{ "protocolVersion": "0.3.0", "name": "Stack Facts", "description": "Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.", "url": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us", "preferredTransport": "HTTP+JSON", "version": "0.6.0", "documentationUrl": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt", "capabilities": { "streaming": false, "pushNotifications": false, "stateTransitionHistory": false }, "defaultInputModes": [ "application/json" ], "defaultOutputModes": [ "application/json" ], "skills": [ { "id": "stackfacts_eol_product", "name": "stackfacts_eol_product", "description": "List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.", "tags": [ "EOL", "end-of-life dates", "support status", "is still supported", "release cycles", "LTS", "endoflife.date" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/eol/{product}" ], "x-paid": true }, { "id": "stackfacts_eol_cycle", "name": "stackfacts_eol_cycle", "description": "Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.", "tags": [ "is still supported", "EOL", "end-of-life date", "support status", "support until", "latest patch version", "LTS" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/eol/{product}/{cycle}" ], "x-paid": true }, { "id": "stackfacts_eol_check", "name": "stackfacts_eol_check", "description": "Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.", "tags": [ "check my stack for end-of-life versions", "is still supported", "EOL", "support status", "dependency EOL audit", "batch end-of-life check" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/eol/check", "GET /v1/eol/check" ], "x-paid": true }, { "id": "stackfacts_eol_image", "name": "stackfacts_eol_image", "description": "Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.", "tags": [ "is my docker image end-of-life", "container base image EOL", "is still supported", "Dockerfile FROM audit", "EOL", "support status", "base OS end-of-life" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/eol/image" ], "x-paid": true }, { "id": "stackfacts_eol_snapshot", "name": "stackfacts_eol_snapshot", "description": "Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.", "tags": [ "EOL", "end-of-life dataset download", "support status", "is still supported", "endoflife.date bulk", "signed snapshot" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/eol/snapshot" ], "x-paid": true }, { "id": "stackfacts_kev_lookup", "name": "stackfacts_kev_lookup", "description": "Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.", "tags": [ "check if a CVE is actively exploited (CISA KEV)", "known exploited vulnerability", "CISA KEV lookup", "CVE exploited in the wild" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/kev/{cve}" ], "x-paid": true }, { "id": "stackfacts_kev_check", "name": "stackfacts_kev_check", "description": "Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.", "tags": [ "check if a CVE is actively exploited (CISA KEV)", "batch CVE check", "vulnerability scan triage", "known exploited vulnerabilities" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/kev/check" ], "x-paid": true }, { "id": "stackfacts_kev_changes", "name": "stackfacts_kev_changes", "description": "List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.", "tags": [ "new CISA KEV entries", "newly exploited vulnerabilities", "KEV change feed", "check if a CVE is actively exploited (CISA KEV)" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/kev/changes" ], "x-paid": true }, { "id": "stackfacts_kev_snapshot", "name": "stackfacts_kev_snapshot", "description": "Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.", "tags": [ "CISA KEV download", "known exploited vulnerabilities catalog", "signed snapshot" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/kev/snapshot" ], "x-paid": true }, { "id": "stackfacts_models_lookup", "name": "stackfacts_models_lookup", "description": "Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.", "tags": [ "price per million tokens", "context window", "model deprecation date", "LLM pricing", "max output tokens" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/models/{provider}/{model}" ], "x-paid": true }, { "id": "stackfacts_models_estimate", "name": "stackfacts_models_estimate", "description": "Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.", "tags": [ "LLM cost estimate", "price per million tokens", "token cost calculator", "how much will this prompt cost" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/models/estimate" ], "x-paid": true }, { "id": "stackfacts_models_cheapest", "name": "stackfacts_models_cheapest", "description": "Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.", "tags": [ "cheapest model with tools and 128k context", "cheapest LLM", "price per million tokens", "context window", "model comparison" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/models/cheapest" ], "x-paid": true }, { "id": "stackfacts_models_changes", "name": "stackfacts_models_changes", "description": "List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.", "tags": [ "LLM price changes", "model deprecation date", "new LLM models", "price per million tokens" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/models/changes" ], "x-paid": true }, { "id": "stackfacts_models_watch", "name": "stackfacts_models_watch", "description": "Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.", "tags": [ "watch LLM prices and deprecations", "Use when the models you call may change price or be