Stack Facts
Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.
Free sample: curl -s https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol. Paid calls cost $0.001 to $0.05 in USDC over x402 v2 exact on Base: call the route, take the price from the 402 PAYMENT-REQUIRED header, pay and retry with PAYMENT-SIGNATURE. x402 v1 clients can pay the offer in the 402 body instead and retry with X-PAYMENT. No account or API key. Errors are never charged.
Updated 2026-10-12. Version 0.5.0.
Quick start
# Free: signed samples, same shape as the paid answers
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/kev'
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/models/preview'
# Free: check an id before paying
curl -s 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/validate?dataset=eol&id=nodejs'
# Paid: 402 with the price in the PAYMENT-REQUIRED header (base64 JSON) and the body
curl -si 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/kev/CVE-2021-44228'
curl -si -X POST 'https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/eol/check' -H 'content-type: application/json' -d '{"items":[{"product":"nodejs","version":"18.19.0"},{"product":"python","version":"3.12.4"}]}'
Datasets
- Software end-of-life dates (
/v1/eol/…): endoflife.date, MIT, refreshed every 24 h. Snapshot eol-20261011T184823Z-fb3e9d0a, as of 2026-10-11T18:48:23Z, 483 records. Free sample: /v1/try/eol.
- Actively exploited CVEs (CISA KEV) (
/v1/kev/…): CISA KEV, CC0-1.0, refreshed every 4 h. Snapshot kev-20261009T183031Z-bc476d6c, as of 2026-10-09T18:30:31Z, 1739 records. Free sample: /v1/try/kev.
- LLM prices, context windows and deprecation dates (
/v1/models/…): LiteLLM + models.dev, MIT, refreshed every 12 h. Snapshot models-20261010T070852Z-7d710157, as of 2026-10-10T07:08:52Z, 368 records. Free sample: /v1/try/models.
Paid tools
USD per call, paid in USDC on Base (eip155:8453). Atomic USDC (USD x 1,000,000) is the 402 amount.
- stackfacts_eol_product: GET /v1/eol/{product}, $0.001. List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.
- stackfacts_eol_cycle: GET /v1/eol/{product}/{cycle}, $0.001. Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.
- stackfacts_eol_check: POST /v1/eol/check or GET /v1/eol/check, $0.01. Check dependencies, runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs to cycle, end-of-life date and support status.
- stackfacts_eol_image: GET /v1/eol/image, $0.005. Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.
- stackfacts_eol_snapshot: GET /v1/eol/snapshot, $0.05. Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.
- stackfacts_kev_lookup: GET /v1/kev/{cve}, $0.002. Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.
- stackfacts_kev_check: POST /v1/kev/check, $0.005. Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.
- stackfacts_kev_changes: GET /v1/kev/changes, $0.01. List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.
- stackfacts_kev_snapshot: GET /v1/kev/snapshot, $0.05. Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.
- stackfacts_models_lookup: GET /v1/models/{provider}/{model}, $0.002. Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.
- stackfacts_models_estimate: POST /v1/models/estimate, $0.002. Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.
- stackfacts_models_cheapest: POST /v1/models/cheapest, $0.008. Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.
- stackfacts_models_changes: GET /v1/models/changes, $0.02. List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.
- stackfacts_models_snapshot: GET /v1/models/snapshot, $0.05. Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.
- stackfacts_stack_check: POST /v1/stack/check, $0.012. Check dependencies, runtimes and OS versions in one call: OSV advisories for up to 50 package purls, EOL status for 50 product@version pairs, CISA KEV hits.
- stackfacts_osv_check: POST /v1/osv/check, $0.005. Check dependencies for known vulnerabilities: up to 50 package purls (npm, PyPI, Go, crates.io, Maven) against OSV.dev, with fixed versions and CISA KEV flags.
- stackfacts_preflight: POST /v1/preflight, $0.008. Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.
- stackfacts_stack_watch: POST /v1/stack/watch, $0.012. Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.
Free tools
- stackfacts_preview: GET /v1/{dataset}/preview, free. Preview a dataset for free: sample end-of-life products, the newest CISA KEV entries or LLM prices, signed like the paid answers.
- stackfacts_try: GET /v1/try/{dataset}, free. Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.
- stackfacts_index: GET /v1/{dataset}/index, free. List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.
- stackfacts_validate: GET /v1/validate, free. Validate an id for free before paying: whether a product, product/cycle or provider/model exists, or a CVE id is well formed.
- stackfacts_manifest: GET /v1/{dataset}/manifest, free. Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.
- stackfacts_keys: GET /v1/keys, free. Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.
For agents
Docs
Data is provided as is, without warranty of any kind. Payments are final. Every dataset is normalised (modified) from the sources named here, and no source endorses this service.