---
name: OSV Dependency Scan
slug: osv-dependency-scan
category: Quality
description: OSV Dependency Scan runs osv-scanner through the mantis_osv_scanner MCP server to find known vulnerable dependencies in manifests and lockfiles. Use it during the Detect stage and verify whether flagged code is actually reached before rejecting or accepting a finding.
github: "https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/osv-dependency-scan"
language: Rust
stars: 490
forks: 73
install: "npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/osv-dependency-scan ~/.claude/skills/osv-dependency-scan"
installs_to: ~/.claude/skills/osv-dependency-scan
source_path: .codex/skills/osv-dependency-scan/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/deonmenezes/mantishack"
added: 2026-08-26T05:13:18.826Z
last_synced: 2026-08-26T05:13:18.826Z
canonical_url: "https://dirskills.com/skills/osv-dependency-scan"
---

# OSV Dependency Scan

OSV Dependency Scan runs osv-scanner through the mantis_osv_scanner MCP server to find known vulnerable dependencies in manifests and lockfiles. Use it during the Detect stage and verify whether flagged code is actually reached before rejecting or accepting a finding.

**Install:**

```bash
npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/osv-dependency-scan ~/.claude/skills/osv-dependency-scan
```

## README

Use `osv_scan({ path })` (mantis_osv_scanner MCP server) for the **Detect** stage's SCA coverage: known-vulnerable dependencies matched against the OSV database, recursively across manifests/lockfiles under `path`.

- Each result is a `candidate` keyed by package + version + advisory id (CVE/GHSA). A vulnerable dependency being present does **not** mean the vulnerable code path is reachable or exercised by the application -- that's a separate reachability question.
- Before validating, check whether the vulnerable function/API of the dependency is actually called anywhere in the target codebase (grep/ast-grep for the relevant import or call). If it's an unused transitive dependency, note that in the rejection reason rather than dropping the finding silently.
- Prefer `offline: true` only when the environment has no network access to query the live OSV database; note in your report that offline results may be stale.
- If `osv-scanner` reports `available: false`, say so explicitly -- don't claim SCA coverage you didn't actually get.