osv-scanner-mcp 0.11.0 → 0.12.0

package/README.md

@@ -7,12 +7,13 @@
 
 An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-scanner). Ask an MCP client such as Claude to "check this project for vulnerabilities", and it returns the known vulnerabilities (CVE / GHSA) in your dependencies as a report sorted by severity, together with recommended upgrades.
 
-> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), and Go, with upgrade recommendations for all four. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
+> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, and Rust (`Cargo.lock`), with upgrade recommendations for all but Rust (planned). Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
 
 ## Features
 
-- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, and Go lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
+- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, and Rust lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
 - **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that fixes all its known vulnerabilities, for Maven, npm, PyPI, and Go. The recommended version is also checked against the OSV database so that it does not introduce other known vulnerabilities
+- **Rust without false positives**: For `Cargo.lock`, only crates from crates.io are scanned. Your own workspace crates, git dependencies, and crates from private registries are not looked up as crates.io crates (OSV-Scanner alone would match them by name, and send their names to the OSV API). RustSec notices about unmaintained or unsound crates are labeled `informational` and counted apart from vulnerabilities
 - **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, and `pom.xml`), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
 - **Java project scan**: `scan_java_project` scans only the Java (Maven / Gradle) manifests and returns a formatted report
 - **JAR/WAR scan**: `scan_java_artifact` detects known vulnerabilities from the metadata inside JAR/WAR archives, for projects without a lockfile or with only shaded/fat JARs (best-effort identification, stated explicitly in `coverage`)
@@ -181,7 +182,7 @@ Destinations confirmed with osv-scanner v2.4.0 (2026-10-07):
 |---|---|---|
 | Scanning `pom.xml` (`scan_project` / `scan_java_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | Package names and versions. To resolve transitive dependencies, the names and versions of the dependencies declared in `pom.xml` (including internal packages) are sent to deps.dev |
 | Scanning `requirements.txt` (`scan_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | As with `pom.xml`, the names and versions of the listed dependencies are sent to deps.dev to resolve transitive dependencies. Package indexes given with `--index-url` and similar options are not contacted |
-| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely) |
+| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11) |
 | `scan_java_artifact` / `scan_sbom` | `api.osv.dev` | Names and versions of the identified packages |
 | `suggest_fix` checking recommended versions | `api.osv.dev` | The names of packages with a recommendation (already sent during the scan) and the candidate versions (published fixed versions). Disable with `OSV_MCP_NO_CANDIDATE_CHECK=1` |
 | `explain_vulnerability` | `api.osv.dev` | The vulnerability ID |
@@ -196,7 +197,7 @@ Both api.osv.dev and deps.dev are operated by Google. **In every configuration,
 
 ### `scan_project`
 
-Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go dependencies together. Package managers and builds are never run.
+Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go / Rust dependencies together. Package managers and builds are never run.
 
 **Input**
 
@@ -212,11 +213,14 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 | JavaScript (npm) | `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock` (text format) |
 | Python (PyPI) | `poetry.lock`, `uv.lock`, `Pipfile.lock`, `pdm.lock`, `requirements.txt` (and variants such as `requirements-dev.txt`) |
 | Go | `go.mod` |
+| Rust (crates.io) | `Cargo.lock` (lockfile versions 1 to 4) |
 
-`.git`, `node_modules`, `target`, `build`, `.idea`, `.vscode`, `.venv`, `venv`, `site-packages`, `__pycache__`, `.tox`, `vendor`, and symbolic links are not searched. Only the detected files are passed to OSV-Scanner, each with its format given explicitly (`coverage.manifests` in the response is exactly the scan scope). The search limits are the same as for `scan_java_project`.
+`.git`, `node_modules`, `target`, `build`, `.idea`, `.vscode`, `.venv`, `venv`, `site-packages`, `__pycache__`, `.tox`, `vendor`, `.cargo`, and symbolic links are not searched. Only the detected files are passed to OSV-Scanner, each with its format given explicitly (`coverage.manifests` in the response is exactly the scan scope). The search limits are the same as for `scan_java_project`.
 
 **`requirements.txt` files are not passed to OSV-Scanner as they are.** The server parses them, rewrites only the dependency lines it can interpret into simple forms such as `name==version`, and scans a private temporary copy (deleted after the scan). OSV-Scanner interprets include directives on its own (it even treats `- r ../x.txt`, with a space, as an include and reads files outside the scan scope), so the copy never contains include directives or options. Includes (`-r` / `--requirement`) are expanded by the server, and only when the included file is inside the project directory.
 
+**`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
+
 **Reading the output**
 
 ```json
@@ -233,6 +237,8 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
       { "file": "py/requirements.txt", "line": 4, "text": "-e git+https://…", "reason": "…" },
       { "file": "py/requirements.txt", "line": 5, "text": "-r ../shared/base.txt", "reason": "…" }
     ],
+    "local_crates": 2,
+    "unscannable_crates": [{ "file": "Cargo.lock", "name": "my-fork", "version": "1.0.0", "reason": "Git dependency: …" }],
     "skipped_files": []
   },
   "ecosystem_breakdown": { "npm": { "manifests": 1, "vulnerable_package_count": 2, "vulnerability_count": 4 } },
@@ -247,20 +253,23 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 ```
 
 - **Always check `coverage`.** If `complete` is `false`, some dependencies were not scanned, so zero findings does not mean the project is safe
-  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces). Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (yarn.lock, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
+  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (yarn.lock, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
   - `unpinned_requirements`: lines in `requirements.txt` that do not pin a version. `kind` is `unpinned` (no version), `range` (`>`, `<`, `!=`, `==1.*`, combined ranges, and so on), or `lower_bound` (`>=`, `~=`). OSV-Scanner does not scan `unpinned` and `range` lines, and scans `lower_bound` lines at the lower bound (those packages are marked `version_is_lower_bound: true` and may differ from the installed version)
   - `unscannable_requirements`: lines that are not scanned, with the reason: `-e`, `name @ URL`, paths, includes that were not expanded (outside the project directory, missing, URLs, or over the limits), constraint files (`-c`, not applied), and options or version specifiers that cannot be interpreted. Lines that cannot be interpreted are recorded here instead of being ignored
-  - `skipped_files`: files excluded from the scan, with the reason (a `requirements.txt` that cannot be read or is larger than 1 MiB, or a `pom.xml` whose parent POM chain references a file outside the allowed root). A `pom.xml` scanned without its parent POM, because the parent could not be read, is also listed here with the reason (see [Parent POMs](#parent-poms))
+  - `local_crates` (only when a `Cargo.lock` was scanned): the number of crates without a source in `Cargo.lock` (workspace members and path dependencies). They are your own code and are not scanned; they do not make `complete` false. A third-party crate vendored as a path dependency is not scanned either (as with `cargo audit`)
+  - `unscannable_crates` (only when a `Cargo.lock` was scanned): git dependencies (their versions do not correspond to crates.io releases) and crates from registries other than crates.io (a crate with the same name on crates.io may be a different crate). They are not scanned, so `complete` is false. Source URLs are not included in the response
+  - `skipped_files`: files excluded from the scan, with the reason (a `Cargo.lock` that cannot be interpreted with certainty, a `requirements.txt` that cannot be read or is larger than 1 MiB, or a `pom.xml` whose parent POM chain references a file outside the allowed root). A `pom.xml` scanned without its parent POM, because the parent could not be read, is also listed here with the reason (see [Parent POMs](#parent-poms))
   - Each list holds up to 200 entries; the number of omitted entries is returned in `omitted_items`
 - `ecosystem_breakdown` includes ecosystems with zero findings, to show that they were scanned
+- **Informational advisories (Rust)**: RustSec also publishes notices that are not vulnerabilities: `unmaintained` (the crate is no longer maintained), `unsound` (a soundness bug), and `notice`. Most have no fixed version. When every advisory in a group is such a notice (every related ID, including aliases, must have its details available and be a notice of a known kind; otherwise it is treated as a vulnerability), the vulnerability has `informational` set to its kind, is listed after the vulnerabilities of the package, and is counted in `informational_count` (and in `ecosystem_breakdown`) instead of `vulnerability_count`, `severity_breakdown`, and `vulnerable_package_count`. If another database (such as GitHub's) lists the same issue as a vulnerability, it stays a vulnerability. `informational_count` appears only when there is at least one
 - `dependency_relation` shows whether a package is a direct (`direct`) or transitive (`transitive`) dependency. OSV-Scanner does not report this, so the server determines it by parsing the scanned copies:
   - `package-lock.json` (v2 or later): dependencies of the root and workspace `package.json` files, resolved with Node's lookup rules (nested `node_modules` first, then parent directories), are direct; everything reachable from them is transitive. Direct dependencies list the `package.json` files that declare them in `declared_in`; transitive dependencies list the direct dependencies that require them in `introduced_by` (up to 10, with the rest counted in `introduced_by_omitted`). A version that is both a direct dependency and required by another dependency is `direct` and also has `introduced_by`
   - `go.mod`: `require` lines without `// indirect` are direct. Modules affected by a `replace` directive are marked `replaced_in_go_mod: true` (OSV-Scanner reports the replacement module and version)
   - `requirements.txt`: dependencies written in the file are direct; dependencies resolved through deps.dev are transitive
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
-  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, `pdm.lock`), lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, `pdm.lock`, and `Cargo.lock` for now), lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
-- Upgrade recommendations (`suggest_fix`) are available for Java, JavaScript, Python, and Go
+- Upgrade recommendations (`suggest_fix`) are available for Java, JavaScript, Python, and Go. Rust packages are returned with `verification: "unsupported_ecosystem"` for now
 
 ### `scan_java_project`
 
@@ -376,7 +385,7 @@ Looks up the dependencies recorded in an existing SBOM with OSV-Scanner. It does
 - `status`: `packages_identified` if anything was identified, otherwise `no_packages_identified`.
