osv-scanner-mcp 0.16.0 → 0.18.0

package/README.md

@@ -7,12 +7,13 @@
 
 An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-scanner). Ask an MCP client such as Claude to "check this project for vulnerabilities", and it returns the known vulnerabilities (CVE / GHSA) in your dependencies as a report sorted by severity, together with recommended upgrades.
 
-> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, Rust (`Cargo.lock`), and .NET (NuGet: `packages.lock.json`, `obj/project.assets.json`, `packages.config`, `*.deps.json`, and project files), with upgrade recommendations for Maven, npm, PyPI, Go, and crates.io. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
+> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, Rust (`Cargo.lock`), and .NET (NuGet: `packages.lock.json`, `obj/project.assets.json`, `packages.config`, `*.deps.json`, and project files), and PHP (Composer: `composer.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, crates.io, Packagist, and NuGet. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
 
 ## Features
 
-- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, Rust, and .NET lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
-- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, and Rust (crates.io). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
+- **PHP / Composer (source checkout)**: `scan_project` scans `composer.lock`, including both `packages` and `packages-dev`, as Packagist packages. `suggest_fix` recommends release versions and checks candidates against OSV. Composer and PHP code are never executed. See [Composer support](#composer-support).
+- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, Rust, .NET, and PHP lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
+- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
 - **Rust without false positives**: For `Cargo.lock`, only crates from crates.io are scanned. Your own workspace crates, git dependencies, and crates from private registries are not looked up as crates.io crates (OSV-Scanner alone would match them by name, and send their names to the OSV API). RustSec notices about unmaintained or unsound crates are labeled `informational` and counted apart from vulnerabilities
 - **.NET without guessing versions**: Each project file is matched to its own lockfile or `obj/project.assets.json`. Without one, only its direct `PackageReference` items are scanned, and a `Version="x"` (which means x or higher) is reported as a lower bound. References whose version cannot be known without running MSBuild (properties, conditions, floating versions, `Update` / `Remove`) are listed instead of being looked up: OSV treats an unparsable version as older than every release and would report every vulnerability for it
 - **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, `pom.xml`, `Cargo.lock`, and the .NET files), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
@@ -21,9 +22,21 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
 - **SBOM scan**: `scan_sbom` checks the dependencies recorded in a CycloneDX/SPDX JSON SBOM. It states explicitly that the SBOM's completeness and its match with the actual artifacts are not verified
 - **Scan history (opt-in)**: With `OSV_MCP_HISTORY=1`, each scan is recorded locally, and `scan_history` lists past runs and shows what changed since the previous run (new and resolved vulnerabilities, version changes, coverage changes)
 - **Severity-sorted reports**: Vulnerabilities are grouped by package and sorted by CVSS score, with five severity labels (critical / high / medium / low / unknown) and summary counts
-- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, and PEP 440 for PyPI
+- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, PEP 440 for PyPI, Composer ordering for Packagist, and NuGet ordering for NuGet
 - **Security first**: No shell execution, a fixed argument allowlist, path normalization and boundary checks, scanning private copies instead of the original files, and timeouts and output size limits are built in
 
+## Composer support
+
+Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. The lockfile records both direct and transitive dependencies; their relationship is currently reported as `unknown`. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+
+The server reads each lockfile safely and scans a private sanitized copy containing only package names and release versions. Repository URLs, dist/source commit references, scripts, and credentials are not passed to OSV-Scanner. Both production and development packages are included. JSON is limited to 16 MiB per lockfile and 64 MiB per scan, with structural work limits. Invalid JSON is excluded; invalid entries and unsupported versions are omitted and reported in `skipped_files`, making `coverage.complete` false.
+
+Composer version comparison supports classical numeric releases with one to four components, an optional `v` prefix, and alpha/beta/RC/stable/patch suffixes (including their short forms). Branch/dev versions, aliases, and other formats such as date-based tags are not evaluated. An advisory with unsupported version boundaries cannot establish a verified fix. Upgrade tiers follow the existing cautious 0.x rules; they do not guarantee compatibility with your constraints or PHP runtime. Update the applicable constraints in `composer.json` and regenerate the lockfile in a trusted environment; check PHP and extension requirements first. The server does not run Composer or change project files.
+
+Packages with `dist.type: "path"` are local code: they are excluded before building scanner input, so neither their names nor versions are sent to OSV. They are your own code, so they are counted in `coverage.local_composer_packages` (like `local_crates` and `local_projects`) and do not make `coverage.complete` false; their own dependencies are listed in `composer.lock` and scanned. This applies to both production and development dependencies, even when a local package uses the same name and release version as a public package.
+
+**Privacy:** other private Composer package names and versions are also sent to `api.osv.dev`. A lockfile alone cannot establish whether a non-path package comes from public Packagist; same-name private packages and VCS forks can produce false positives. `coverage.composer_warnings` warns when scanned entries lack the standard `notification-url` (`https://packagist.org/downloads/`); this is a heuristic, not proof of origin. `coverage.complete` describes inspected dependency entries, not the lockfile's freshness or its match with `composer.json`, and does not verify the PHP runtime or extensions.
+
 ## Requirements
 
