Stack Facts

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Stack Facts": {
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (41)

• stackfacts_eol_product read-only

  List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.

  Parameters:

  • product (required) — string — endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_eol_cycle read-only

  Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.

  Parameters:

  • product (required) — string — endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)
  • cycle (required) — string — Release cycle, e.g. 3.12, 22 or 24.04

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_eol_check read-only

  Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.

  Parameters:

  • items (required) — array — The versions to check, in order

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_eol_image read-only

  Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.

  Parameters:

  • image (required) — string — Image reference or a whole Dockerfile FROM line (FROM, --platform and AS name are dropped), e.g. node:18-alpine3.19, python:3.12-slim-bookworm, gcr.io/distroless/nodejs20-debian12, FROM --platform=linux/amd64 ubuntu:22.04 AS build

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_eol_snapshot read-only

  Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_kev_lookup read-only

  Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.

  Parameters:

  • cve (required) — string — CVE id, e.g. CVE-2021-44228

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_kev_check read-only

  Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.

  Parameters:

  • cves (required) — array — CVE ids; duplicates are merged

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_kev_changes read-only

  List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.

  Parameters:

  • since (required) — string — meta.snapshot_id of an earlier kev answer, e.g. kev-20261009T060000Z-1a2b3c4d; kept for 30 snapshots

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_kev_snapshot read-only

  Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_lookup read-only

  Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.

  Parameters:

  • provider (required) — string — Provider, e.g. openai, anthropic, google (GET /v1/models/index lists them)
  • model (required) — string — Model id at the provider, e.g. gpt-4o

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_estimate read-only

  Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.

  Parameters:

  • model (required) — string — provider/model id, e.g. openai/gpt-4o
  • input_tokens — integer — Uncached input tokens
  • cached_tokens — integer — Cached input tokens (cache reads)
  • output_tokens — integer — Output tokens

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_cheapest read-only

  Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.

  Parameters:

  • tools — boolean — Require tool calling
  • vision — boolean — Require image input
  • providers — array — Only these providers
  • min_context — integer — Minimum context window in tokens
  • include_free — boolean — Keep models priced 0/0 (default false)
  • max_usd_per_mtok — number — Max blended USD per million tokens (3:1 input:output)
  • include_deprecated — boolean — Keep deprecated models (default false)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_changes read-only

  List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.

  Parameters:

  • since (required) — string — meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots. /v1/models/changes needs ?since=.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_watch read-only

  Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.

  Parameters:

  • models (required) — array — provider/model ids, e.g. openai/gpt-4o
  • since — string — meta.snapshot_id of your last answer; omit on the first call
  • warn_days — integer — Alert when deprecation is this many days away or less (default 90)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_models_snapshot read-only

  Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_stack_check read-only

  Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.

  Parameters:

  • cves — array — Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only
  • items — array — The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["[email protected]"]}
  • packages — array — Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_osv_check read-only

  Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.

  Parameters:

  • format — string — The lockfile's format; detected when left out
  • lockfile — string — Instead of packages: the text of a package-lock.json, yarn.lock (v1), requirements.txt or poetry.lock; its distinct exact versions are checked (at most 50). The raw lockfile may also be sent as the whole body
  • packages — array — Package URLs with versions, in order. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_preflight read-only

  Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.

  Parameters:

  • name — string — Package name as the registry spells it, e.g. lodash, @babel/traverse, jinja2, org.apache.logging.log4j:log4j-core
  • package — string — Package URL with a version, e.g. pkg:npm/[email protected] or pkg:pypi/[email protected]. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are refused until imported). Send this, or ecosystem, name and version
  • version — string — Exact version, e.g. 4.17.20
  • ecosystem — string — npm, pypi, golang, cargo or maven (with name and version, instead of package)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_cve_lookup read-only

  Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.

  Parameters:

  • id (required) — string — CVE id, e.g. CVE-2021-44228. Loose ids such as cve 2021 44228 or cve_2021_44228 are accepted.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_cwe_lookup read-only

  Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.

  Parameters:

  • id (required) — string — CWE id, e.g. CWE-79 or 79

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_technique_lookup read-only

  Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.

  Parameters:

  • id (required) — string — Technique id, e.g. T1055.011 or T1055

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_capec_lookup read-only

  Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.

  Parameters:

  • id (required) — string — CAPEC id, e.g. CAPEC-66 or 66

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_domain_lookup read-only

  Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.

  Parameters:

  • host (required) — string — Host name, e.g. shop.example.co.uk (Unicode names work)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_port_lookup read-only

  Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.

  Parameters:

  • number (required) — string — Port number from 0 to 65535, e.g. 443

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_control_lookup read-only

  Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.

