DEDUPED Hot AI repos. Real use cases. What people build. Get the Monday 5

How to scan a project for vulnerable dependencies with Osv Scanner

Recursively scan a source directory and list known vulnerabilities in its dependencies.

Short answer: Download a prebuilt binary from the releases page, or build from source with go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest; then run osv-scanner scan source -r /path/to/your/dir; read the vulnerabilities reported for files like package.json or go.mod. All steps.

  • Top pick
  • Security and science
  • Beginner
  • 15 minutes
  • From the README
  • Claude Code
  • Codex
  • Cursor
  • Gemini CLI

data. Package names, versions and ecosystems are sent to the OSV.dev API unless you use offline mode.

Who it is forA developer who wants a fast check of a repo's lockfiles before a release.

The problemDependencies pick up known vulnerabilities after you ship.

The outcomeA list of vulnerabilities found in the supported package files.

What you need first

  • A prebuilt binary from the releases page, or Go to run go install
  • A project directory with lockfiles or manifests, or a container image
  • Network access to OSV.dev, unless you use offline mode

Steps

  1. Download a prebuilt binary from the releases page, or build from source with go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
  2. Run osv-scanner scan source -r /path/to/your/dir
  3. Read the vulnerabilities reported for files like package.json or go.mod
  4. Upgrade the affected dependencies and rescan

Prompt for your agent

Using google/osv-scanner, install it with `go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest`, run `osv-scanner scan source -r /path/to/your/dir` on <my repo>, and summarise the findings by severity with the fix for each.

Caveat. These are the V2 instructions; V1 has its own README.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for google/osv-scanner and "Scan a project for vulnerable dependencies"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer