OSV API
by google.github.io
Security related services
Added on November 1st, 2026
Visit google.github.io →
What it does
OSV.dev is Google's open database of security vulnerabilities in open source packages, covering ecosystems such as npm, PyPI, Maven, Go and crates.io. Its API tells you whether a package version or commit is affected: POST to /v1/query or /v1/querybatch, or fetch an advisory by ID with GET /v1/vulns/{id}. Responses are JSON in the OSV format. Free, no key needed. The official OSV-Scanner includes an experimental MCP server (osv-scanner experimental-mcp) that lets AI agents look up vulnerabilities in the OSV database.
At a glance
- API key
- Not needed · More APIs with no key
- Pricing
- Free, no key needed.
- From the browser
- Yes (CORS)
- Formats
- JSON
- Interface
- REST, MCP
- Provider
- google.github.io
More information: https://google.github.io/osv.dev/api/
Is this your service? Show that it is listed
Put this badge on your website or in your README; it links to this page. About the badge
Example request
curl
curl 'https://api.osv.dev/v1/vulns/OSV-2020-111'JavaScript
const response = await fetch("https://api.osv.dev/v1/vulns/OSV-2020-111");
const data = await response.json();
console.log(data);Python
import requests
response = requests.get(
"https://api.osv.dev/v1/vulns/OSV-2020-111",
timeout=30,
)
print(response.json())The JavaScript works in a web page as well as in Node.js 18 or newer.