deprecated", "model deprecation alert", "LLM price change monitor", "what changed for my models since my last check" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/models/watch" ], "x-paid": true }, { "id": "stackfacts_models_snapshot", "name": "stackfacts_models_snapshot", "description": "Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.", "tags": [ "LLM pricing dataset", "price per million tokens", "context window", "signed snapshot" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/models/snapshot" ], "x-paid": true }, { "id": "stackfacts_stack_check", "name": "stackfacts_stack_check", "description": "Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.", "tags": [ "check my stack for end-of-life versions and exploited CVEs", "stack audit", "EOL, package vulnerabilities and KEV in one call", "is still supported", "dependency risk check", "known exploited vulnerabilities" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/stack/check" ], "x-paid": true }, { "id": "stackfacts_osv_check", "name": "stackfacts_osv_check", "description": "Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.", "tags": [ "check my dependencies for known vulnerabilities", "is vulnerable", "OSV", "purl", "npm PyPI Go crates.io Maven advisories", "GHSA", "fixed version", "known exploited vulnerabilities", "malicious package check", "lockfile scan", "package-lock.json yarn.lock requirements.txt poetry.lock" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/osv/check" ], "x-paid": true }, { "id": "stackfacts_preflight", "name": "stackfacts_preflight", "description": "Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.", "tags": [ "call before installing a package an LLM suggested", "npm install check", "pip install check", "package preflight", "malicious package check", "known exploited vulnerabilities", "OSV", "purl" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/preflight" ], "x-paid": true }, { "id": "stackfacts_cve_lookup", "name": "stackfacts_cve_lookup", "description": "Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.", "tags": [ "get a CVE", "CVE lookup", "CVE details", "CVE fixed version", "CVE affected packages", "CVSS score", "OSV", "CISA KEV", "CVE priority" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/cve/{id}" ], "x-paid": true }, { "id": "stackfacts_cwe_lookup", "name": "stackfacts_cwe_lookup", "description": "Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.", "tags": [ "CWE lookup", "CWE weakness", "common weakness enumeration", "CWE name", "CWE description", "MITRE CWE" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/cwe/{id}" ], "x-paid": true }, { "id": "stackfacts_technique_lookup", "name": "stackfacts_technique_lookup", "description": "Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.", "tags": [ "technique lookup", "adversary technique", "attack technique id", "technique tactics", "technique platforms", "MITRE technique" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/technique/{id}" ], "x-paid": true }, { "id": "stackfacts_capec_lookup", "name": "stackfacts_capec_lookup", "description": "Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.", "tags": [ "CAPEC lookup", "CAPEC attack pattern", "common attack pattern enumeration", "attack pattern mitigations", "CAPEC description", "MITRE CAPEC" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/capec/{id}" ], "x-paid": true }, { "id": "stackfacts_domain_lookup", "name": "stackfacts_domain_lookup", "description": "Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.", "tags": [ "public suffix", "registrable domain", "eTLD+1", "domain split", "subdomain parser", "Public Suffix List", "effective TLD" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/domain/{host}" ], "x-paid": true }, { "id": "stackfacts_port_lookup", "name": "stackfacts_port_lookup", "description": "Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.", "tags": [ "port number", "IANA", "service name", "well-known ports", "port lookup", "TCP port", "UDP port", "service names and port numbers" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/port/{number}" ], "x-paid": true }, { "id": "stackfacts_control_lookup", "name": "stackfacts_control_lookup", "description": "Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.", "tags": [ "NIST SP 800-53", "security controls", "control catalogue", "compliance", "OSCAL", "control enhancement", "FedRAMP", "access control" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/control/{id}" ], "x-paid": true }, { "id": "stackfacts_bcp47_lookup", "name": "stackfacts_bcp47_lookup", "description": "Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.", "tags": [ "BCP 47", "language tag", "locale", "IANA language subtag registry", "RFC 5646", "ISO 639", "script subtag", "region subtag" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/bcp47/{tag}" ], "x-paid": true }, { "id": "stackfacts_tz_lookup", "name": "stackfacts_tz_lookup", "description": "Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.", "tags": [ "time zone", "IANA time zone", "tz database", "tzdata", "UTC offset", "daylight saving", "DST", "timezone abbreviation" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/tz/{zone}" ], "x-paid": true }, { "id": "stackfacts_package_card", "name": "stackfacts_package_card", "description": "Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.", "tags": [ "package metadata", "latest version", "npm package", "PyPI package", "package licence", "SPDX licence", "deprecated