# Stack Facts

> Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.

- name: us.srv.g5joilnmeep4ntz3nwezxt5dmu/stackfacts
- version: 0.5.0
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 72/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/us.srv.g5joilnmeep4ntz3nwezxt5dmu%2Fstackfacts
- tools: https://api.protogrid.dev/v1/servers/us.srv.g5joilnmeep4ntz3nwezxt5dmu%2Fstackfacts/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "stackfacts": {
      "type": "http",
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-9d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 72/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 41 of 41 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 8,074 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 33 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 41, about 8,074 tokens to load them all
- tool set hash: f843811287e5ec0bc4b1e239b3bcfa30
- tools last changed: 2026-10-15T04:41:00.291Z
- badge: [![protogrid quality](https://protogrid.dev/badge/us.srv.g5joilnmeep4ntz3nwezxt5dmu/stackfacts.svg)](https://protogrid.dev/servers/us.srv.g5joilnmeep4ntz3nwezxt5dmu/stackfacts)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-15 `stackfacts_tz_lookup` added
  - Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.
- 2026-10-15 `stackfacts_bcp47_lookup` added
  - Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.
- 2026-10-14 `stackfacts_validate` changed (inputSchema)
- 2026-10-14 `stackfacts_lockfile_diff` changed (description, inputSchema)
  - before: Check npm or PyPI purl lists: version changes judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review or no_go.
  - after: Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.
- 2026-10-14 `stackfacts_cve_search` changed (description)
  - before: Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status, EPSS score, and CVSS v3 where an OSV advisory has one.
  - after: Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.
- 2026-10-14 `stackfacts_cve_prioritize` changed (description)
  - before: Call before patching: rank up to 100 CVEs by CISA KEV status, then FIRST EPSS exploit probability score and percentile.
  - after: Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.
- 2026-10-14 `stackfacts_control_lookup` added
  - Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.
- 2026-10-14 `stackfacts_port_lookup` added
  - Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.
- 2026-10-14 `stackfacts_domain_lookup` added
  - Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.
- 2026-10-14 `stackfacts_capec_lookup` added
  - Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.

Full history: https://api.protogrid.dev/v1/servers/us.srv.g5joilnmeep4ntz3nwezxt5dmu%2Fstackfacts/changes

## Remotes

- https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (41)

- `stackfacts_bcp47_lookup`: Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.
- `stackfacts_capec_lookup`: Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.
- `stackfacts_control_lookup`: Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.
- `stackfacts_cve_lookup`: Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.
- `stackfacts_cve_prioritize`: Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.
- `stackfacts_cve_search`: Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.
- `stackfacts_cwe_lookup`: Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.
- `stackfacts_domain_lookup`: Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.
- `stackfacts_eol_check`: Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.
- `stackfacts_eol_cycle`: Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.
- `stackfacts_eol_image`: Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.
- `stackfacts_eol_product`: List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.
- `stackfacts_eol_snapshot`: Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.
- `stackfacts_index`: List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.
- `stackfacts_kev_changes`: List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.
- `stackfacts_kev_check`: Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.
- `stackfacts_kev_lookup`: Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.
- `stackfacts_kev_snapshot`: Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.
- `stackfacts_keys`: Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.
- `stackfacts_license_check`: Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.
- `stackfacts_lockfile_diff`: Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.
- `stackfacts_manifest`: Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.
- `stackfacts_models_changes`: List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.
- `stackfacts_models_cheapest`: Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.
- `stackfacts_models_estimate`: Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.
- `stackfacts_models_lookup`: Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.
- `stackfacts_models_snapshot`: Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.
- `stackfacts_models_watch`: Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.
- `stackfacts_osv_check`: Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.
- `stackfacts_package_card`: Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.
- `stackfacts_package_preflight`: Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.
- `stackfacts_port_lookup`: Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.
- `stackfacts_preflight`: Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.
- `stackfacts_preview`: Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.
- `stackfacts_stack_check`: Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.
- `stackfacts_stack_watch`: Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.
- `stackfacts_technique_lookup`: Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.
- `stackfacts_try`: Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.
- `stackfacts_tz_lookup`: Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.
- `stackfacts_upgrade_delta`: Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.
- `stackfacts_validate`: Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.