Description

Google-led open source vulnerability database and REST API for querying known security vulnerabilities in open source packages. Supports querying by package version or commit hash across more than 25 ecosystems including PyPI, npm, Go, Maven, crates.io, and NuGet. Uses the OpenSSF OSV schema, an open standard developed in collaboration with open source communities. No API rate limits currently. Full database dumps available via public GCS bucket.

AI-native score

How ready this product is for agents to use, on a 0–100 scale across four weighted dimensions. Security is one of them, so a high score is not a substitute for your own security or vendor-risk review. How is this scored?

Unrated. Only 38% of the scored decision fields are researched, so the grade is held until more are confirmed. The breakdown below shows what's been scored.

Component	Raw	Weight	Contribution
Integration	3/10	35%	10.5
Trust	0/6	30%	0.0
Portability	4/4	20%	20.0
Security	0/4	15%	0.0

Signals that fired

Integration: API spec, OpenAPI / gRPC / GraphQL (+1) ; Command-line interface (+1) ; SDK / developer kit (+1)
Portability: Data export (full, +2) ; Open standards (+1) ; Standard protocol access (+1) ; No proprietary-SDK lock-in (+1) ; Open source (+1)

Signals not researched

These gaps cover the fields used in the AI-native score.

Integration surfaces: llms.txt, WebMCP, Headless signup, Native connectors, Agent skills
Trust & data policy: Trust center, Multi-factor authentication, Zero data retention, No generative AI training, Hard budget caps, Sandbox environment, Data import, Documented provider swap, Self-hostable
Security & compliance: Compliance certifications, Access controls

Trust & data policy

Data export: Full
Open standards: Yes
Standard protocol access: Yes
No proprietary-SDK lock-in: Yes
Open source: Yes
Source code: https://github.com/google/osv.dev

Not yet researched Trust center, Multi-factor authentication, Zero data retention, No generative AI training, Hard budget caps, Sandbox environment, Data import, Documented provider swap, Self-hostable

What it does

Jobs to be done

Research software packages and dependencies

Look up metadata, versions, licenses, dependency graphs, and known vulnerabilities for software packages and open source dependencies.

View 3 products

Integration surfaces

How an agent connects to this product and finds its documentation. The largest dimension of the AI-native score (35%).

Not yet researched llms.txt, WebMCP, Headless signup, Native connectors, Agent skills

Offers

No offers recorded.

Reviews

No approved reviews yet.

RSS: approved reviews

Catalog activity

Track how this entry changes as proposals are opened and merged.

RSS: merged changes · RSS: open proposals

More from Google

Other products from this publisher. Confirm you are viewing the one you want.

Google Maps Platform Tier C

Maps and routing
Cloud Natural Language Unrated

Text Analytics / NLP API
Google Analytics 4 Unrated

Product Analytics
Google Cloud Text-to-Speech Unrated

AI Voice / Text-to-Speech (TTS)
Google Cloud Translation Unrated

Translation & Localization
Google Ads Unrated

Advertising Platform Performance Marketing

Products from other publishers that share a job-to-be-done or category, most-shared first.

Ecosyste.ms Packages API by Ecosyste.ms Unrated

Same job: Research software packages and dependencies (not assessed)
deps.dev API by Open Source Insights Unrated

Same job: Research software packages and dependencies (not assessed)

Own this product? Add a directory badge to your site

Link your site back to this Open Agent Guide listing. The badge makes no grade claim while this product is unrated, and updates on its own once enough is verified to assign a grade.

HTML

<a href="https://www.openagentguide.com/organizations/google/products/osv-api/?utm_source=badge&amp;utm_medium=referral">
  <img src="https://www.openagentguide.com/organizations/google/products/osv-api/badge.svg" alt="OSV API — listed on Open Agent Guide" height="64" />
</a>

Markdown

[![OSV API — listed on Open Agent Guide](https://www.openagentguide.com/organizations/google/products/osv-api/badge.svg?style=flat)](https://www.openagentguide.com/organizations/google/products/osv-api/?utm_source=badge&utm_medium=referral)

The badge shows only that this product is listed; it makes no grade claim and can’t be self-set. How scoring works