Local MCP capabilities provider for Expo
Nothing to run from here
Stack Facts is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
37
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http stack-facts-mcp https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp
# 2 — ask your agent for something these tools do
# stackfacts_eol_product, stackfacts_eol_cycle, stackfacts_eol_check and 34 more
Stack Facts costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
SRAll 2 servers
srv2 servers
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http stack-facts-mcp https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
37 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| product | string | yes | endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them) |
Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| product | string | yes | endoflife.date product id or alias, e.g. nodejs, python, ubuntu (GET /v1/eol/index lists them) |
| cycle | string | yes | Release cycle, e.g. 3.12, 22 or 24.04 |
Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| items | array | yes | The versions to check, in order |
Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| image | string | yes | Image reference or a whole Dockerfile FROM line (FROM, --platform and AS name are dropped), e.g. node:18-alpine3.19, python:3.12-slim-bookworm, gcr.io/distroless/nodejs20-debian12, FROM --platform=lin |
Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.
No parameter schema on file.
Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cve | string | yes | CVE id, e.g. CVE-2021-44228 |
Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cves | array | yes | CVE ids; duplicates are merged |
List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| since | string | yes | meta.snapshot_id of an earlier kev answer, e.g. kev-20261009T060000Z-1a2b3c4d; kept for 30 snapshots |
Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.
No parameter schema on file.
Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| provider | string | yes | Provider, e.g. openai, anthropic, google (GET /v1/models/index lists them) |
| model | string | yes | Model id at the provider, e.g. gpt-4o |
Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| model | string | yes | provider/model id, e.g. openai/gpt-4o |
| input_tokens | integer | no | Uncached input tokens |
| output_tokens | integer | no | Output tokens |
| cached_tokens | integer | no | Cached input tokens (cache reads) |
Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| min_context | integer | no | Minimum context window in tokens |
| tools | boolean | no | Require tool calling |
| vision | boolean | no | Require image input |
| max_usd_per_mtok | number | no | Max blended USD per million tokens (3:1 input:output) |
| providers | array | no | Only these providers |
| include_deprecated | boolean | no | Keep deprecated models (default false) |
| include_free | boolean | no | Keep models priced 0/0 (default false) |
List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| since | string | yes | meta.snapshot_id of an earlier models answer, e.g. models-20261009T060000Z-1a2b3c4d; kept for 30 snapshots. /v1/models/changes needs ?since=. |
Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| models | array | yes | provider/model ids, e.g. openai/gpt-4o |
| since | string | no | meta.snapshot_id of your last answer; omit on the first call |
| warn_days | integer | no | Alert when deprecation is this many days away or less (default 90) |
Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.
No parameter schema on file.
Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| items | array | no | The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["nodejs@18.19.0" |
| cves | array | no | Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only |
| packages | array | no | Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as |
Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | array | no | Package URLs with versions, in order. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as ecosystem_unavailable until imported) |
| lockfile | string | no | Instead of packages: the text of a package-lock.json, yarn.lock (v1), requirements.txt or poetry.lock; its distinct exact versions are checked (at most 50). The raw lockfile may also be sent as the wh |
| format | string | no | The lockfile's format; detected when left out |
Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package | string | no | Package URL with a version, e.g. pkg:npm/lodash@4.17.20 or pkg:pypi/jinja2@2.11.2. Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are refused until imported). Send this, or ecosystem, |
| ecosystem | string | no | npm, pypi, golang, cargo or maven (with name and version, instead of package) |
| name | string | no | Package name as the registry spells it, e.g. lodash, @babel/traverse, jinja2, org.apache.logging.log4j:log4j-core |
| version | string | no | Exact version, e.g. 4.17.20 |
Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | CVE id, e.g. CVE-2021-44228. Loose ids such as cve 2021 44228 or cve_2021_44228 are accepted. |
Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | CWE id, e.g. CWE-79 or 79 |
Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | Technique id, e.g. T1055.011 or T1055 |
Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | CAPEC id, e.g. CAPEC-66 or 66 |
Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Host name, e.g. shop.example.co.uk (Unicode names work) |
Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ecosystem | string | yes | npm or pypi |
| name | string | yes | Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode) |
| version | string | no | Version to describe (npm: or a dist-tag); default the latest |
Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| items | array | yes | Up to 20 items: an SPDX licence expression (MIT, GPL-2.0-or-later, MIT OR Apache-2.0) or a package with its declared licence; a package with no licence is unknown |
