Stack Facts: paid EOL, CVE and LLM price checks

npx add-mcp 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp'

Stack Facts

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.

Free sample: curl -s https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol. CVE/KEV lookup $0.003 per call (GET /v1/kev/{cve}). Paid calls cost $0.002 to $0.05 in USDC over x402 v2 exact on Base: call the route, take the price from the 402 PAYMENT-REQUIRED header, pay and retry with PAYMENT-SIGNATURE. x402 v1 clients can pay the offer in the 402 body instead and retry with X-PAYMENT. MPP (Machine Payments Protocol) clients that support x402 can pay these routes unchanged. No account or API key. Errors are never charged.

Updated 2026-10-15. Version 0.6.0. Base URL: https://g5joilnmeep4ntz3nwezxt5dmu.srv.us

Quick start

# Free: signed samples, same shape as the paid answers
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/kev'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/models/preview'
# Free: check an id before paying
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/validate?dataset=eol&id=nodejs'
# Paid: 402 with the price in the PAYMENT-REQUIRED header (base64 JSON) and the body
curl -si 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/CVE-2021-44228'
curl -si -X POST 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/eol/check' -H 'content-type: application/json' -d '{"items":[{"product":"nodejs","version":"18.19.0"},{"product":"python","version":"3.12.4"}]}'

Examples

• curl.md: curl: a free call, then a paid route's 402 and its PAYMENT-REQUIRED header decoded
• fetch-x402.mjs: Node 18+, no dependencies: an x402 client that pays one call (add a viem account as the signer)
• python_x402.py: Python 3 standard library: the same client (add an EIP-712 signer)

Prices

USD per call, paid in USDC on Base (eip155:8453). Atomic USDC (USD x 1,000,000) is the 402 amount.

Method	Route	Tool	USD	Atomic USDC
GET	/v1/eol/{product}	stackfacts_eol_product	0.003	3000
GET	/v1/eol/{product}/{cycle}	stackfacts_eol_cycle	0.003	3000
POST	/v1/eol/check	stackfacts_eol_check	0.01	10000
GET	/v1/eol/check	stackfacts_eol_check	0.01	10000
GET	/v1/eol/image	stackfacts_eol_image	0.005	5000
GET	/v1/eol/snapshot	stackfacts_eol_snapshot	0.05	50000
GET	/v1/kev/{cve}	stackfacts_kev_lookup	0.003	3000
POST	/v1/kev/check	stackfacts_kev_check	0.005	5000
GET	/v1/kev/changes	stackfacts_kev_changes	0.01	10000
GET	/v1/kev/snapshot	stackfacts_kev_snapshot	0.05	50000
GET	/v1/models/{provider}/{model}	stackfacts_models_lookup	0.003	3000
POST	/v1/models/estimate	stackfacts_models_estimate	0.003	3000
POST	/v1/models/cheapest	stackfacts_models_cheapest	0.008	8000
POST	/v1/models/watch	stackfacts_models_watch	0.012	12000
GET	/v1/models/changes	stackfacts_models_changes	0.02	20000
GET	/v1/models/snapshot	stackfacts_models_snapshot	0.05	50000
POST	/v1/stack/check	stackfacts_stack_check	0.012	12000
POST	/v1/stack/watch	stackfacts_stack_watch	0.012	12000
POST	/v1/osv/check	stackfacts_osv_check	0.005	5000
POST	/v1/preflight	stackfacts_preflight	0.008	8000
GET	/v1/cve/{id}	stackfacts_cve_lookup	0.003	3000
GET	/v1/cwe/{id}	stackfacts_cwe_lookup	0.002	2000
GET	/v1/technique/{id}	stackfacts_technique_lookup	0.002	2000
GET	/v1/capec/{id}	stackfacts_capec_lookup	0.003	3000
GET	/v1/domain/{host}	stackfacts_domain_lookup	0.003	3000
GET	/v1/port/{number}	stackfacts_port_lookup	0.003	3000
GET	/v1/control/{id}	stackfacts_control_lookup	0.003	3000
GET	/v1/bcp47/{tag}	stackfacts_bcp47_lookup	0.002	2000
GET	/v1/tz/{zone}	stackfacts_tz_lookup	0.003	3000
GET	/v1/package/{ecosystem}/{name}	stackfacts_package_card	0.003	3000
POST	/v1/license/check	stackfacts_license_check	0.003	3000
POST	/v1/cve/prioritize	stackfacts_cve_prioritize	0.01	10000
GET	/v1/cve/search	stackfacts_cve_search	0.005	5000
GET	/v1/preflight/{ecosystem}/{name}	stackfacts_package_preflight	0.005	5000
GET	/v1/upgrade/{ecosystem}/{name}	stackfacts_upgrade_delta	0.005	5000
POST	/v1/lockfile/diff	stackfacts_lockfile_diff	0.02	20000

