Osv Dev

io.github.pipeworx-ioPublished by GitHub account pipeworx-iov0.1.0Updated Oct 24, 2026

OSV.dev — Google's open-source vulnerability database

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP endpoint that lets an assistant look up open-source vulnerabilities in Google's OSV.dev database by package, version, or git commit.

What you can do
  • Query vulnerabilities for a package, optionally at a specific version, or for a git commit
  • Run batch queries of up to 1000 package or commit lookups in one call
  • Fetch a full vulnerability record by ID (CVE, GHSA, or OSV identifiers)
  • Ask questions in plain English through the gateway's ask_pipeworx tool, which picks the tool and arguments
When to use it
Useful when checking whether a dependency, library version, or commit has known vulnerabilities, for example during dependency review, upgrade planning, or security triage of open-source components.
Requirements
A remote MCP client pointed at the Pipeworx gateway endpoint; no package install, API key, or environment variables are declared. Network access to the gateway is required.
Before you install
Queries go to a third-party gateway (Pipeworx) that proxies OSV.dev, so package names, versions, and commits you look up are visible to it. The README also offers a full gateway endpoint exposing many other data sources, which broadens what the assistant can reach. Lookups are read-only.

Installation

In SourceWeft

  1. Open Osv Dev in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.pipeworx-io%2Fosv-dev/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "osv-dev": {
      "type": "http",
      "url": "https://gateway.pipeworx.io/osv-dev/mcp"
    }
  }
}

README

mcp-osv-dev

OSV.dev MCP — Google's open-source vulnerability database.

Part of Pipeworx — an MCP gateway connecting AI agents to 673+ live data sources.

Tools

ToolDescription
vulnerabilitiesQuery vulnerabilities by package (+ optional version) or git commit.
query_batchBatch query (≤1000 queries). Pass an array of {package: {name, ecosystem}, version?} or {commit}.
getFull vulnerability record by id (CVE-…, GHSA-…, OSV-…).

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):

json
{  "mcpServers": {    "osv-dev": {      "url": "https://gateway.pipeworx.io/osv-dev/mcp"    }  }}

Or connect to the full Pipeworx gateway for access to all 673+ data sources:

json
{  "mcpServers": {    "pipeworx": {      "url": "https://gateway.pipeworx.io/mcp"    }  }}

Using with ask_pipeworx

Instead of calling tools directly, you can ask questions in plain English:

ask_pipeworx({ question: "your question about Osv Dev data" })

The gateway picks the right tool and fills the arguments automatically.

More

License

MIT

Source: README.md at commit fab69a1

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts