osv-ui is a developer-oriented visual CVE audit dashboard, designed to solve the problem of dependency vulnerabilities being overlooked. It supports npm, Python, Go, Rust, Java, PHP, and Ruby projects, and can be started with a single command, without complex configuration, registration, or API keys. All analysis is performed locally, and code never leaves your machine, ensuring privacy and security.
Main capabilities include: real-time risk scoring, vulnerability charts, and clear upgrade guidance, helping to quickly identify and fix vulnerabilities. It supports multiple platforms, with native support for Node.js (npm), Python, Go, Rust, Java, PHP, and Ruby. It can scan the current directory, a monorepo (multiple services), or automatically discover all services under the current directory.
Usage: start the dashboard with the npx osv-ui command, or add it to a package.json script. It also acts as a Model Context Protocol (MCP) server, allowing AI agents (such as Claude Desktop, Cursor, Claude Code) to automatically scan projects, open the visual dashboard for human review, and apply fixes after explicit confirmation. In addition, it provides a powerful built-in API that can generate machine-readable reports (such as CI reports, PR diffs, SBOM), and supports comparison with baseline reports, failing only when newly introduced high-severity vulnerabilities are present.
Applicable scenarios: suitable for developers auditing dependency vulnerabilities locally or in CI processes, especially for scenarios that require a visual interface and human confirmation of fixes. It can be used together with osv-scanner, providing the visualization layer that the latter lacks, such as a browser dashboard, multi-service sidebar, and Dependabot-style upgrade guidance.
Limitations: internet access is required to query OSV.dev (or use the --offline option). npm projects need to run npm install first to generate package-lock.json. Python projects require supported manifest files. CVE data comes from OSV.dev, updated daily, with no account, no rate limits, and no vendor lock-in. The project uses the MIT license, and contributions are welcome.
