Package Vulnerability Scanner (OSV SCA, CVSS + Fixes)

SBOM Vulnerability Scanner — Lockfile CVE Scan (OSV/KEV)

malonestar/sbom-vulnerability-rollup

SBOM vulnerability scanner: paste an npm, pip or go lockfile and get a prioritized CVE report with upgrade targets. Batch-queries OSV.dev, flags CISA KEV known-exploited vulns, adds NVD CVSS, and computes the minimum fix version per package plus a severity rollup. Keyless.

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.

OSV Open Source Vulnerabilities Scraper

parseforge/osv-vulnerabilities-scraper

Scrapes open source vulnerability records from the OSV catalogue by package, version, commit, or vulnerability ID. Returns each advisory as a flat row with aliases, affected versions, and severity scores.

DepGuard - Dependency Vulnerability Scanner

george.the.developer/depguard-dependency-vulnerability-scanner

Scan your dependencies for known vulnerabilities over OSV.dev and flag the ones CISA lists as actively exploited, so you patch the dangerous bugs first. Packages or a lockfile in, normalized vulnerability rows out. No API key, standby ready.

Normalized npm and PyPI package metadata plus OSV.dev vulnerability signals for dependency auditing and supply-chain monitoring.

Grype Vulnerability Matcher

ayeeyee/grype-vulnerability-matcher

Scan a container image or git repository for known CVEs using Grype, Anchore open-source vulnerability scanner. Get severity-scored matches from Critical to Negligible, cross-referenced against the latest vulnerability database. $0.79 per completed scan; failed scans are never charged.

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.

DepGuard MCP — Dependency Vulnerability Scanner

snipr/depguard-mcp

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

OSV & GitHub Security Scraper

taroyamada/oss-vulnerability-monitor

Scrape GitHub Security Advisories and OSV databases to extract CVSS v3.1 base scores, fixed version tags, and patching details for your tech stack.

Trivy Security Scanner

ayeeyee/trivy-security-scanner

Scan a container image or git repository for CVEs, exposed secrets, and misconfigurations using Trivy, the open-source scanner trusted across the container security ecosystem. Severity-scored findings, Critical to Negligible. $0.99 per completed scan; failed scans are never charged.