The osv-ui-mcp server enables AI agents to scan projects for CVE vulnerabilities, visualize findings, and apply fixes with a human-in-the-loop workflow. All analysis runs 100% locally, ensuring your code never leaves your environment.

• Scan projects for CVEs (scan_project): Automatically detect and scan manifest files (e.g., package-lock.json, requirements.txt, go.sum, Cargo.lock, pom.xml) across npm, Python, Go, Rust, Java, PHP, and Ruby ecosystems. Queries live CVE data from OSV.dev and returns structured reports with severity counts, risk scores, and fix recommendations. Supports filtering by severity (critical, high, moderate, low).

• Launch a visual dashboard (open_dashboard): Opens a zero-config, privacy-first browser-based dashboard for human review of CVE details, severity charts, and upgrade guides — the recommended step before applying any fixes.

• Preview fix commands (get_fix_commands): Retrieves safe upgrade commands (e.g., npm install, pip install) for vulnerable packages without executing them, allowing users to review proposed changes before action.

• Apply security fixes (apply_fixes): Executes package upgrade commands to remediate CVEs. Supports dry-run mode for final confirmation; requires explicit package selection to prevent unintended modifications.

Utilizes the GitHub Advisory Database as a core source for vulnerability data to provide accurate security assessments.

Enables security auditing within GitLab CI/CD pipelines to monitor for vulnerabilities and block deployments containing critical security risks.

Scans npm projects by parsing package-lock.json files to identify security vulnerabilities, calculate risk scores, and provide clear upgrade guides.

Provides specific support for auditing Python dependencies defined in poetry.lock manifest files.

Integrates with the PyPI Advisory Database to identify known vulnerabilities in Python package dependencies.

Audits Python projects for CVEs by scanning manifest files such as requirements.txt, Pipfile.lock, and poetry.lock.

Identifies and reports known security vulnerabilities in Rust projects by analyzing Cargo.lock files.

$ npm audit

# ... 300 lines of this ...
# moderate Regular Expression Denial of Service in semver
# package semver
# patched in >=7.5.2
# ...
# 12 vulnerabilities (3 moderate, 6 high, 3 critical)

npx osv-ui

npx osv-ui

npx osv-ui ./frontend ./api ./worker ./ml-service

npx osv-ui -d

{
 "scripts": {
 "audit:ui": "npx osv-ui",
 "audit:all": "npx osv-ui ./frontend ./api ./worker"
 }
}

--discover, -d Auto-find service dirs that contain a supported manifest
--port=2003 Use a custom port (default: 2003)
--json[=file] Save report as JSON without opening browser (defaults to osv-report.json)
--html[=file] Save report as HTML without opening browser (defaults to osv-report.html)
--cyclonedx[=file] Save CycloneDX SBOM JSON (defaults to osv-sbom.cdx.json)
--spdx[=file] Save SPDX SBOM JSON (defaults to osv-sbom.spdx.json)
--baseline=file Compare with a previous --json report
--markdown[=file] Save a Markdown PR/comment report (defaults to osv-report.md)
--fail-on=level Exit non-zero for critical/high/moderate/low findings
--webhook-url=url POST matching findings to a webhook
--webhook-severity=level Webhook threshold (default: critical)
--watch Keep dashboard running and re-scan when manifests change
--no-open Don't auto-open the browser
--offline Skip OSV.dev lookup — parse manifests only
-h, --help Show help message

{
 "mcpServers": {
 "osv-ui": {
 "command": "npx",
 "args": ["-y", "osv-ui-mcp"]
 }
 }
}

# Get full JSON payload for all services
curl http://localhost:2003/api/data

# Use it in your custom scripts
curl -s http://localhost:2003/api/data | jq '.[0].vulns'

npx osv-ui -d --json=osv-report.json --markdown=osv-report.md --cyclonedx=sbom.cdx.json --spdx=sbom.spdx.json --no-open

npx osv-ui -d --json=current.json --baseline=main-osv-report.json --markdown=osv-pr.md --fail-on=high --no-open

name: osv-ui
on: [pull_request]
jobs:
 scan:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - uses: actions/setup-node@v4
 with:
 node-version: 20
 - run: npx osv-ui -d --json=current.json --markdown=osv-pr.md --cyclonedx=sbom.cdx.json --fail-on=high --no-open
 - uses: actions/upload-artifact@v4
 if: always()
 with:
 name: osv-ui-report
 path: |
 current.json
 osv-pr.md
 sbom.cdx.json

npx osv-ui -d --baseline=main-osv-report.json --webhook-url="$SECURITY_WEBHOOK_URL" --webhook-severity=critical --json=current.json

Your project files
 │
 ├─ package-lock.json ──┐
 ├─ Pipfile / poetry ──┤──► parser ──► package list
 ├─ go.sum / Cargo.lock ──┘
 │
 ▼
 OSV.dev batch API (free, no key)
 │
 ▼
 CVE matches + fix versions
 │
 ▼
 Express server → browser dashboard
 http://localhost:2003

audit:
 stage: test
 image: node:20-alpine
 script:
 - npm audit --json > /tmp/audit.json || true
 - |
 node -e "
 const r = require('/tmp/audit.json');
 const crit = Object.values(r.vulnerabilities || {})
 .filter(v => v.severity === 'critical').length;
 if (crit > 0) {
 console.error('BLOCKED: ' + crit + ' critical CVE(s). Run: npx osv-ui');
 process.exit(1);
 }
 console.log('OK: no critical vulnerabilities');
 "
 artifacts:
 paths: [/tmp/audit.json]
 when: always

# Clone and run locally
git clone https://github.com/toan203/osv-ui
cd osv-ui
npm install

# Run against your own project
node bin/cli.js /path/to/your/project

# Run against multiple services
node bin/cli.js ./frontend ./backend