# Stack Facts (remote · g5joilnmeep4ntz3nwezxt5dmu.srv.us)

Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.

- Trust score: 76/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- remote · `g5joilnmeep4ntz3nwezxt5dmu.srv.us`: 76/100 (this document), [markdown](https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu.md), [page](https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu)

## Channel facts

- Endpoint: `https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.5.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Endpoint Security**: 74/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 73/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4773 tokens (~116/item across 41 items; 41 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 41 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Stack Facts MCP server?

Stack Facts is a hosted endpoint at https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts": {
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts": {
      "type": "http",
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts]
url = "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts": {
      "type": "remote",
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts --url 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts:
    url: "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts": {
      "Transport": "http",
      "Url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts -t streamable-http -u 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp'
```

### Other

```json
{
  "mcpServers": {
    "us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts": {
      "type": "http",
      "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-18 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-16 (score 73, +1)

- [functional] New tool “stackfacts_tz_lookup”

### 2026-10-15 (score 72, 0)

- [security] Tool “stackfacts_cve_lookup” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_cve_prioritize” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_cve_search” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_eol_check” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_lockfile_diff” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_stack_check” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_validate” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 3930 → 4689
- [functional] New tool “stackfacts_bcp47_lookup”
- [functional] New tool “stackfacts_capec_lookup”
- [functional] New tool “stackfacts_control_lookup”
- [functional] New tool “stackfacts_cwe_lookup”
- [functional] New tool “stackfacts_domain_lookup”
- [functional] New tool “stackfacts_port_lookup”
- [functional] New tool “stackfacts_technique_lookup”
- [cosmetic] “stackfacts_lockfile_diff” added an optional parameter “from_lockfile”
- [cosmetic] “stackfacts_lockfile_diff” added an optional parameter “to_lockfile”
- [cosmetic] “stackfacts_cve_lookup” reworded the description of “id”
- [cosmetic] “stackfacts_models_changes” reworded the description of “since”
- [cosmetic] “stackfacts_stack_check” reworded the description of “items”
- [cosmetic] “stackfacts_stack_watch” reworded the description of “items”
- [cosmetic] “stackfacts_validate” reworded the description of “dataset”
- [cosmetic] “stackfacts_validate” reworded the description of “id”
- [cosmetic] “stackfacts_lockfile_diff” made “from” optional
- [cosmetic] “stackfacts_lockfile_diff” made “to” optional

### 2026-10-14 (score 72, +1)

- [security] Tool “stackfacts_package_preflight” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_validate” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 3385 → 3930
- [functional] New tool “stackfacts_lockfile_diff”
- [functional] New tool “stackfacts_models_watch”
- [functional] New tool “stackfacts_upgrade_delta”
- [cosmetic] “stackfacts_package_preflight” added an optional parameter “version”

### 2026-10-13 (score 71, 0)

- [security] Tool “stackfacts_cve_lookup” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_osv_check” rewrote its description, which is the text the model reads
- [security] Tool “stackfacts_preview” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: pass → fail
- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 0.5.0 → 0.6.0
- [functional] New tool “stackfacts_cve_prioritize”
- [functional] New tool “stackfacts_cve_search”
- [functional] New tool “stackfacts_license_check”
- [functional] New tool “stackfacts_package_preflight”
- [cosmetic] “stackfacts_osv_check” added an optional parameter “format”
- [cosmetic] “stackfacts_osv_check” added an optional parameter “lockfile”
- [cosmetic] “stackfacts_preview” reworded the description of “dataset”
- [cosmetic] “stackfacts_osv_check” made “packages” optional

### 2026-10-12 (score 71)

First indexed and scored.

## MCP tools (41)

### `stackfacts_eol_product` (~86 tokens)

List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.

Input parameters:

- `product` (string, required): endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)

### `stackfacts_eol_cycle` (~111 tokens)

Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.

