> ## Documentation Index
> Fetch the complete documentation index at: https://chatcli.edilsonfreitas.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Scan (@osv)

> Checks dependencies against the OSV.dev database — keyless, no external CLI. Supports go.mod, requirements.txt, package-lock.json and Cargo.lock.

The **`@osv`** tool checks the project's pinned dependencies against the public **[OSV.dev](https://osv.dev)** database — **keyless**, no API key and no external CLI. Inspired by hermes-agent's `osv_check`, implemented natively in Go.

***

## Subcommands

```text theme={"system"}
<tool_call name="@osv" args='{"cmd":"scan","args":{"path":"go.mod"}}' />
<tool_call name="@osv" args='{"cmd":"check","args":{"ecosystem":"PyPI","package":"requests","version":"2.19.0"}}' />
```

### `scan {path}`

Reads a manifest (or a directory containing one) and checks every pinned dependency:

| Ecosystem | Manifest                         |
| --------- | -------------------------------- |
| Go        | `go.mod`                         |
| PyPI      | `requirements.txt` (`==` pins)   |
| npm       | `package-lock.json` (v1 and v2+) |
| crates.io | `Cargo.lock`                     |

`path` defaults to the current directory; a directory is resolved to the first supported manifest found.

### `check {ecosystem, package, version}`

Checks a single dependency. Ecosystems: `Go | PyPI | npm | crates.io | Maven | RubyGems | NuGet | Packagist`.

***

## Output

For each vulnerable dependency it lists the **advisory ID**, aliases (CVE/GHSA), **severity** (CVSS) and a summary:

```text theme={"system"}
@osv scan of go.mod — 42 dependencies checked

⚠️  1 vulnerable dependenc(ies):

• github.com/evil/pkg@v1.0.0 (Go)
    GHSA-xxxx (CVE-2020-0001) [CVSS_V3:9.8] — vulnerability description
```

When nothing is found: `✅ No known vulnerabilities found.`

***

## Notes

* It is **read-only** and concurrency-safe — the orchestrator can fan out multiple `@osv` calls in parallel.
* Transient network failures on individual deps are skipped without aborting the whole scan.
* Being keyless and HTTP-based, it works on any OS.

<Tip>
  Combine with the [Scheduler](/features/scheduler) for a periodic scan and `@send` to notify you when a new CVE appears in your dependencies.
</Tip>