Contributing to `osv-mcp`

First off, thank you for taking the time to contribute to osv-mcp! 👍 🎉 osv-mcp is released under the Apache 2.0 license. If you would like to contribute something or want to hack on the code, this document should help you get started. You can find some hints for starting development in osv-mcp's README.

Code of conduct

This project adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to code-of-conduct@stacklok.dev.

Reporting security vulnerabilities

If you think you have found a security vulnerability in osv-mcp please DO NOT disclose it publicly until we've had a chance to fix it. Please don't report security vulnerabilities using GitHub issues; instead, please follow this process

How to contribute

Using GitHub Issues

We use GitHub issues to track bugs and enhancements. If you have a general usage question, please ask in the #mcp-servers channel of the Stacklok Discord server.

If you are reporting a bug, please help to speed up problem diagnosis by providing as much information as possible. Ideally, that would include a small sample project that reproduces the problem.

Not sure how to start contributing?

PRs to resolve existing issues are greatly appreciated and issues labeled as "good first issue" are a great place to start!

Pull request process

-All commits must include a Signed-off-by trailer at the end of each commit message to indicate that the contributor agrees to the Developer Certificate of Origin. For additional details, check out the DCO instructions.

Create an issue outlining the fix or feature.
Fork the osv-mcp repository to your own GitHub account and clone it locally.
Hack on your changes.
Correctly format your commit messages, see Commit message guidelines below.
Open a PR by ensuring the title and its description reflect the content of the PR.
Ensure that CI passes, if it fails, fix the failures.
Every pull request requires a review from the core osv-mcp team before merging.
Once approved, all of your commits will be squashed into a single commit with your PR title.

Commit message guidelines

We follow the commit formatting recommendations found on Chris Beams' How to Write a Git Commit Message article:

Separate subject from body with a blank line
Limit the subject line to 50 characters
Capitalize the subject line
Do not end the subject line with a period
Use the imperative mood in the subject line
Use the body to explain what and why vs. how

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!