Stack Facts: paid EOL, CVE and LLM price checks

Paid per call in USDC over x402: check a package for malware, known vulnerabilities, exploited CVEs and end-of-life dates, plus LLM prices. Signed answers, no account or API key.

View on srv.us

Hosted MCP Server

npx add-mcp 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Stack Facts

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.

Free sample: curl -s https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol. CVE/KEV lookup $0.003 per call (GET /v1/kev/{cve}). Paid calls cost $0.002 to $0.05 in USDC over x402 v2 exact on Base: call the route, take the price from the 402 PAYMENT-REQUIRED header, pay and retry with PAYMENT-SIGNATURE. x402 v1 clients can pay the offer in the 402 body instead and retry with X-PAYMENT. MPP (Machine Payments Protocol) clients that support x402 can pay these routes unchanged. No account or API key. Errors are never charged.

Updated 2026-10-14. Version 0.6.0. Base URL: https://g5joilnmeep4ntz3nwezxt5dmu.srv.us

Quick start

# Free: signed samples, same shape as the paid answers
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/kev'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/models/preview'
# Free: check an id before paying
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/validate?dataset=eol&id=nodejs'
# Paid: 402 with the price in the PAYMENT-REQUIRED header (base64 JSON) and the body
curl -si 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/CVE-2021-44228'
curl -si -X POST 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/eol/check' -H 'content-type: application/json' -d '{"items":[{"product":"nodejs","version":"18.19.0"},{"product":"python","version":"3.12.4"}]}'

Examples

  • curl.md: curl: a free call, then a paid route's 402 and its PAYMENT-REQUIRED header decoded
  • fetch-x402.mjs: Node 18+, no dependencies: an x402 client that pays one call (add a viem account as the signer)
  • python_x402.py: Python 3 standard library: the same client (add an EIP-712 signer)

Prices

USD per call, paid in USDC on Base (eip155:8453). Atomic USDC (USD x 1,000,000) is the 402 amount.

MethodRouteToolUSDAtomic USDC
GET/v1/eol/{product}stackfacts_eol_product0.0033000
GET/v1/eol/{product}/{cycle}stackfacts_eol_cycle0.0033000
POST/v1/eol/checkstackfacts_eol_check0.0110000
GET/v1/eol/checkstackfacts_eol_check0.0110000
GET/v1/eol/imagestackfacts_eol_image0.0055000
GET/v1/eol/snapshotstackfacts_eol_snapshot0.0550000
GET/v1/kev/{cve}stackfacts_kev_lookup0.0033000
POST/v1/kev/checkstackfacts_kev_check0.0055000
GET/v1/kev/changesstackfacts_kev_changes0.0110000
GET/v1/kev/snapshotstackfacts_kev_snapshot0.0550000
GET/v1/models/{provider}/{model}stackfacts_models_lookup0.0033000
POST/v1/models/estimatestackfacts_models_estimate0.0033000
POST/v1/models/cheapeststackfacts_models_cheapest0.0088000
POST/v1/models/watchstackfacts_models_watch0.01212000
GET/v1/models/changesstackfacts_models_changes0.0220000
GET/v1/models/snapshotstackfacts_models_snapshot0.0550000
POST/v1/stack/checkstackfacts_stack_check0.01212000
POST/v1/stack/watchstackfacts_stack_watch0.01212000
POST/v1/osv/checkstackfacts_osv_check0.0055000
POST/v1/preflightstackfacts_preflight0.0088000
GET/v1/cve/{id}stackfacts_cve_lookup0.0033000
GET/v1/cwe/{id}stackfacts_cwe_lookup0.0022000
GET/v1/technique/{id}stackfacts_technique_lookup0.0022000
GET/v1/capec/{id}stackfacts_capec_lookup0.0033000
GET/v1/domain/{host}stackfacts_domain_lookup0.0033000
GET/v1/port/{number}stackfacts_port_lookup0.0033000
GET/v1/control/{id}stackfacts_control_lookup0.0033000
GET/v1/bcp47/{tag}stackfacts_bcp47_lookup0.0033000
GET/v1/package/{ecosystem}/{name}stackfacts_package_card0.0033000
POST/v1/license/checkstackfacts_license_check0.0033000
POST/v1/cve/prioritizestackfacts_cve_prioritize0.0110000
GET/v1/cve/searchstackfacts_cve_search0.0055000
GET/v1/preflight/{ecosystem}/{name}stackfacts_package_preflight0.0055000
GET/v1/upgrade/{ecosystem}/{name}stackfacts_upgrade_delta0.0055000
POST/v1/lockfile/diffstackfacts_lockfile_diff0.0220000

