X (Twitter)LinkedInGitHubDiscordYouTube

How to connect OSV to Claude

Connect Claude Web, Desktop and Cowork to OSV MCP. List all vulnerabilities for package django, get vulnerability details for cve-2023-1234, and more using natural language, with authentication handled for you.

Get started for freeGet a demo
OSV logoOSV
No Auth

OSV is an open vulnerability database and API for querying vulnerabilities by package, version, commit, or vulnerability identifier. It helps you quickly find and track known software vulnerabilities across ecosystems.

5 Tools

Introduction

Claude is Anthropic's AI assistant, available on the web, in the desktop app, and on mobile. Cowork is its agent for knowledge work, and it runs on all of those surfaces too. Connected to your apps, Claude can work with your files and services to accomplish complex tasks on your behalf.

This guide walks you through the easiest and most secure way to connect your OSV account to Claude via Composio Connect, enabling it to list all vulnerabilities for package django, get vulnerability details for CVE-2023-1234, find vulnerable versions for package lodash, and more such actions on your behalf without compromising your account security.

Setup is the same on Claude Web, Desktop, and Cowork, and you only need to do it once. The connector is tied to your account, so it's available in all three.

Also integrate OSV with

ChatGPT WorkHermes

Connecting OSV to Claude Web, Desktop, and Cowork

1. Open Customize

In Claude Desktop, click Customize in the left sidebar, then select Connectors and click the + icon at the top.

Claude Desktop connectors screen with Add custom connector selected

2. Add the Composio MCP server

Click Add custom connector and paste in the Composio MCP server URL:

bash
https://connect.composio.dev/mcp
Add custom connector dialog with Composio MCP server URL

3. Authorize in your browser

Click Connect. You'll be redirected to a browser window where you can authorize Composio to continue.

Composio authorization screen for Claude Web, Desktop, and Cowork

4. Connect your OSV account

Back in Claude, ask it to connect to OSV or give it any OSV-related task.

For example, ask Claude to:

  • "List all vulnerabilities for package django"
  • "Get vulnerability details for CVE-2023-1234"
  • "Find vulnerable versions for package lodash"

It will prompt you to authenticate and authorize access.

That's it. Composio's tools are now available in Claude, and your OSV account is ready to use.

What is the OSV Claude Connector, and what's possible with it?

The OSV MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your OSV account. It provides structured and secure access so your agent can perform OSV operations on your behalf.

Troubleshooting

1. Why does Claude not use the Composio connector for OSV?

The connector can show as connected, but Claude must use it in each OSV conversation.

  • Click + at the lower left of the chat, or type /.
  • Hover Connectors.
  • Turn on Composio.
  • Ask Claude to connect to OSV again.

2. Why does Claude show an MCP server error before OSV connects?

Claude can show Couldn't reach the MCP server or Authorization with the MCP server failed when you add the connector for OSV.

  • Check that the connector URL is https://connect.composio.dev/mcp.
  • Connectors run from Anthropic's cloud, so your device network is usually not the problem.
  • Add the connector again from Customize > Connectors, then ask Claude to connect OSV.
  • If it fails again, send the error and the ofid_ reference id to support@composio.dev.

3. Why does the OSV authorization link not work?

The Composio connector is one server. Your OSV account connects separately when Claude asks for it.

  • If the browser does not open, or the link expires, ask Claude to retry the OSV connection.
  • Composio creates a fresh OSV authorization link.
  • Open that link in your browser and finish the OSV sign-in.

4. Why do OSV actions fail after they worked before?

The OSV connection can expire or lose permission.

  • Ask Claude to inspect the OSV connection.
  • If the connection is unhealthy, disconnect it when Claude prompts you.
  • Reconnect the OSV account and retry the action.
  • If Claude shows a permission prompt, approve it before Claude changes data in OSV.
  • If the action still fails with a permission error, check that the connected account has that permission in OSV itself.

5. How do I switch to a different OSV account?

Claude can manage the OSV connection for you.

  • Ask Claude to disconnect or delete the current OSV account.
  • Ask Claude to connect OSV again.
  • Open the new Composio authorization link for OSV.
  • Sign in with the other OSV account in the browser.
  • After the account connects, ask Claude to retry the OSV task.

6. Why is my OSV connection missing in Claude Desktop or on a Team plan?

The connector belongs to your Claude account, so your OSV connection works in Claude Web, Desktop, and Cowork.

  • In Claude Desktop, open Customize > Connectors.
  • Next to Composio, click ⋮ and click Clear cache.
  • If OSV tools still do not appear, click ⋮, disconnect, remove the connector, and add it again.
  • On Team or Enterprise, an Owner or Primary Owner must enable the connector before you can connect OSV.
TOOLS

Supported Tools

Every OSV action and event your agent gets out of the box.

Determine Version

Experimentally rank probable versions of an OSS-Fuzz C/C++ library from relative source-file paths and base64-encoded MD5 hashes.

Get Import Findings

Experimentally list OSV records from one exact import source that failed import-time quality checks; intended for OSV source maintainers and may return no records.

Get Vulnerability

Return the complete OSV record for one case-sensitive vulnerability ID, including affected versions, ranges, severity, references, and aliases.

Query Vulnerabilities

Find full OSV vulnerability records affecting one package, package version, package URL, or commit.

Query Vulnerabilities Batch

Check up to 1,000 packages, package versions, package URLs, or commits in one request and return position-matched compact vulnerability IDs.

FRAMEWORKS

How to build OSV MCP Agent with another framework

ChatGPT Work logo

ChatGPT Work

Use OSV MCP with ChatGPT Work

Hermes logo

Hermes

Use OSV MCP with Hermes

FAQ

Frequently asked questions

With a standalone OSV MCP server, the agents and LLMs can only access a fixed set of OSV tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from OSV and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Claude Cowork fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right OSV tools.

Yes, absolutely. You can configure which OSV scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your OSV data and credentials are handled as safely as possible.

Start with OSV.It takes 30 seconds.

Managed auth, hosted MCP servers, and every OSV tool your agent needs.Free to start.

Start building