# OSV API

Category: [Security related services](https://free-web-services.com/web-services/web-development/security/)  
Page: https://free-web-services.com/web-services/web-development/security/osv-api.html  
Documentation: https://google.github.io/osv.dev/api/

OSV.dev is Google's open database of security vulnerabilities in open source packages, covering ecosystems such as npm, PyPI, Maven, Go and crates.io. Its API tells you whether a package version or commit is affected: POST to /v1/query or /v1/querybatch, or fetch an advisory by ID with GET /v1/vulns/{id}. Responses are JSON in the OSV format. Free, no key needed. The official OSV-Scanner includes an experimental MCP server (osv-scanner experimental-mcp) that lets AI agents look up vulnerabilities in the OSV database.

- API key: Not needed
- Pricing: Free, no key needed.
- From the browser: Yes (CORS)
- Formats: JSON
- Interface: REST, MCP
- Provider: google.github.io

Example request:

```sh
curl 'https://api.osv.dev/v1/vulns/OSV-2020-111'
```

The JavaScript works in a web page as well as in Node.js 18 or newer.