 - Node.js >= 20.19 (development: Node.js 26.12.1, as specified in `.node-version`)
@@ -206,7 +219,7 @@ Both api.osv.dev and deps.dev are operated by Google. **In every configuration,
 
 ### `scan_project`
 
-Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go / Rust / .NET dependencies together. Package managers and builds are never run.
+Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go / Rust / .NET / PHP dependencies together. Package managers and builds are never run.
 
 **Input**
 
@@ -224,6 +237,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 | Go | `go.mod` |
 | Rust (crates.io) | `Cargo.lock` (lockfile versions 1 to 4) |
 | .NET (NuGet) | `packages.lock.json` / `packages.<project>.lock.json`, `obj/project.assets.json`, `packages.config` / `packages.<project>.config`, `*.deps.json`, and `*.csproj` / `*.fsproj` / `*.vbproj` (direct references only, when no lockfile matches) |
+| PHP (Packagist) | `composer.lock` (`packages` and `packages-dev`; see [Composer support](#composer-support)) |
 
 `.git`, `node_modules`, `target`, `build`, `.idea`, `.vscode`, `.venv`, `venv`, `site-packages`, `__pycache__`, `.tox`, `vendor`, `.cargo`, `bin` and `obj` in a directory that contains a .NET project file (build output of that project), and symbolic links are not searched. Only the detected files are passed to OSV-Scanner, each with its format given explicitly (`coverage.manifests` in the response is exactly the scan scope). The search limits are the same as for `scan_java_project`.
 
@@ -296,7 +310,13 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
   - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
-- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, and Rust (crates.io). NuGet packages are returned with `verification: "unsupported_ecosystem"` for now
+- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet; source checkout).
+
+**NuGet recommendations (source checkout).** `suggest_fix` compares NuGet release versions with one to four numeric components (missing components become zero), including legacy revisions such as `1.2.3.4`. Numeric components must fit a nonnegative 32-bit integer; unsupported formats withhold a recommendation. Prerelease identifiers compare numerically when they fit signed 32-bit integers, and otherwise by ASCII case-insensitive lexical order, matching NuGet VersionRelease; numeric prerelease identifiers with leading zeroes are rejected. Build metadata does not affect ordering. Package IDs match case-insensitively. Recommendations use OSV `ECOSYSTEM` affected ranges and are rechecked against OSV; unsupported or incomplete ranges cannot establish a verified fix. Stable candidates are preferred; prerelease-only fixes are labeled. The existing cautious 0.x upgrade tiers apply.
+
+For direct dependencies, update the `PackageReference` (or `packages.config` in older projects); with central management, update `PackageVersion` in `Directory.Packages.props`. For transitive dependencies, update the parent dependency or explicitly reference a compatible fixed version if NuGet resolution allows it. Runtime packs (`Microsoft.NETCore.App.Runtime.*`, `Microsoft.AspNetCore.App.Runtime.*`, `Microsoft.WindowsDesktop.App.Runtime.*`) generally require an SDK/runtime or target-framework update rather than a new explicit package reference. Check target-framework/RID compatibility and all version constraints, regenerate restore/lockfiles, and rescan. These are suggestions, not edits; `dotnet restore` and MSBuild are not run.
+
+`PackageReference Version="x"` or an inclusive minimum range is scanned at its lower bound, not at a confirmed restored version. Its recommendation retains `version_is_lower_bound: true`, and the note means raising that bound. Coverage still records missing restore/lockfiles and unresolved references. Neither a verified affected-range check nor `candidate_check: "clean"` proves framework compatibility, availability on a private feed, or absence of unknown vulnerabilities.
 
