Install OSV-Scanner v2 from the GitHub releases page or via `go install github.com/google/osv-scanner/cmd/osv-scanner@latest`
Pull or tag the container image locally so it is accessible to the Docker daemon (e.g., `docker pull myrepo/myimage:tag`)
Run the image scan with the v2 subcommand syntax: `osv-scanner scan image myrepo/myimage:tag`
Review the output table listing vulnerable packages, affected OSV IDs, severity scores, and the layer in which each package was introduced
Optionally pass `--format json` to emit structured JSON output suitable for ingestion into a CI pipeline or SIEM
Known gotchas
The `--docker` / `-D` flag for image scanning was removed in OSV-Scanner v2; using it will produce an error — the correct v2 syntax is the `scan image` subcommand
OSV-Scanner v2 requires access to the local Docker daemon to export image layers; ensure the daemon is running and the image is present locally before scanning
Results reflect the OSV advisory database at scan time; re-scan after database updates or image rebuilds to catch newly published vulnerabilities
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp