Add an MCP server exposing the OSV API as tools for AI agents

オープン
  • 何か問題がありますか？
#6,272 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python
領域
api, security

調査の方向性

Start with the existing Python tooling pattern in tools/datafix and the MCP SDK. Create an isolated server under tools/osv-mcp/ with its own pyproject.toml, using OSV_API_BASE_URL to target the stable /v1 endpoints. Done means exposing the four listed query and vulnerability lookup tools without adding dependencies to the root library; the issue says a PR is being opened, so check for that work before starting.

索引モデルが issue の本文から書いたものです。

説明

Is your feature request related to a problem? Please describe.

AI coding agents (Claude, Gemini, Joule, etc.) increasingly author and modify dependency manifests, but they have no first-class, machine-native way to ask OSV "is this package/version vulnerable?" during a task. Today an agent has to know and hand-roll the OSV REST contract. There is no Model Context Protocol (MCP) server in this repo, so OSV cannot be plugged into the MCP tool ecosystem that these agents natively consume.

Describe the solution you'd like

A small, self-contained MCP server under tools/ that wraps the stable public OSV REST API (https://api.osv.dev) as MCP tools, so any MCP-capable agent can query OSV directly:

  • query_package_vulnerabilities(package_name, ecosystem, version=None) → POST /v1/query
  • query_by_commit(commit) → POST /v1/query
  • query_batch(queries) → POST /v1/querybatch
  • get_vulnerability(vuln_id) → GET /v1/vulns/{id}

Design intent:

  • Python, using the official mcp SDK, matching the existing Python tooling (poetry, yapf, pylint).
  • Fully isolated in its own tools/osv-mcp/ directory with its own pyproject.toml (same pattern as tools/datafix), so nothing leaks into the root osv library.
  • Thin REST wrapper only — no GCP dependencies, no new surface on the Go migration path. Only the stable /v1 endpoints (the two /v1experimental/ endpoints are intentionally excluded).
  • OSV_API_BASE_URL env var to target staging / a local API dev server.

Describe alternatives you've considered

  • A Go implementation (matching the repo's Python→Go migration direction) — but the MCP SDK is most mature in Python, this is auxiliary tooling rather than a core service, and tools/datafix establishes the Python-in-tools/ precedent.
  • Leaving it to third-party/out-of-tree MCP wrappers — but a first-party server keeps the tool surface and endpoint contracts in sync with OSV itself.

Additional context

Happy to open a PR for this. Flagging up front per CONTRIBUTING: this would be an AI-assisted contribution and the PR will disclose that. I'll sign the CLA. Opening a PR alongside this issue for concreteness, but happy to iterate on scope/placement first.

主要言語
Go
スター
3k
フォーク
390
平均マージ
1日 42分
マージ済み PR（30日）
133

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

google/osv.dev のほかの issue

google/osv.dev の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。