---
canonical_url: "https://docs.composio.dev/toolkits/osv"
markdown_url: "https://docs.composio.dev/toolkits/osv.md"
product: "platform"
version: null
last_updated: null
---

# OSV

OSV provides an open vulnerability database and API for querying vulnerabilities by package, version, commit, or vulnerability identifier.

- **Category:** developer tools
- **Auth:** NO_AUTH
- **Composio-managed OAuth available?** N/A
- **Tools:** 5
- **Triggers:** 0
- **Slug:** `OSV`
- **Version:** 20260921_00

## Tools

### Determine Version

**Slug:** `OSV_DETERMINE_VERSION`

Experimentally rank probable versions of an OSS-Fuzz C/C++ library from relative source-file paths and base64-encoded MD5 hashes. Results may be empty or change because the API is experimental.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `file_hashes` | array | Yes | Source-file fingerprints from the library tree; provide at least one useful C/C++ file hash for matching. Empty requests are intentionally rejected because they cannot produce a match. |
| `package_name` | string | No | Optional package-name hint used to improve version matching. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Import Findings

**Slug:** `OSV_GET_IMPORT_FINDINGS`

Experimentally list OSV records from one exact import source that failed import-time quality checks; intended for OSV source maintainers and may return no records.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `source` | string | Yes | Case-sensitive source name exactly matching OSV's source.yaml configuration; this API does not provide source discovery. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Vulnerability

**Slug:** `OSV_GET_VULNERABILITY`

Return the complete OSV record for one case-sensitive vulnerability ID, including affected versions, ranges, severity, references, and aliases.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `vulnerability_id` | string | Yes | Case-sensitive OSV, CVE, GHSA, or ecosystem vulnerability ID, for example OSV-2020-111 or GHSA-vp9c-fpxx-744v. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Query Vulnerabilities

**Slug:** `OSV_QUERY_VULNERABILITIES`

Find full OSV vulnerability records affecting one package, package version, package URL, or commit. Use next_cursor to continue a large result set.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `commit` | string | No | Commit hash to check. Do not combine with version. |
| `version` | string | No | Case-sensitive upstream package version to check. Do not combine with commit or a versioned package_url. |
| `ecosystem` | string | No | Case-sensitive OSV ecosystem, such as npm, PyPI, Maven, or Debian. Provide together with package_name. |
| `next_cursor` | string | No | Opaque continuation cursor returned by a previous call. It retains the original query identifiers, so a continuation may pass this field alone. |
| `package_url` | string | No | Package URL (purl) identifying the package, optionally including its version. Use instead of package_name and ecosystem. |
| `package_name` | string | No | Case-sensitive package name. Provide together with ecosystem, or use package_url instead. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Query Vulnerabilities Batch

**Slug:** `OSV_QUERY_VULNERABILITIES_BATCH`

Check up to 1,000 packages, package versions, package URLs, or commits in one request and return position-matched compact vulnerability IDs. Continue unfinished items with their individual page tokens.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `queries` | array | No | Zero to 1,000 vulnerability queries. Results preserve this array's order; an empty list returns no results. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |