io.github.cyanheads/osv-advisory-mcp-server

Est-ce que io.github.cyanheads/osv-advisory-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/osv-advisory-mcp-server » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• osv_get_vulnerability≈ 3750 tokens

  Fetch the full advisory record for an OSV vulnerability ID. Returns the complete record: summary, full details text, CVE aliases, all affected packages and version ranges, fix versions, CVSS severity vectors, CWE weakness IDs, and references. Use when osv_query_package or osv_query_batch returns a vuln ID and you need the full advisory context — affected packages or remediation guidance. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Every page is a fresh lookup; restart a changed node without a revision. Transmission overflow and upstream truncation are separate; neither confirms clean.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    One exact, complete OSV advisory ID from any OSV source database, matched case-sensitively. Prefixes include "GHSA-" (GitHub), "PYSEC-" (PyPI), "RUSTSEC-" (Rust), "GO-" (Go), "DSA-"/"DLA-" (Debian), "USN-" (Ubuntu), "RHSA-" (Red Hat), and "CVE-". No wildcards or partial IDs — take IDs from osv_query_package or osv_query_batch results. Example: "GHSA-29mw-wpgm-hmr9".
  • page · object · optionnel
    Repeat id with page: overflow.page first; then select path, offset: page.nextOffset, revision: page.revision. Start deferred child paths without a revision.

  Exemple d'appel

  {"name": "osv_get_vulnerability", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "page": {}, "error": {}, "cweIds": [], "aliases": [], "details": "texte", "preview": {}, "summary": "texte", "affected": [], "modified": "texte", "overflow": {}, "severity": []}}

• osv_list_ecosystems≈ 575 tokens

  Return the supported ecosystem identifier strings for osv_query_package and osv_query_batch: every ecosystem the OSV schema names that OSV.dev accepts at query time, plus GIT, as verified on 2026-09-24. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static and may lag ecosystems added after that date.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "osv_list_ecosystems", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"note": "texte", "error": {}, "ecosystems": []}}

• osv_query_batch≈ 3332 tokens

  Query vulnerabilities for multiple packages in one call — the primary tool for dependency audits, SBOM scanning, and lockfile triage. Pass up to 1000 mixed {name, ecosystem, version} tuples and {purl, version?} identifiers, with exactly one embedded or separate version per PURL. Each entry in the response corresponds positionally to the input. Each finding includes CVE aliases for chaining to nist-nvd-mcp-server for CVSS scoring. Large replies retain the complete summary. For overflow, repeat the original packages array with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. /results/17 selects original input row 17, even when earlier rows failed. Pages are fresh lookups and do not recompute the initial summary; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

  Paramètres, retour & exemple (2)

  Paramètres

  • page · object · optionnel
    Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision.
  • packages · array · requis
    Packages to audit. One entry per dependency. Positional: result[i] corresponds to packages[i].

  Exemple d'appel

  {"name": "osv_query_batch", "arguments": {"packages": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"page": {}, "error": {}, "notice": "texte", "preview": {}, "results": [], "summary": {}, "overflow": {}, "effectiveQuery": "texte"}}

• osv_query_commit≈ 3371 tokens

  Query known vulnerabilities for one full Git commit hash (40 hexadecimal SHA-1 or 64 hexadecimal SHA-256 characters, case-insensitive). Abbreviated hashes are rejected. Returns advisory summaries, record-wide severity and GIT ranges with repositories and ordered fix events; use osv_get_vulnerability for full records. No package-specific fixedVersions are inferred. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

  Paramètres, retour & exemple (2)

  Paramètres

  • page · object · optionnel
    Repeat the original commit with page: overflow.page first, then select path, offset: page.nextOffset and revision: page.revision.
  • commit · string · requis
    Full Git commit hash: 40 SHA-1 or 64 SHA-256 hex characters, case-insensitive.

  Exemple d'appel

  {"name": "osv_query_commit", "arguments": {"commit": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"page": {}, "error": {}, "vulns": [], "preview": {}, "overflow": {}, "queryMeta": {}, "truncated": true}}

• osv_query_package≈ 4048 tokens

  Query known vulnerabilities for a single package version using {name, ecosystem, version} or {purl, version?}; supply exactly one embedded or separate version. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and the fixed versions listed for the queried package. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results. For overflow, repeat the original input with page: overflow.page. Continue the same path with offset: page.nextOffset and revision: page.revision until nextOffset is null. Retrieve each entries[].deferred.path separately at offset zero without a revision. Do not pass the output page object as input. Set page.advisoryId to an announced ID to fetch its fields with fixes and severity for the queried package; retain advisoryId on subsequent pages. Pages are fresh lookups; restart a changed node without a revision. Transmission overflow and upstream truncated are separate; neither confirms clean.

  Paramètres, retour & exemple (5)

  Paramètres

  • name · string · optionnel
    Exact package name in its ecosystem.
  • page · object · optionnel
    Repeat the original input with page: overflow.page first; later select path, offset: page.nextOffset and revision: page.revision. Retain advisoryId when set.
  • purl · string · optionnel
    PURL alternative to name and ecosystem; supply one embedded or separate version.
  • version · string · optionnel
    Exact package version, never a range.
  • ecosystem · string · optionnel
    Case-sensitive ecosystem identifier from osv_list_ecosystems.

  Exemple d'appel

  {"name": "osv_query_package", "arguments": {"name": "texte", "page": {}, "purl": "texte", "version": "texte", "ecosystem": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"page": {}, "error": {}, "vulns": [], "notice": "texte", "preview": {}, "overflow": {}, "queryMeta": {}, "truncated": true, "effectiveQuery": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://osv-advisory.caseyjhand.com/mcp