Vulnerable Version Checker MCP tool

Lists the known vulnerabilities that affect one version of a package, runtime or server, from the OSV.dev database (Open Source Vulnerabilities, run by Google), without credentials. ecosystem picks the database: Bitnami for runtimes, servers and apps (node for Node.js, php, python, nginx, apache, mariadb, postgresql, redis, wordpress), or a package registry (npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN). name and version must be spelled as the ecosystem does; OSV matches the version exactly, so a misspelled name or a version that doesn't exist gives an empty list, not an error. Records of one issue from several databases (a GitHub advisory and its PyPI or Go copy) are merged into one vulnerability. Returns ecosystem, name (as queried), version and vulnerabilities, most severe first, each with id (the OSV ID, such as GHSA-29mw-wpgm-hmr9 or BIT-node-2022-32212), aliases (other IDs, CVE IDs first), summary (untrusted third-party text, shortened), severity (critical, high, medium or low, from the advisory's own rating; null when it has none), fixedIn (the lowest fixed version above the checked one, read from the advisory's ranges; null when none is listed), published (ISO 8601) and url (its osv.dev page). totalVulnerabilities is how many were found; a list too long for one answer holds only the most severe. complete is false when OSV had more results than could be read in time. Fails when OSV can't be reached, answers with an error or doesn't answer in time.

• ecosystemstring · Required
  OSV ecosystem the package is in, one of Bitnami, npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN. Bitnami is for runtimes, servers and apps such as node (Node.js), php, python, nginx, apache, mariadb, postgresql, redis and wordpress; the others are language package registries (Packagist is PHP's Composer, Maven Java's, NuGet .NET's, Hex Erlang's and Elixir's, Pub Dart's)
  Allowed values: Bitnami, npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN
• namestring · Required
  Package name as the ecosystem spells it: node or php on Bitnami (nodejs and node.js are read as node), lodash on npm, laravel/framework on Packagist, group:artifact on Maven (org.apache.logging.log4j:log4j-core), the module path on Go (github.com/gin-gonic/gin)
  Up to 256 characters
• versionstring · Required
  Exact version to check, as the ecosystem spells it, such as 18.0.0 or 4.17.15; not a range
  Up to 128 characters

Every request needs an API token, which you can create in your account and send as a Bearer token in the Authorization header.