Paid tools

• stackfacts_eol_product: GET /v1/eol/{product}, $0.003. List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version. Keywords: EOL; end-of-life dates; support status; is still supported; release cycles; LTS; endoflife.date.
• stackfacts_eol_cycle: GET /v1/eol/{product}/{cycle}, $0.003. Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch. Keywords: is still supported; EOL; end-of-life date; support status; support until; latest patch version; LTS.
• stackfacts_eol_check: POST /v1/eol/check or GET /v1/eol/check, $0.01. Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions. Keywords: check my stack for end-of-life versions; is still supported; EOL; support status; dependency EOL audit; batch end-of-life check.
• stackfacts_eol_image: GET /v1/eol/image, $0.005. Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status. Keywords: is my docker image end-of-life; container base image EOL; is still supported; Dockerfile FROM audit; EOL; support status; base OS end-of-life.
• stackfacts_eol_snapshot: GET /v1/eol/snapshot, $0.05. Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest. Keywords: EOL; end-of-life dataset download; support status; is still supported; endoflife.date bulk; signed snapshot.
• stackfacts_kev_lookup: GET /v1/kev/{cve}, $0.003. Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use. Keywords: check if a CVE is actively exploited (CISA KEV); known exploited vulnerability; CISA KEV lookup; CVE exploited in the wild.
• stackfacts_kev_check: POST /v1/kev/check, $0.005. Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one. Keywords: check if a CVE is actively exploited (CISA KEV); batch CVE check; vulnerability scan triage; known exploited vulnerabilities.
• stackfacts_kev_changes: GET /v1/kev/changes, $0.01. List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities. Keywords: new CISA KEV entries; newly exploited vulnerabilities; KEV change feed; check if a CVE is actively exploited (CISA KEV).
• stackfacts_kev_snapshot: GET /v1/kev/snapshot, $0.05. Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature. Keywords: CISA KEV download; known exploited vulnerabilities catalog; signed snapshot.
• stackfacts_models_lookup: GET /v1/models/{provider}/{model}, $0.003. Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date. Keywords: price per million tokens; context window; model deprecation date; LLM pricing; max output tokens.
• stackfacts_models_estimate: POST /v1/models/estimate, $0.003. Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used. Keywords: LLM cost estimate; price per million tokens; token cost calculator; how much will this prompt cost.
• stackfacts_models_cheapest: POST /v1/models/cheapest, $0.008. Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens. Keywords: cheapest model with tools and 128k context; cheapest LLM; price per million tokens; context window; model comparison.
• stackfacts_models_changes: GET /v1/models/changes, $0.02. List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id. Keywords: LLM price changes; model deprecation date; new LLM models; price per million tokens.
• stackfacts_models_watch: POST /v1/models/watch, $0.012. Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates. Keywords: watch LLM prices and deprecations; Use when the models you call may change price or be deprecated; model deprecation alert; LLM price change monitor; what changed for my models since my last check.
• stackfacts_models_snapshot: GET /v1/models/snapshot, $0.05. Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest. Keywords: LLM pricing dataset; price per million tokens; context window; signed snapshot.
• stackfacts_stack_check: POST /v1/stack/check, $0.012. Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns. Keywords: check my stack for end-of-life versions and exploited CVEs; stack audit; EOL, package vulnerabilities and KEV in one call; is still supported; dependency risk check; known exploited vulnerabilities.
• stackfacts_osv_check: POST /v1/osv/check, $0.005. Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV. Keywords: check my dependencies for known vulnerabilities; is vulnerable; OSV; purl; npm PyPI Go crates.io Maven advisories; GHSA; fixed version; known exploited vulnerabilities; malicious package check; lockfile scan; package-lock.json yarn.lock requirements.txt poetry.lock.
• stackfacts_preflight: POST /v1/preflight, $0.008. Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons. Keywords: call before installing a package an LLM suggested; npm install check; pip install check; package preflight; malicious package check; known exploited vulnerabilities; OSV; purl.
