OSV vulnerabilities API

Known OSV advisories for one package, newest id first, with the fixed versions.

Ask your agent

“Call osv/vulnerabilities with package lodash and summarize what comes back.”

Works in any MCP client connected to https://data.openkrill.app/mcp. Install in one line.

Path: osv/vulnerabilities
MCP tool: call_endpoint
Credits: 5
Cache: 2 min

Parameters

packagestring, required	Package name, such as lodash
ecosystemstring, optional	OSV ecosystem, such as npm, PyPI or Maven, default npm
versionstring, optional	Only advisories that affect this version
limitinteger, optional	1-40 advisories, default 20

Response

data.resources[] uses the same keys as every other platform: author, engagement, metadata, with OSV-only fields under extras. A failed upstream call is never billed.

More OSV tools

MCP tool call

{
  "name": "call_endpoint",
  "arguments": {
    "path": "osv/vulnerabilities",
    "params": {
      "package": "lodash"
    }
  }
}

curl

curl "https://data.openkrill.app/v1/osv/vulnerabilities?package=lodash" \
  -H "x-api-key: YOUR_API_KEY"

Response

{
  "success": true,
  "platform": "osv",
  "endpoint": "osv/vulnerabilities",
  "data": {
    "resources": [
      { "id": …, "title": …, "text": …, "url": …,
        "author": {…}, "engagement": {…},
        "metadata": {…}, "extras": {…} }
    ]
  },
  "credits_used": 5,
  "cached": false
}