 ### `scan_java_project`
 
@@ -361,7 +381,7 @@ If an existing parent POM cannot be read (larger than 10 MiB, not a regular file
 ```
 
 - `packages` is sorted by the most severe vulnerability, and each `vulnerabilities` list by severity (unknown last)
-- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), and PEP 440 for PyPI (in the order listed by OSV up to v0.5.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
+- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), PEP 440 for PyPI (in the order listed by OSV up to v0.5.0), Composer ordering for Packagist (since v0.17.0), and NuGet ordering for NuGet (since v0.18.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
 - Vulnerabilities without a severity score are reported as `null` / `"unknown"`
 
 ### `scan_java_artifact`
@@ -418,7 +438,7 @@ Invalid JSON returns `invalid_sbom`, an unsupported format `unsupported_sbom_for
 
 ### `suggest_fix`
 
-Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
+Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), PHP (Packagist / Composer), and .NET (NuGet; source checkout). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
 
 | Tier | Meaning |
 |---|---|
@@ -630,7 +650,8 @@ Design notes and open items are in [docs/DESIGN_TODO.md](docs/DESIGN_TODO.md) (i
 - [x] `suggest_fix` and direct/transitive dependencies for Rust
 - [x] Scan history and changes between runs (`scan_history`, opt-in)
 - [x] `scan_project` for .NET (NuGet), with per-project matching and lower bounds for project files
-- [ ] `suggest_fix` for .NET (NuGet)
+- [x] `scan_project` and `suggest_fix` for PHP (Composer `composer.lock`)
+- [x] `suggest_fix` for .NET (NuGet; source checkout)
 - [ ] Direct and transitive dependencies for `gradle.lockfile` and the YAML/TOML lockfiles
 
 ## License

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.16.0";
+const SERVER_VERSION = "0.18.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -75,10 +75,10 @@ const historyConfig = historyConfigFromEnv();
 /** スキャンのツールを実行履歴に記録する(OSV_MCP_HISTORYが無効なら何もしない) */
 const recorded = (tool, input, run) => withHistory(tool, input, run, { config: historyConfig, serverVersion: SERVER_VERSION, allowedRootSet: allowedRootFromEnv() !== undefined });
 server.registerTool("scan_project", {
-    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust / .NET)",
+    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust / .NET / PHP)",
     description: "Detects the lockfiles and manifests in a project and scans the dependencies for known vulnerabilities (CVE/GHSA). " +
         "Supported: Java (pom.xml / gradle.lockfile), JavaScript (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml / bun.lock), " +
-        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock), " +
+        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock), PHP (composer.lock, including packages-dev), " +
         ".NET (packages.lock.json / obj/project.assets.json / packages.config / *.deps.json, and the direct PackageReference items of .csproj / .fsproj / .vbproj files without them). " +
         "Package managers and builds are never run. " +
         "Always check coverage at the top of the response: it lists manifests without a lockfile, requirements lines without a pinned version, and excluded files. " +
@@ -89,7 +89,8 @@ server.registerTool("scan_project", {
         "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
         "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, and Rust (not yet for .NET). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
+        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
+        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
             .string()
@@ -113,11 +114,13 @@ server.registerTool("scan_java_project", {
 server.registerTool("suggest_fix", {
     title: "Recommend upgrades that fix vulnerabilities",
     description: "Scans the project with the same detection as scan_project and recommends an upgrade version for each vulnerable package. " +
-        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). " +
+        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), PHP (Packagist / Composer), and .NET (NuGet). " +
+        "NuGet versions support up to four numeric components, case-insensitive prerelease labels, and ignored build metadata. Updates must satisfy target-framework and dependency constraints; runtime packs generally require SDK/runtime or target-framework updates. No dotnet restore or MSBuild is run. " +