Input parameters:

- `cycle` (string, required): Release cycle, e.g. 3.12, 22 or 24.04
- `product` (string, required): endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them)

### `stackfacts_eol_check` (~62 tokens)

Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.

Input parameters:

- `items` (array, required): The versions to check, in order

### `stackfacts_eol_image` (~122 tokens)

Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.

Input parameters:

- `image` (string, required): Image reference or a whole Dockerfile FROM line (FROM, --platform and AS name are dropped), e.g. node:18-alpine3.19, python:3.12-slim-bookworm, gcr.io/distroless/nodejs20-debian12, FROM --platform=li…

### `stackfacts_eol_snapshot` (~47 tokens)

Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.

### `stackfacts_kev_lookup` (~66 tokens)

Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.

Input parameters:

- `cve` (string, required): CVE id, e.g. CVE-2021-44228

### `stackfacts_kev_check` (~58 tokens)

Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.

Input parameters:

- `cves` (array, required): CVE ids; duplicates are merged

### `stackfacts_kev_changes` (~84 tokens)

List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.

Input parameters:

- `since` (string, required): meta.snapshot_id of an earlier kev answer, e.g. kev-20261009T060000Z-1a2b3c4d; kept for 30 snapshots

### `stackfacts_kev_snapshot` (~37 tokens)

Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.

### `stackfacts_models_lookup` (~89 tokens)

Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.

Input parameters:

- `model` (string, required): Model id at the provider, e.g. gpt-4o
- `provider` (string, required): Provider, e.g. openai, anthropic, google (GET /v1/models/index lists them)

### `stackfacts_models_estimate` (~98 tokens)

Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.

Input parameters:

- `cached_tokens` (integer): Cached input tokens (cache reads)
- `input_tokens` (integer): Uncached input tokens
- `model` (string, required): provider/model id, e.g. openai/gpt-4o
- `output_tokens` (integer): Output tokens

### `stackfacts_models_cheapest` (~145 tokens)

Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.

Input parameters:

- `include_deprecated` (boolean): Keep deprecated models (default false)
- `include_free` (boolean): Keep models priced 0/0 (default false)
- `max_usd_per_mtok` (number): Max blended USD per million tokens (3:1 input:output)
- `min_context` (integer): Minimum context window in tokens
- `providers` (array): Only these providers
- `tools` (boolean): Require tool calling
- `vision` (boolean): Require image input

### `stackfacts_models_changes` (~92 tokens)

List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.

Input parameters:

- `since` (string, required): meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots. /v1/models/changes needs ?since=.

### `stackfacts_models_watch` (~107 tokens)

Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.

Input parameters:

- `models` (array, required): provider/model ids, e.g. openai/gpt-4o
- `since` (string): meta.snapshot_id of your last answer; omit on the first call
- `warn_days` (integer): Alert when deprecation is this many days away or less (default 90)

### `stackfacts_models_snapshot` (~40 tokens)

Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.

### `stackfacts_stack_check` (~213 tokens)

Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.

Input parameters:

- `cves` (array): Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only
- `items` (array): The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["nodejs@18.19.0…
- `packages` (array): Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered a…

### `stackfacts_osv_check` (~166 tokens)

Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.

Input parameters:

- `format` (string): The lockfile's format; detected when left out
- `lockfile` (string): Instead of packages: the text of a package-lock.json, yarn.lock (v1), requirements.txt or poetry.lock; its distinct exact versions are checked (at most 50). The raw lockfile may also be sent as the w…
- `packages` (array): Package URLs with versions, in order. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported)

### `stackfacts_preflight` (~218 tokens)

Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.

Input parameters:

- `ecosystem` (string): npm, pypi, golang, cargo or maven (with name and version, instead of package)
- `name` (string): Package name as the registry spells it, e.g. lodash, @babel/traverse, jinja2, org.apache.logging.log4j:log4j-core
- `package` (string): Package URL with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:pypi/jinja2@2.11.2. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are refused until imported). Send this, or ecosystem…
- `version` (string): Exact version, e.g. 4.17.20

### `stackfacts_cve_lookup` (~92 tokens)

Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.

