Integration

OSV integration

OSV is the open-source vulnerability database run by Google, and this is its public API. It aggregates advisories from GitHub Security Advisories, the language ecosystem databases (npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Hex, Pub and more), Linux distributions (Debian, Ubuntu, Alpine, Rocky, AlmaLinux, SUSE), Android, the Linux kernel and OSS-Fuzz, and normalises them into one schema where every entry states precise affected version ranges instead of prose. No credential is needed. Query one package version, or a commit hash, and get every vulnerability affecting it: id and aliases (CVE, GHSA, PYSEC and the rest), summary and details, severity scores, references, database-specific metadata, and the exact introduced and fixed versions per affected package and ecosystem, paged through a page token when the answer is long. Query up to a thousand package versions in one batch call when scanning a whole lockfile, then read the entries you care about one by one by OSV id. Two experimental routes complete it: match a set of file hashes against upstream C and C++ repositories to work out which library version a vendored source tree actually is, and list the records a given upstream source failed to import, which is how a database maintainer sees why an advisory is missing. A package is identified either by name plus ecosystem or by a purl, and version matching follows the upstream version ordering of the ecosystem rather than string comparison.

Connect OSV How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in OSV.Built from the 5 OSV tools below, on the connection you add once.

What you can do with OSV

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Determineversion, 1 operation

determine_library_versionDetermine library versionPOSTDetermine the version of the provided hash values.

Importfinding, 1 operation

list_import_findingsList import findingsGETGet import findings per source.

Query, 1 operation

query_vulnerabilitiesQuery vulnerabilitiesPOSTQuery vulnerabilities for a particular project at a given commit or version.

Querybatch, 1 operation

query_vulnerabilities_batchQuery vulnerabilities batchPOSTQuery vulnerabilities (batched) for given package versions and commits. This currently allows a maximum of 1000 package versions to be included in a single query.

Vuln, 1 operation

get_vulnerabilityGet vulnerabilityGETReturn a `Vulnerability` object for a given OSV ID.

Use OSV from Claude Code, Cursor or Codex

Connect OSV in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its OSV operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect OSV

Create your workspace
Sign up free. Nothing to install.
Connect OSV once
OSV needs no credential, so its tools work immediately.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.