Container CVE Matcher

SBOM Vulnerability Scanner — Lockfile CVE Scan (OSV/KEV)

malonestar/sbom-vulnerability-rollup

SBOM vulnerability scanner at $0.02 per finding: paste an npm, pip or go lockfile and get a prioritized CVE report with upgrade targets. Batch-queries OSV.dev, flags CISA KEV known-exploited vulns, adds NVD CVSS, and computes the minimum fix version per package plus a severity rollup. Keyless.

Parse a dependency manifest (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile, composer.json) from text or a public raw URL into a clean dependency list + a CycloneDX SBOM (JSON). Deterministic, no AI. Optional free keyless OSV.dev advisory enrichment. SSRF-guarded.

OSV.dev Vulnerabilities Scraper

crawlerbros/osv-vulnerabilities-scraper

Scrape OSV.dev, Google's open vulnerability database covering NPM, PyPI, Go, Maven, NuGet, Cargo, RubyGems, GitHub Actions, OS distros, and more. Look up vulnerabilities by package, fetch a specific OSV/GHSA/CVE record, or batch-query an entire dependency tree.

Syft SBOM Generator

ayeeyee/syft-sbom-generator

Generate a real, standards-compliant SBOM (Software Bill of Materials) for a container image or git repository using Syft, in CycloneDX or SPDX format. Get a full dependency inventory covering OS packages and application libraries across every major ecosystem. $0.49 per generated SBOM.

DepGuard MCP — Dependency Vulnerability Scanner

snipr/depguard-mcp

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

Read dependency manifests through a GitHub MCP connector, check pinned versions against OSV, and create or update a source-linked review issue without changing code.

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.

Manifest to OSV Vulnerability Triage

vedder1980/osv-manifest-triage

Triages up to 500 dependency versions against the public OSV vulnerability database.

Prioritize SBOM vulnerabilities with OSV, CISA KEV and EPSS for agent remediation workflows.

SBOM Vulnerability Auditor

technicaldost/sbom-vulnerability-auditor

Audit CycloneDX, package-lock, or simple package lists against OSV.