Can I use OSV as a CLI?

Yes. KosmoKrator exposes a OSV CLI through kosmo integrations:call and the provider shortcut command. Commands can return JSON for scripts, CI, and coding agents.

Can I expose OSV through MCP?

Yes. The KosmoKrator MCP gateway can expose selected OSV tools to clients such as Claude Code, Cursor, Codex, and other MCP-compatible tools.

Where are OSV credentials stored?

OSV credentials are configured in KosmoKrator's local integration settings and reused by CLI, Lua, and MCP gateway surfaces.

Can I deny write access for OSV MCP tools?

Yes. Start the gateway with --write=deny for read-only clients, or use ask/allow only for trusted workspaces.

data

OSV MCP, CLI, and Lua Integration for AI Agents

OSV integration docs for AI agents: MCP gateway setup, OSV CLI commands, Lua API reference, credentials, and function schemas.

OSV for agents

No credentials required; available in web and CLI hosts when runtime dependencies are installed.

Use this integration from Lua code mode, the headless integrations CLI, or the KosmoKrator MCP gateway. The same package metadata powers all three surfaces.

Agent Surfaces

OSV CLIHeadless setup, JSON output, direct function calls. OSV MCPExpose selected tools to local MCP clients. OSV LuaAgent-facing namespace and Lua reference. FeedbackReport missing tools, auth issues, or bad metadata.

Machine-Readable Metadata

integration_slug: osv
route_slug: osv
package: osv
auth_strategy: none
cli_setup_supported: true
cli_runtime_supported: true
mcp_gateway_supported: true
lua_supported: true

Function Catalog

Function	Type	Description
`osv.osv_query`	Read `read`	Query vulnerabilities for one package version, purl, or commit.
`osv.osv_query_batch`	Read `read`	Query vulnerabilities for multiple package versions or commits.
`osv.osv_get_vulnerability`	Read `read`	Retrieve one OSV vulnerability record by ID.
`osv.osv_import_findings`	Read `read`	Retrieve experimental import-quality findings for a source.
`osv.osv_determine_version`	Read `read`	Experimentally identify likely C/C++ library versions from file hashes.