• stackfacts_cve_lookup: GET /v1/cve/{id}, $0.003. Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions. Keywords: get a CVE; CVE lookup; CVE details; CVE fixed version; CVE affected packages; CVSS score; OSV; CISA KEV; CVE priority.
• stackfacts_cwe_lookup: GET /v1/cwe/{id}, $0.002. Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer. Keywords: CWE lookup; CWE weakness; common weakness enumeration; CWE name; CWE description; MITRE CWE.
• stackfacts_technique_lookup: GET /v1/technique/{id}, $0.002. Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited. Keywords: technique lookup; adversary technique; attack technique id; technique tactics; technique platforms; MITRE technique.
• stackfacts_capec_lookup: GET /v1/capec/{id}, $0.003. Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link. Keywords: CAPEC lookup; CAPEC attack pattern; common attack pattern enumeration; attack pattern mitigations; CAPEC description; MITRE CAPEC.
• stackfacts_domain_lookup: GET /v1/domain/{host}, $0.003. Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section. Keywords: public suffix; registrable domain; eTLD+1; domain split; subdomain parser; Public Suffix List; effective TLD.
• stackfacts_port_lookup: GET /v1/port/{number}, $0.003. Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry. Keywords: port number; IANA; service name; well-known ports; port lookup; TCP port; UDP port; service names and port numbers.
• stackfacts_control_lookup: GET /v1/control/{id}, $0.003. Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status. Keywords: NIST SP 800-53; security controls; control catalogue; compliance; OSCAL; control enhancement; FedRAMP; access control.
• stackfacts_bcp47_lookup: GET /v1/bcp47/{tag}, $0.002. Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry. Keywords: BCP 47; language tag; locale; IANA language subtag registry; RFC 5646; ISO 639; script subtag; region subtag.
• stackfacts_tz_lookup: GET /v1/tz/{zone}, $0.003. Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata. Keywords: time zone; IANA time zone; tz database; tzdata; UTC offset; daylight saving; DST; timezone abbreviation.
• stackfacts_package_card: GET /v1/package/{ecosystem}/{name}, $0.003. Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range. Keywords: package metadata; latest version; npm package; PyPI package; package licence; SPDX licence; deprecated package; yanked release.
• stackfacts_license_check: POST /v1/license/check, $0.003. Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item. Keywords: licence compatibility; license compatibility; SPDX licence check; GPL compatible; copyleft licence; dependency licence; open source licence policy; AGPL SaaS.
• stackfacts_cve_prioritize: POST /v1/cve/prioritize, $0.01. Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score. Keywords: CVE prioritization; exploit prediction; KEV; vulnerability triage; patch priority; CVE ranking; known exploited.
• stackfacts_cve_search: GET /v1/cve/search, $0.005. Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one. Keywords: CVE search; search vulnerabilities by keyword; CVEs for a package; KEV; known exploited; vulnerability lookup by product; OSV advisories.
• stackfacts_package_preflight: GET /v1/preflight/{ecosystem}/{name}, $0.005. Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block. Keywords: call before npm install; call before pip install; package preflight; is this package safe; latest version; package licence; deprecated package; known exploited vulnerabilities.
• stackfacts_upgrade_delta: GET /v1/upgrade/{ecosystem}/{name}, $0.005. Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go. Keywords: is this upgrade safe; npm upgrade check; pip upgrade check; upgrade package version; version bump risk; vulnerabilities fixed by upgrade; breaking upgrade; dependency upgrade decision.
• stackfacts_lockfile_diff: POST /v1/lockfile/diff, $0.02. Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go. Keywords: lockfile diff; compare lockfiles; dependency diff; package.json diff; requirements diff; dependency update risk; pull request dependency check; dependabot review.
• stackfacts_stack_watch: POST /v1/stack/watch, $0.012. Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token. Keywords: watch my stack for end-of-life and new exploited CVEs; Use when you need to know what changed in a stack since your last check; stack monitor; dependency monitor; what changed since my last check; alert when a version reaches end of life; new vulnerabilities in my packages.

