pagination
  • osv_query_batch — the same query shape repeated across many targets in one call, each item following the same rules
  • Validation rules encoded in the schema so the model gets them right first time: use commit or version but never both, a version requires a package, a package is either a purl or a name-and-ecosystem pair, and when a version is given the purl must omit its own @version
  • Worked example calls for the common shapes — a PyPI package by purl and version, an npm package by name and ecosystem, and a commit lookup

Requirements

No account and no key — OSV is a public API. Bun is the only prerequisite: bun install, then run index.ts with PORT and HOST set (defaulting to 3000 and 0.0.0.0); OSV_API_URL overrides the OSV base URL and defaults to the public one. Register it with claude mcp add --transport http mcp-osv http://localhost:3000/mcp, add it to VS Code with one command, or point the MCP Inspector at the same endpoint. MIT licensed.

Setup effort

Follow the published steps — bun install

See installation options