 - `completeness` / `artifact_match`: both `not_verified`. Whether the SBOM covers every dependency, and whether it matches the actual build, are not verified.
 
-`sbom` returns the original file path, the format, the specification version, and the SHA256 of the bytes that were scanned. `identified_vulnerability_count` and `packages` contain the findings for the identified dependencies. **Zero findings does not mean the software is safe.** To cover JARs without metadata, prepare an accurate SBOM for that build.
+`sbom` returns the original file path, the format, the specification version, and the SHA256 of the bytes that were scanned. `identified_vulnerability_count` and `packages` contain the findings for the identified dependencies. RustSec informational advisories for crates in the SBOM are counted in `informational_count` instead (see `scan_project`). **Zero findings does not mean the software is safe.** To cover JARs without metadata, prepare an accurate SBOM for that build.
 
 Invalid JSON returns `invalid_sbom`, an unsupported format `unsupported_sbom_format`, input over the size limit `sbom_too_large`, and a missing or unreadable file `sbom_not_found`. An empty SBOM, or one with no identifiable packages, returns a successful report with a warning. The same timeout, output limit, and concurrency limit as the other tools apply.
 
@@ -512,8 +521,8 @@ The following measures keep the vulnerability scanner itself from becoming an at
 - **Supply chain**: The automatic download is limited to the official GitHub Releases and a pinned version, and is verified against **a SHA256 checksum embedded in the package** (the SHA256SUMS file from the release is not trusted, so tampering on the release side is detected). The binary is not made executable until it passes verification, and cached binaries are verified again on every use. `OSV_MCP_PREFER_DOWNLOAD=1` avoids unverified binaries on `PATH`
 - **Command injection**: Commands are run with `spawn` and an argument array, never through a shell. OSV-Scanner receives only a fixed list of arguments, plus verified absolute paths
 - **Snapshots (no gap between checking and reading)**: OSV-Scanner never receives the original files. Lockfiles, `pom.xml` (including the parent POM chain), and JAR/WARs are read safely once, copied into a private temporary directory (accessible only by the owner, deleted afterwards), and the copies are both checked and scanned. Replacing the original files or directories after the check has no effect on the results. Parent POMs are copied into the temporary directory at their original relative positions, so OSV-Scanner can follow relative paths but only finds the verified copies (references that climb out of the temporary directory with repeated `..` are excluded). Reads refuse a symbolic link at the final path component and anything that is not a regular file (so named pipes cannot stall the server), and afterwards the path is resolved again to confirm that it is still inside the boundary and is the same file that was opened. The copies are limited to 2 GiB in total (`scan_input_too_large`). When the server is terminated (SIGTERM/SIGINT/SIGHUP, or stdin closing), the temporary directories are deleted and running OSV-Scanner processes are stopped. Directories left behind by an uncatchable termination such as SIGKILL are deleted at a later startup (only directories whose names exactly match this server's prefixes, owned by the current user, not symbolic links, and unmodified for 24 hours or more)
-- **Path traversal**: Input paths are resolved with `realpath` (following symbolic links) before the boundary check. Manifest searches do not follow symbolic links. OSV-Scanner never receives a directory, only the detected manifests, each with its format given explicitly (given a directory, OSV-Scanner also reads `requirements.txt` files there and follows their `-r ../x.txt` includes outside the scan scope). `requirements.txt` files are not passed as they are: only the dependency lines the server could interpret are normalized and written to a private copy without any include directives, so even if OSV-Scanner's interpretation of includes differs from the server's, files outside the scope are never read. A `pom.xml` whose parent POM chain references a file outside `OSV_MCP_ALLOWED_ROOT` is excluded ([Parent POMs](#parent-poms))
-- **Denial of service**: Timeouts and limits on stdout and on the stderr excerpt. Scanner output is parsed defensively and malformed output does not throw. The number of concurrent scans is limited (2 by default) so that parallel requests cannot start unlimited processes. The server's own analysis reads each file once and reuses the result (lockfiles for npm workspace membership, shared `requirements.txt` includes, parent POMs), with a limit on the total amount read. Responses do not include the internal affected-range data, which keeps large scans to a fraction of their former size
+- **Path traversal**: Input paths are resolved with `realpath` (following symbolic links) before the boundary check. Manifest searches do not follow symbolic links. OSV-Scanner never receives a directory, only the detected manifests, each with its format given explicitly (given a directory, OSV-Scanner also reads `requirements.txt` files there and follows their `-r ../x.txt` includes outside the scan scope). `requirements.txt` files are not passed as they are: only the dependency lines the server could interpret are normalized and written to a private copy without any include directives, so even if OSV-Scanner's interpretation of includes differs from the server's, files outside the scope are never read. `Cargo.lock` files are likewise replaced by a copy the server writes, listing only crates.io packages A `pom.xml` whose parent POM chain references a file outside `OSV_MCP_ALLOWED_ROOT` is excluded ([Parent POMs](#parent-poms))
+- **Denial of service**: Timeouts and limits on stdout and on the stderr excerpt. Scanner output is parsed defensively and malformed output does not throw. The number of concurrent scans is limited (2 by default) so that parallel requests cannot start unlimited processes. The server's own analysis reads each file once and reuses the result (lockfiles for npm workspace membership, `Cargo.lock` files, shared `requirements.txt` includes, parent POMs), with a limit on the total amount read. Responses do not include the internal affected-range data, which keeps large scans to a fraction of their former size
 - **Fail-closed mode**: `OSV_MCP_REQUIRE_ALLOWED_ROOT=1` refuses to start the server when no allowed root is set
 - **Restricted permissions (optional)**: The server works under Node's permission model, reports denied access as `permission_denied`, and warns about missing permissions at startup ([Running with restricted permissions](#running-with-restricted-permissions))
 - **Fixed and documented network destinations**: Dependency resolution is set to `deps.dev` explicitly, and the mode that connects to arbitrary repositories listed in the scanned `pom.xml` (`--data-source native`) is never used (guaranteed by tests). See [Network destinations and privacy](#network-destinations-and-privacy) for the destinations and for `OSV_MCP_NO_REMOTE_RESOLUTION=1`, which stops sending data to deps.dev
@@ -547,6 +556,8 @@ Design notes and open items are in [docs/DESIGN_TODO.md](docs/DESIGN_TODO.md) (i
 - [x] Flagging inferred coordinates in JAR/WAR scans
 - [x] Running under Node's permission model
 - [x] English tool descriptions and messages
+- [x] `scan_project` for Rust (`Cargo.lock`, crates.io crates only) and RustSec informational advisories
+- [ ] `suggest_fix` and direct/transitive dependencies for Rust
 - [ ] Direct and transitive dependencies for `gradle.lockfile` and the YAML/TOML lockfiles
 
 ## License

package/dist/index.js

@@ -61,17 +61,19 @@ if (startupWarning !== null) {
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
 const server = new McpServer({
     name: "osv-scanner-mcp",
-    version: "0.11.0",
+    version: "0.12.0",
 });