Input parameters:

- `id` (string, required): CVE id, e.g. CVE-2021-44228. Loose ids such as cve 2021 44228 or cve_2021_44228 are accepted.

### `stackfacts_cwe_lookup` (~72 tokens)

Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.

Input parameters:

- `id` (string, required): CWE id, e.g. CWE-79 or 79

### `stackfacts_technique_lookup` (~76 tokens)

Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.

Input parameters:

- `id` (string, required): Technique id, e.g. T1055.011 or T1055

### `stackfacts_capec_lookup` (~64 tokens)

Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.

Input parameters:

- `id` (string, required): CAPEC id, e.g. CAPEC-66 or 66

### `stackfacts_domain_lookup` (~61 tokens)

Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.

Input parameters:

- `host` (string, required): Host name, e.g. shop.example.co.uk (Unicode names work)

### `stackfacts_port_lookup` (~61 tokens)

Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.

Input parameters:

- `number` (string, required): Port number from 0 to 65535, e.g. 443

### `stackfacts_control_lookup` (~79 tokens)

Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.

Input parameters:

- `id` (string, required): Control id like AC-2 or enhancement AC-2(1) (ac-2.1 also works)

### `stackfacts_bcp47_lookup` (~75 tokens)

Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.

Input parameters:

- `tag` (string, required): IANA language tag like en, en-AU or zh-Hant (case does not matter)

### `stackfacts_tz_lookup` (~84 tokens)

Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.

Input parameters:

- `zone` (string, required): IANA time zone like Europe/Berlin, UTC or an alias such as US/Pacific (case does not matter; a path needs the slash sent as %2F)

### `stackfacts_package_card` (~105 tokens)

Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.

Input parameters:

- `ecosystem` (string, required): npm or pypi
- `name` (string, required): Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
- `version` (string): Version to describe (npm: or a dist-tag); default the latest

### `stackfacts_license_check` (~146 tokens)

Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.

Input parameters:

- `items` (array, required): Up to 20 items: an SPDX licence expression (MIT, GPL-2.0-or-later, MIT OR Apache-2.0) or a package with its declared licence; a package with no licence is unknown
- `project_license` (string): Your project's licence: one SPDX id (Apache-2.0, GPL-3.0-only) or proprietary; default proprietary
- `use` (string): How you ship it: distribute (default), saas (network use only) or internal

### `stackfacts_cve_prioritize` (~68 tokens)

Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.

Input parameters:

- `cves` (array, required): Up to 100 CVE ids, e.g. CVE-2021-44228; duplicates are dropped

### `stackfacts_cve_search` (~266 tokens)

Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.

Input parameters:

- `ecosystem` (string): With package only: npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems or Packagist (or the purl type); default all
- `kev` (boolean): true: only CVEs in CISA KEV; false: only CVEs not in KEV
- `limit` (integer): Most results to return (default 20, at most 50)
- `package` (string): Package name (send q or package, not both), matched exactly in the OSV advisories, e.g. lodash
- `q` (string): Keyword search (send q or package, not both): 1 to 8 words, all must appear in the CISA KEV vendor, product or vulnerability name; also tried as an exact OSV package name
- `severity` (string): Only CVEs of this severity or higher (from the OSV advisories; keeps only CVEs with an OSV score or label, so most KEV-only CVEs are left out)

### `stackfacts_package_preflight` (~199 tokens)

Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.

Input parameters:

- `ecosystem` (string, required): npm or pypi
- `name` (string, required): Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
- `project_license` (string): Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary
- `use` (string): How the package is used: distribute (default), saas or internal
- `version` (string): The version to judge: an exact version (e.g. 2.31.0) or an npm dist-tag; default the latest. Unknown version 404

### `stackfacts_upgrade_delta` (~198 tokens)

Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.

