Andrew Borden-Chisholm

Catalog / Tools

OSV-Scanner

Google's scanner that matches a project's lockfiles, vendored code or container image against the open OSV.dev vulnerability database.

Install

  1. macOS / Linux

    brew install osv-scanner

    Windows users can use `winget install Google.OSVScanner` or Scoop.

  2. Scan a skill or MCP server's dependencies

    osv-scanner scan source -r path/to/project

  3. Offline scan

    osv-scanner --offline ./path/to/your/dir

    Download the local database first with --download-offline-databases.

Many skills and MCP servers ship a package.json, requirements.txt or lockfile. OSV-Scanner tells you which of those pinned versions have known vulnerabilities, and whether a fix exists.

When to use it

  • Vetting an MCP server or a script-bundling skill before you install it.
  • In CI for your own agent tooling, alongside gitleaks.
  • Guided remediation (osv-scanner fix) recommends package upgrades to clear advisories.

Good to know

Findings depend on a lockfile. A bare package.json with version ranges gives weaker results. The default mode sends package names to OSV.dev; use --offline for private code.

Publisher
Google
Source
github.com/google/osv-scanner
Works with
Any agent
Categories
Security & trust
License
Apache-2.0
Cost
Free

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.