 server.registerTool("scan_project", {
-    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go)",
+    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust)",
     description: "Detects the lockfiles and manifests in a project and scans the dependencies for known vulnerabilities (CVE/GHSA). " +
         "Supported: Java (pom.xml / gradle.lockfile), JavaScript (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml / bun.lock), " +
-        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod). " +
+        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock). " +
         "Package managers and builds are never run. " +
         "Always check coverage at the top of the response: it lists manifests without a lockfile, requirements lines without a pinned version, and excluded files. " +
+        "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
+        "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
         "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, and Go.",
+        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, and Go (not yet for Rust).",
     inputSchema: {
         project_path: z
             .string()

package/dist/osv/sbomReport.js

@@ -49,6 +49,7 @@ export function buildSbomReport(raw, input, snapshotPath) {
         },
         identified_vulnerability_count: report.vulnerability_count,
         identified_vulnerable_package_count: report.vulnerable_package_count,
+        ...(report.informational_count !== undefined ? { informational_count: report.informational_count } : {}),
         severity_breakdown: report.severity_breakdown,
         packages: report.packages,
     };

package/dist/osv/scanReport.js

@@ -15,6 +15,59 @@
 import { asArray, asRecord, asString, asStrings } from "../utils/unknownJson.js";
 import { extractAffectedVersions } from "./affectedVersions.js";
 import { samePackageName, sortVersions, versionRangeTypes } from "./versionScheme.js";
+/**
+ * RustSecの`informational`の値。並びは複数の種類が混在するグループで代表にする優先順
+ * (健全性の欠陥は版ごとの欠陥で、保守終了・通知より重い)
+ */
+export const INFORMATIONAL_KINDS = ["unsound", "unmaintained", "notice"];
+function isInformationalKind(value) {
+    return INFORMATIONAL_KINDS.includes(value);
+}
+/**
+ * OSVレコードのうち、対象パッケージの`affected[]`の`database_specific.informational`。
+ * 該当する`affected[]`が無い・1つでも値が無い(未知の値を含む)場合はnull
+ */
+export function recordInformationalKind(record, packageName, ecosystem) {
+    let kind = null;
+    let matched = false;
+    for (const affectedRaw of asArray(record.affected)) {
+        const affected = asRecord(affectedRaw);
+        const pkg = asRecord(affected?.package);
+        const affectedName = asString(pkg?.name);
+        if (affectedName === null || !samePackageName(affectedName, packageName, ecosystem) || asString(pkg?.ecosystem) !== ecosystem)
+            continue;
+        matched = true;
+        const value = asString(asRecord(affected.database_specific)?.informational);
+        if (value === null || !isInformationalKind(value))
+            return null;
+        if (kind === null || INFORMATIONAL_KINDS.indexOf(value) < INFORMATIONAL_KINDS.indexOf(kind))
+            kind = value;
+    }
+    return matched ? kind : null;
+}
+/**
+ * グループが情報提供か。関連するすべてのID(グループのids・aliases、各レコードのaliases)の詳細があり、
+ * そのすべてが情報提供の場合だけ種類を返す。GHSA等が同じ欠陥を脆弱性として登録していれば(informationalなし)、
+ * また詳細の欠けたID(aliasesにだけ現れるGHSA・CVE等)があれば分類を確かめられないため、従来どおり脆弱性として扱う
+ */
+function groupInformationalKind(details, ids, aliases, packageName, ecosystem) {
+    if (ids.length === 0)
+        return null;
+    const related = new Set([...ids, ...aliases]);
+    for (const record of findVulnDetails(details, ids))
+        for (const alias of asStrings(record.aliases))
+            related.add(alias);
+    let kind = null;
+    for (const id of related) {
+        const record = findVulnDetails(details, [id])[0];
+        const recordKind = record === undefined ? null : recordInformationalKind(record, packageName, ecosystem);
+        if (recordKind === null)
+            return null;
+        if (kind === null || INFORMATIONAL_KINDS.indexOf(recordKind) < INFORMATIONAL_KINDS.indexOf(kind))
+            kind = recordKind;
+    }
+    return kind;
+}
 /** 外部由来のsummaryをLLMに渡す際の長さ上限(プロンプト肥大・DoS対策) */
 const MAX_SUMMARY_LENGTH = 500;
 const CVSS_CRITICAL = 9.0;
@@ -156,6 +209,7 @@ export function parseOsvScanOutput(raw) {
                     continue;
                 const score = parseSeverityScore(asString(group.max_severity));
                 const vulnDetails = findVulnDetails(details, ids);
+                const informational = groupInformationalKind(details, ids, aliases, name, ecosystem);
                 entry.vulns.set(primaryId, {
                     id: primaryId,
                     cve: aliases.find((a) => a.startsWith("CVE-")) ??
@@ -163,6 +217,7 @@ export function parseOsvScanOutput(raw) {
                     aliases: [...new Set([...ids, ...aliases])].filter((a) => a !== primaryId),
                     severity_score: score,
                     severity: severityFromScore(score),
+                    ...(informational !== null ? { informational } : {}),
                     summary: extractSummary(vulnDetails),
                     fixed_versions: extractFixedVersions(vulnDetails, name, ecosystem),
                 });
@@ -189,11 +244,19 @@ function buildReport(sourceFiles, packageMap) {
         unknown: 0,
     };
     let vulnerabilityCount = 0;
+    let informationalCount = 0;
     const packages = [...packageMap.values()]
         .filter((entry) => entry.vulns.size > 0)
         .map((entry) => {
-        const vulnerabilities = [...entry.vulns.values()].sort((a, b) => sortScore(b.severity_score) - sortScore(a.severity_score) || cmpId(a.id, b.id));
+        // 情報提供のグループは脆弱性の後ろに置く
+        const vulnerabilities = [...entry.vulns.values()].sort((a, b) => Number(a.informational !== undefined) - Number(b.informational !== undefined) ||
+            sortScore(b.severity_score) - sortScore(a.severity_score) ||
+            cmpId(a.id, b.id));
         for (const vuln of vulnerabilities) {
+            if (vuln.informational !== undefined) {
+                informationalCount++;
+                continue;
+            }
             severityBreakdown[vuln.severity]++;
             vulnerabilityCount++;
         }
@@ -210,14 +273,23 @@ function buildReport(sourceFiles, packageMap) {
         .sort((a, b) => maxScore(b.vulnerabilities) - maxScore(a.vulnerabilities) || cmpId(a.name, b.name));
     return {
         source_files: sourceFiles,
-        vulnerable_package_count: packages.length,
+        vulnerable_package_count: packages.filter(hasVulnerability).length,
         vulnerability_count: vulnerabilityCount,
+        ...(informationalCount > 0 ? { informational_count: informationalCount } : {}),
         severity_breakdown: severityBreakdown,
         packages,
     };
 }
+/** 情報提供でない脆弱性を1件以上持つか */
+export function hasVulnerability(pkg) {
+    return pkg.vulnerabilities.some((v) => v.informational === undefined);
+}
+/** 並び替え用。情報提供だけのパッケージは、脆弱性のあるパッケージ(unknownを含む)の後ろに置く */
 function maxScore(vulns) {
-    return vulns.reduce((max, v) => Math.max(max, sortScore(v.severity_score)), -1);
+    const counted = vulns.filter((v) => v.informational === undefined);
+    if (counted.length === 0)
+        return -2;
+    return counted.reduce((max, v) => Math.max(max, sortScore(v.severity_score)), -1);
 }
 function cmpId(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;

package/dist/tools/scanProject.js

@@ -1,5 +1,5 @@
 /**
- * `scan_project`ツールのハンドラ: Java / JavaScript / Python / Goのlockfileをまとめてスキャンする。
+ * `scan_project`ツールのハンドラ: Java / JavaScript / Python / Go / Rustのlockfileをまとめてスキャンする。
  *
  * 誤要約対策(JAR実体スキャンと同じ原則): スキャンできなかった依存を示すcoverageを件数より前に置き、
  * complete=falseの場合は「検出0件でも安全とは言えない」旨の警告を付ける。
@@ -7,8 +7,9 @@
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isRemoteResolutionDisabled, runOsvScan } from "../osv/runner.js";
-import { packageSources, parseOsvScanOutput } from "../osv/scanReport.js";