Input parameters:

- `ecosystem` (string, required): npm or pypi
- `from` (string, required): The version you run now: an exact version or an npm dist-tag
- `name` (string, required): Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode)
- `project_license` (string): Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary
- `to` (string): The version you move to; default the latest. An exact version or an npm dist-tag
- `use` (string): How the package is used: distribute (default), saas or internal

### `stackfacts_lockfile_diff` (~336 tokens)

Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.

Input parameters:

- `from` (array): Packages before, as purls with a version, e.g. pkg:npm/lodash@4.17.15 or pkg:pypi/requests@2.31.0 (npm and PyPI only); or {purl, integrity} with an SRI hash (sha512-...) from the lockfile
- `from_lockfile` (string): Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when i…
- `to` (array): Packages after, as purls with a version (or {purl, integrity}); a package in both lists at another version is judged, one in a single list is reported added or removed; the same version with two diff…
- `to_lockfile` (string): Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Each side is capped at 5,000 distinct packages (413 too_many_items). Send to or to_lockfile,…

### `stackfacts_stack_watch` (~323 tokens)

Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.

Input parameters:

- `cves` (array): Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only
- `full` (boolean): Re-check only: also return data.check, the full current stack answer, at the same price (default false)
- `items` (array): The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["nodejs@18.19.0…
- `packages` (array): Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered a…
- `token` (string): Re-check only: data.watch.token from your last answer. Nothing else with it but full. It holds your stack in readable form; keep it as you would the stack
- `warn_days` (integer): Start only: report an item as due soon when its EOL date is this many days away or fewer (default 90, 0 = off). Kept in the token

### `stackfacts_preview` (~86 tokens)

Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.

Input parameters:

- `dataset` (string, required): Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities), models (LLM prices), package (npm/PyPI package card) or license (licence compatibility)

### `stackfacts_try` (~82 tokens)

Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.

Input parameters:

- `dataset` (string, required): Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)

### `stackfacts_index` (~59 tokens)

List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.

Input parameters:

- `dataset` (string, required): eol (product ids and aliases) or models (provider/model ids)

### `stackfacts_validate` (~161 tokens)

Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.

Input parameters:

- `dataset` (string, required): Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE), technique (MITRE ATT&CK) or capec (MITRE CAPEC)
- `id` (string, required): Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79, T1059 or CAPEC-66

### `stackfacts_manifest` (~68 tokens)

Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.

Input parameters:

- `dataset` (string, required): Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices)

### `stackfacts_keys` (~31 tokens)

Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu#diagnostics

## Score history

- 2026-10-23: 76
- 2026-10-22: 75
- 2026-10-21: 75
- 2026-10-20: 75
- 2026-10-19: 74
- 2026-10-18: 74
- 2026-10-17: 73
- 2026-10-16: 73
- 2026-10-15: 72
- 2026-10-14: 72
- 2026-10-13: 71
- 2026-10-12: 71

## Common questions

### What is the Stack Facts MCP server?

Stack Facts is an MCP server listed in the public MCP registry as us.srv.g5joilnmeep4ntz3nwezxt5dmu/stackfacts. Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap. This page covers its hosted endpoint (https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp).

### Is the Stack Facts MCP server safe to use?

Stack Facts scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Stack Facts MCP server expose?

Stack Facts exposes 41 tools: stackfacts_eol_product, stackfacts_eol_cycle, stackfacts_eol_check, stackfacts_eol_image, stackfacts_eol_snapshot, and 36 more. Their descriptions and schemas cost roughly 4,633 tokens of context every time the server is loaded.

### Does the Stack Facts MCP server require authentication?

No. We connected to Stack Facts without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Stack Facts MCP server still maintained?

Stack Facts is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp
- Website: https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/docs/mcp
- Changelog RSS feed: https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu.xml
- Changelog JSON feed: https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu.json
- HTML version of this page: https://verifymcp.io/servers/us-srv-g5joilnmeep4ntz3nwezxt5dmu-stackfacts/g5joilnmeep4ntz3nwezxt5dmu