How to use Osv Scanner: what you can do with it

3 use cases

• Scan a project for vulnerable dependencies

  Recursively scan a source directory and list known vulnerabilities in its dependencies.

  • REPO google/osv-scanner
  • Claude Code
  • Codex
  • Cursor
  • Gemini CLI
  • Security and science
  • Beginner
  View prompt

  Using google/osv-scanner, install it with `go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest`, run `osv-scanner scan source -r /path/to/your/dir` on <my repo>, and summarise the findings by severity with the fix for each.

  Share Email me this

• Scan a container image and check licenses

  Scan an image layer by layer, then check dependency licenses against an allow list.

  • REPO google/osv-scanner
  • Claude Code
  • Codex
  • Cursor
  • Gemini CLI
  • Security and science
  • Intermediate
  View prompt

  With google/osv-scanner, run `osv-scanner scan image my-image-name:tag` for <my image>, then `osv-scanner --licenses path/to/repository` for <my repo>, and list anything that breaks an allowed list of MIT and Apache-2.0.

  Share Email me this

• Scan dependencies without a network connection

  Download the vulnerability database once, then scan locally with no calls to OSV.dev.

  • REPO google/osv-scanner
  • Claude Code
  • Codex
  • Cursor
  • Gemini CLI
  • Security and science
  • Intermediate
  View prompt

  Using google/osv-scanner, run `osv-scanner --offline --download-offline-databases ./path/to/your/dir` on <my project> and report the vulnerabilities found.

  Share Email me this

Quick start with Osv Scanner

1. Check you have what it needs: A prebuilt binary from the releases page, or Go to run go install; A project directory with lockfiles or manifests, or a container image; Network access to OSV.dev, unless you use offline mode.
2. Open google/osv-scanner on GitHub and read the README and license.
3. Download a prebuilt binary from the releases page, or build from source with go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
4. Run osv-scanner scan source -r /path/to/your/dir
5. Read the vulnerabilities reported for files like package.json or go.mod
6. Upgrade the affected dependencies and rescan

These steps come from our top use case, Scan a project for vulnerable dependencies, which also has a copy-paste agent prompt.

Using the Deduped MCP, get the setup steps for google/osv-scanner

claude mcp add --transport http deduped https://dedupedai.com/mcp

Best AI repos for Security and science

About this repo

• Who it is forDevelopers and security teams who want free dependency vulnerability scanning backed by the open OSV.dev database.
• Why it is hot11k stars, talked about in 2 AI sources we track
• LanguageGo
• Sourcegithub.com/google/osv-scanner · Back to Hot repos

Requirements

• A prebuilt binary from the releases page, or Go to run go install
• A project directory with lockfiles or manifests, or a container image
• Network access to OSV.dev, unless you use offline mode

Related repos

• Trended earlier REPO aquasecurity/trivy Trivy Trivy is Aqua Security's open source security scanner. It scans container images, filesystems, remote git repositories, virtual machine images and Kubernetes clusters for known vulnerabilities (CVEs), software dependencies (SBOM), infrastructure as code misconfigurations, secrets and software licenses. It installs through Homebrew, Docker or a binary and integrates with GitHub Actions, a Kubernetes operator and VS Code.
• Trended earlier REPO Mah3Sec/ForgeGuardian Forge Guardian ForgeGuardian is a local-first, Go-based software supply chain security scanner that checks project dependencies across 9 ecosystems with 8 scan engines.