+import { hasVulnerability, packageSources, parseOsvScanOutput } from "../osv/scanReport.js";
 import { combineRelations, goModRelations, npmLockRelations, pomRelations, requirementsRelations, } from "../utils/dependencyRelations.js";
+import { cargoLockCopyContent } from "../utils/cargoLock.js";
 import { sanitizeExternalText } from "../utils/externalText.js";
 import { readRegularFile } from "../utils/safeRead.js";
 import { detectProject } from "../utils/manifestDetector.js";
@@ -21,7 +22,7 @@ export const TRANSITIVE_OMITTED_WARNING = "Because OSV_MCP_NO_REMOTE_RESOLUTION
     "but vulnerabilities in the transitive dependencies of the dependencies listed directly in pom.xml or requirements.txt are not included. " +
     "Zero findings does not confirm that the transitive dependencies are safe";
 const INCOMPLETE_WARNING = "Some dependencies were not scanned, or were scanned at an assumed version " +
-    "(see lockfile_missing / unpinned_requirements / unscannable_requirements / skipped_files). " +
+    "(see lockfile_missing / unpinned_requirements / unscannable_requirements / unscannable_crates / skipped_files). " +
     "Zero findings does not confirm that those dependencies are safe";
 /** coverageの各一覧の上限(巨大なrequirements.txtで応答を膨らませない) */
 const MAX_COVERAGE_ITEMS = 200;
@@ -34,11 +35,14 @@ export function buildCoverage(project) {
     const unpinned = capped(project.requirementIssues);
     const unscannable = capped(project.requirementReferences);
     const skipped = capped(project.skippedFiles);
+    const crates = capped(project.unscannableCrates);
     const complete = project.lockfileMissing.length === 0 &&
         project.requirementIssues.length === 0 &&
         project.requirementReferences.length === 0 &&
+        project.unscannableCrates.length === 0 &&
         project.skippedFiles.length === 0;
-    const omitted = lockfileMissing.omitted + unpinned.omitted + unscannable.omitted + skipped.omitted;
+    const omitted = lockfileMissing.omitted + unpinned.omitted + unscannable.omitted + crates.omitted + skipped.omitted;
+    const hasCargo = project.manifests.some((m) => m.format === "Cargo.lock");
     return {
         complete,
         ...(complete ? {} : { warning: INCOMPLETE_WARNING }),
@@ -62,6 +66,18 @@ export function buildCoverage(project) {
             text: sanitizeExternalText(ref.text),
             reason: ref.reason,
         })),
+        // Rust: 従来のエコシステムの応答を変えないよう、Cargo.lockをスキャンした場合だけ付ける
+        ...(hasCargo
+            ? {
+                local_crates: project.localCrateCount,
+                unscannable_crates: crates.items.map((c) => ({
+                    file: sanitizeExternalText(c.file),
+                    name: sanitizeExternalText(c.name),
+                    version: sanitizeExternalText(c.version),
+                    reason: c.reason,
+                })),
+            }
+            : {}),
         skipped_files: skipped.items.map((s) => ({ path: sanitizeExternalText(s.path), reason: sanitizeExternalText(s.reason) })),
         ...(omitted > 0 ? { omitted_items: omitted } : {}),
     };
@@ -73,9 +89,13 @@ function ecosystemBreakdown(project, packages) {
         breakdown[manifest.ecosystem].manifests++;
     }
     for (const pkg of packages) {
-        breakdown[pkg.ecosystem] ??= { manifests: 0, vulnerable_package_count: 0, vulnerability_count: 0 };
-        breakdown[pkg.ecosystem].vulnerable_package_count++;
-        breakdown[pkg.ecosystem].vulnerability_count += pkg.vulnerabilities.length;
+        const counts = (breakdown[pkg.ecosystem] ??= { manifests: 0, vulnerable_package_count: 0, vulnerability_count: 0 });
+        const informational = pkg.vulnerabilities.filter((v) => v.informational !== undefined).length;
+        if (hasVulnerability(pkg))
+            counts.vulnerable_package_count++;
+        counts.vulnerability_count += pkg.vulnerabilities.length - informational;
+        if (informational > 0)
+            counts.informational_count = (counts.informational_count ?? 0) + informational;
     }
     return breakdown;
 }
@@ -188,6 +208,13 @@ export async function scanFromSnapshot(project, options) {
             targets.push({ path: generated, format: "requirements.txt" });
             relationSources.push({ copy: generated, format: "requirements.txt", originalRelative: copy.path, entries: copy.entries });
         }
+        for (const copy of project.cargoCopies) {
+            if (copy.packages.length === 0)
+                continue;
+            const generated = await snapshot.writeGenerated(cargoLockCopyContent(copy.packages));
+            targets.push({ path: generated, format: "Cargo.lock" });
+            relationSources.push({ copy: generated, format: "Cargo.lock", originalRelative: copy.path });
+        }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });
         const report = await withScopeNotes(project.skippedFiles, () => snapshot.guard(() => runOsvScan(targets, options)));
@@ -210,6 +237,7 @@ export async function handleScanProject(args, options = {}) {
             ecosystem_breakdown: ecosystemBreakdown(project, report.packages),
             vulnerable_package_count: report.vulnerable_package_count,
             vulnerability_count: report.vulnerability_count,
+            ...(report.informational_count !== undefined ? { informational_count: report.informational_count } : {}),
             severity_breakdown: report.severity_breakdown,
             packages: markLowerBounds(project, report.packages),
         });

package/dist/tools/suggestFix.js

@@ -6,6 +6,7 @@
  */
 import { isRemoteResolutionDisabled } from "../osv/runner.js";
 import { candidateCheckDisabledFromEnv, checkRecommendedCandidates } from "../osv/candidateCheck.js";
+import { hasVulnerability } from "../osv/scanReport.js";
 import { suggestUpgrades } from "../osv/suggestFix.js";
 import { sanitizeExternalText } from "../utils/externalText.js";
 import { detectProject } from "../utils/manifestDetector.js";
@@ -26,7 +27,8 @@ export async function handleSuggestFix(args, options = {}) {
             manifests: project.manifests.map((m) => sanitizeExternalText(m.path)),
             dependency_resolution: dependencyResolution(noRemoteResolution, TRANSITIVE_OMITTED_WARNING),
             coverage: buildCoverage(project),
-            vulnerable_package_count: suggestions.length,
+            // 情報提供のアドバイザリ(RustSecのunmaintained等)だけのパッケージは数えない
+            vulnerable_package_count: packages.filter(hasVulnerability).length,
             unfixed_vulnerability_count: unfixedVulnerabilities,
             suggestions,
         });

package/dist/utils/cargoLock.js

@@ -0,0 +1,533 @@
+/**
+ * Cargo.lockの解析と、osv-scannerに渡すコピーの内容の生成(cargoは実行しない)。
+ *
+ * osv-scanner v2.4.0はCargo.lockの`source`を見ずに全パッケージをcrates.ioとして照会する(2026-10-11 実機確認)。
+ * workspaceのメンバー・pathの依存・gitの依存・別レジストリの依存も、同名・同版のcrates.ioのアドバイザリが付き(誤検知)、
+ * 社内crateの名前がapi.osv.devへ送られる。そこで元のファイルは渡さず、ここで解析したcrates.io由来の
+ * パッケージだけを書いたコピーをスキャンする(docs/DESIGN_TODO.md「Rust(crates.io)対応」)。
+ *
+ * 解析はcargoが生成する範囲のTOMLだけを受け付ける厳格な行解析。想定外の行が1つでもあれば
+ * ファイル全体を失敗にする(部分的に読んで取りこぼしを隠さない)。
+ */
+/** crates.ioを指すsource(git索引・sparse索引) */
+const CRATES_IO_SOURCES = new Set([
+    "registry+https://github.com/rust-lang/crates.io-index",
+    "sparse+https://index.crates.io/",
+]);
+/** 1つのCargo.lockで受け付けるパッケージ数の上限 */
+const MAX_PACKAGES = 50_000;
+/** crateの名前(cargoの制約より緩め。英数字・`-`・`_`) */
+const CRATE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** 版(SemVerの文字の範囲) */
+const CRATE_VERSION = /^[0-9A-Za-z.+-]{1,256}$/;
+export function cargoSourceKind(source) {
+    if (source === null)
+        return "local";
+    if (CRATES_IO_SOURCES.has(source))
+        return "crates_io";
+    if (source.startsWith("git+"))
+        return "git";
+    return "registry";
+}
+const BARE_KEY = /^([A-Za-z0-9_-]+)\s*=\s*(.*)$/;
+/**
+ * TOMLの基本文字列(`"..."`)を先頭から1つ読む。読めなければnull。
+ * cargoが書くエスケープ(`\"` `\\` `\n` `\t` `\uXXXX` `\UXXXXXXXX`等)だけを受け付ける
+ */
+function readBasicString(text, start) {
+    if (text[start] !== '"')
+        return null;
