ecosystems

ACVE ecosystems

Use a real OSV ecosystem whenever a server is backed by a package manager: npm, PyPI, Go, or crates.io, with the package's normal name and package URL where available. This lets ordinary OSV consumers match the component without understanding ACVE.

Use ACVE ecosystems only when OSV has no package identity:

| Ecosystem | Name rule | | --- | --- | | AgentHarness | Canonical harness id, such as claude-code | | MCP | Official MCP registry name or a stable pkg: identity | | AgentPlugin | <name>@<marketplace> | | AgentSkill | Stable published skill name | | Model | Provider/model identifier |

An MCP lock entry can retain both a package coordinate and registryName; an advisory may carry twin npm/MCP affected entries with identical events. Ecosystem names are case-sensitive where OSV defines them. ACVE's extension does not change OSV range semantics: SEMVER uses version ranges/events, ECOSYSTEM uses ecosystem rules, and GIT identifies repository history.

Advisory status is draft, candidate, published, or withdrawn. Candidate matches are visibly unverified; withdrawn records are skipped unless explicitly requested.