feat: OSV-Scanner MCP server

[another-rex]

Basic MVP of an osv-scanner MCP server fulfilling workflow 1. Directly vulnerability scanning of a project with prioritisation.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 9.52381% with 133 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.94%. Comparing base (280ac6a) to head (ac4141c).
⚠️ Report is 285 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/osv-scanner/mcp/command.go	0.00%	118 Missing ⚠️
cmd/osv-scanner/mcp/stats.go	0.00%	11 Missing ⚠️
pkg/osvscanner/scan.go	50.00%	1 Missing and 2 partials ⚠️
cmd/osv-scanner/main.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2256      +/-   ##
==========================================
- Coverage   68.64%   67.94%   -0.70%     
==========================================
  Files         169      171       +2     
  Lines       12646    12785     +139     
==========================================
+ Hits         8681     8687       +6     
- Misses       3294     3425     +131     
- Partials      671      673       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[another-rex]

/gemini

[spencerschrock]

Scorecard is looking into a MCP server as well, is there a reason you went with this library? We had been looking at the official SDK ( partly maintained by the Go team)?
https://github.com/modelcontextprotocol/go-sdk

I haven't personally looked at alternatives, so I'm just trying to avoid redoing any analysis that may have already been done.

[another-rex]

I haven't looked too much into the different mcp libraries, I mostly picked go-mcp as it was the most popular by stars, and was not aware that there is an official one.

But what I found during implementation is that it really doesn't matter too much the mcp library being used, the actual part interfacing with the mcp library is quite minimal, so it should be very easy to switch between different libraries. I might switch to use go-sdk as it looks like an evolution of the go-mcp library that's more officially supported.

[another-rex]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces an experimental MCP (Model-Context Protocol) server to osv-scanner, allowing AI models to interact with the scanner's capabilities. The implementation adds a new mcp command, which can run as a server over stdio or an SSE HTTP server.

My review has identified a critical race condition in the handling of the vulnerability cache, which could lead to panics under concurrent use. I've also found a high-severity security issue where the HTTP server is started without timeouts, making it vulnerable to resource exhaustion attacks. Additionally, there are a couple of medium-severity suggestions for improving context propagation and code clarity.

Once these critical and high-severity issues are addressed, this will be a great addition to the project.

[michaelkedar]

lgtm