echelongraph-mcpCAUTION
MCP server for CVE intelligence: 16 read-only tools for CVE records, CISA KEV, EPSS history, exploits, fix guidance as sources state it, version, SBOM and lockfile checks, vendor advisories, and per-CVE exposure from Shodan data (© Shodan). Free and keyless.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
CVE and internet-exposure data for Claude, Cursor, VS Code, Cline, and any MCP client, straight from EchelonGraph's free public feed.
It exposes EchelonGraph's CVE Pulse (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, fused into one score) plus a per-CVE internet-exposure footprint: how many internet-facing services (distinct ip:port) EchelonGraph's KEV-exposure radar has on record running a version that maps to the CVE. Exposure counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan).
Its 16 tools look up one CVE (record, exploit code and fixed versions, how it is fixed as its sources state it, EPSS history, vendor advisories, exposure footprint), list CISA's newest KEV additions, check whether a product or package version is affected, check an SBOM or a project's lockfiles, and read a CWE and its CVEs. Every result says how it was measured (state, measured_at, method, coverage, freshness, notes), so a model cannot mistake an outage or an unassessed lookup for an all-clear.
It also serves five prompts, ready-made workflows a client can show as slash commands (triage_cve, kev_weekly_brief, am_i_affected, sbom_review, workload_triage; see "Prompts"), and three resources (echelongraph://methodology, echelongraph://sources and cve://{cve_id}; see "Resources").
Free and keyless: no API key, no auth, read-only. The server makes no request other than the API call a tool needs to answer.
- npm: `echelongraph-mcp` · Official MCP
Registry: io.echelongraph/echelongraph-mcp · Docs:
- Source: · Changes:
CHANGELOG.md · Security: SECURITY.md
- Also listed on: [Smithery](https://smithery.ai/servers/echelongraph/echelongra
d13864d5bf96OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add echelongraph-mcp -- npx -y [email protected]
Exposed tools (13)
13 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cve_exposure | read | |
cve_intel | read | |
cve_summary | read | |
dummy_tool | read | d |
exposure_radar | read | |
filler | read | x |
get_cve | read | |
get_cwe | read | |
get_vendor_advisory | read | |
kev_recent | read | |
search_cves | read | |
search_vendor_advisories | read | |
vendor_advisories_for_cve | read |
Trust audit
CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (17)
const env = { PATH: process.env.PATH ?? "", HOME: cwd, ECHELONGRAPH_API_BASE: "http://127.0.0.1:9" };base: `http://127.0.0.1:${server.address().port}`,const TOKEN = "forward-token-for-tests-2316";
import { StdioMcpClient, MODERN } from "../../test/mcp-stdio-client.mjs";for (const bad of ["", "XSS", "CWE-", "CWE-79a", "79/../../cves"]) {["a symlink in node_modules/", (d) => fs.symlinkSync("../../dist/index.js", path.join(d, "node_modules", "zod", "link.js")),for (const cve_id of ["", " ", "exchange server", "CVE-24-1", "CVE-2024-1234/../../x"]) {base: `http://127.0.0.1:${server.address().port}`,const dead = await startForwarder({ upstream: "http://127.0.0.1:1", token: UA_TOKEN });url: `http://127.0.0.1:${port}/mcp`,const HIDDEN = /[----\u0000-\u0008\u000B-\u001F\u007F-\u009F]/u;
const HIDDEN = /[----\u0000-\u0008\u000B-\u001F\u007F-\u009F]/u;
assert.ok(bad("A zerowidth space.").length > 0);@types/node, typescript
django-filter, celery, numpy, https://files.example.invalid/pkg/simplejson-3.19.1.tar.gz, ./vendor/localpkg, flask
No test account exists, and none is needed: the server is keyless and read-only, so there are no credentials to give. Connect https://mcp.echelongraph.io/mcp with no authentication and call each tool,
No test account exists, and none is needed: the server is keyless and read-only, so there are no credentials to give. Connect https://mcp.echelongraph.io/mcp with no authentication and call each tool,
Gates applied: no_behavioural_pass.
d13864d5bf96full audit observations/trust-audit/mcp-server/echelongraph__echelongraph-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | d13864d5bf96 | CAUTION | B | 84 | first audit |
Questions
What is the echelongraph-mcp MCP server?
MCP server for CVE intelligence: 16 read-only tools for CVE records, CISA KEV, EPSS history, exploits, fix guidance as sources state it, version, SBOM and lockfile checks, vendor advisories, and per-CVE exposure from Shodan data (© Shodan). Free and keyless.
What tools does echelongraph-mcp expose?
13 in total: 13 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is echelongraph-mcp safe to connect to an agent?
With care. The audit graded it B (84/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does echelongraph-mcp need?
It reads ECHELONGRAPH_FORWARD_TOKEN and MCP_REQUIRE_FORWARD_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does echelongraph-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as echelongraph-mcp at 2.7.2.
How current is this page?
The grade is for one exact copy of the source (d13864d5bf96), read on 2026-10-11. The repository is watched and re-audited when it changes.