Paid tools

  • stackfacts_eol_product: GET /v1/eol/{product}, $0.003. List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version. Keywords: EOL; end-of-life dates; support status; is still supported; release cycles; LTS; endoflife.date.
  • stackfacts_eol_cycle: GET /v1/eol/{product}/{cycle}, $0.003. Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch. Keywords: is still supported; EOL; end-of-life date; support status; support until; latest patch version; LTS.
  • stackfacts_eol_check: POST /v1/eol/check or GET /v1/eol/check, $0.01. Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions. Keywords: check my stack for end-of-life versions; is still supported; EOL; support status; dependency EOL audit; batch end-of-life check.
  • stackfacts_eol_image: GET /v1/eol/image, $0.005. Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status. Keywords: is my docker image end-of-life; container base image EOL; is still supported; Dockerfile FROM audit; EOL; support status; base OS end-of-life.
  • stackfacts_eol_snapshot: GET /v1/eol/snapshot, $0.05. Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest. Keywords: EOL; end-of-life dataset download; support status; is still supported; endoflife.date bulk; signed snapshot.
  • stackfacts_kev_lookup: GET /v1/kev/{cve}, $0.003. Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use. Keywords: check if a CVE is actively exploited (CISA KEV); known exploited vulnerability; CISA KEV lookup; CVE exploited in the wild.
  • stackfacts_kev_check: POST /v1/kev/check, $0.005. Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one. Keywords: check if a CVE is actively exploited (CISA KEV); batch CVE check; vulnerability scan triage; known exploited vulnerabilities.
  • stackfacts_kev_changes: GET /v1/kev/changes, $0.01. List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities. Keywords: new CISA KEV entries; newly exploited vulnerabilities; KEV change feed; check if a CVE is actively exploited (CISA KEV).
  • stackfacts_kev_snapshot: GET /v1/kev/snapshot, $0.05. Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature. Keywords: CISA KEV download; known exploited vulnerabilities catalog; signed snapshot.
  • stackfacts_models_lookup: GET /v1/models/{provider}/{model}, $0.003. Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date. Keywords: price per million tokens; context window; model deprecation date; LLM pricing; max output tokens.
  • stackfacts_models_estimate: POST /v1/models/estimate, $0.003. Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used. Keywords: LLM cost estimate; price per million tokens; token cost calculator; how much will this prompt cost.
  • stackfacts_models_cheapest: POST /v1/models/cheapest, $0.008. Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens. Keywords: cheapest model with tools and 128k context; cheapest LLM; price per million tokens; context window; model comparison.
  • stackfacts_models_changes: GET /v1/models/changes, $0.02. List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id. Keywords: LLM price changes; model deprecation date; new LLM models; price per million tokens.
  • stackfacts_models_watch: POST /v1/models/watch, $0.012. Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates. Keywords: watch LLM prices and deprecations; Use when the models you call may change price or be deprecated; model deprecation alert; LLM price change monitor; what changed for my models since my last check.
  • stackfacts_models_snapshot: GET /v1/models/snapshot, $0.05. Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest. Keywords: LLM pricing dataset; price per million tokens; context window; signed snapshot.
  • stackfacts_stack_check: POST /v1/stack/check, $0.012. Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns. Keywords: check my stack for end-of-life versions and exploited CVEs; stack audit; EOL, package vulnerabilities and KEV in one call; is still supported; dependency risk check; known exploited vulnerabilities.
  • stackfacts_osv_check: POST /v1/osv/check, $0.005. Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV. Keywords: check my dependencies for known vulnerabilities; is vulnerable; OSV; purl; npm PyPI Go crates.io Maven advisories; GHSA; fixed version; known exploited vulnerabilities; malicious package check; lockfile scan; package-lock.json yarn.lock requirements.txt poetry.lock.