+    let value = "";
+    for (let i = start + 1; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '"')
+            return { value, end: i + 1 };
+        if (ch === "\\") {
+            const next = text[i + 1];
+            const simple = { '"': '"', "\\": "\\", n: "\n", t: "\t", r: "\r", b: "\b", f: "\f" };
+            if (next !== undefined && next in simple) {
+                value += simple[next];
+                i++;
+                continue;
+            }
+            const width = next === "u" ? 4 : next === "U" ? 8 : 0;
+            const hex = text.slice(i + 2, i + 2 + width);
+            if (width === 0 || !/^[0-9A-Fa-f]+$/.test(hex) || hex.length !== width)
+                return null;
+            const codePoint = Number.parseInt(hex, 16);
+            if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff))
+                return null;
+            value += String.fromCodePoint(codePoint);
+            i += 1 + width;
+            continue;
+        }
+        if (ch.charCodeAt(0) < 0x20 && ch !== "\t")
+            return null;
+        value += ch;
+    }
+    return null;
+}
+/** 行の残り(値の後ろ)が空白かコメントだけか */
+function restIsBlank(rest) {
+    return /^\s*(?:#.*)?$/.test(rest);
+}
+/** 1行全体が文字列1つ(と任意の末尾カンマ・コメント)の場合にその値を返す */
+function lineString(text, allowComma) {
+    const parsed = readBasicString(text, 0);
+    if (parsed === null)
+        return null;
+    let rest = text.slice(parsed.end);
+    if (allowComma)
+        rest = rest.replace(/^\s*,/, "");
+    return restIsBlank(rest) ? parsed.value : null;
+}
+/** `["a", "b"]`形式(1行の配列)の要素。読めなければnull */
+function inlineStringArray(text) {
+    if (!text.startsWith("["))
+        return null;
+    const items = [];
+    let i = 1;
+    for (;;) {
+        while (text[i] === " " || text[i] === "\t")
+            i++;
+        if (text[i] === "]")
+            return restIsBlank(text.slice(i + 1)) ? items : null;
+        const parsed = readBasicString(text, i);
+        if (parsed === null)
+            return null;
+        items.push(parsed.value);
+        i = parsed.end;
+        while (text[i] === " " || text[i] === "\t")
+            i++;
+        if (text[i] === ",")
+            i++;
+        else if (text[i] !== "]")
+            return null;
+    }
+}
+/**
+ * Cargo.lock(形式v1〜v4)を解析する。
+ * 受け付ける行: 空行・コメント、先頭の`version = 整数`、`[[package]]`、`[[patch.unused]]`(読み飛ばす)、
+ * `[metadata]`(v1のchecksum。読み飛ばす)、`キー = "文字列"`、`dependencies = [` 〜 `]`の各要素
+ */
+export function parseCargoLock(text) {
+    const packages = [];
+    let current = null;
+    let state = "top";
+    let sawTable = false;
+    const fail = (line, what) => ({
+        ok: false,
+        reason: `Cargo.lock could not be interpreted with certainty (${what} at line ${line}), so the file was excluded from the scan`,
+    });
+    const finish = (line) => {
+        if (current === null)
+            return null;
+        const { name, version, source, replace, dependencies } = current;
+        current = null;
+        if (name === undefined || version === undefined)
+            return fail(line, "a package without a name or version");
+        if (!CRATE_NAME.test(name))
+            return fail(line, "an unexpected crate name");
+        if (!CRATE_VERSION.test(version))
+            return fail(line, "an unexpected version");
+        if (packages.length >= MAX_PACKAGES)
+            return fail(line, `more than ${MAX_PACKAGES} packages`);
+        packages.push({ name, version, source: source ?? null, dependencies, ...(replace !== undefined ? { replace } : {}) });
+        return null;
+    };
+    const lines = text.replace(/^/, "").split(/\r?\n/);
+    for (let index = 0; index < lines.length; index++) {
+        const lineNo = index + 1;
+        const line = lines[index].trim();
+        if (state === "dependencies") {
+            if (line === "" || line.startsWith("#"))
+                continue;
+            if (/^\]\s*(?:#.*)?$/.test(line)) {
+                state = "package";
+                continue;
+            }
+            const item = lineString(line, true);
+            if (item === null)
+                return fail(lineNo, "an unexpected dependency entry");
+            current.dependencies.push(item);
+            continue;
+        }
+        if (line === "" || line.startsWith("#"))
+            continue;
+        if (/^\[\[package\]\]\s*(?:#.*)?$/.test(line)) {
+            const failed = finish(lineNo);
+            if (failed)
+                return failed;
+            current = { dependencies: [] };
+            state = "package";
+            sawTable = true;
+            continue;
+        }
+        if (/^\[\[patch\.unused\]\]\s*(?:#.*)?$/.test(line)) {
+            const failed = finish(lineNo);
+            if (failed)
+                return failed;
+            state = "skipped_table";
+            sawTable = true;
+            continue;
+        }
+        if (/^\[metadata\]\s*(?:#.*)?$/.test(line)) {
+            const failed = finish(lineNo);
+            if (failed)
+                return failed;
+            state = "metadata";
+            sawTable = true;
+            continue;
+        }
+        if (line.startsWith("["))
+            return fail(lineNo, "an unexpected table");
+        if (state === "metadata") {
+            // v1: "checksum 名前 版 (source)" = "ハッシュ"
+            const key = readBasicString(line, 0);
+            const valueMatch = key === null ? null : /^\s*=\s*(.*)$/.exec(line.slice(key.end));
+            if (valueMatch === null || lineString(valueMatch[1], false) === null)
+                return fail(lineNo, "an unexpected metadata entry");
+            continue;
+        }
+        const match = BARE_KEY.exec(line);
+        if (match === null)
+            return fail(lineNo, "an unexpected line");
+        const [, key, valueText] = match;
+        if (state === "top") {
+            if (key !== "version" || sawTable || !/^\d{1,3}\s*(?:#.*)?$/.test(valueText))
+                return fail(lineNo, "an unexpected top-level key");
+            continue;
+        }
+        if (key === "dependencies" && (state === "package" || state === "skipped_table")) {
+            if (/^\[\s*(?:#.*)?$/.test(valueText)) {
+                if (state === "skipped_table")
+                    return fail(lineNo, "an unexpected array");
+                state = "dependencies";
+                continue;
+            }
+            const items = inlineStringArray(valueText);
+            if (items === null)
+                return fail(lineNo, "an unexpected dependencies value");
+            if (state === "package")
+                current.dependencies.push(...items);
+            continue;
+        }
+        const value = lineString(valueText, false);
+        if (value === null)
+            return fail(lineNo, `an unexpected value for ${key}`);
+        if (state === "package") {
+            if (key === "name" || key === "version" || key === "source" || key === "replace") {
+                if (current[key] !== undefined)
+                    return fail(lineNo, `a duplicate ${key}`);
+                current[key] = value;
+            }
+            // checksum等の他の文字列キーはスキャンに使わない
+        }
+    }
+    if (state === "dependencies")
+        return fail(lines.length, "an unterminated dependencies array");
+    const failed = finish(lines.length);
+    if (failed)
+        return failed;
+    // 置換先が解釈でき、別のパッケージとして記載されていることを確かめる(置換元は使われないためスキャンしない)
+    for (const pkg of packages) {
+        if (pkg.replace === undefined)
+            continue;
+        const target = parsePackageId(pkg.replace);
+        const found = target !== null && packages.some((other) => other !== pkg && other.name === target.name && other.version === target.version && other.source === target.source);
+        if (!found) {
+            return {
+                ok: false,
+                reason: `Cargo.lock could not be interpreted with certainty (the replacement of ${pkg.name} ${pkg.version} by [replace] was not found), so the file was excluded from the scan`,