+        "Composer recommendations support classical numeric release versions with up to four components and alpha/beta/RC/patch suffixes; dev branches, aliases, and unsupported version formats are not evaluated. Check PHP/extension constraints and application compatibility before upgrading. " +
         "The fixed version closest to the current release line is chosen with a three-tier fallback " +
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
-        "Dependencies scanned at a requirements.txt lower bound (>=) are marked version_is_lower_bound, and the recommendation then means raising the lower bound. " +
+        "Dependencies scanned at a requirements.txt lower bound (>=) or a NuGet PackageReference minimum/range are marked version_is_lower_bound, and the recommendation then means raising the lower bound rather than confirming the installed version. " +
         "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm and Cargo.lock also introduced_by and declared_in). Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
         "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +

package/dist/osv/suggestFix.js

@@ -20,6 +20,7 @@ import { candidateStatus } from "./affectedVersions.js";
 import { versionSchemeFor } from "./versionScheme.js";
 const TIER_ORDER = ["same_minor", "major_internal", "cross_major"];
 const UPDATE_HINTS = {
+    Packagist: "Update the applicable constraints in composer.json, then regenerate composer.lock in a trusted environment with composer update vendor/package --with-all-dependencies --no-scripts --no-plugins. For a transitive dependency, update the package that requires it or adjust its constraints. Check PHP and extension requirements and application compatibility before updating; Composer is not executed by this server",
     npm: "For a direct dependency, update the version in package.json. For a transitive dependency, update the direct dependency that requires it, " +
         "or set the version with overrides in the root package.json (effective only in the root project)",
     Go: "Update with go get <module>@<version> (a transitive dependency is added to the require block of go.mod and updated as well). " +
@@ -37,6 +38,17 @@ function updateHint(pkg) {
     const relation = pkg.dependency_relation;
     const by = pkg.introduced_by?.join(", ");
     switch (pkg.ecosystem) {
+        case "NuGet": {
+            if (/^Microsoft\.(?:NETCore|AspNetCore|WindowsDesktop)\.App\.Runtime\./i.test(pkg.name)) {
+                return "Runtime pack. Update the .NET SDK/runtime or target framework that supplies this pack and regenerate restore/build outputs; do not add an explicit PackageReference merely to change the runtime pack. Check framework/RID compatibility and rescan. This server does not run dotnet restore or MSBuild";
+            }
+            const shared = "If centrally managed, change PackageVersion in Directory.Packages.props. Regenerate restore/lockfiles and rescan in a trusted environment; verify target-framework compatibility and dependency constraints. This server does not run dotnet restore or MSBuild";
+            if (relation === "direct")
+                return "Direct dependency. Update its PackageReference in the project file (or packages.config for older projects). " + shared;
+            if (relation === "transitive")
+                return "Transitive dependency. Update the direct dependency that requires it, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. " + shared;
+            return "Update the dependency version in the project file or packages.config; for a transitive dependency, update its parent or explicitly reference a compatible fixed version. " + shared;
+        }
         case "npm":
             if (relation === "direct") {
                 return `Direct dependency. Update the version in ${pkg.declared_in?.join(", ") ?? "package.json"}` +
@@ -132,6 +144,7 @@ function hintFields(pkg, recommended = null, tier = null) {
 /** スキャン結果に付いた直接/推移的依存の項目を提案にも写す(無ければ何も出さない) */
 function relationFields(pkg) {
     return {
+        ...(pkg.version_is_lower_bound ? { version_is_lower_bound: true } : {}),
         ...(pkg.dependency_relation !== undefined ? { dependency_relation: pkg.dependency_relation } : {}),
         ...(pkg.introduced_by !== undefined ? { introduced_by: pkg.introduced_by } : {}),
         ...(pkg.introduced_by_omitted !== undefined ? { introduced_by_omitted: pkg.introduced_by_omitted } : {}),
@@ -212,15 +225,19 @@ function buildNote(scheme, pkg, recommended, tier, fixableCount, unfixedCount) {
         if (unfixedCount > 0)
             note += `. The remaining ${unfixedCount} CVEs have no fixed version newer than the current one and are excluded from the fix. Check recommended_status`;
     }
-    if (pkg.version_is_lower_bound) {
