Public git repository to clone and scan for lockfiles/SBOMs (https:// or http:// only). Provide this, or fill in "manifests"/"dependencies" below, or any combination. Example: "https://github.com/expressjs/express.git".

Type:string

Git branch / tag / commit

gitRef

Optional

Branch, tag, or commit to check out. Leave empty to use the repository's default branch.

Type:string

Inline lockfiles / SBOMs

manifests

Optional

One or more dependency files pasted directly, instead of (or in addition to) a repository URL. Each item needs a "filename" (used to detect the format: "package-lock.json", "requirements.txt", "Pipfile.lock", or a CycloneDX/SPDX SBOM .json file) and its "content".

Type:object[]

Default:

[]

Direct dependency list

dependencies

Optional

A flat package+version list, for callers (e.g. an AI agent) that already know exactly what's installed and don't need lockfile/SBOM parsing. Each item needs a "name" and exact "version"; "ecosystem" defaults to "npm" (also supports "PyPI").

Type:object[]

Default:

[]

Max dependencies to check

maxDependencies

Optional

Safety cap on how many dependencies get a live OSV.dev lookup in one run. Example: 300.

Type:integer

Minimum:1

Maximum:1000

Default:300

SBOM Vulnerability Scanner — Lockfile CVE Scan (OSV/KEV)

malonestar/sbom-vulnerability-rollup

SBOM vulnerability scanner at $0.02 per finding: paste an npm, pip or go lockfile and get a prioritized CVE report with upgrade targets. Batch-queries OSV.dev, flags CISA KEV known-exploited vulns, adds NVD CVSS, and computes the minimum fix version per package plus a severity rollup. Keyless.

Kyle Maloney

Dependency SBOM Auditor

timely_quarterstaff/dependency-sbom-auditor

Parse a dependency manifest (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile, composer.json) from text or a public raw URL into a clean dependency list + a CycloneDX SBOM (JSON). Deterministic, no AI. Optional free keyless OSV.dev advisory enrichment. SSRF-guarded.

Ahmed Moussa

OSV.dev Vulnerabilities Scraper

crawlerbros/osv-vulnerabilities-scraper

Scrape OSV.dev, Google's open vulnerability database covering NPM, PyPI, Go, Maven, NuGet, Cargo, RubyGems, GitHub Actions, OS distros, and more. Look up vulnerabilities by package, fetch a specific OSV/GHSA/CVE record, or batch-query an entire dependency tree.

Crawler Bros

Syft SBOM Generator

ayeeyee/syft-sbom-generator

Generate a real, standards-compliant SBOM (Software Bill of Materials) for a container image or git repository using Syft, in CycloneDX or SPDX format. Get a full dependency inventory covering OS packages and application libraries across every major ecosystem. $0.49 per generated SBOM.

Virtual Footprint LLC

DepGuard MCP — Dependency Vulnerability Scanner

snipr/depguard-mcp

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

Snithin P R

GitHub Dependency Risk Triage with OSV

thirdwatch/github-dependency-risk-triage

Read dependency manifests through a GitHub MCP connector, check pinned versions against OSV, and create or update a source-linked review issue without changing code.

Thirdwatch

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.

Virtual Footprint LLC