+            };
+        }
+    }
+    return { ok: true, packages };
+}
+/** Cargo.lockのパッケージID(`"名前 版"` / `"名前 版 (source)"`)。解釈できなければnull */
+export function parsePackageId(id) {
+    const match = /^(\S+) (\S+)(?: \((.+)\))?$/.exec(id);
+    if (match === null)
+        return null;
+    return { name: match[1], version: match[2], source: match[3] ?? null };
+}
+export const UNSCANNABLE_CRATE_REASONS = {
+    git: "Git dependency: its version does not correspond to a crates.io release, so it was not checked against crates.io advisories",
+    registry: "Dependency from a registry other than crates.io: a crate with the same name on crates.io may be a different crate, " +
+        "so it was not checked (and its name was not sent to api.osv.dev)",
+};
+export function classifyCargoPackages(packages) {
+    const result = { cratesIo: [], localCrates: [], unscannable: [] };
+    const seen = new Set();
+    for (const pkg of packages) {
+        // [replace]で置換されたパッケージは使われない(置換先は別のパッケージとして分類する)
+        if (pkg.replace !== undefined)
+            continue;
+        const kind = cargoSourceKind(pkg.source);
+        const key = JSON.stringify([pkg.name, pkg.version, pkg.source]);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (kind === "crates_io")
+            result.cratesIo.push(pkg);
+        else if (kind === "local")
+            result.localCrates.push(pkg.name);
+        else
+            result.unscannable.push({ name: pkg.name, version: pkg.version, kind });
+    }
+    return result;
+}
+/**
+ * osv-scannerに渡すコピーの内容。crates.io由来のパッケージのname・version・sourceだけを書く
+ * (名前・版は解析時に文字の範囲を検証済み、sourceは固定の値なので、エスケープは不要)
+ */
+export function cargoLockCopyContent(cratesIo) {
+    const blocks = cratesIo.map((pkg) => `[[package]]\nname = "${pkg.name}"\nversion = "${pkg.version}"\nsource = "${pkg.source}"\n`);
+    return `version = 3\n\n${blocks.join("\n")}`;
+}
+/**
+ * Cargo.tomlの行のうち、文字列・配列・インラインテーブルの外で始まる行(テーブルの見出し・キーの行)だけを返す。
+ * 複数行文字列(`"""` / `\'\'\'`)の中の`[workspace]`等を見出しと誤認しないため(レビュー指摘、2026-10-11)。
+ * 閉じない文字列・括弧の不整合など解釈できない場合はnull
+ */
+export function topLevelTomlLines(text) {
+    const src = text.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n");
+    const lines = [];
+    let depth = 0;
+    let lineStart = 0;
+    let i = 0;
+    const pushLine = (end) => {
+        if (lineStart !== null)
+            lines.push({ line: src.slice(lineStart, end), offset: lineStart });
+    };
+    while (i < src.length) {
+        const ch = src[i];
+        if (ch === "\n") {
+            pushLine(i);
+            i++;
+            lineStart = depth === 0 ? i : null;
+            continue;
+        }
+        if (ch === "#") {
+            while (i < src.length && src[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (src.startsWith('"""', i) || src.startsWith("'''", i)) {
+            const quote = src.slice(i, i + 3);
+            let j = i + 3;
+            for (;;) {
+                if (j >= src.length)
+                    return null;
+                if (quote === '"""' && src[j] === "\\") {
+                    j += 2;
+                    continue;
+                }
+                if (src.startsWith(quote, j))
+                    break;
+                j++;
+            }
+            // 閉じの引用符の直前に引用符を最大2つ書ける(`"""a"""""`は`a""`)ため、続く引用符も文字列に含める
+            let extra = 0;
+            while (extra < 2 && src[j + 3] === quote[0]) {
+                j++;
+                extra++;
+            }
+            j += 3;
+            const inner = src.slice(i, j);
+            if (inner.includes("\n"))
+                lineStart = null; // 複数行にまたがる文字列の後の続きは見出し・キーの行として扱わない
+            i = j;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            let j = i + 1;
+            for (;;) {
+                if (j >= src.length || src[j] === "\n")
+                    return null;
+                if (ch === '"' && src[j] === "\\") {
+                    j += 2;
+                    continue;
+                }
+                if (src[j] === ch)
+                    break;
+                j++;
+            }
+            i = j + 1;
+            continue;
+        }
+        if (ch === "[" || ch === "{")
+            depth++;
+        if (ch === "]" || ch === "}") {
+            depth--;
+            if (depth < 0)
+                return null;
+        }
+        i++;
+    }
+    if (depth !== 0)
+        return null;
+    pushLine(src.length);
+    return lines;
+}
+/** 見出しの行(`[名前]`)のテーブル名。配列のテーブル(`[[...]]`)・引用符付きの名前は`""`(どのテーブルにも一致させない) */
+function tableHeader(line) {
+    if (!line.startsWith("["))
+        return null;
+    const header = /^\[\s*([A-Za-z0-9_.-]+)\s*\]\s*(?:#.*)?$/.exec(line);
+    return header ? header[1] : "";
+}
+/**
+ * Cargo.tomlの`[package]`テーブルの`name`(workspaceのメンバーの確認用)。
+ * `name = "..."`の単純な形だけを読み、読めなければnull
+ */
+export function cargoTomlPackageName(text) {
+    const lines = topLevelTomlLines(text);
+    if (lines === null)
+        return null;
+    let table = null;
+    for (const { line: raw } of lines) {
+        const line = raw.trim();
+        const header = tableHeader(line);
+        if (header !== null) {
+            table = header;
+            continue;
+        }
+        if (table !== "package")
+            continue;
+        const match = /^name\s*=\s*(.*)$/.exec(line);
+        if (match) {
+            const value = lineString(match[1], false);
+            return value !== null && CRATE_NAME.test(value) ? value : null;
+        }
+    }
+    return null;
+}
+/**
+ * `[`の位置から文字列の配列(複数行・コメント・末尾カンマ可)を読む。文字列以外を含めばnull
+ */
+function readStringArray(text, start) {
+    if (text[start] !== "[")
+        return null;
+    const items = [];
+    let i = start + 1;
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r" || ch === ",") {
+            i++;
+        }
+        else if (ch === "#") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+        }
+        else if (ch === "]") {
+            return items;
+        }
+        else {
+            if (text.startsWith('"""', i))
+                return null; // 複数行文字列は扱わない
+            const parsed = readBasicString(text, i);
+            if (parsed === null)
+                return null;
+            items.push(parsed.value);
+            i = parsed.end;
+        }
+    }
+    return null;
+}
+/**
+ * workspaceのルートのCargo.tomlから`[workspace]`の`members`・`exclude`を読む。
+ * `[workspace]`が無い・値を解釈できない場合はnull(所属を確認できない)
+ */
+export function cargoWorkspace(text) {
+    const normalized = text.replace(/^\uFEFF/, "").replace(/\r\n/g, "\n");
+    const lines = topLevelTomlLines(normalized);
+    if (lines === null)
+        return null;
+    const result = { members: [], exclude: [] };
+    let inWorkspace = false;
+    let sawWorkspace = false;
+    for (const { line: raw, offset } of lines) {
+        const line = raw.trim();
+        const header = tableHeader(line);
+        if (header !== null) {
+            inWorkspace = header === "workspace";
+            sawWorkspace ||= inWorkspace;
+            continue;
+        }
+        // ルートのテーブルのドット付きのキー(workspace.members = ...)は扱わない(所属を確認できない)
+        if (!inWorkspace && /^workspace\s*\./.test(line))
+            return null;
+        if (!inWorkspace || line === "")
+            continue;
+        // 引用符付きのキー("exclude" = ...)は読み落としを避けるため解釈できないものとする
+        if (line.startsWith('"') || line.startsWith("'"))
+            return null;
+        const match = /^(members|exclude)\s*=\s*/.exec(line);
+        if (match === null)
+            continue;
+        const items = readStringArray(normalized, offset + raw.indexOf(line) + match[0].length);
+        if (items === null)
+            return null;
+        result[match[1]] = items;
+    }
+    return sawWorkspace ? result : null;
+}
+/** workspaceのルートからの相対パス(`/`区切り)を、`./`・末尾の`/`を除いて正規化する */
+function normalizeWorkspacePath(value) {
+    const parts = value.replace(/\\/g, "/").split("/").filter((part) => part !== "" && part !== ".");
+    if (value.startsWith("/") || parts.some((part) => part === ".."))
