Skip to main content
fastcrw
All providersProvider terms
fastCRW Pergamon
Developer · US

OSV.dev

api.osv.dev

Open-source vulnerability records across npm, PyPI, Go, Maven, crates.io and more.

Showing the catalogue

1Request

Ecosystem partition name WITHOUT the trailing slash - the template adds it. Spaces and colons are fine and are percent-encoded for you: PyPI, Maven, Go, npm, RubyGems, crates.io, Red Hat, Alpine:v3.19, Debian:12, Ubuntu:22.04:LTS. Get the exact list from the ecosystems capability; a name that does not exist returns 200 with no items rather than a 404.

Upper bound on how much the bucket scans per call, not a guarantee of how many rows come back - a page can be short and still carry a nextPageToken. 1000 is the server default and yields roughly 59 KB.

Opaque continuation value copied from the previous response's nextPageToken. Large ecosystems such as PyPI and Red Hat run to many pages.

1 credit⌘ ↵
Code follows the fields above
curl "https://api.fastcrw.com/v1/data/osv/ecosystem-advisories?ecosystem=PyPI&maxResults=1000" \
  -H "Authorization: Bearer $FASTCRW_API_KEY"

2Response example

A sample shape. Press Run to see live data from OSV.dev.

JSON
{
  "nextPageToken": "Ch1QeVBJL0dIU0EtNTJ3ci0zdnd3LXJtcHEuanNvbg==",
  "items": [
    {
      "name": "PyPI/ECHO-01ac-8821-274a.json"
    },
    {
      "name": "PyPI/ECHO-1dc5-af13-00c1.json"
    },
    {
      "name": "PyPI/ECHO-34c7-ca18-1a8c.json"
    },
    {
      "name": "PyPI/ECHO-37cc-2ae7-e3c8.json"
    },
    {
      "name": "PyPI/ECHO-3d34-cec5-cf72.json"
    },
    {
      "name": "PyPI/ECHO-435f-9eb9-99cb.json"
    },
    {
      "name": "PyPI/ECHO-4dea-2475-6d75.json"
    },
    {
      "name": "PyPI/ECHO-579f-8639-173e.json"
    },
    {
      "name": "PyPI/ECHO-5818-1fba-950a.json"
    },
    {
      "name": "PyPI/ECHO-7627-a361-b4d3.json"
    },
    "… 990 more items"
  ]
}

Attribution: Source: OSV.dev

Licence: OSV data is published under CC BY 4.0 by the Open Source Vulnerabilities project (Google OSS).

Ask with this source

A prompt for your agent that names this source and how to call it through the crw MCP.

  • Advisory IDs in an ecosystem

    Use OSV.dev (osv) from fastCRW Pergamon, capability "Advisory IDs in an ecosystem" (ecosystem-advisories). You want the full inventory of advisories for one ecosystem or distro release rather than a single record, for example to diff OSV's coverage or to walk every Alpine v3.19 advisory. Example options: ecosystem=PyPI, maxResults=1000, pageToken=Ch1QeVBJL0dIU0EtNTJ3ci0zdnd3LXJtcHEuanNvbg==. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "osv" and capability "ecosystem-advisories". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>

  • Covered ecosystems

    Use OSV.dev (osv) from fastCRW Pergamon, capability "Covered ecosystems" (ecosystems). You need to know which package ecosystems and distro releases OSV actually covers, or you need the exact ecosystem string to feed into the advisory listing. Example options: pageToken=CghNaW5pbU9TLw==. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "osv" and capability "ecosystems". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>

  • Vulnerability by ID

    Use OSV.dev (osv) from fastCRW Pergamon, capability "Vulnerability by ID" (vulnerability). You hold a vulnerability identifier from any ecosystem (GHSA, CVE, PYSEC, RUSTSEC, GO, DSA, MAL) and want one normalised record with its affected version ranges. Example options: id=GHSA-jfh8-c2jp-5v3q. Use the crw MCP tools: crw_find_data to confirm the source and its options, then crw_get_data with provider "osv" and capability "vulnerability". Tell me the credits used and cite the licence from the response. If the crw MCP tools are missing, install them with: npx -y crw-mcp install --api-key <your fastCRW API key>