GET /v1/cve/{id} still answers (and is charged) when one source is stale or missing: a stale OSV ecosystem's advisories are left out and listed in meta.datasets.osv.stale_ecosystems (one that failed its load check: unavailable_ecosystems); a stale or missing KEV snapshot gives in_kev: null (not checked). Each left-out source is named in meta.warnings ({code, dataset, message}). A CVE found in no source answers 404 unknown_id only when every source is fresh; while any source is stale or missing the miss answers 503 stale_data with Retry-After (retry later), since the CVE may be in the part left out. 503s and 404s are never charged.

Free tools

• stackfacts_preview: GET /v1/{dataset}/preview, free. Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict. Keywords: free sample; end-of-life dates; CISA KEV; price per million tokens.
• stackfacts_try: GET /v1/try/{dataset}, free. Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices. Keywords: free example; try before paying; check if a CVE is actively exploited (CISA KEV).
• stackfacts_index: GET /v1/{dataset}/index, free. List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses. Keywords: product list; model list; valid ids; aliases.
• stackfacts_validate: GET /v1/validate, free. Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored. Keywords: validate id; check before paying; product exists.
• stackfacts_manifest: GET /v1/{dataset}/manifest, free. Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature. Keywords: signed manifest; snapshot_id; data freshness; provenance.
• stackfacts_keys: GET /v1/keys, free. Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest. Keywords: public key; verify signature; JWKS; Ed25519.

Free: /v1/sample lists a static example answer for every paid route, with its key and price. Examples: /v1/sample/eol-product, /v1/sample/kev-cve, /v1/sample/models-cheapest. No payment, no account.

Free: /v1/try/cve shows the GET /v1/cve/{id} answer for CVE-2021-44228 only (paid route; the sample is not charged).

Free: /v1/try/preflight shows the POST /v1/preflight answer for one fixed package (paid route; the sample is not charged).

Free: /v1/models/{name} resolves a bare model id or alias to its full id (resolved_id), and a provider name (e.g. openai) to its model ids. Unknown names are not charged.

Free routes: no key, no stated limit.

Connect over MCP: claude mcp add --transport http stackfacts https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp

Stack watch

POST /v1/stack/watch ($0.012 a call, start or re-check) answers what changed in a stack since your last call. Start with a stack, as for POST /v1/stack/check: the answer holds the full check and a signed token, data.watch.token. Later send {"token": "<watch.token>"}: the answer lists each change since then (an end-of-life date passed or near, a CVE newly in CISA KEV, a new OSV advisory) with worst (high, medium, low or null for no change) and a new token for the next call.

• The token holds your stack in readable form; keep it as you would the stack. It is signed, so a changed token is refused (token_invalid), and it is good for 180 days.
• No watch state is stored: the token is the whole watch. Lose it and you start again.
• Data refreshes every 4 h (KEV), 6 h (OSV) and 24 h (EOL), so a sooner re-check finds nothing new; watch.suggested_recheck_at is the next refresh that matters.
• A start token is at most 32,000 characters and a re-check token at most 48,000; over that the call is 413 too_many_items, not charged: split the stack into two watches.

Datasets

• Software end-of-life dates (/v1/eol/…): endoflife.date, MIT, refreshed every 24 h. Snapshot eol-20261015T194045Z-65faad04, as of 2026-10-15T19:40:45Z, 485 records. Free sample: /v1/try/eol. Paid from $0.003 per call.
• Actively exploited CVEs (CISA KEV) (/v1/kev/…): CISA KEV, CC0-1.0, refreshed every 4 h. Snapshot kev-20261015T204050Z-9a57dbf2, as of 2026-10-15T20:40:50Z, 1746 records. Free sample: /v1/try/kev. Paid from $0.003 per call.
• LLM prices, context windows and deprecation dates (/v1/models/…): LiteLLM + models.dev, MIT, refreshed every 12 h. Snapshot models-20261015T174041Z-ab0f2981, as of 2026-10-15T17:40:41Z, 374 records. Free sample: /v1/try/models. Paid from $0.003 per call.

Data is provided as is, without warranty of any kind. Payments are final. A 200 response is charged per request even if some items are reported unknown; 4xx/5xx are never charged. Every dataset is normalised (modified) from the sources named here, and no source endorses this service.

Machine-readable

• openapi.json: OpenAPI 3.1 with x-payment-info on every paid operation
• pricing.json: paid routes and prices
• /.well-known/x402: paid resources (x402scan and IETF draft shapes)
• /.well-known/api-catalog: RFC 9727 linkset
• MCP server card: the same tools over MCP (Streamable HTTP) at POST https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp
• /v1/keys: Ed25519 public keys (JWK) for verifying answers and snapshots

Docs

• End-of-life pages: is a product end-of-life? One page per product at /docs/eol/ (485 products, all in sitemap.xml)
• Newest KEV CVEs: the 20 newest actively exploited CVEs
• LLM model changes: price and deprecation changes in the last 7 days
• Cheapest LLMs by context size: the 5 cheapest models with at least 32k, 128k, 200k, 1M tokens of context
• MCP setup: copy-paste MCP configs for Claude Code, Cursor and Codex
• Compared with the free sources: what each free source gives and what Stack Facts adds
• Errors: error codes and what to do
• Provenance: sources, refresh schedule and snapshot verification
• Licences: licences and attribution for every source
• Changelog: service changes
• Health: status and freshness of each dataset

Optional

• llms-full.txt: every tool with its input schema, a curl call and an example answer; errors; provenance; licences