$ loading_
Query OSV and batch-audit dependencies to uncover package security risks.
This MCP tool appears overall low risk: it is listed in the official registry, open-source, and recently maintained, and its required environment variables do not look like sensitive credentials. The main caution is that it claims to query OSV.dev while the actual remote endpoint is a custom domain, so data flow through that intermediary should be verified before deployment.
The materials only require OSV_REQUEST_TIMEOUT_MS and MCP_LOG_LEVEL, which are timeout and logging configuration values rather than API keys, tokens, or other sensitive secrets; credential abuse risk appears low.
The tool claims to query OSV.dev, but the actual remote endpoint is osv-advisory.caseyjhand.com, indicating requests may be sent through a third-party intermediary. If users submit dependency lists or package names, that data may be transmitted to this domain; verify that this matches the stated functionality and privacy expectations.
As an MCP tool, it is flagged to execute code/start a local process, which is standard for this class of tools. The materials do not show requests for additional high-risk system privileges or execution scope beyond its stated vulnerability-query purpose.
The description only indicates querying vulnerability information and batch-auditing dependency lists; it does not state that it can read arbitrary local files, write to disk, or access unrelated system resources. Based on the available materials, there is no sign of overbroad data access.
Positive factors include listing in the official registry, open-source availability, and updates within the last year, making the code in principle auditable; however, the missing README, undeclared license, and very low community adoption (0 stars) mean maturity and review depth still warrant manual verification.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "io.github.cyanheads/osv-advisory-mcp-server" MCP server from askskill: Run: claude mcp add 'io-github-cyanheads-osv-advisory-mcp-server' -- npx -y @cyanheads/osv-advisory-mcp-server
Look up open-source vulnerabilities and guide remediation decisions.
Get real-time package health, vulnerabilities, and dependency insights for safer decisions.
Connect OSSEC security monitoring to AI for alerts, host status, and event analysis.
Query unified vulnerability intelligence for triage, audits, and threat monitoring.
Discover and shortlist OSINT MCP servers for research and investigation workflows.
Audit codebases for security issues with AST, call graph, and AI analysis.