How to integrate OSV MCP with Atomic Agent

Atomic Agent is an open-source AI agent that runs on your machine and supports local models through llama.cpp. Connect it to 1,500+ apps through Composio, including OSV.

This guide uses Atomic Agent's built-in Composio integration. You need Atomic Agent v0.5.6 or later, your own Composio API key, and a OSV account. See the Atomic Agent documentation for installation instructions.

How Atomic Agent connects to OSV

Atomic Agent connects to Composio's Tool Router over Streamable HTTP MCP. It discovers the tools needed for your request, and Composio handles account authentication.

Execution and account-connection tools follow Atomic Agent's configured approval policy. Review any approval prompt before allowing an action on your connected account.

Connect OSV to Atomic Agent

1. Sign up or sign in to the Composio dashboard. Copy your API key.
2. In Atomic Agent, open the Integrations tab and select Composio. Select API key, press e, paste the key, and press Enter. The tools become available immediately, without a restart.
3. Ask Atomic Agent to do something in OSV. It searches Composio for the right tool.
4. On first use, open the sign-in link returned in the chat. Connect your OSV account, then return to Atomic Agent to continue.

Headless setup

Add the following line to ~/.atomic-agent/.env, replacing YOUR_COMPOSIO_API_KEY with your key. Start Atomic Agent after saving the file.

The OSV MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to OSV. It provides structured and secure access to open source vulnerability data, so your agent can check packages and commits, retrieve vulnerability records, scan dependency lists, identify probable library versions, and review import findings on your behalf.

• Package vulnerability checks: Have your agent find known vulnerabilities affecting a package, package version, package URL, or commit.
• Detailed vulnerability research: Direct your agent to retrieve a vulnerability record with its affected versions, ranges, severity, references, and aliases.
• Batch dependency scanning: Let the agent check up to 1,000 packages, versions, package URLs, or commits and return position-matched vulnerability identifiers.
• Library version identification: Instruct your agent to rank probable versions of an OSS-Fuzz C or C++ library using source-file paths and file hashes.
• Import quality investigation: Have your agent list vulnerability records from a specific import source that failed import-time quality checks.

Use OSV from Atomic Agent

With your account connected, ask Atomic Agent to work with OSV in natural language. You can connect more apps through the same Composio integration as you need them.

Visit the Atomic Agent website or inspect the Atomic Agent source code.