package", "yanked release" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/package/{ecosystem}/{name}" ], "x-paid": true }, { "id": "stackfacts_license_check", "name": "stackfacts_license_check", "description": "Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.", "tags": [ "licence compatibility", "license compatibility", "SPDX licence check", "GPL compatible", "copyleft licence", "dependency licence", "open source licence policy", "AGPL SaaS" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/license/check" ], "x-paid": true }, { "id": "stackfacts_cve_prioritize", "name": "stackfacts_cve_prioritize", "description": "Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.", "tags": [ "CVE prioritization", "exploit prediction", "KEV", "vulnerability triage", "patch priority", "CVE ranking", "known exploited" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/cve/prioritize" ], "x-paid": true }, { "id": "stackfacts_cve_search", "name": "stackfacts_cve_search", "description": "Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.", "tags": [ "CVE search", "search vulnerabilities by keyword", "CVEs for a package", "KEV", "known exploited", "vulnerability lookup by product", "OSV advisories" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/cve/search" ], "x-paid": true }, { "id": "stackfacts_package_preflight", "name": "stackfacts_package_preflight", "description": "Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.", "tags": [ "call before npm install", "call before pip install", "package preflight", "is this package safe", "latest version", "package licence", "deprecated package", "known exploited vulnerabilities" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/preflight/{ecosystem}/{name}" ], "x-paid": true }, { "id": "stackfacts_upgrade_delta", "name": "stackfacts_upgrade_delta", "description": "Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.", "tags": [ "is this upgrade safe", "npm upgrade check", "pip upgrade check", "upgrade package version", "version bump risk", "vulnerabilities fixed by upgrade", "breaking upgrade", "dependency upgrade decision" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/upgrade/{ecosystem}/{name}" ], "x-paid": true }, { "id": "stackfacts_lockfile_diff", "name": "stackfacts_lockfile_diff", "description": "Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.", "tags": [ "lockfile diff", "compare lockfiles", "dependency diff", "package.json diff", "requirements diff", "dependency update risk", "pull request dependency check", "dependabot review" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/lockfile/diff" ], "x-paid": true }, { "id": "stackfacts_stack_watch", "name": "stackfacts_stack_watch", "description": "Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.", "tags": [ "watch my stack for end-of-life and new exploited CVEs", "Use when you need to know what changed in a stack since your last check", "stack monitor", "dependency monitor", "what changed since my last check", "alert when a version reaches end of life", "new vulnerabilities in my packages" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "POST /v1/stack/watch" ], "x-paid": true }, { "id": "stackfacts_preview", "name": "stackfacts_preview", "description": "Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.", "tags": [ "free sample", "end-of-life dates", "CISA KEV", "price per million tokens" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/{dataset}/preview" ], "x-paid": false }, { "id": "stackfacts_try", "name": "stackfacts_try", "description": "Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.", "tags": [ "free example", "try before paying", "check if a CVE is actively exploited (CISA KEV)" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/try/{dataset}" ], "x-paid": false }, { "id": "stackfacts_index", "name": "stackfacts_index", "description": "List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.", "tags": [ "product list", "model list", "valid ids", "aliases" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/{dataset}/index" ], "x-paid": false }, { "id": "stackfacts_validate", "name": "stackfacts_validate", "description": "Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.", "tags": [ "validate id", "check before paying", "product exists" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/validate" ], "x-paid": false }, { "id": "stackfacts_manifest", "name": "stackfacts_manifest", "description": "Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.", "tags": [ "signed manifest", "snapshot_id", "data freshness", "provenance" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/{dataset}/manifest" ], "x-paid": false }, { "id": "stackfacts_keys", "name": "stackfacts_keys", "description": "Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.", "tags": [ "public key", "verify signature", "JWKS", "Ed25519" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "x-routes": [ "GET /v1/keys" ], "x-paid": false } ], "x-payment": { "protocols": [ "x402" ], "scheme": "exact", "network": "eip155:8453", "x402Versions": [ 2, 1 ], "network_v1": "base", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "resources": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/.well-known/x402", "pricing": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/pricing.json", "openapi": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/openapi.json", "mcp": "https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/mcp" } }