-        note += `. The current version (${pkg.version}) is the lower bound in requirements.txt (>= or ~=) and may differ from the installed version. ` +
-            "The recommendation means raising the lower bound to at least that version";
-    }
+    note += lowerBoundNote(pkg);
     if (pkg.ecosystem === "Go" && GO_PSEUDO_VERSION.test(pkg.version)) {
         note += ". The current version is a pseudo-version (an untagged commit)";
     }
     return note;
 }
+function lowerBoundNote(pkg) {
+    if (!pkg.version_is_lower_bound)
+        return "";
+    const source = pkg.ecosystem === "NuGet" ? "PackageReference (NuGet minimum/range)" : "requirements.txt (>= or ~=)";
+    return `. The current version (${pkg.version}) is the lower bound in ${source} and may differ from the installed version. ` +
+        "Any recommendation means raising the lower bound to at least that version";
+}
 /**
  * 1パッケージ分のアップグレード提案を組み立てる(同期・純粋)。
  * contextを渡すと、照会で見つかった脆弱性も避けて候補を選び直す(contextなしの結果が従来の推奨)。
@@ -317,9 +334,9 @@ export function suggestUpgradeForPackage(pkg, context = {}) {
         upgrade_note: (recommended === null && fixableCount > 0
             ? "No known fixed version could be confirmed to be outside the affected ranges of every CVE to fix. The recommendation is also withheld when the data are insufficient or use unsupported range types." +
                 (unparseableCount > 0 ? ` ${unparseableCount} CVEs list fixed versions that cannot be parsed as versions (tier: unparseable_fix), so the recommendation is withheld.` : "")
-            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount)) + (informationalNotes ? ` ${informationalNotes}` : ""),
+            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount)) +
+            (recommended === null && fixableCount > 0 ? lowerBoundNote(pkg) : "") + (informationalNotes ? ` ${informationalNotes}` : ""),
         ...hintFields(pkg, recommended, upgradeTier),
-        ...(pkg.version_is_lower_bound ? { version_is_lower_bound: true } : {}),
         per_cve_detail: details,
         verification: recommended === null ? "no_verified_candidate" : "verified",
     };

package/dist/osv/versionScheme.js

@@ -12,6 +12,8 @@
 import { compareMavenVersions, mavenVersionSeries } from "../utils/mavenVersion.js";
 import { compareParsedPep440, parsePep440 } from "../utils/pep440Version.js";
 import { compareParsedSemver, parseSemver } from "../utils/semverVersion.js";
+import { compareComposerVersions, parseComposerVersion } from "../utils/composerVersion.js";
+import { compareNugetVersions, parseNugetVersion } from "../utils/nugetVersion.js";
 const SEMVER_ECOSYSTEMS = new Set(["npm", "Go", "crates.io"]);
 const MAVEN_SCHEME = {
     isValid: () => true,
@@ -103,8 +105,45 @@ const PEP440_SCHEME = {
         return major === 0n && minor === 0n ? `${epoch}0.0.${patch}` : `${epoch}${major}.${minor}`;
     },
 };
+/** Composer: classical release ordering, with conservative 0.x upgrade tiers. */
+const COMPOSER_SCHEME = {
+    isValid: (v) => parseComposerVersion(v) !== null,
+    compare: compareComposerVersions,
+    isPrerelease: (v) => (parseComposerVersion(v)?.stability ?? 3) < 3,
+    classify(current, candidate) {
+        const a = parseComposerVersion(current), b = parseComposerVersion(candidate);
+        if (!a || !b)
+            return "cross_major";
+        return classifyCaret({ major: a.parts[0], minor: a.parts[1], patch: a.parts[2] }, { major: b.parts[0], minor: b.parts[1], patch: b.parts[2] });
+    },
+    seriesLabel(v) {
+        const parsed = parseComposerVersion(v);
+        return parsed ? `${parsed.parts[0]}.${parsed.parts[1]}` : null;
+    },
+};
+/** NuGet VersionRelease ordering; prerelease names and package IDs ignore ASCII case. */
+const NUGET_SCHEME = {
+    isValid: (v) => parseNugetVersion(v) !== null,
+    compare: compareNugetVersions,
+    isPrerelease: (v) => (parseNugetVersion(v)?.prerelease.length ?? 0) > 0,
+    classify(current, candidate) {
+        const a = parseNugetVersion(current), b = parseNugetVersion(candidate);
+        if (!a || !b)
+            return "cross_major";
+        return classifyCaret({ major: a.parts[0], minor: a.parts[1], patch: a.parts[2] }, { major: b.parts[0], minor: b.parts[1], patch: b.parts[2] });
+    },
+    seriesLabel(v) {
+        const parsed = parseNugetVersion(v);
+        return parsed ? parsed.parts[0] === 0 && parsed.parts[1] === 0
+            ? `0.0.${parsed.parts[2]}` : `${parsed.parts[0]}.${parsed.parts[1]}` : null;
+    },
+};
 /** 修正版の推奨に対応するエコシステムの操作。未対応ならnull */
 export function versionSchemeFor(ecosystem) {
+    if (ecosystem === "NuGet")
