OSV Schema
Radar: Initial
Apache-2.0
The JSON schema describing open-source vulnerabilities in a way that is precise about which versions are affected, across every package ecosystem.
OSV Schema
Specifications it implements
What this tool does to each specification, in the role vocabulary. Follow a standard through to standards.apievangelist.com for what it actually specifies.
| Standard | Role | What that means |
|---|---|---|
| OSV Schema | authors |
Using this from an agent
- Interfaces
library- Consumes
- json-schema
- Emits
- json
- Runtime
- Runs offline Deterministic Read-only No credentials
Where it applies
Jobs this tool actually does, and the surface each one is exercised on.
Parse vulnerability data from any OSV-compatible source with one schema.
coding-agent
The reason this schema won: version ranges are expressed exactly, so "is my version affected?" is a computation rather than a judgement call about a CVE description.
- Website
- https://ossf.github.io/osv-schema/
- Repository
- https://github.com/ossf/osv-schema
- License
- Apache-2.0 — reported by the GitHub API, verified 2026-09-17
- Stars
- 271 · last commit 2026-09-15
Reading this as an agent? Don't scrape the page — this entry is published as
structured data at
arrow_back
All tools by adoption
/tools.json,
against the tool.schema.json
schema, using the roles.json
vocabulary. Start at /llms.txt.