  • stackfacts_preflight: POST /v1/preflight, $0.008. Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons. Keywords: call before installing a package an LLM suggested; npm install check; pip install check; package preflight; malicious package check; known exploited vulnerabilities; OSV; purl.
  • stackfacts_cve_lookup: GET /v1/cve/{id}, $0.003. Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions. Keywords: get a CVE; CVE lookup; CVE details; CVE fixed version; CVE affected packages; CVSS score; OSV; CISA KEV; CVE priority.
  • stackfacts_cwe_lookup: GET /v1/cwe/{id}, $0.002. Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer. Keywords: CWE lookup; CWE weakness; common weakness enumeration; CWE name; CWE description; MITRE CWE.
  • stackfacts_technique_lookup: GET /v1/technique/{id}, $0.002. Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited. Keywords: technique lookup; adversary technique; attack technique id; technique tactics; technique platforms; MITRE technique.
  • stackfacts_capec_lookup: GET /v1/capec/{id}, $0.003. Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link. Keywords: CAPEC lookup; CAPEC attack pattern; common attack pattern enumeration; attack pattern mitigations; CAPEC description; MITRE CAPEC.
  • stackfacts_domain_lookup: GET /v1/domain/{host}, $0.003. Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section. Keywords: public suffix; registrable domain; eTLD+1; domain split; subdomain parser; Public Suffix List; effective TLD.
  • stackfacts_port_lookup: GET /v1/port/{number}, $0.003. Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry. Keywords: port number; IANA; service name; well-known ports; port lookup; TCP port; UDP port; service names and port numbers.
  • stackfacts_control_lookup: GET /v1/control/{id}, $0.003. Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status. Keywords: NIST SP 800-53; security controls; control catalogue; compliance; OSCAL; control enhancement; FedRAMP; access control.
  • stackfacts_bcp47_lookup: GET /v1/bcp47/{tag}, $0.003. Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry. Keywords: BCP 47; language tag; locale; IANA language subtag registry; RFC 5646; ISO 639; script subtag; region subtag.
  • stackfacts_package_card: GET /v1/package/{ecosystem}/{name}, $0.003. Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range. Keywords: package metadata; latest version; npm package; PyPI package; package licence; SPDX licence; deprecated package; yanked release.
  • stackfacts_license_check: POST /v1/license/check, $0.003. Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item. Keywords: licence compatibility; license compatibility; SPDX licence check; GPL compatible; copyleft licence; dependency licence; open source licence policy; AGPL SaaS.
  • stackfacts_cve_prioritize: POST /v1/cve/prioritize, $0.01. Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score. Keywords: CVE prioritization; exploit prediction; KEV; vulnerability triage; patch priority; CVE ranking; known exploited.
  • stackfacts_cve_search: GET /v1/cve/search, $0.005. Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one. Keywords: CVE search; search vulnerabilities by keyword; CVEs for a package; KEV; known exploited; vulnerability lookup by product; OSV advisories.
  • stackfacts_package_preflight: GET /v1/preflight/{ecosystem}/{name}, $0.005. Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block. Keywords: call before npm install; call before pip install; package preflight; is this package safe; latest version; package licence; deprecated package; known exploited vulnerabilities.
  • stackfacts_upgrade_delta: GET /v1/upgrade/{ecosystem}/{name}, $0.005. Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go. Keywords: is this upgrade safe; npm upgrade check; pip upgrade check; upgrade package version; version bump risk; vulnerabilities fixed by upgrade; breaking upgrade; dependency upgrade decision.
  • stackfacts_lockfile_diff: POST /v1/lockfile/diff, $0.02. Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go. Keywords: lockfile diff; compare lockfiles; dependency diff; package.json diff; requirements diff; dependency update risk; pull request dependency check; dependabot review.
  • stackfacts_stack_watch: POST /v1/stack/watch, $0.012. Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token. Keywords: watch my stack for end-of-life and new exploited CVEs; Use when you need to know what changed in a stack since your last check; stack monitor; dependency monitor; what changed since my last check; alert when a version reaches end of life; new vulnerabilities in my packages.