+        return NUGET_SCHEME;
+    if (ecosystem === "Packagist")
+        return COMPOSER_SCHEME;
     if (ecosystem === "Maven")
         return MAVEN_SCHEME;
     if (SEMVER_ECOSYSTEMS.has(ecosystem))
@@ -118,6 +157,8 @@ export function versionSchemeFor(ecosystem) {
  * PyPIはPEP 503の正規化(小文字化、`-` `_` `.`の連続を`-`)で比較する(実データでは完全一致したが防御的に)
  */
 export function samePackageName(a, b, ecosystem) {
+    if (ecosystem === "NuGet")
+        return a.toLowerCase() === b.toLowerCase();
     if (ecosystem !== "PyPI")
         return a === b;
     const normalize = (name) => name.toLowerCase().replace(/[-_.]+/g, "-");

package/dist/tools/scanProject.js

@@ -107,6 +107,9 @@ export function buildCoverage(project) {
             }
             : {}),
         skipped_files: skipped.items.map((s) => ({ path: sanitizeExternalText(s.path), reason: sanitizeExternalText(s.reason) })),
+        // Composer: 自分のコード(dist.type=path)は数だけ示し、completeには影響させない(local_crates・local_projectsと同じ)
+        ...(project.manifests.some((m) => m.format === "composer.lock") ? { local_composer_packages: project.composerLocalPackages ?? 0 } : {}),
+        ...((project.composerWarnings?.length ?? 0) > 0 ? { composer_warnings: project.composerWarnings.slice(0, MAX_COVERAGE_ITEMS).map(sanitizeExternalText) } : {}),
         ...(omitted > 0 ? { omitted_items: omitted } : {}),
     };
 }
@@ -318,6 +321,11 @@ export async function scanFromSnapshot(project, options) {
             targets.push({ path: generated, format: "packages.lock.json" });
             relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages });
         }
+        for (const copy of project.composerCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "composer.lock" });
+            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path });
+        }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });
         const report = await withScopeNotes(project.skippedFiles, () => snapshot.guard(() => runOsvScan(targets, options)));

package/dist/tools/suggestFix.js

@@ -1,7 +1,7 @@
 /**
  * `suggest_fix`ツールのハンドラ。
  * scan_projectと同じ検出・スキャンを実行し、脆弱なパッケージごとの
- * 推奨アップグレードバージョン(3段階Tier)を返す。推奨はMaven・npm・Go・PyPI・crates.ioに対応し、
+ * 推奨アップグレードバージョン(3段階Tier)を返す。推奨はMaven・npm・Go・PyPI・crates.io・Packagist・NuGetに対応し、
  * それ以外はunsupported_ecosystemとして返す。
  */
 import { isRemoteResolutionDisabled } from "../osv/runner.js";

package/dist/utils/composerLock.js

@@ -0,0 +1,40 @@
+import { parseNpmLock } from "./npmLockCopy.js";
+import { parseComposerVersion } from "./composerVersion.js";
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Only names and release versions reach OSV; repository URLs, scripts, and commit IDs are never forwarded. */
+export function composerLockCopy(text, budget) {
+    const data = parseNpmLock(text, budget);
+    if (!record(data) || !Array.isArray(data.packages) || (data["packages-dev"] !== undefined && !Array.isArray(data["packages-dev"]))) {
+        throw new Error("composer.lock must contain a packages array and an optional packages-dev array");
+    }
+    const issues = [];
+    const warnings = [];
+    let uncertainOrigin = 0;
+    // dist.type=pathは自分のコード(monorepoのパッケージ)。Rustのlocal_crates・.NETのlocal_projectsと同じく数だけ返し、範囲の欠けにしない
+    let localPackages = 0;
+    const output = {};
+    for (const group of ["packages", "packages-dev"]) {
+        const packages = [];
+        let skipped = 0;
+        for (const raw of (data[group] ?? [])) {
+            if (record(raw) && record(raw.dist) && raw.dist.type === "path") {
+                localPackages++;
+                continue;
+            }
+            if (!record(raw) || typeof raw.name !== "string" || !/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(raw.name) || raw.name.length > 200 ||
+                typeof raw.version !== "string" || parseComposerVersion(raw.version) === null) {
+                skipped++;
+                continue;
+            }
+            packages.push({ name: raw.name, version: raw.version });
+            if (raw["notification-url"] !== "https://packagist.org/downloads/")
+                uncertainOrigin++;
+        }
+        output[group] = packages;
+        if (skipped > 0)
+            issues.push(`${skipped} entries in ${group} were not scanned: invalid package names or non-release versions (branches, aliases, and dev versions are not evaluated)`);
+    }
+    if (uncertainOrigin > 0)
+        warnings.push(`${uncertainOrigin} Composer package entries lack the standard Packagist notification URL. Their names and versions are sent to api.osv.dev as Packagist packages; private or forked packages may produce false positives. The notification URL is only a heuristic and does not prove origin`);
