OSV Dependency Vulnerability Check MCP Server
by fairqueryio.github.fairquery/osv-dependency-vulnerability-checkv1.0.1
Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.
context tax
needs auth
security
100/100
cold start
hosted
freshness
Activetoday
Our reading of OSV Dependency Vulnerability Check, from the data
OSV Dependency Vulnerability Check is a security MCP server from fairquery, listed in the official MCP Registry.
Its endpoint requires sign-in or an API key just to list tools, so we haven't measured its token cost; we never use real credentials.
Maintenance is active: the last public signal was in the last day (2026-10-18). For comparison, 67% of security servers are active or maintained.
With 0 GitHub stars it ranks #579 of 1,263 security servers we index.
It runs as a hosted endpoint, so there is nothing to install.
Install OSV Dependency Vulnerability Check MCP server
Install in Claude Code
claude mcp add --transport http osv-dependency-vulnerability-check https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-checkInstall in Cursor
{
"mcpServers": {
"osv-dependency-vulnerability-check": {
"url": "https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check"
}
}
}Install in Claude Desktop
{
"mcpServers": {
"osv-dependency-vulnerability-check": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check"
]
}
}
}Or add it as a custom connector under Settings → Connectors. The config above bridges via mcp-remote.
Install in VS Code
{
"servers": {
"osv-dependency-vulnerability-check": {
"type": "http",
"url": "https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check"
}
}
}Install in Windsurf
{
"mcpServers": {
"osv-dependency-vulnerability-check": {
"serverUrl": "https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check"
}
}
}Remote endpoints
- streamable-http
https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check
Security signals
100/100 — no known issues found as of 2026-10-19, from the checks below. This is not a guarantee of safety; review what a server can do before connecting it.
Deductions
No findings from the checks that ran.
Checks
- ✓Repository hygiene (archived, activity, license, security policy)
- ○Package metadata (install scripts, provenance) — pending
- ○Tool descriptions (prompt-injection and hidden-text heuristics) — pending
- ○Source scan (secrets, CVEs, risky code) by vectra-guard — pending
Scan it yourself before installing with vectra-guard, the open-source agent security CLI. Scoring rules
Freshness
Active — last maintenance signal today. The newest of the signals below sets the band.
Last commit (default branch)
2026-10-18 · today · GitHub
Latest release
2026-10-18 · today · GitHub · v1.2.0
Package published
no data · npm/PyPI
Registry entry updated
2026-10-18 · 1d ago · official registry · v1.0.1
How it compares in Security
Against the most-starred security servers we index. Token cost is per model turn, measured from each server's live tool list.
| Server | Stars | Tools | Tokens / turn | Freshness | Runs |
|---|---|---|---|---|---|
| OSV Dependency Vulnerability Check (this) | 0 | — | not measured | Active | hosted |
| Semgrep | 17,123 | — | not measured | Active | — |
| Ida Pro | 13,002 | — | not measured | Active | — |
| Ghidra | 11,390 | — | not measured | Active | — |
| Robin: AI-Powered Dark Web OSINT | 7,591 | — | not measured | Active | local |
| Claude Code Ultimate Guide | 6,196 | — | not measured | Active | local |
FAQ
›How do I install the OSV Dependency Vulnerability Check MCP server in Claude Code?
Run: claude mcp add --transport http osv-dependency-vulnerability-check https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check. For Cursor, VS Code, Claude Desktop and Windsurf, use the install tabs above.
›Does OSV Dependency Vulnerability Check require an API key?
No required environment variables are declared in its published metadata.
›Can I use OSV Dependency Vulnerability Check as a remote (hosted) MCP server?
Yes. It is a hosted MCP server; connect to its URL with any client that supports remote MCP.
›Is OSV Dependency Vulnerability Check in the official MCP registry?
Yes, as io.github.fairquery/osv-dependency-vulnerability-check.
Sources and method
- Official MCP Registry entry
- updated 2026-10-18
- GitHub repository
- fetched 2026-10-19
- Security signals, computed by us
- 2026-10-19
- Last checked against all sources
- 2026-10-19
The description, packages and links come from the maintainer's own published metadata. Token cost, security signals, freshness and the reading above are MCPSkillHub's own measurements; see the methodology. Spot an error? Request a correction or claim the listing.
Alternatives to OSV Dependency Vulnerability Check
Other security MCP servers.
SemgrepActiveScan code for security vulnerabilities using Semgrep.
Ida ProActiveIDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.
GhidraActiveAutonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.
Robin: AI-Powered Dark Web OSINTActiveDark web OSINT over Tor: search onion engines, scrape pages, report with your own model.
Claude Code Ultimate GuideActiveSearch the Claude Code Ultimate Guide, official Anthropic documentation, releases, examples, security references, agent harness data, and translations from any MCP-compatible client.
Jadx AIActiveJADX decompiler plugin providing live, LLM-assisted reverse engineering.