| project_license | string | no | Your project's licence: one SPDX id (Apache-2.0, GPL-3.0-only) or proprietary; default proprietary |
| use | string | no | How you ship it: distribute (default), saas (network use only) or internal |
Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cves | array | yes | Up to 100 CVE ids, e.g. CVE-2021-44228; duplicates are dropped |
Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| q | string | no | Keyword search (send q or package, not both): 1 to 8 words, all must appear in the CISA KEV vendor, product or vulnerability name; also tried as an exact OSV package name |
| package | string | no | Package name (send q or package, not both), matched exactly in the OSV advisories, e.g. lodash |
| ecosystem | string | no | With package only: npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems or Packagist (or the purl type); default all |
| kev | boolean | no | true: only CVEs in CISA KEV; false: only CVEs not in KEV |
| severity | string | no | Only CVEs of this severity or higher (from the OSV advisories; keeps only CVEs with an OSV score or label, so most KEV-only CVEs are left out) |
| limit | integer | no | Most results to return (default 20, at most 50) |
Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ecosystem | string | yes | npm or pypi |
| name | string | yes | Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode) |
| version | string | no | The version to judge: an exact version (e.g. 2.31.0) or an npm dist-tag; default the latest. Unknown version 404 |
| project_license | string | no | Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary |
| use | string | no | How the package is used: distribute (default), saas or internal |
Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ecosystem | string | yes | npm or pypi |
| name | string | yes | Package name, e.g. express, requests; a scoped npm name is URL-encoded in the path (%40types%2Fnode) |
| from | string | yes | The version you run now: an exact version or an npm dist-tag |
| to | string | no | The version you move to; default the latest. An exact version or an npm dist-tag |
| project_license | string | no | Your project licence, one SPDX id (e.g. MIT, Apache-2.0, GPL-3.0-only) or proprietary; default proprietary |
| use | string | no | How the package is used: distribute (default), saas or internal |
Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| from | array | no | Packages before, as purls with a version, e.g. pkg:npm/lodash@4.17.15 or pkg:pypi/requests@2.31.0 (npm and PyPI only); or {purl, integrity} with an SRI hash (sha512-...) from the lockfile |
| to | array | no | Packages after, as purls with a version (or {purl, integrity}); a package in both lists at another version is judged, one in a single list is reported added or removed; the same version with two diffe |
| from_lockfile | string | no | Instead of from: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most; the whole body 2.5 MB). Lists every package version it pins, with its integrity hash when it |
| to_lockfile | string | no | Instead of to: the text of a package-lock.json, yarn.lock, requirements.txt or poetry.lock (1 MB at most). Each side is capped at 5,000 distinct packages (413 too_many_items). Send to or to_lockfile, |
Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| items | array | no | The versions to check, in order: "product@version" strings or {product, version} objects. Needed unless packages is sent. Send each item as one string, product@version, e.g. {"items":["nodejs@18.19.0" |
| cves | array | no | Optional CVE ids to check against CISA KEV; duplicates are merged. Leave out (or send []) to check versions only |
| packages | array | no | Optional package URLs with versions, answered as POST /v1/osv/check answers them (advisories, fixed versions, KEV flag). Types: npm, pypi, golang, cargo, maven (nuget, gem and composer are answered as |
| warn_days | integer | no | Start only: report an item as due soon when its EOL date is this many days away or fewer (default 90, 0 = off). Kept in the token |
| token | string | no | Re-check only: data.watch.token from your last answer. Nothing else with it but full. It holds your stack in readable form; keep it as you would the stack |
| full | boolean | no | Re-check only: also return data.check, the full current stack answer, at the same price (default false) |
Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| dataset | string | yes | Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities), models (LLM prices), package (npm/PyPI package card) or license (licence compatibility) |
Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| dataset | string | yes | Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices) |
List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| dataset | string | yes | eol (product ids and aliases) or models (provider/model ids) |
Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| dataset | string | yes | Dataset: eol (software end-of-life), kev or cve (CISA known exploited CVEs; cve is kev), models (LLM prices), cwe (MITRE CWE) or technique (MITRE ATT&CK) |
| id | string | yes | Id to check: nodejs, nodejs/22, CVE-2021-44228, openai/gpt-4o, CWE-79 or T1059 |
Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| dataset | string | yes | Dataset: eol (software end-of-life), kev (CISA known exploited vulnerabilities) or models (LLM prices) |
Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.
No parameter schema on file.
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Stack Facts or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither. So there is no grade — not a withheld one, an unmeasured one.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 0.5.0.
0.5.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Stack Facts can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.