# Stack Facts compared with the free sources

Updated 2026-10-12. Every Stack Facts answer comes from free, openly licensed sources. If you need a lookup now and then and are happy to parse the source yourself, use the source directly. Stack Facts is for agents that need one checked, signed answer per call.

| Question | Free from the source | Stack Facts adds |
|---|---|---|
| Is this product version end-of-life? | [endoflife.date](https://endoflife.date/api/v1/products/full): release cycles with their dates | The status of each cycle on the answer date (supported, security-only, eol or unknown); up to 50 product versions in one call (POST /v1/eol/check). |
| Is this container image end-of-life? | [endoflife.date](https://endoflife.date/api/v1/products/full): release cycles per product, not per image tag | The image tag or whole FROM line read for you (node:18-alpine3.19, python:3.12-slim-bookworm, ubuntu:jammy, gcr.io/distroless/nodejs20-debian12): the runtime, Java and base OS it names, each with its cycle and status, and the worst of them; a version older than every listed cycle of an end-of-life line is eol; when the image product itself did not match, the headline is unknown unless a matched part is eol or security-only, and complete says whether every part matched (GET /v1/eol/image). |
| Is this CVE actively exploited? | [CISA KEV](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json): the whole catalog as one JSON file | One CVE, or up to 100 in one call (POST /v1/kev/check), with the required action and due date; what changed since a snapshot (GET /v1/kev/changes). |
| What does this LLM cost, and which is cheapest? | [LiteLLM](https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json) and [models.dev](https://models.dev/api.json): price and context lists | The two sources merged into one record per model, with a flag where they disagree; the cheapest models for your constraints (POST /v1/models/cheapest); a cost estimate; a change feed. |
| Does this package version have known vulnerabilities? | [OSV.dev](https://osv.dev/): advisories per ecosystem, as bulk files and a query API | The advisories affecting each version, with fixed versions and a CISA KEV flag; up to 50 purls in one call (POST /v1/osv/check), or with the rest of the stack (POST /v1/stack/check). |

## On every answer

- A snapshot id and the time the source data was fetched, so the answer is dated.
- An Ed25519 signature over the snapshot manifest (EOL, KEV and Models), checkable with the keys at [/v1/keys](https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/keys).
- One call for a whole stack: POST /v1/stack/check takes up to 50 product versions, 50 packages (purls) and 100 CVEs ($0.012).
- Container images: GET /v1/eol/image?image=node:18-alpine3.19 answers the end-of-life status of the runtime and base OS the tag names ($0.005).
- What changed since your last check: POST /v1/stack/watch answers a stack, then on each re-check with its signed token only what changed (an end-of-life date passed or near, a new CISA KEV listing, a new OSV advisory); no watch state is stored ($0.012 a call).
- Open-source packages: POST /v1/osv/check takes up to 50 purls and answers the OSV.dev advisories for each version, with fixed versions and a CISA KEV flag ($0.005).
- Paid per call in USDC over x402: no account, no API key. Errors are never charged.

Free samples first: [/v1/try/eol](https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/eol), [/v1/try/kev](https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/try/kev), [/v1/models/preview](https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/models/preview). Licences and attribution: [/licences](https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/licences).

Data is provided as is, without warranty of any kind. Payments are final. Every dataset is normalised (modified) from the sources named here, and no source endorses this service.