Add an MCP server exposing the OSV API as tools for AI agents
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with the existing Python tooling pattern in tools/datafix and the MCP SDK. Create an isolated server under tools/osv-mcp/ with its own pyproject.toml, using OSV_API_BASE_URL to target the stable /v1 endpoints. Done means exposing the four listed query and vulnerability lookup tools without adding dependencies to the root library; the issue says a PR is being opened, so check for that work before starting.
由索引模型根据 Issue 内容生成。
描述
Is your feature request related to a problem? Please describe.
AI coding agents (Claude, Gemini, Joule, etc.) increasingly author and modify dependency manifests, but they have no first-class, machine-native way to ask OSV "is this package/version vulnerable?" during a task. Today an agent has to know and hand-roll the OSV REST contract. There is no Model Context Protocol (MCP) server in this repo, so OSV cannot be plugged into the MCP tool ecosystem that these agents natively consume.
Describe the solution you'd like
A small, self-contained MCP server under tools/ that wraps the stable public OSV REST API (https://api.osv.dev) as MCP tools, so any MCP-capable agent can query OSV directly:
query_package_vulnerabilities(package_name, ecosystem, version=None)→POST /v1/queryquery_by_commit(commit)→POST /v1/queryquery_batch(queries)→POST /v1/querybatchget_vulnerability(vuln_id)→GET /v1/vulns/{id}
Design intent:
- Python, using the official
mcpSDK, matching the existing Python tooling (poetry, yapf, pylint). - Fully isolated in its own
tools/osv-mcp/directory with its ownpyproject.toml(same pattern astools/datafix), so nothing leaks into the rootosvlibrary. - Thin REST wrapper only — no GCP dependencies, no new surface on the Go migration path. Only the stable
/v1endpoints (the two/v1experimental/endpoints are intentionally excluded). OSV_API_BASE_URLenv var to target staging / a local API dev server.
Describe alternatives you've considered
- A Go implementation (matching the repo's Python→Go migration direction) — but the MCP SDK is most mature in Python, this is auxiliary tooling rather than a core service, and
tools/datafixestablishes the Python-in-tools/precedent. - Leaving it to third-party/out-of-tree MCP wrappers — but a first-party server keeps the tool surface and endpoint contracts in sync with OSV itself.
Additional context
Happy to open a PR for this. Flagging up front per CONTRIBUTING: this would be an AI-assisted contribution and the PR will disclose that. I'll sign the CLA. Opening a PR alongside this issue for concreteness, but happy to iterate on scope/placement first.
- 主要语言
- Go
- 星标
- 3k
- 派生
- 390
- 平均合并
- 1 天 1 小时
- 30 天内合并 PR
- 129
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
google/osv.dev 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
worker to log more information for gitter internal server errors可能重新可做 @ZedingZhang 于 59 天前认领，目前没有进行中的 PR。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
Create repo purls for GIT ecosystem ranges可能重新可做 关联的 PR 已关闭且未合并。 未关闭backlog data quality
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
data quality
难度 3/5 半天 新手友好度 22/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 84/100
维护者通常 1 天内回复
-
cmd/ebitenmobile: multi-language bindings run the complete generator twice可能已有人在做 @kumagi 今天认领。 未关闭os:macos performance
难度 2/5 1-3 小时 新手友好度 82/100
hajimehoshi/ebiten#4011 · 1 条评论 ·
维护者通常 1 天内回复
-
agent-butler-finding chore
难度 1/5 1 小时以内 新手友好度 78/100
jordansmall/spindrift#6318 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
Eyevinn/moqlivemock#166 ·
维护者通常 1 天内回复