+    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages };
+}

package/dist/utils/composerVersion.js

@@ -0,0 +1,36 @@
+const STABILITY = { alpha: 0, a: 0, beta: 1, b: 1, rc: 2, stable: 3, patch: 4, pl: 4, p: 4 };
+export function parseComposerVersion(version) {
+    if (version.length > 256)
+        return null;
+    const match = /^v?(\d{1,5}(?:\.\d+){0,3})(?:[._-]?(alpha|a|beta|b|RC|stable|patch|pl|p)((?:[.-]?\d+(?:[.-]\d+)*)?))?(?:\+[0-9A-Za-z.-]+)?$/i.exec(version);
+    if (!match)
+        return null;
+    const parts = match[1].split(".").map(BigInt);
+    while (parts.length < 4)
+        parts.push(0n);
+    return {
+        parts,
+        stability: match[2] === undefined ? 3 : STABILITY[match[2].toLowerCase()],
+        suffix: match[2]?.toLowerCase() === "stable" ? [] : (match[3] ?? "").replace(/^[.-]/, "").split(/[.-]/).filter(Boolean).map(BigInt),
+    };
+}
+export function compareComposerVersions(a, b) {
+    const x = parseComposerVersion(a), y = parseComposerVersion(b);
+    if (x === null || y === null)
+        return 0;
+    for (let i = 0; i < 4; i++) {
+        if (x.parts[i] !== y.parts[i])
+            return x.parts[i] < y.parts[i] ? -1 : 1;
+    }
+    if (x.stability !== y.stability)
+        return x.stability < y.stability ? -1 : 1;
+    for (let i = 0; i < Math.max(x.suffix.length, y.suffix.length); i++) {
+        // PHP version_compare treats even an extra zero component as greater.
+        if (i >= x.suffix.length || i >= y.suffix.length)
+            return i >= x.suffix.length ? -1 : 1;
+        const left = x.suffix[i], right = y.suffix[i];
+        if (left !== right)
+            return left < right ? -1 : 1;
+    }
+    return 0;
+}

package/dist/utils/manifestDetector.js

@@ -19,6 +19,7 @@ import { createNpmLockWorkBudget, MAX_NPM_LOCK_BYTES, MAX_NPM_LOCK_TOTAL_BYTES,
 import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requirementsFile.js";
 import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, createGlobWorkBudget, classifyCargoPackages, createCargoLockParseBudget, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 import { analyzeNuget, collectNugetFile, emptyNugetFiles, NUGET_DEPS_JSON, NUGET_LOCKFILE, NUGET_PACKAGES_CONFIG, NUGET_PROJECT_ASSETS, NUGET_PROJECT_FILE, } from "./nugetProject.js";
+import { composerLockCopy } from "./composerLock.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -35,6 +36,7 @@ const LOCKFILES = new Map([
     ["pdm.lock", { ecosystem: "PyPI", format: "pdm.lock" }],
     ["go.mod", { ecosystem: "Go", format: "go.mod" }],
     ["Cargo.lock", { ecosystem: "crates.io", format: "Cargo.lock" }],
+    ["composer.lock", { ecosystem: "Packagist", format: "composer.lock" }],
 ]);
 /** requirements.txt / requirements-dev.txt / dev-requirements.txt 等 */
 const REQUIREMENTS_NAME = /^(?:[\w.]+[-_])?requirements(?:[-_][\w.]+)?\.txt$/;
@@ -50,9 +52,11 @@ const LOCK_MARKERS = new Map([
     ["settings.gradle", "gradle"],
     ["settings.gradle.kts", "gradle"],
     ["Cargo.toml", "cargo"],
+    ["composer.json", "composer"],
 ]);
-const LOCK_GROUP_ECOSYSTEM = { npm: "npm", pypi: "PyPI", gradle: "Maven", cargo: "crates.io" };
+const LOCK_GROUP_ECOSYSTEM = { npm: "npm", pypi: "PyPI", gradle: "Maven", cargo: "crates.io", composer: "Packagist" };
 const LOCKFILE_HINTS = {
+    composer: "No composer.lock. Generate it in a trusted environment with `composer update --no-install --no-scripts --no-plugins`, then scan again. Composer and PHP code are never executed by this server",
     npm: "No lockfile. Run `npm install --package-lock-only --ignore-scripts` in a trusted environment " +
         "(for yarn / pnpm / bun, generate the lockfile with that tool), then scan again",
     pypi: "No lockfile (poetry.lock / uv.lock / Pipfile.lock / pdm.lock) or requirements.txt with pinned versions. " +
@@ -283,6 +287,9 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
         targets: [],
         requirementsCopies: [],
         cargoCopies: [],
+        composerCopies: [],
+        composerWarnings: [],
+        composerLocalPackages: 0,
         localCrateCount: 0,
         unscannableCrates: [],
         lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache),
@@ -298,6 +305,8 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
         hasNuget: Object.values(nugetFiles).some((list) => list.length > 0),
     };
     const readContext = createRequirementsReadContext();
+    const composerBudget = createNpmLockWorkBudget();
+    let composerBytes = MAX_NPM_LOCK_TOTAL_BYTES;
