Batch-check multiple package versions for known vulnerabilities using the OSV.dev querybatch API
domain: osv.dev · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Build a JSON request body with a queries array where each entry specifies either a version plus package {name, ecosystem} or a versioned purl, but not both in the same entry.
POST the batch to the querybatch endpoint, keeping the batch under the documented cap of 1,000 queries per request.
Read the vulnerability id and modified fields returned per query; because querybatch returns minimal data, follow up with a single-vulnerability lookup for full advisory details on matches that need action.
Handle per-query pagination: if an individual query has more than 1,000 vulnerabilities, or the batch totals more than 3,000, use the returned page token for just those specific queries in a follow-up request.
Cache results locally keyed by package and version to avoid re-querying unchanged dependencies on every CI run.
Known gotchas
Supplying both a version and a versioned purl for the same query entry is invalid and can cause that entry (or the whole batch, depending on client) to be rejected — pick one form consistently.
querybatch responses omit full vulnerability details by design for size and performance; code that expects severity or summary fields directly in the batch response will get incomplete data.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?