OSV MCP Server

OSV is the open vulnerability database that aggregates advisories across npm, PyPI, Go, Maven, crates and more, and this Go server puts three of its endpoints in front of an agent. query_vulnerability takes a package and version, a purl, or a commit hash; that last form is the interesting one, because vendored code and pinned forks appear in no lockfile and are exactly what a manifest scanner misses. query_vulnerabilities_batch sends a whole dependency list in one request rather than one call per package, and get_vulnerability pulls the full record for an advisory ID. It runs over SSE or streamable HTTP on a configurable port and needs no credentials, since OSV is public.