GET /v1/cve/{id} still answers (and is charged) when one source is stale or missing: a stale OSV ecosystem's advisories are left out and listed in meta.datasets.osv.stale_ecosystems (one that failed its load check: unavailable_ecosystems); a stale or missing KEV snapshot gives in_kev: null (not checked). Each left-out source is named in meta.warnings ({code, dataset, message}). A CVE found in no source answers 404 unknown_id only when every source is fresh; while any source is stale or missing the miss answers 503 stale_data with Retry-After (retry later), since the CVE may be in the part left out. 503s and 404s are never charged.

Free tools

  • stackfacts_preview: GET /v1/{dataset}/preview, free. Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict. Keywords: free sample; end-of-life dates; CISA KEV; price per million tokens.
  • stackfacts_try: GET /v1/try/{dataset}, free. Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices. Keywords: free example; try before paying; check if a CVE is actively exploited (CISA KEV).
  • stackfacts_index: GET /v1/{dataset}/index, free. List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses. Keywords: product list; model list; valid ids; aliases.
  • stackfacts_validate: GET /v1/validate, free. Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored. Keywords: validate id; check before paying; product exists.
  • stackfacts_manifest: GET /v1/{dataset}/manifest, free. Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature. Keywords: signed manifest; snapshot_id; data freshness; provenance.
  • stackfacts_keys: GET /v1/keys, free. Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest. Keywords: public key; verify signature; JWKS; Ed25519.

Free: /v1/sample lists a static example answer for every paid route, with its key and price. Examples: /v1/sample/eol-product, /v1/sample/kev-cve, /v1/sample/models-cheapest. No payment, no account.

Free: /v1/models/{name} resolves a bare model id or alias to its full id (resolved_id), and a provider name (e.g. openai) to its model ids. Unknown names are not charged.

Free routes: no key, no stated limit.

Connect over MCP: claude mcp add --transport http stackfacts https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp

Stack watch

POST /v1/stack/watch ($0.012 a call, start or re-check) answers what changed in a stack since your last call. Start with a stack, as for POST /v1/stack/check: the answer holds the full check and a signed token, data.watch.token. Later send {"token": "<watch.token>"}: the answer lists each change since then (an end-of-life date passed or near, a CVE newly in CISA KEV, a new OSV advisory) with worst (high, medium, low or null for no change) and a new token for the next call.

  • The token holds your stack in readable form; keep it as you would the stack. It is signed, so a changed token is refused (token_invalid), and it is good for 180 days.
  • No watch state is stored: the token is the whole watch. Lose it and you start again.
  • Data refreshes every 4 h (KEV), 6 h (OSV) and 24 h (EOL), so a sooner re-check finds nothing new; watch.suggested_recheck_at is the next refresh that matters.
  • A start token is at most 32,000 characters and a re-check token at most 48,000; over that the call is 413 too_many_items, not charged: split the stack into two watches.

Datasets

  • Software end-of-life dates (/v1/eol/…): endoflife.date, MIT, refreshed every 24 h. Snapshot eol-20261014T185236Z-5f9c2e55, as of 2026-10-14T18:52:36Z, 484 records. Free sample: /v1/try/eol. Paid from $0.003 per call.
  • Actively exploited CVEs (CISA KEV) (/v1/kev/…): CISA KEV, CC0-1.0, refreshed every 4 h. Snapshot kev-20261014T195239Z-c22faae8, as of 2026-10-14T19:52:39Z, 1745 records. Free sample: /v1/try/kev. Paid from $0.003 per call.
  • LLM prices, context windows and deprecation dates (/v1/models/…): LiteLLM + models.dev, MIT, refreshed every 12 h. Snapshot models-20261014T171146Z-f2c233bb, as of 2026-10-14T17:11:46Z, 374 records. Free sample: /v1/try/models. Paid from $0.003 per call.

Data is provided as is, without warranty of any kind. Payments are final. A 200 response is charged per request even if some items are reported unknown; 4xx/5xx are never charged. Every dataset is normalised (modified) from the sources named here, and no source endorses this service.

Machine-readable

Docs

Optional

  • llms-full.txt: every tool with its input schema, a curl call and an example answer; errors; provenance; licences