     // A null value permanently marks a crate name with multiple declaration paths.
     const cargoManifests = new Map();
     const cargoMarkers = new Set([
@@ -312,7 +321,27 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     }
     for (const manifest of manifests) {
         const absolute = path.join(projectDir, manifest.path);
-        if (manifest.format === "requirements.txt") {
+        if (manifest.format === "composer.lock") {
+            const read = await readRegularFile(absolute, { maxBytes: Math.min(MAX_NPM_LOCK_BYTES, composerBytes), boundary: projectDir });
+            if (!read.ok) {
+                result.skippedFiles.push({ path: manifest.path, reason: capitalizeReason(read.message) });
+                continue;
+            }
+            composerBytes -= read.bytes.length;
+            try {
+                const parsed = composerLockCopy(read.bytes.toString("utf8"), composerBudget);
+                if (parsed.packageCount > 0)
+                    result.composerCopies.push({ path: manifest.path, content: parsed.content });
+                result.skippedFiles.push(...parsed.issues.map((reason) => ({ path: manifest.path, reason })));
+                result.composerWarnings.push(...parsed.warnings.map((warning) => `${manifest.path}: ${warning}`));
+                result.composerLocalPackages += parsed.localPackages;
+            }
+            catch {
+                result.skippedFiles.push({ path: manifest.path, reason: "composer.lock could not be parsed within the JSON size and work limits" });
+                continue;
+            }
+        }
+        else if (manifest.format === "requirements.txt") {
             const analysis = await analyzeRequirementsFile(absolute, projectDir, readContext);
             if (!analysis.ok) {
                 result.skippedFiles.push({ path: manifest.path, reason: analysis.reason });

package/dist/utils/manifestFormats.js

@@ -20,6 +20,7 @@ export const MANIFEST_FORMATS = [
     "go.mod",
     "Cargo.lock",
     "packages.lock.json",
+    "composer.lock",
 ];
 const FORMAT_SET = new Set(MANIFEST_FORMATS);
 export function isManifestFormat(value) {

package/dist/utils/nugetVersion.js

@@ -0,0 +1,41 @@
+const INT_MAX = 2_147_483_647;
+export function parseNugetVersion(version) {
+    if (version.length > 256)
+        return null;
+    const match = /^(\d{1,10}(?:\.\d{1,10}){0,3})(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+    if (!match || match[0] !== version)
+        return null;
+    const parts = match[1].split(".").map(Number);
+    if (parts.some(n => n > INT_MAX))
+        return null;
+    while (parts.length < 4)
+        parts.push(0);
+    const prerelease = match[2]?.toLowerCase().split(".") ?? [];
+    // NuGet rejects purely numeric release labels with leading zeroes.
+    if (prerelease.some(label => /^0\d+$/.test(label)))
+        return null;
+    return { parts, prerelease };
+}
+export function compareNugetVersions(a, b) {
+    const x = parseNugetVersion(a), y = parseNugetVersion(b);
+    if (!x || !y)
+        return 0;
+    for (let i = 0; i < 4; i++)
+        if (x.parts[i] !== y.parts[i])
+            return x.parts[i] < y.parts[i] ? -1 : 1;
+    if (x.prerelease.length === 0 || y.prerelease.length === 0) {
+        return x.prerelease.length === y.prerelease.length ? 0 : x.prerelease.length === 0 ? 1 : -1;
+    }
+    for (let i = 0; i < Math.min(x.prerelease.length, y.prerelease.length); i++) {
+        const left = x.prerelease[i], right = y.prerelease[i];
+        const numeric = (label) => /^-?\d+$/.test(label) && Number(label) >= -2_147_483_648 && Number(label) <= INT_MAX;
+        const leftNumeric = numeric(left);
+        const rightNumeric = numeric(right);
+        if (leftNumeric !== rightNumeric)
+            return leftNumeric ? -1 : 1;
+        const l = leftNumeric ? Number(left) : left, r = rightNumeric ? Number(right) : right;
+        if (l !== r)
+            return l < r ? -1 : 1;
+    }
+    return Math.sign(x.prerelease.length - y.prerelease.length);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.16.0",
-  "description": "MCP server that wraps Google's OSV-Scanner to scan Java, JavaScript, Python, Go, Rust, and .NET dependencies for known vulnerabilities and recommend fixes",
+  "version": "0.18.0",
+  "description": "MCP server that wraps Google's OSV-Scanner to scan Java, JavaScript, Python, Go, Rust, .NET, and PHP dependencies for known vulnerabilities and recommend fixes",
   "type": "module",
   "license": "Apache-2.0",
   "author": "tedorigawa001",
@@ -20,6 +20,8 @@
     "rust",
     "nuget",
     "dotnet",
+    "php",
+    "composer",
     "sca"
   ],
   "files": [