echelongraph/echelongraph-mcp

**CVE and internet-exposure data** for Claude, Cursor, VS Code, Cline, and any
MCP client, straight from
EchelonGraph's free public feed.
It exposes EchelonGraph's CVE Pulse (NVD + MITRE-CNA *pre-NVD* + CISA-KEV + EPSS + GitHub
GHSA, fused into one score) **plus a per-CVE internet-exposure footprint**: how many
internet-facing services (distinct ip:port) EchelonGraph's KEV-exposure radar has on record
running a version that maps to the CVE. Exposure counts are derived from Shodan data.
Shodan data is owned by Shodan, which holds its copyright (© Shodan).
Its 16 tools look up one CVE (record, exploit code and fixed versions, how it is fixed as its
sources state it, EPSS history, vendor advisories, exposure footprint), list CISA's newest KEV additions, check whether a product or
package version is affected, check an SBOM or a project's lockfiles, and read a CWE and its CVEs. Every result says how
it was measured (state, measured_at, method, coverage, freshness, notes), so a model
cannot mistake an outage or an unassessed lookup for an all-clear.
It also serves five prompts, ready-made workflows a client can show as slash commands
(triage_cve, kev_weekly_brief, am_i_affected, sbom_review, workload_triage; see "Prompts"), two resources
(echelongraph://methodology and echelongraph://sources) and one resource template
(cve://{cve_id}; see "Resources").
Free and keyless: no API key, no auth, read-only. The server makes no request other than the
API call a tool needs to answer.
- npm: echelongraph-mcp · Official MCP
Registry: io.echelongraph/echelongraph-mcp · Docs:
- Source: · Changes:
CHANGELOG.md · Security: SECURITY.md
- Also listed on: Smithery ·
Glama
Quick start
The local server runs through npx and needs Node.js 20 or later; nothing is installed
globally. Claude Desktop's one-click extension, below, needs neither. Add one of the blocks below
to your client, quit it fully and reopen it, then ask: *"Is CVE-2023-44487 actively exploited, and
how many exposed services does EchelonGraph's radar have on record for it?"*
Claude Desktop
Three ways in. The first two need no Node.js: a one-click extension that runs the server on your
machine, and a custom connector to the hosted endpoint. The third runs the server through npx.
**1. Install in Claude Desktop
(one click, no Node.js).** The link downloads echelongraph-mcp.mcpb, a Claude Desktop extension.
Open it, or in Claude Desktop choose Settings → Extensions → Advanced settings → Install Extension
and pick it, then choose **Install**. Claude Desktop runs the server with the Node.js it ships and
writes its own configuration: no PATH and no JSON to edit. To update, install the next release's
bundle the same way. Every new release on GitHub carries the bundle (releases up to 2.6.5 do not),
built from the release's tag by the workflow that publishes the npm package, and signed with a SLSA
build-provenance attestation. To check a download:
gh attestation verify echelongraph-mcp.mcpb --repo echelongraph/echelongraph-mcp.
**2. Custom connector (no install).** Claude Desktop uses your claude.ai account's connectors:
Customize → Connectors → **+ Add** → **Add custom connector**. Name it EchelonGraph, paste
https://mcp.echelongraph.io/mcp, choose **No sign in**, and add it. No Node.js, no PATH and no
JSON to edit. A connector added on claude.ai shows up in Claude Desktop too, and the plan rules
are claude.ai's (see "Remote (no install)" below).
**3. Local server through npx.**
1. **Check Node.js.** In Terminal (macOS) or PowerShell (Windows), run node -v. It must print
v20 or later. If it prints an older version or command not found, install the LTS release
from , or on macOS with Homebrew run brew install node.
2. **Open the config file in a plain-text editor.** Settings → Developer → Edit Config shows
claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json;
Windows: %APPDATA%\Claude\claude_desktop_config.json). Open it in a plain-text editor such as
VS Code, Notepad or nano. TextEdit on macOS turns " into curly quotes (“ ”) when Smart
Quotes is on, and the JSON then breaks without an error: turn it off under Edit → Substitutions
→ Smart Quotes, or use another editor.
3. **Merge, do not replace.** The file usually exists already and holds Claude Desktop's own
settings (for example a "preferences" object). Keep everything in it. Add an "mcpServers"
key at the top level, next to the keys already there; if "mcpServers" is already there, add
the "echelongraph" entry inside it. Mind the comma between entries. The result looks like