OSV vuln API

One OSV vulnerability: summary, affected packages and versions, CVSS vectors, CWE ids and references.

Ask your agent

“Call osv/vuln with id GHSA-29mw-wpgm-hmr9 and summarize what comes back.”

Works in any MCP client connected to https://data.openkrill.app/mcp. Install in one line.

Path: osv/vuln
MCP tool: call_endpoint
Credits: 5
Cache: 10 min

Parameters

idstring, required	Advisory id, such as GHSA-29mw-wpgm-hmr9 or CVE-2021-44228

Response

data.resources[] uses the same keys as every other platform: author, engagement, metadata, with OSV-only fields under extras. A failed upstream call is never billed.

More OSV tools

MCP tool call

{
  "name": "call_endpoint",
  "arguments": {
    "path": "osv/vuln",
    "params": {
      "id": "GHSA-29mw-wpgm-hmr9"
    }
  }
}

curl

curl "https://data.openkrill.app/v1/osv/vuln?id=GHSA-29mw-wpgm-hmr9" \
  -H "x-api-key: YOUR_API_KEY"

Response

{
  "success": true,
  "platform": "osv",
  "endpoint": "osv/vuln",
  "data": {
    "resources": [
      { "id": …, "title": …, "text": …, "url": …,
        "author": {…}, "engagement": {…},
        "metadata": {…}, "extras": {…} }
    ]
  },
  "credits_used": 5,
  "cached": false
}