+        return null; // 絶対パス・ルートの外は扱わない
+    return parts.join("/");
+}
+/** パスの区切り単位での前方一致 */
+function isPathPrefix(prefix, target) {
+    return prefix === "" || target === prefix || target.startsWith(`${prefix}/`);
+}
+/** `*`・`?`だけのglobの一致。それ以外のglob(`**`・`[...]`・`{...}`)はnull(判定できない) */
+function globMatches(pattern, target) {
+    const patternParts = pattern.split("/");
+    const targetParts = target === "" ? [] : target.split("/");
+    if (patternParts.some((part) => part.includes("**") || /[[\]{}]/.test(part)))
+        return null;
+    if (patternParts.length !== targetParts.length)
+        return false;
+    return patternParts.every((part, i) => {
+        const regex = new RegExp(`^${part.replace(/[.+^$()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
+        return regex.test(targetParts[i]);
+    });
+}
+/**
+ * memberDir(workspaceのルートからの相対パス)が`members`に含まれ、`exclude`で除かれていないか。
+ * Cargoの規則(2026-10-11 cargo 1.98で確認): `members`はglobで展開し、`exclude`はパスの前方一致で除く。
+ * ただし`members`に(globでなく)文字どおり書かれたパスの配下は`exclude`より優先する。
+ * true=所属 / false=所属しない / null=判定できない(解釈できないパス・glob)
+ */
+export function workspaceIncludes(workspace, memberDir) {
+    const target = normalizeWorkspacePath(memberDir);
+    if (target === null)
+        return null;
+    let undecided = false;
+    let matched = false;
+    for (const member of workspace.members) {
+        const pattern = normalizeWorkspacePath(member);
+        const result = pattern === null ? null : globMatches(pattern, target);
+        if (result === null)
+            undecided = true;
+        else if (result)
+            matched = true;
+    }
+    if (!matched)
+        return undecided ? null : false;
+    const explicit = workspace.members.some((member) => {
+        const literal = normalizeWorkspacePath(member);
+        return literal !== null && isPathPrefix(literal, target);
+    });
+    const excluded = workspace.exclude.some((ex) => {
+        const prefix = normalizeWorkspacePath(ex);
+        return prefix !== null && isPathPrefix(prefix, target);
+    });
+    if (workspace.exclude.some((ex) => normalizeWorkspacePath(ex) === null))
+        return null;
+    return !(excluded && !explicit);
+}

package/dist/utils/manifestDetector.js

@@ -1,9 +1,10 @@
 /**
- * `scan_project`用の検出: Java / JavaScript / Python / Goのlockfileを列挙する。
+ * `scan_project`用の検出: Java / JavaScript / Python / Go / Rustのlockfileを列挙する。
  *
  * - 検出したファイルだけをosv-scannerに渡す(ディレクトリは渡さない)。解析形式も明示する
  * - パッケージマネージャー・ビルドは実行しない。lockfileが無いマニフェストはcoverageに記録する
  * - requirements.txtは取り込み先を検証し、プロジェクト外を読む場合はスキャン対象から外す
+ * - Cargo.lockはここで解析し、crates.io由来のパッケージだけをスキャンする(cargoLock.ts)
  *
  * 検出・除外の根拠はdocs/DESIGN_TODO.md「対象エコシステム拡大 詳細設計メモ」を参照。
  */
@@ -11,8 +12,9 @@ import { stat } from "node:fs/promises";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { assertInsideAllowedRoot, resolveExistingPath, walkProjectFiles, } from "./projectWalk.js";
-import { readRegularFile } from "./safeRead.js";
+import { capitalizeReason, readRegularFile } from "./safeRead.js";
 import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requirementsFile.js";
+import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, classifyCargoPackages, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -28,6 +30,7 @@ const LOCKFILES = new Map([
     ["Pipfile.lock", { ecosystem: "PyPI", format: "Pipfile.lock" }],
     ["pdm.lock", { ecosystem: "PyPI", format: "pdm.lock" }],
     ["go.mod", { ecosystem: "Go", format: "go.mod" }],
+    ["Cargo.lock", { ecosystem: "crates.io", format: "Cargo.lock" }],
 ]);
 /** requirements.txt / requirements-dev.txt / dev-requirements.txt 等 */
 const REQUIREMENTS_NAME = /^(?:[\w.]+[-_])?requirements(?:[-_][\w.]+)?\.txt$/;
@@ -42,8 +45,9 @@ const LOCK_MARKERS = new Map([
     ["build.gradle.kts", "gradle"],
     ["settings.gradle", "gradle"],
     ["settings.gradle.kts", "gradle"],
+    ["Cargo.toml", "cargo"],
 ]);
-const LOCK_GROUP_ECOSYSTEM = { npm: "npm", pypi: "PyPI", gradle: "Maven" };
+const LOCK_GROUP_ECOSYSTEM = { npm: "npm", pypi: "PyPI", gradle: "Maven", cargo: "crates.io" };
 const LOCKFILE_HINTS = {
     npm: "No lockfile. Run `npm install --package-lock-only --ignore-scripts` in a trusted environment " +
         "(for yarn / pnpm / bun, generate the lockfile with that tool), then scan again",
@@ -51,10 +55,12 @@ const LOCKFILE_HINTS = {
         "Generate one in a trusted environment, then scan again (generating it may run build scripts)",
     gradle: "No gradle.lockfile. Run `./gradlew dependencies --write-locks` in a trusted environment, then scan again " +
         "(if dependency locking is not configured, add dependencyLocking { lockAllConfigurations() } to build.gradle)",
+    cargo: "No Cargo.lock. Run `cargo generate-lockfile` in a trusted environment (it fetches the registry index; " +
+        "for a workspace member, run it at the workspace root), then scan again",
 };
 const SKIPPED_DIRS = new Set([
     ".git", "node_modules", "target", "build", ".idea", ".vscode",
-    ".venv", "venv", "site-packages", "__pycache__", ".tox", "vendor",
+    ".venv", "venv", "site-packages", "__pycache__", ".tox", "vendor", ".cargo",
 ]);
 function classifyFile(name) {
     const lockfile = LOCKFILES.get(name);
@@ -110,6 +116,77 @@ export class LockfileKeyCache {
         return keys;
     }
 }
+/** Cargo.lock1件の上限(読み込み自体の上限。合計はLockfileKeyCacheと同じ上限) */
+const MAX_CARGO_LOCK_BYTES = 64 * 1024 * 1024;
+const MAX_CARGO_TOML_BYTES = 1024 * 1024;
+/**
+ * Cargo.lockの解析結果を1回だけ作る(workspaceの収録確認とスキャン対象の生成で共用)。
+ * 元のファイルは安全に読み(safeRead)、osv-scannerには渡さない
+ */
+export class CargoLockCache {
+    results = new Map();
+    remaining;
+    constructor(maxTotalBytes = MAX_LOCKFILE_TOTAL_BYTES) {
+        this.remaining = maxTotalBytes;
+    }
+    async get(lockAbs, projectDir) {
+        const cached = this.results.get(lockAbs);
+        if (cached !== undefined)
+            return cached;
+        let result;
+        if (this.remaining <= 0) {
+            result = { reason: "Not read because the total size of the Cargo.lock files exceeded the limit" };
+        }
