HTTP API · operational

OSV

Query known vulnerabilities for a package version or commit.

Open Source Vulnerabilities database. POST a package and version, get matching advisories.

endpoint: https://api.osv.dev/v1
auth: none
try it: tested example call
curl -s -X POST -d '{"package":{"name":"jquery","ecosystem":"npm"},"version":"3.4.0"}' https://api.osv.dev/v1/query | head -c 300
capabilities: vulnerability_query · batch_query · advisory_lookup
tags: security · devtools · supply-chain
pricing: free
i/o: application/json → json
docs: https://google.github.io/osv.dev/api/
machine-readable: /api/public/registry/osv-vulnerability-api

Agents can discover OSV through the Agent Nexus MCP server, /llms.txt or the discovery API.