Osv Audit

OSV审核MCP服务器

模型上下文协议（MCP）服务器，用于解析依赖文件并查询OSV.dev API中的漏洞，提供可操作的修复建议。

特性

• 多格式依赖关系解析：支持npm、Python、Go和Rust锁文件
• 漏洞扫描：查询OSV.dev API以查找已知漏洞
• 修复建议：优先推荐版本升级
• 标准响应信封：一致的JSON响应格式

安装

npm install
npm run build

用法

运行服务器

# Stdio transport (default)
npm start

# HTTP transport
npm start -- --transport http --port 3000

# Using environment variables
TRANSPORT=http PORT=8080 npm start

CLI选项

osv-audit [OPTIONS]

OPTIONS:
    -t, --transport    Transport type: stdio (default) or http
    -p, --port 
        HTTP server port (default: 3000)
        --host         HTTP server host (default: 127.0.0.1)
    -h, --help               Show help message
    -v, --version            Show version

工具

parse_dependency

解析依赖清单文件并提取包名称/版本。

输入：

{
  "text": "",
  "manifest_type": "package-lock" | "pnpm-lock" | "yarn-lock" | "requirements" | "poetry-lock" | "go-mod" | "cargo-lock"
}

输出：

{
  "ok": true,
  "data": {
    "dependencies": [
      { "ecosystem": "npm", "name": "lodash", "version": "4.17.21" }
    ],
    "count": 1
  },
  "meta": {
    "source": "parsed from package-lock",
    "retrieved_at": "2024-01-15T10:00:00.000Z",
    "warnings": []
  }
}

支持的清单类型：

osvquery

查询OSV.dev API以查找影响给定依赖关系的漏洞。

输入：

{
  "dependencies": [
    { "ecosystem": "npm", "name": "lodash", "version": "4.17.20" }
  ]
}

输出：

{
  "ok": true,
  "data": {
    "results": [
      {
        "dependency": { "ecosystem": "npm", "name": "lodash", "version": "4.17.20" },
        "vulnerabilities": [
          {
            "id": "GHSA-xxxx-yyyy-zzzz",
            "summary": "Prototype Pollution in lodash",
            "severity": "CRITICAL",
            "severity_score": 9.8,
            "fixed_versions": ["4.17.21"],
            "aliases": ["CVE-2021-23337"],
            "references": [{ "type": "ADVISORY", "url": "https://..." }]
          }
        ]
      }
    ],
    "total_vulnerabilities": 1
  },
  "meta": {
    "source": "osv.dev",
    "retrieved_at": "2024-01-15T10:00:00.000Z",
    "warnings": []
  }
}

suggest_fixes

分析漏洞结果，并建议版本升级或缓解措施。

输入：

{
  "vuln_results": [
    {
      "dependency": { "ecosystem": "npm", "name": "lodash", "version": "4.17.20" },
      "vulnerabilities": [
        {
          "id": "GHSA-xxxx-yyyy-zzzz",
          "summary": "Prototype Pollution",
          "severity": "CRITICAL",
          "severity_score": 9.8,
          "fixed_versions": ["4.17.21"],
          "aliases": ["CVE-2021-23337"],
          "references": []
        }
      ]
    }
  ]
}

输出：

{
  "ok": true,
  "data": {
    "suggestions": [
      {
        "package": "lodash",
        "ecosystem": "npm",
        "current_version": "4.17.20",
        "suggested_version": "4.17.21",
        "vulnerabilities_fixed": ["GHSA-xxxx-yyyy-zzzz"],
        "severity": "CRITICAL",
        "priority": "critical",
        "action": "upgrade",
        "notes": [
          "Upgrade from 4.17.20 to 4.17.21",
          "Related CVEs: CVE-2021-23337"
        ]
      }
    ],
    "summary": {
      "total": 1,
      "by_priority": { "critical": 1, "high": 0, "medium": 0, "low": 0 }
    }
  },
  "meta": {
    "retrieved_at": "2024-01-15T10:00:00.000Z",
    "warnings": []
  }
}

工作流示例

// 1. Parse your dependencies
const parseResult = await client.callTool({
  name: 'parse_dependencies',
  arguments: {
    text: fs.readFileSync('package-lock.json', 'utf-8'),
    manifest_type: 'package-lock'
  }
});

// 2. Query OSV for vulnerabilities
const queryResult = await client.callTool({
  name: 'osv_query',
  arguments: {
    dependencies: parseResult.data.dependencies
  }
});

// 3. Get fix suggestions
const suggestions = await client.callTool({
  name: 'suggest_fixes',
  arguments: {
    vuln_results: queryResult.data.results
  }
});

响应信封

所有工具均以标准信封格式返回响应：

成功：

{
  "ok": true,
  "data": { ... },
  "meta": {
    "source": "optional string",
    "retrieved_at": "ISO-8601 timestamp",
    "pagination": { "next_cursor": null },
    "warnings": []
  }
}

错误：

{
  "ok": false,
  "error": {
    "code": "INVALID_INPUT | UPSTREAM_ERROR | RATE_LIMITED | TIMEOUT | PARSE_ERROR | INTERNAL_ERROR",
    "message": "human readable message",
    "details": {}
  },
  "meta": {
    "retrieved_at": "ISO-8601 timestamp"
  }
}

环境变量

发展

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

# Run tests with coverage
npm run test:coverage

# Type checking
npm run typecheck

许可证

麻省理工学院