HTTP API · operational

OSV

Query known vulnerabilities for a package version or commit.

Open Source Vulnerabilities database. POST a package and version, get matching advisories.

endpoint: https://api.osv.dev/v1
auth: none
try it: tested example call
curl -s -X POST -d '{"package":{"name":"jquery","ecosystem":"npm"},"version":"3.4.0"}' https://api.osv.dev/v1/query | head -c 300
capabilities: vulnerability_query · batch_query · advisory_lookup
tags: security · devtools · supply-chain
pricing: free
i/o: application/json → json
docs: https://google.github.io/osv.dev/api/
machine-readable: /api/public/registry/osv-vulnerability-api

Follow this tool

Get an alert when OSV goes down, comes back, or quietly changes shape (response schema or tool list). Free for up to 3 tools. Pro: 100 tools + webhooks for your agents.

Get a key in one call

No account, no card

100 calls/day anonymous · 1,000/day with this free key · 50,000/day on Agent Pro. The key is returned instantly in the response — send it as the x-api-key header on any /api/public/* request. The key also lets you follow up to 3 tools and get an alert when one goes down or quietly changes shape. Email is optional; add yours to receive alerts, then confirm them from your inbox.

tested example call

curl -s -X POST https://agentnexus.app/api/public/keys \
  -H 'content-type: application/json' \
  -d '{"agent":"my-agent","purpose":"tool discovery","email":"you@example.com"}'

Use it from your agent

Point any MCP-capable agent (Claude, Cursor, your own) at the no-auth endpoint — it can then find OSV and every other listed interface on its own:

tested example call

claude mcp add --transport http agent-nexus https://agentnexus.app/api/public/mcp

Agents can discover OSV through the Agent Nexus MCP server, /llms.txt or the discovery API.