+        else {
+            const read = await readRegularFile(lockAbs, { maxBytes: Math.min(MAX_CARGO_LOCK_BYTES, this.remaining), boundary: projectDir });
+            if (!read.ok) {
+                result = { reason: capitalizeReason(read.message) };
+            }
+            else {
+                this.remaining -= read.bytes.length;
+                const parsed = parseCargoLock(read.bytes.toString("utf8"));
+                result = parsed.ok ? classifyCargoPackages(parsed.packages) : { reason: parsed.reason };
+            }
+        }
+        this.results.set(lockAbs, result);
+        return result;
+    }
+    workspaces = new Map();
+    /** Cargo.lockと同じディレクトリのCargo.tomlの`[workspace]`(1回だけ読む)。無い・読めない場合はnull */
+    async workspace(lockAbs, projectDir) {
+        if (this.workspaces.has(lockAbs))
+            return this.workspaces.get(lockAbs);
+        const read = await readRegularFile(path.join(path.dirname(lockAbs), "Cargo.toml"), { maxBytes: MAX_CARGO_TOML_BYTES, boundary: projectDir });
+        const workspace = read.ok ? cargoWorkspace(read.bytes.toString("utf8")) : null;
+        this.workspaces.set(lockAbs, workspace);
+        return workspace;
+    }
+}
+/**
+ * 上位のCargo.lockに、メンバーのCargo.tomlのcrateが収録されているか。
+ * - 同名のsourceなしパッケージが無ければ未収録(false)。workspaceのメンバーでもpathの依存でもない
+ * - 同名があっても名前だけでは所属を確定しない(独立したサブプロジェクトが同名のこともある)。
+ *   Cargo.lockと同じディレクトリのCargo.tomlの`[workspace]`の`members`・`exclude`で所属を確認できた場合だけ収録(true)
+ * - それ以外は確認できない(null): `[package] name`を読めない、lockfileを解析できない、`[workspace]`が無い・解釈できない、
+ *   `members`に含まれない(pathの依存として収録されている可能性がある)、解釈できないglob
+ */
+async function cargoLockfileRecords(cache, projectDir, lockfile, memberToml) {
+    const lock = await cache.get(path.join(projectDir, lockfile.path), projectDir);
+    if ("reason" in lock)
+        return null;
+    const read = await readRegularFile(path.join(projectDir, memberToml), { maxBytes: MAX_CARGO_TOML_BYTES, boundary: projectDir });
+    const name = read.ok ? cargoTomlPackageName(read.bytes.toString("utf8")) : null;
+    if (name === null)
+        return null;
+    if (!lock.localCrates.includes(name))
+        return false;
+    const lockAbs = path.join(projectDir, lockfile.path);
+    const workspace = await cache.workspace(lockAbs, projectDir);
+    if (workspace === null)
+        return null;
+    const memberDir = path.relative(path.dirname(lockAbs), path.join(projectDir, path.dirname(memberToml))).split(path.sep).join("/");
+    return workspaceIncludes(workspace, memberDir) === true ? true : null;
+}
 /**
  * package-lock.json(v2以降)の`packages`に、memberDirのエントリがあるか。
  * true=収録 / false=未収録 / null=確認できない
@@ -128,7 +205,7 @@ async function npmLockfileRecords(cache, projectDir, lockfile, memberDir) {
  * - 上位のlockfileだけの場合は、収録を確認できたときだけ充足(npm workspacesのpackage-lock.json)。
  *   workspace設定の無いルートのlockfileで、独立した子プロジェクトの欠落を隠さないため
  */
-async function findLockfileMissing(projectDir, markers, manifests) {
+async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
     const cache = new LockfileKeyCache();
     const missing = [];
     for (const marker of markers) {
@@ -146,7 +223,9 @@ async function findLockfileMissing(projectDir, markers, manifests) {
         for (const candidate of candidates) {
             const result = candidate.format === "package-lock.json"
                 ? await npmLockfileRecords(cache, projectDir, candidate, markerDir)
-                : null;
+                : candidate.format === "Cargo.lock"
+                    ? await cargoLockfileRecords(cargoCache, projectDir, candidate, marker.path)
+                    : null;
             if (result === true)
                 recorded = true;
             if (result !== false)
@@ -166,13 +245,17 @@ async function findLockfileMissing(projectDir, markers, manifests) {
     return missing;
 }
 async function finalize(projectDir, manifests, markers, allowedRootReal) {
+    const cargoCache = new CargoLockCache();
     const result = {
         projectDir,
         allowedRootReal,
         manifests: [],
         targets: [],
         requirementsCopies: [],
-        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests),
+        cargoCopies: [],
+        localCrateCount: 0,
+        unscannableCrates: [],
+        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache),
         requirementIssues: [],
         requirementReferences: [],
         lowerBounds: [],
@@ -192,6 +275,16 @@ async function finalize(projectDir, manifests, markers, allowedRootReal) {
             result.lowerBounds.push(...analysis.lowerBounds);
             result.requirementsCopies.push({ path: manifest.path, entries: analysis.entries });
         }
+        else if (manifest.format === "Cargo.lock") {
+            const lock = await cargoCache.get(absolute, projectDir);
+            if ("reason" in lock) {
+                result.skippedFiles.push({ path: manifest.path, reason: lock.reason });
+                continue;
+            }
+            result.cargoCopies.push({ path: manifest.path, packages: lock.cratesIo });
+            result.localCrateCount += lock.localCrates.length;
+            result.unscannableCrates.push(...lock.unscannable.map((c) => ({ file: manifest.path, name: c.name, version: c.version, reason: UNSCANNABLE_CRATE_REASONS[c.kind] })));
+        }
         else {
             result.targets.push({ path: absolute, format: manifest.format });
         }

package/dist/utils/manifestFormats.js

@@ -1,6 +1,7 @@
 /**
  * osv-scannerに`--lockfile <形式>:<絶対パス>`で個別に渡せる解析形式(2.4.0で実機確認)。
  * ここに無い形式はosv-scannerに渡さない。npm-shrinkwrap.jsonは"package-lock.json"形式で解析する。
+ * Cargo.lockは元のファイルを渡さず、crates.io由来のパッケージだけを書いたコピーを渡す(cargoLock.ts)。
  */
 export const MANIFEST_FORMATS = [
     "pom.xml",
@@ -16,6 +17,7 @@ export const MANIFEST_FORMATS = [
     "pdm.lock",
     "requirements.txt",
     "go.mod",
+    "Cargo.lock",
 ];
 const FORMAT_SET = new Set(MANIFEST_FORMATS);
 export function isManifestFormat(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java projects for known vulnerabilities",
   "type": "module",
   "license": "Apache-2.0",