google/osv.dev

Health v2 · maintenance only

Adoption not part of the score

2901 stars · 354 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OSV (Open Source Vulnerabilities) is Google's open, distributed vulnerability database and triage service that aggregates security advisories from dozens of ecosystems (npm, PyPI, Go, Maven, Debian, Alpine, Linux distros, etc.) into a precise structured schema, exposed via a public API, web UI, and GCS data dumps. This repository contains the full code powering the hosted osv.dev service, including the API server, web backend, ingestion workers, NVD/CVE feed converters, language bindings, and Terraform deployment configuration.

Use cases

• check whether a specific package version is affected by known vulnerabilities
• query a vulnerability database by package name and version via API
• convert CVE and NVD feeds into a structured vulnerability format
• aggregate security advisories across many package ecosystems
• download structured vulnerability data dumps for security tooling
• look up vulnerabilities in an SBOM or lockfile
• run my own instance of a vulnerability database service

When to choose

• You need an open, precise, per-ecosystem vulnerability data source with a queryable API
• You want structured OSV-format data dumps to power your own security scanning or compliance tooling
• You are building dependency or SBOM analysis and need to resolve whether versions are affected
• You want to study or self-host the infrastructure of a vulnerability ingestion and triage pipeline

When to avoid

• You only want to scan your project's dependencies locally - use the separate google/osv-scanner CLI instead
• You need a full commercial vulnerability management platform with ticketing, policies, and dashboards
• You just need general application security testing rather than known-vulnerability data

Facets

service · maturity stable

vulnerability-scanning security database search-engine etl api-framework http-server sdk infrastructure-as-code security developer-tools databases apis cloud go python serverless vulnerability-database osv-schema cve security-advisories sbom dependency-vulnerabilities triage gcp terraform data-dumps automation web-server docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/osv.dev")