Provenance

Updated 2026-10-12. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.

Snapshots

• Each source is fetched, normalised to one record per id and checked against the schema.
• A parse or schema failure, or fewer than 90 % of the previous records, keeps the previous snapshot live.
• Each snapshot is canonical JSON (RFC 8785) with a sha256 and an Ed25519-signed manifest (snapshot_id, sha256, record count, source, licence).
• The last 30 snapshots and their diffs are kept for the change feeds.

Verifying a snapshot

sha256 of the canonical JSON (RFC 8785) of data.snapshot equals data.manifest.sha256; data.manifest.signature is Ed25519 (base64url) over the canonical JSON of the manifest without "signature", by the key in GET /v1/keys with that key_id.

Software end-of-life dates

• Source: endoflife.date, https://endoflife.date/api/v1/products/full, MIT. Attribution: Data from endoflife.date (https://endoflife.date), Copyright 2020 endoflife.date contributors, MIT License.
• Refresh: every 24 h; stale (paid routes answer 503) after 48 h without a successful refresh.
• Snapshot: eol-20261011T184823Z-fb3e9d0a, as of 2026-10-11T18:48:23Z, 483 records, sha256 fb3e9d0aeca0c7df060e0eaf2193f1cf74910961adc62857bde67de6167dc061.
• Live: /v1/eol/manifest (free) and /health.

Actively exploited CVEs (CISA KEV)

• Source: CISA KEV, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json, CC0-1.0. Attribution: Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.
• Refresh: every 4 h; stale (paid routes answer 503) after 8 h without a successful refresh.
• Snapshot: kev-20261009T183031Z-bc476d6c, as of 2026-10-09T18:30:31Z, 1739 records, sha256 bc476d6c11a365d2f4371f6775a025d2d0e3d74bed5bca521838007452b956b0.
• Live: /v1/kev/manifest (free) and /health.

LLM prices, context windows and deprecation dates

• Source: LiteLLM, https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json, MIT. Attribution: Pricing data derived from LiteLLM, Copyright (c) 2023 Berri AI, MIT License. Community-maintained; may lag vendor pages.
• Source: models.dev, https://models.dev/api.json, MIT. Attribution: Data from models.dev (https://models.dev), Copyright (c) 2025 models.dev, MIT License.
• Refresh: every 12 h; stale (paid routes answer 503) after 24 h without a successful refresh.
• Snapshot: models-20261010T070852Z-7d710157, as of 2026-10-10T07:08:52Z, 368 records, sha256 7d710157205630955bc076be6979f3482143ce31046fb2042ed2917ef2d2a998.
• Live: /v1/models/manifest (free) and /health.

Data is provided as is, without warranty of any kind. Payments are final. Every dataset is normalised (modified) from the sources named here, and no source endorses this service.

Privacy: our request log keeps no IP address or payment header, and no query or body beyond the names we could not find. It keeps only time, method, path, status, duration, user agent, referrer origin and path, a flag marking our own traffic, our codes for the payment outcome, the kind of payment header sent (payhdr: x402v2, x402v1, l402, mpp or none; never its value), MCP method, tool name and error, and, on the EOL, stack and OSV checks and the image route, the names we could not find: unknown EOL product ids, the product name of an unknown image (never its registry, path, tag or digest) and package types we do not cover. Sales records keep a hash of the payer address. Cloudflare, which hosts the service, logs client IP addresses. Our payment store keeps the payer address with each payment nonce until the authorisation expires, or longer while settlement is unclear.