EchelonGraph CVE & Exposure

Connect Remote server

claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp

{
  "mcpServers": {
    "echelongraph-mcp": {
      "url": "https://mcp.echelongraph.io/mcp"
    }
  }
}

{
  "servers": {
    "echelongraph-mcp": {
      "type": "http",
      "url": "https://mcp.echelongraph.io/mcp"
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://mcp.echelongraph.io/mcp

Tools 16 found in our last check

• cve_summary

  Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. su…

• search_cves

  Search/list CVEs from EchelonGraph's CVE feed (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, each polled on a schedule). Filter by severity, minimum CVSS, free text, and sort; page with limit and offset. Returns cves, each with cve_id, severity, cvss_v3_score, echelon…

• get_cve

  One CVE's record: description, severity, cvss_v3_score, cvss_v4_score and cvss_v4_severity, echelongraph_score, echelongraph_severity and score_confidence, epss_score and epss_percentile, CISA-KEV status (kev_listed, kev_added_date, kev_due_date, kev_ransomware) and, if KEV-list…

• cve_exposure

  Internet-exposure footprint for one CVE from EchelonGraph's KEV-exposure radar: how many internet-facing services (distinct ip:port, as exposed_hosts; a machine answering on two ports counts twice) the radar has on record running a version that maps to this CVE, with a breakdown…

• exposure_radar

  Aggregate totals from EchelonGraph's internet-exposure radars: kev_exposure, internet-facing services running actively-exploited (CISA-KEV) CVEs, plus the ransomware-linked subset, derived from Shodan data; exposed_databases, unauthenticated data stores and observability UIs, fo…

• kev_recent

  The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each kev row gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev…

• epss_history

  How one CVE's EPSS score (FIRST's exploit-prediction probability, 0 to 1, with its percentile) has changed, as EchelonGraph recorded it: points, oldest first, each with at, epss_score, epss_percentile and score_date (FIRST's score date, null where the record does not hold it); c…

• check_affected

  Whether a product or package at a given version is affected by known CVEs, from the same matcher as echelongraph.io/am-i-affected. The CPE path takes product (an NVD CPE product token, such as nginx) and version, and returns the CVEs whose NVD CPE match criteria include it at th…

• check_sbom

  Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. For container images and Kubernetes pods, the input is an SBOM of each image, or its purls. Pass purls (package URLs, up to 2,000 distinct, 10,000 with repeats) or sbom (a CycloneDX or SPD…

• scan_manifest

  Check a project's lockfile or pinned manifest against EchelonGraph's advisory corpus, one verdict per dependency. Pass files: 1 to 20 of filename and content, up to 5,000,000 characters in all. Read: requirements.txt (== and === pins only), go.mod, package-lock.json and npm-shri…

• cve_intel

  Weakness, exploit code, detection checks, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if…

• cve_remediation

  How one CVE is fixed, as its sources state it, in one answer. Every text is relayed as stated by its source; EchelonGraph has not tested it. An empty list or a remediation_state of none_in_source or not_parsed is not a finding that no fix exists. Returns fix_status (the API's fi…

• get_cwe

  One CWE (weakness class) and the CVEs classified under it. Returns cwe_id, name and description (from the MITRE CWE catalog EchelonGraph embeds, version catalog_version), total (the active CVEs in EchelonGraph's feed that an NVD, GitHub or CVE.org record classifies under it, rej…

• vendor_advisories_for_cve

  The vendor-published advisories that name one CVE, newest first, at most 20: for each, vendor, vendor_advisory_id, title, severity and cvss_v3_score where given. Covers the vendor feeds EchelonGraph polls, for example Microsoft MSRC, Red Hat, Cisco, Palo Alto Networks and GitHub…

• get_vendor_advisory

  One vendor advisory in full, by vendor and advisory ID (the vendor and vendor_advisory_id of a vendor advisory row, never its advisory_id): title, description, severity, cvss_v3_score, cve_ids and known_cve_ids (in EchelonGraph's CVE feed), affected_products, remediation, refere…

• search_vendor_advisories

  Search or list vendor-published advisories, newest first. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, IDs and affected_products (search_match substring). A query of 1 or 2 characters matches who…

Details

More security servers See all

• BlackVeil DNS & Email Security Scanner

  DNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.

• Forwardsmith buyer desk (read-only)

  Read-only desk for buyers and assistants: offer, prices, fit check, readiness scan, intake draft.

• MakeItSay

  Change the words in a screenshot or photo and keep the original font and layout.

• Kestrova Solidity Security Scan

  Free Slither scan of Solidity contracts for AI coding agents; optional paid report (1 USDC, x402).

• Paragon Boxing & BJJ Gear Advisor

  Read-only boxing and BJJ gear guidance, sizing, product comparison, rules and identity checks.

• Spurvik EU AI Act

  Live URL scan, AI Act risk check, 24-EU-language Art. 50 badge, HMAC receipts & approval gates.