# AI use cases for Osv Scanner (google/osv-scanner)

Repo: [google/osv-scanner](https://github.com/google/osv-scanner) | Use cases: 3 | Page: https://dedupedai.com/use-cases/google-osv-scanner/

OSV-Scanner is Google's officially supported frontend to the OSV database. It finds known vulnerabilities in your project's dependencies across languages and package managers, scans container images layer by layer, checks licenses, can scan offline against a local database, and offers experimental guided remediation that suggests upgrades.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Scan a project for vulnerable dependencies: https://dedupedai.com/use-cases/google-osv-scanner/scan-a-project-for-vulnerable-dependencies-with-osv-scanner/
- Scan a container image and check licenses: https://dedupedai.com/use-cases/google-osv-scanner/scan-a-container-image-and-check-licenses-with-osv-scanner/
- Scan dependencies without a network connection: https://dedupedai.com/use-cases/google-osv-scanner/scan-dependencies-offline-with-osv-scanner/

## How to scan a project for vulnerable dependencies with Osv Scanner

Repo: [google/osv-scanner](https://github.com/google/osv-scanner) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Recursively scan a source directory and list known vulnerabilities in its dependencies.

**Who it is for:** A developer who wants a fast check of a repo's lockfiles before a release.

**The problem:** Dependencies pick up known vulnerabilities after you ship.

**The outcome:** A list of vulnerabilities found in the supported package files.

### Steps

1. Download a prebuilt binary from the releases page, or build from source with `go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest`
2. Run `osv-scanner scan source -r /path/to/your/dir`
3. Read the vulnerabilities reported for files like package.json or go.mod
4. Upgrade the affected dependencies and rescan

### Prompt to paste into your agent

```text
Using google/osv-scanner, install it with `go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest`, run `osv-scanner scan source -r /path/to/your/dir` on <my repo>, and summarise the findings by severity with the fix for each.
```

### Caveat

These are the V2 instructions; V1 has its own README.

Risk, data: Package names, versions and ecosystems are sent to the OSV.dev API unless you use offline mode.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/google-osv-scanner/scan-a-project-for-vulnerable-dependencies-with-osv-scanner/

## How to scan a container image and check licenses with Osv Scanner

Repo: [google/osv-scanner](https://github.com/google/osv-scanner) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Scan an image layer by layer, then check dependency licenses against an allow list.

**Who it is for:** A platform team gating images and dependencies before they reach production.

**The problem:** Base images and licenses both carry hidden risk.

**The outcome:** Image vulnerabilities plus a license report for a project.

### Steps

1. Install OSV-Scanner from the releases page
2. Run `osv-scanner scan image my-image-name:tag` with your image
3. Run `osv-scanner --licenses path/to/repository` for a license summary
4. Run `osv-scanner --licenses="MIT,Apache-2.0" path/to/directory` to check against an allowed SPDX list

### Prompt to paste into your agent

```text
With google/osv-scanner, run `osv-scanner scan image my-image-name:tag` for <my image>, then `osv-scanner --licenses path/to/repository` for <my repo>, and list anything that breaks an allowed list of MIT and Apache-2.0.
```

### Caveat

Image scanning covers Alpine, Debian and Ubuntu plus Go, Java, Node and Python artifacts.

Risk, data: License scanning sends package names, versions and ecosystems to deps.dev.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/google-osv-scanner/scan-a-container-image-and-check-licenses-with-osv-scanner/

## How to scan dependencies without a network connection with Osv Scanner

Repo: [google/osv-scanner](https://github.com/google/osv-scanner) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Download the vulnerability database once, then scan locally with no calls to OSV.dev.

**Who it is for:** An engineer on an air-gapped or privacy-sensitive build machine.

**The problem:** Sending dependency lists to an external API is not always allowed.

**The outcome:** A vulnerability scan that runs against a local database.

### Steps

1. Install OSV-Scanner from the releases page
2. Run `osv-scanner --offline --download-offline-databases ./path/to/your/dir` once with network access
3. Rerun the same command later without a connection
4. Review the findings

### Prompt to paste into your agent

```text
Using google/osv-scanner, run `osv-scanner --offline --download-offline-databases ./path/to/your/dir` on <my project> and report the vulnerabilities found.
```

### Caveat

The database can also be downloaded manually per the README.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/google-osv-scanner/scan-dependencies-offline-with-osv-scanner/