EchelonGraph CVE & Exposure MCP server
online · 100% uptimeCVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
not scanned yet
0 stars2.2k downloads/wk
Reviews
Write oneNobody has reviewed EchelonGraph CVE & Exposure yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
EchelonGraph CVE & Exposure tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Install EchelonGraph CVE & Exposure in Claude Code, Cursor or VS Code
claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp
What the publisher says
From the EchelonGraph CVE & Exposure repository's README, as published. We do not edit it. Read it on GitHub
EchelonGraph MCP server
CVE and internet-exposure data for Claude, Cursor, Cline, and any MCP client, straight from EchelonGraph's free public feed.
It exposes EchelonGraph's CVE Pulse (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, fused into one score) plus a per-CVE internet-exposure footprint: how many internet-facing services (distinct ip:port) EchelonGraph's KEV-exposure radar has on record running a version that maps to the CVE. Exposure counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan).
Free and keyless: no API key, no auth, read-only. The server makes no request other than the API call a tool needs to answer.
Tools
Every figure is as fresh as the schedule that refreshes it. The CVE feed is polled from its sources on a schedule; each radar refreshes on its own.
How cve_summary reads its counts
summary.critical, summary.high, summary.medium and summary.low count the active CVEs by severity band, and summary.total counts them all. summary.none counts the active CVEs with no severity band from any source: CVEs not yet scored, not CVEs rated None. The answer sends the same count again as summary.unscored.
summary.nvdcritical, summary.nvdhigh, summary.nvdmedium, summary.nvdlow and summary.nvdnone count the same active CVEs a second time, by NVD's CVSS severity label (v3.x, else v4.0). Before NVD's record arrives, or where it gives none, a pre-NVD label from the CVE.org record or a GitHub advisory can stand in. They are provenance, never EchelonGraph's severity band. summary.nvdnone counts the active CVEs with no Critical, High, Medium or Low label there, and many of those carry an NVD CVSS v2 score instead, so it is neither a count of CVEs rated None nor the count of CVEs with no severity, which is summary.none.
summary.rejected counts the CVE records rejected (withdrawn) by their numbering authority. summary.total and the other counts leave them out, and they are withdrawn records, never vulnerabilities.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
EchelonGraph CVE & Exposure: common questions
- Is EchelonGraph CVE & Exposure MCP server safe?
- Yes, by our scan: it is graded A (94/100). Read the EchelonGraph CVE & Exposure safety report
- How do I install EchelonGraph CVE & Exposure?
- It runs remotely at mcp.echelongraph.io. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does EchelonGraph CVE & Exposure need an API key?
- No secret keys are declared. It reads 2 settings from the environment.
- Is EchelonGraph CVE & Exposure maintained?
- The last commit was 13 days ago (2026-09-30). The latest release is v3.0.0.
- Is EchelonGraph CVE & Exposure up?
- 100% of our last 13 checks got an answer. We check remote servers about four times a day.
- What can I use instead of EchelonGraph CVE & Exposure?
- Servers from other publishers that do the same job: Patch Tuesday MCP server, grim-mcp server and SSH Manager MCP server. Compare all EchelonGraph CVE & Exposure alternatives.
Alternatives to EchelonGraph CVE & Exposure
Same job from other publishers: the closest match first, then the best rated.
- Patch TuesdayQuery Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichmentnot reviewedGrowingB
- grim-mcpSecurity audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.not reviewedGrowingC
- SSH ManagerSSH server management for agents, with per-server read-only and allowlist security modesnot reviewedEstablishedB
Dechonet25 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.not reviewedGrowingA- not reviewedGrowingA
