OSV-Scanner
Radar: Initial
Apache-2.0
Scans lockfiles, SBOMs, container images and directories against the OSV database, and reports vulnerabilities in the OSV schema.
OSV Schema
Specifications it implements
What this tool does to each specification, in the role vocabulary. Follow a standard through to standards.apievangelist.com for what it actually specifies.
| Standard | Role | What that means |
|---|---|---|
| OSV Schema | scans |
Using this from an agent
- Interfaces
clici-actioncontainer- Install
-
brew
osv-scannergogithub.com/google/osv-scanner/cmd/osv-scanner - Invoke
osv-scanner scan --lockfile <package-lock.json> --format json- Consumes
- lockfile, spdx, cyclonedx, oci-image
- Emits
- json, sarif, table
- Runtime
- Needs network Non-deterministic Read-only No credentials
Where it applies
Jobs this tool actually does, and the surface each one is exercised on.
Find known vulnerabilities in a project's declared dependencies.
coding-agentci-pipeline
Reads lockfiles directly, so an agent can scan a repository it has just cloned with no build and no install step.
Produce SARIF a code-hosting platform will render inline on a pull request.
ci-pipeline
- Website
- https://google.github.io/osv-scanner/
- Repository
- https://github.com/google/osv-scanner
- License
- Apache-2.0 — reported by the GitHub API, verified 2026-09-17
- Stars
- 11045 · last commit 2026-09-17
Reading this as an agent? Don't scrape the page — this entry is published as
structured data at
arrow_back
All tools by adoption
/tools.json,
against the tool.schema.json
schema, using the roles.json
vocabulary. Start at /llms.txt.