  Parameters:

  • id (required) — string — Control id like AC-2 or enhancement AC-2(1) (ac-2.1 also works)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_bcp47_lookup read-only

  Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.

  Parameters:

  • tag (required) — string — IANA language tag like en, en-AU or zh-Hant (case does not matter)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_tz_lookup read-only

  Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.

  Parameters:

  • zone (required) — string — IANA time zone like Europe/Berlin, UTC or an alias such as US/Pacific (case does not matter; a path needs the slash sent as %2F)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_package_card read-only

  Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.

  Parameters:

  • ecosystem (required) — string — npm or pypi
  • name (required) — string — Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
  • version — string — Version to describe (npm: or a dist-tag); default the latest

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_license_check read-only

  Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.

  Parameters:

  • items (required) — array — Up to 20 items: an SPDX licence expression (MIT, GPL-2.0-or-later, MIT OR Apache-2.0) or a package with its declared licence; a package with no licence is unknown
  • use — string — How you ship it: distribute (default), saas (network use only) or internal
  • project_license — string — Your project's licence: one SPDX id (Apache-2.0, GPL-3.0-only) or proprietary; default proprietary

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_cve_prioritize read-only

  Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.

  Parameters:

  • cves (required) — array — Up to 100 CVE ids, e.g. CVE-2021-44228; duplicates are dropped

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_cve_search read-only

  Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.

  Parameters:

  • q — string — Keyword search (send q or package, not both): 1 to 8 words, all must appear in the CISA KEV vendor, product or vulnerability name; also tried as an exact OSV package name
  • kev — boolean — true: only CVEs in CISA KEV; false: only CVEs not in KEV
  • limit — integer — Most results to return (default 20, at most 50)
  • package — string — Package name (send q or package, not both), matched exactly in the OSV advisories, e.g. lodash
  • severity — string — Only CVEs of this severity or higher (from the OSV advisories; keeps only CVEs with an OSV score or label, so most KEV-only CVEs are left out)
  • ecosystem — string — With package only: npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems or Packagist (or the purl type); default all

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_package_preflight read-only

  Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.

  Parameters:

  • ecosystem (required) — string — npm or pypi
  • name (required) — string — Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
  • use — string — How the package is used: distribute (default), saas or internal
  • version — string — The version to judge: an exact version (e.g. 2.31.0) or an npm dist-tag; default the latest. Unknown version 404
  • project_license — string — Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_upgrade_delta read-only

  Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.

  Parameters:

  • ecosystem (required) — string — npm or pypi
  • name (required) — string — Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
  • from (required) — string — The version you run now: an exact version or an npm dist-tag
  • to — string — The version you move to; default the latest. An exact version or an npm dist-tag
  • use — string — How the package is used: distribute (default), saas or internal
  • project_license — string — Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_lockfile_diff read-only

  Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.

  Parameters:

  • to — array — Packages after, as purls with a version (or {purl, integrity}); a package in both lists at another version is judged, one in a single list is reported added or removed; the same version with two different integrity hashes is a hash_mismatch finding (decision review)
  • from — array — Packages before, as purls with a version, e.g. pkg:npm/[email protected] or pkg:pypi/[email protected] (npm and PyPI only); or {purl, integrity} with an SRI hash (sha512-...) from the lockfile
  • to_lockfile — string — Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Each side is capped at 5,000 distinct packages (413 too_many_items). Send to or to_lockfile, not both
  • from_lockfile — string — Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when it has one. Each side is capped at 5,000 distinct packages (413 too_many_items). Send from or from_lockfile, not both

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_stack_watch read-only

  Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.

  Parameters:

  • cves — array — Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only
  • full — boolean — Re-check only: also return data.check, the full current stack answer, at the same price (default false)
  • items — array — The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["[email protected]"]}
  • token — string — Re-check only: data.watch.token from your last answer. Nothing else with it but full. It holds your stack in readable form; keep it as you would the stack
  • packages — array — Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)
  • warn_days — integer — Start only: report an item as due soon when its EOL date is this many days away or fewer (default 90, 0 = off). Kept in the token

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_preview read-only

  Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.

  Parameters:

  • dataset (required) — string — Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities), models (LLM prices), package (npm/PyPI package card) or license (licence compatibility)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_try read-only

  Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.

  Parameters:

  • dataset (required) — string — Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_index read-only

  List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.

  Parameters:

  • dataset (required) — string — eol (product ids and aliases) or models (provider/model ids)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_validate read-only

  Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.

  Parameters:

  • dataset (required) — string — Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE), technique (MITRE ATT&CK) or capec (MITRE CAPEC)
  • id (required) — string — Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79, T1059 or CAPEC-66

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_manifest read-only

  Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.

  Parameters:

  • dataset (required) — string — Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• stackfacts_keys read-only

  Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.