Проверка версий на наличие уязвимостей как MCP-инструмент

Lists the known vulnerabilities that affect one version of a package, runtime or server, from the OSV.dev database (Open Source Vulnerabilities, run by Google), without credentials. ecosystem picks the database: Bitnami for runtimes, servers and apps (node for Node.js, php, python, nginx, apache, mariadb, postgresql, redis, wordpress), or a package registry (npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN). name and version must be spelled as the ecosystem does; OSV matches the version exactly, so a misspelled name or a version that doesn't exist gives an empty list, not an error. Records of one issue from several databases (a GitHub advisory and its PyPI or Go copy) are merged into one vulnerability. Returns ecosystem, name (as queried), version and vulnerabilities, most severe first, each with id (the OSV ID, such as GHSA-29mw-wpgm-hmr9 or BIT-node-2022-32212), aliases (other IDs, CVE IDs first), summary (untrusted third-party text, shortened), severity (critical, high, medium or low, from the advisory's own rating; null when it has none), fixedIn (the lowest fixed version above the checked one, read from the advisory's ranges; null when none is listed), published (ISO 8601) and url (its osv.dev page). totalVulnerabilities is how many were found; a list too long for one answer holds only the most severe. complete is false when OSV had more results than could be read in time. Fails when OSV can't be reached, answers with an error or doesn't answer in time.

• ecosystemstring · Обязательный
  OSV ecosystem the package is in, one of Bitnami, npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN. Bitnami is for runtimes, servers and apps such as node (Node.js), php, python, nginx, apache, mariadb, postgresql, redis and wordpress; the others are language package registries (Packagist is PHP's Composer, Maven Java's, NuGet .NET's, Hex Erlang's and Elixir's, Pub Dart's)
  Допустимые значения: Bitnami, npm, PyPI, Packagist, Maven, NuGet, Go, crates.io, RubyGems, Pub, Hex, CRAN
• namestring · Обязательный
  Package name as the ecosystem spells it: node or php on Bitnami (nodejs and node.js are read as node), lodash on npm, laravel/framework on Packagist, group:artifact on Maven (org.apache.logging.log4j:log4j-core), the module path on Go (github.com/gin-gonic/gin)
  Не более 256 символов
• versionstring · Обязательный
  Exact version to check, as the ecosystem spells it, such as 18.0.0 or 4.17.15; not a range
  Не более 128 символов

Каждому запросу нужен API-токен: его можно создать в учётной записи и отправить как Bearer-токен в заголовке Authorization.