X (Twitter)LinkedInGitHubDiscordYouTube

How to connect OSV MCP with ChatGPT Work

Connect ChatGPT Work to OSV MCP. List all vulnerabilities for package django, get vulnerability details for cve-2023-1234, and more using natural language, with authentication handled for you.

Get started for freeGet a demo
OSV logoOSV
No Auth

OSV is an open vulnerability database and API for querying vulnerabilities by package, version, commit, or vulnerability identifier. It helps you quickly find and track known software vulnerabilities across ecosystems.

5 Tools

How to connect OSV MCP with ChatGPT Work

ChatGPT Work is an agent inside ChatGPT built for your most ambitious work. It takes action across your apps and files, stays with a project for hours, and turns a goal into finished materials like sheets, slides, and docs - not just answers.

In this guide, I will explain the easiest and most secure way to connect your OSV account to ChatGPT Work via Composio Connect, so it can query packages and versions, fetch vulnerability details, filter by severity and affected ranges, monitor new advisories, and generate concise summaries through natural language commands without ever putting your account credentials at risk.

Also integrate OSV with

Claude CoworkHermes

Why use Composio over default connectors?

  • Apps with read and write access. Default connectors mostly can read your data. Composio's OSV integration lets ChatGPT Work take actions like creating drafts, sending updates, labeling records, and more.
  • 1,500+ SaaS toolkits out of the box. Composio gives you instant access to a vast catalog of pre-built connectors, from Gmail and Slack to Notion, Linear, and Salesforce.
  • One MCP server for every app. Connect any of your applications on demand through a single endpoint, rather than juggling a separate server for each app.
  • Smart, context-aware tool loading. Unlike traditional MCP servers that dump every available tool into the LLM context window, Composio searches for and loads only the tools relevant to the task at hand.
  • Cross-app automation. Chain actions across multiple apps in a single run - fetch a thread, summarize it in Notion, and post highlights to Slack without leaving the conversation.

Prerequisites

  • A ChatGPT account with access to ChatGPT Work (rolling out across Pro, Enterprise, Edu, Plus, and Business plans). We will use the ChatGPT desktop app, which is available on every plan.
  • Access to the OSV workspace you want to connect.
  • Composio MCP.

Note: Composio connects through OAuth. You will be asked to sign in and approve specific permissions. Review the permission screen carefully if you are using a work account.

Step-by-step: Connect OSV to ChatGPT Work

1. Open the MCP settings

In ChatGPT Work, go to Settings and open the Plugins section. Inside the Plugins page, click the MCP tab.

ChatGPT Work settings showing the Plugins page with the MCP tab selected

2. Add the server

Click Add server. In the Name field enter Composio, for Type select Streamable HTTP, and in the URL field paste the Composio MCP server URL:

bash
https://connect.composio.dev/mcp
ChatGPT Work Add server dialog with the name Composio, type Streamable HTTP, and the Composio MCP URL

Then click Save. The Composio server now appears in your MCP plugins list.

ChatGPT Work Plugins page showing the Composio MCP server added to the list

3. Authenticate

Click Authenticate, log in via Composio, and click Allow access to authorize ChatGPT Work to use your Composio account.

Composio login and Allow access screen for ChatGPT Work MCP setup

4. Start using Composio

That is it - Composio tools are now available in ChatGPT Work. Ask it to work with your OSV account and it will run the actions you authorize.

What you can do after connecting OSV

  • List all vulnerabilities for package django
  • Get vulnerability details for CVE-2023-1234
  • Find vulnerable versions for package lodash

Security + privacy notes (important)

  • Use least-privilege access: Only grant permissions you actually need.
  • Review OAuth permissions before approving: Make sure requested scopes match what you expect Composio and ChatGPT Work to do.
  • Keep write actions human-reviewed: For actions like sending messages, creating labels, or editing drafts, keep manual confirmation enabled.
  • Be careful with sensitive data: Avoid using this setup with highly sensitive information unless allowed by your personal, company, or client policies.
TOOLS

Supported Tools

Every OSV action and event your agent gets out of the box.

Determine Version

Experimentally rank probable versions of an OSS-Fuzz C/C++ library from relative source-file paths and base64-encoded MD5 hashes.

Get Import Findings

Experimentally list OSV records from one exact import source that failed import-time quality checks; intended for OSV source maintainers and may return no records.

Get Vulnerability

Return the complete OSV record for one case-sensitive vulnerability ID, including affected versions, ranges, severity, references, and aliases.

Query Vulnerabilities

Find full OSV vulnerability records affecting one package, package version, package URL, or commit.

Query Vulnerabilities Batch

Check up to 1,000 packages, package versions, package URLs, or commits in one request and return position-matched compact vulnerability IDs.

FRAMEWORKS

How to build OSV MCP Agent with another framework

Claude Cowork logo

Claude Cowork

Use OSV MCP with Claude Cowork

Hermes logo

Hermes

Use OSV MCP with Hermes

FAQ

Frequently asked questions

With a standalone OSV MCP server, the agents and LLMs can only access a fixed set of OSV tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from OSV and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. ChatGPT Work fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right OSV tools.

Yes, absolutely. You can configure which OSV scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your OSV data and credentials are handled as safely as possible.

Start with OSV.It takes 30 seconds.

Managed auth, hosted MCP servers, and every OSV tool your agent needs.Free to start.

Start building