MCP server

EchelonGraph CVE & Exposure Official

io.echelongraph/echelongraph-mcp

Checked 28 Oct 2026, 09:03 UTC · Connected to it and listed its tools

CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.

Website Source

At a glance

Type

MCP server

Publisher

echelongraph.io (verified by the MCP Registry)

Status

Working at last check

Tools

16

Token cost

About 13,986 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

28 Oct 2026, 09:03 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.echelongraph-mcp]
url = "https://mcp.echelongraph.io/mcp"

Gemini CLI

{"mcpServers":{"echelongraph-mcp":{"httpUrl":"https://mcp.echelongraph.io/mcp"}}}

Cursor

{"mcpServers":{"echelongraph-mcp":{"url":"https://mcp.echelongraph.io/mcp"}}}

VS Code

{"servers":{"echelongraph-mcp":{"type":"http","url":"https://mcp.echelongraph.io/mcp"}}}

Antigravity

agy mcp add echelongraph-mcp https://mcp.echelongraph.io/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"echelongraph-mcp","server_url":"https://mcp.echelongraph.io/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"echelongraph-mcp","server_url":"https://mcp.echelongraph.io/mcp"}

Tools

• check_affected ~926 tokens
  Whether a product or package at a given version is affected by known CVEs, from the same matcher as echelongraph.io/am-i-affected. The CPE path takes product (an NVD CPE product token, such as nginx) and version, and returns the CVEs whose NVD CPE match criteria include that product at that version;
• check_sbom ~969 tokens
  Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. For container images and Kubernetes pods, the input is an SBOM of each image, or its purls. Pass purls (package URLs, up to 2,000 distinct, 10,000 with repeats) or sbom (a CycloneDX or SPDX JSON document, up t
• cve_exposure ~799 tokens
  Internet-exposure footprint for one CVE from EchelonGraph's KEV-exposure radar: how many internet-facing services (distinct ip:port, returned as exposed_hosts; a machine answering on two ports counts twice) the radar has on record running a version its CVE matcher maps to this CVE, with a country/pr
• cve_intel ~804 tokens
  Weakness, exploit code, detection checks, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if none), eg_first_seen
• cve_remediation ~957 tokens
  How one CVE is fixed, as its sources state it, in one answer. Every text is relayed as stated by its source; EchelonGraph has not tested it. An empty list or a remediation_state of none_in_source or not_parsed is not a finding that no fix exists. Returns fix_status (the API's fix-status rule, as CVE
• cve_summary ~774 tokens
  Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. summary.none is not a s
• epss_history ~799 tokens
  How one CVE's EPSS score (FIRST's exploit-prediction probability, 0 to 1, with its percentile) has changed, as EchelonGraph recorded it: points, oldest first, each with at, epss_score, epss_percentile and score_date (FIRST's score date, null where the record does not hold it); current, the record's
• exposure_radar ~757 tokens
  Aggregate totals from EchelonGraph's internet-exposure radars: kev_exposure, internet-facing services running actively-exploited (CISA-KEV) CVEs, plus the ransomware-linked subset, derived from Shodan data; exposed_databases, unauthenticated data stores and observability UIs, found through Shodan (L
• get_cve ~849 tokens
  One CVE's record: description, severity, cvss_v3_score, cvss_v4_score and cvss_v4_severity, echelongraph_score, echelongraph_severity and score_confidence, epss_score and epss_percentile, CISA-KEV status (kev_listed, kev_added_date, kev_due_date, kev_ransomware) and, if KEV-listed, CISA's own text r
• get_cwe ~764 tokens
  One CWE (weakness class) and the CVEs classified under it. Returns cwe_id, name and description (from the MITRE CWE catalog EchelonGraph embeds, version catalog_version), total (the active CVEs in EchelonGraph's feed that an NVD, GitHub or CVE.org record classifies under it, rejected and reserved re
• get_vendor_advisory ~864 tokens
  One vendor advisory in full, by vendor and the vendor's advisory ID (the vendor and vendor_advisory_id of a vendor advisory row, never its advisory_id, EchelonGraph's internal UUID): title, description, severity, cvss_v3_score, cve_ids and known_cve_ids (those with a record in EchelonGraph's CVE fee
• kev_recent ~1014 tokens
  The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each kev row gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ra
• scan_manifest ~1016 tokens
  Check a project's lockfile or pinned manifest against EchelonGraph's advisory corpus, one verdict per dependency. Pass files: 1 to 20 of filename and content, up to 5,000,000 characters in all; the filename or format gives the format. Read: requirements.txt (== and === pins only), go.mod (require, a
• search_cves ~919 tokens
  Search/list CVEs from EchelonGraph's CVE feed (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, each polled on a schedule). Filter by severity, minimum CVSS, free text, and sort; page with limit and offset. Returns cves, each with cve_id, severity, cvss_v3_score, echelongraph_score and score
• search_vendor_advisories ~965 tokens
  Search or list vendor-published advisories, newest first. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, IDs and affected_products (search_match substring). A query of 1 or 2 characters matches whole words only (search
• vendor_advisories_for_cve ~810 tokens
  The vendor-published advisories that name one CVE, newest first, at most 20: for each, vendor, vendor_display_name, vendor_advisory_id, title, severity and cvss_v3_score where the vendor gives them. Covers the vendor feeds EchelonGraph polls, for example Microsoft MSRC, Red Hat, Cisco, Palo Alto Net

Browse

• GitHub tools
• Microsoft tools
• Email marketing
• Company data
• GitHub and code hosting
• Docker and Kubernetes

Related MCP servers

• ContrastAPI
  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
• Cognita
  Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
• Gapup
  271 agent-payable tools: competitive intel, finance, KYC, compliance, ESG. x402 per-call.
• Code402
  Discover machine-payable APIs, probe x402 payment terms, and run seller operations. Non-custodial.
• DataNexus MCP
  Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.
• Shodan Internetdb
  Shodan InternetDB MCP — wraps Shodan InternetDB (internetdb.shodan.io)
• VAREXIS-INDEX - Source-linked evidence
  MCP permissions and audit evidence: free read-only discovery and previews. No advice or authority.
• CVE Risk Check
  Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.echelongraph/echelongraph-mcp.svg)](https://aptlynx.net/servers/io.echelongraph/echelongraph-mcp)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents