toan203/osv-ui

**A beautiful, zero-config visual CVE dashboard for npm, Python, Go, Rust, Java, PHP, and Ruby projects.**
One command. No signup. No API key. **Runs 100% locally — your code never leaves your machine.**
🇻🇳 Tiếng Việt · 🇺🇸 English · 🇨🇳 中文 · 🇯🇵 日本語
---
The problem
Nobody reads that. Security gets ignored. Dependencies stay vulnerable.
The solution
→ Opens a dashboard. Every CVE, every fix, all your services. Done.
Why give it a try?
- **Zero-config**: No complex setup, no signup, no API key required.
- **Privacy First**: Analysis is done 100% on your machine.
- **Fast & Visual**: Real-time Risk Scores, vulnerability charts, and clear upgrade guides in seconds.
- **Multi-platform**: Native support for Node.js (npm), Python, Go, Rust, Java, PHP, and Ruby.
---
Features
| | |
|---|---|
| 🌐 **Multi-Ecosystem** | Scans package-lock.json, pnpm-lock.yaml, yarn.lock, Pipfile.lock, poetry.lock, requirements.txt, go.sum, Cargo.lock, pom.xml, composer.lock, Gemfile.lock |
| 📡 **Live CVE data** | Powered by OSV.dev — updated daily from NVD, GitHub Advisory, PyPI Advisory. **No API key.** |
| 🏢 **Multi-service** | Scan your entire monorepo in one command — frontend, backend, workers, ML services |
| 💊 **Fix guide** | Dependabot-style upgrade table: current version → safe version + one-click copy command |
| 🔌 **Built-in REST API** | Power your own security dashboards with GET /api/data or CLI export flags |
| 🎯 **Risk score** | 0–100 per service so you know where to focus first |
| 🔍 **CVE drill-down** | Click any row — CVSS score, description, NVD link, GitHub Advisory link |
| 🌙 **Dark Mode** | Eye-friendly security audits, day or night |
---
Quick start
**Scan current directory:**
**Scan a monorepo (multiple services at once):**
**Auto-discover all services under the current directory:**
**Add to your package.json scripts:**
🤖 AI Agent Integration (MCP)
osv-ui is now a Model Context Protocol (MCP) server. This allows AI agents like **Claude Desktop**, **Cursor**, and **Claude Code** to:
1. **Scan your project** for CVEs automatically.
2. **Open the visual dashboard** for you to review findings (Human-in-the-loop).
3. **Apply fixes** after your explicit confirmation.
**Quick setup (npx):**
See the MCP Package README for detailed setup instructions.
---
🔌 Powerful built-in API
osv-ui isn't just a dashboard; it's a security data engine.
Once the dashboard is running, you can pull the raw security data for your whole project:
CI reports, PR diffs, and SBOMs
Generate machine-readable reports without opening the browser:
Compare a PR scan against a baseline report and fail on newly introduced high+ findings:
Minimal GitHub Actions flow:
Send new critical findings to a webhook:
---
Supported manifest files
| Ecosystem | Files |
|-----------|-------|
| **npm / JS** | package-lock.json · pnpm-lock.yaml · yarn.lock |
| **Python** | requirements.txt · Pipfile.lock · poetry.lock · pyproject.toml · uv.lock |
| **Go** | go.sum |
| **Rust** | Cargo.lock |
| **Java** | pom.xml (Maven) |
| **PHP** | composer.json · composer.lock |
| **Ruby** | Gemfile · Gemfile.lock |
More ecosystems coming — see Roadmap.
---
How it works
CVE data comes from **OSV.dev** — a free, open database maintained by Google that aggregates: