endoflife.ai — Software Lifecycle Intelligence

Official10 toolsLive

by endoflife-ai · JavaScript

EOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 500+ products.

This MCP server exposes endoflife.ai lifecycle intelligence to AI agents using the Model Context Protocol (MCP) over Streamable HTTP. It is a dependency-free Cloudflare Worker that wraps the public api.endoflife.ai/v1 endpoints and the site’s published feeds, without duplicating data.

🛠️ Key Features

Provides access to EOL dates, risk scores, and CISA KEV exposure
Includes SBOM audits and edge-device EOS for 500+ products
Exposes data via MCP (Streamable HTTP transport)
Wraps api.endoflife.ai/v1 endpoints and published feeds
Each answer includes a source URL
Tool count: 10

🚀 Use Cases

Checking end-of-life timelines for software dependencies
Evaluating risk using risk scores and CISA KEV exposure
Performing SBOM audits and tracking edge-device EOS across 500+ products

⚡ Developer Benefits

Dependency-free Cloudflare Worker deployment model
Integrates with MCP clients for lifecycle-aware automation
Source-linked responses for traceability

⚠️ Limitations

Limited to the scope of endoflife.ai data exposed through the wrapped api.endoflife.ai/v1 endpoints and published feeds

Topics: devops, end-of-life, eol, mcp, model-context-protocol, software-lifecycle

Topics

devopsend-of-lifeeolmcpmodel-context-protocolsoftware-lifecycle

Captured live from the server via tools/list.

check_eol

Check whether a specific version of a software product is end-of-life (EOL). Returns lifecycle status, the EOL date, days remaining or days past EOL, the latest release, and eol_date_source (where the date comes from: vendor-override, vendor-fetched, vendor-verified, custom, upstream, or discrepancy) with its source URL. Use this for "is X version Y still supported?" questions.

Parameters2

product	string	required	Product slug or name, e.g. "postgresql", "nodejs", "ubuntu".
version	string	required	Version/cycle, e.g. "14", "18", "20.04".

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Product slug or name, e.g. \"postgresql\", \"nodejs\", \"ubuntu\"."
    },
    "version": {
      "type": "string",
      "description": "Version/cycle, e.g. \"14\", \"18\", \"20.04\"."
    }
  },
  "required": [
    "product",
    "version"
  ]
}

get_risk_score

Get the proprietary EOL Risk Score (0-100) for a product version, with the four-factor breakdown (EOL recency, attack surface, CISA KEV exposure, extended support). Omit "version" to score the product's highest-risk (most recently end-of-lifed) release. Use this to quantify how dangerous it is to keep running something.

Parameters2

product	string	required	Product slug or name, e.g. "openssl", "python".
version	string	optional	Optional version/cycle. Omit for the highest-risk release.

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Product slug or name, e.g. \"openssl\", \"python\"."
    },
    "version": {
      "type": "string",
      "description": "Optional version/cycle. Omit for the highest-risk release."
    }
  },
  "required": [
    "product"
  ]
}

scan_stack

Audit a whole stack at once. Provide a list of products (optionally with versions) — e.g. parsed from a package.json or Dockerfile — and get an EOL Risk Score for each, so you can see what is unsupported and dangerous in one call. For CycloneDX or SPDX documents use check_sbom instead. Free tier: up to 5 items; Pro: up to 50.

Parameters1

items

array

required

List of stack components to score.

Raw schema

{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "description": "List of stack components to score.",
      "items": {
        "type": "object",
        "properties": {
          "product": {
            "type": "string",
            "description": "Product slug or name."
          },
          "version": {
            "type": "string",
            "description": "Optional version/cycle. Omit for highest-risk release."
          }
        },
        "required": [
          "product"
        ]
      }
    }
  },
  "required": [
    "items"
  ]
}

list_products

List or search the products endoflife.ai tracks (500+). Pass an optional "query" substring to find the canonical slug for a product before calling the other tools (e.g. "postgres" → "postgresql"). Returns matching product slugs.

Parameters1

query

string

optional

Optional case-insensitive substring filter.

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "type": "string",
      "description": "Optional case-insensitive substring filter."
    }
  },
  "required": []
}

get_product_lifecycle

Get the full version history for one product: every tracked version/cycle with its release date, EOL date, support status, and EOL Risk Score. Use for "give me the whole EOL schedule for X".

Parameters1

product

string

required

Product slug or name, e.g. "postgresql".

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Product slug or name, e.g. \"postgresql\"."
    }
  },
  "required": [
    "product"
  ]
}

get_kev_exposure

The exploited-vulnerability record for a product: every CVE CISA lists against it in the Known Exploited Vulnerabilities catalog, with the date added, the federal due date and CISA's required-action text verbatim (the "discontinue use" entries are the ones that matter for end-of-life versions), plus any entries from endoflife.ai's Exploited & Unpatchable feed (exploited CVEs whose affected versions will never receive a fix). Pass an optional version to include its support status alongside.

Parameters2

product	string	required	Product slug or name, e.g. "ivanti-connect-secure", "fortios".
version	string	optional	Optional version/cycle to check support status for.

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Product slug or name, e.g. \"ivanti-connect-secure\", \"fortios\"."
    },
    "version": {
      "type": "string",
      "description": "Optional version/cycle to check support status for."
    }
  },
  "required": [
    "product"
  ]
}

get_upcoming_eol

What reaches end-of-life soon. Returns every tracked version whose EOL date falls within the next N days (default 90), optionally limited to a list of products, sorted by date. Also lists versions that went EOL within the last "recent_past_days" days when set. Use for "what in our stack expires this quarter?".

Parameters3

products	array	optional	Optional product slugs or names to restrict to (max 50). Omit for the whole catalog.
days	integer	optional	Look-ahead window in days (default 90, max 730).
recent_past_days	integer	optional	Also include versions that went EOL within this many days in the past (default 0).

Raw schema

{
  "type": "object",
  "properties": {
    "products": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional product slugs or names to restrict to (max 50). Omit for the whole catalog."
    },
    "days": {
      "type": "integer",
      "description": "Look-ahead window in days (default 90, max 730)."
    },
    "recent_past_days": {
      "type": "integer",
      "description": "Also include versions that went EOL within this many days in the past (default 0)."
    }
  },
  "required": []
}

get_edge_device_status

Query the EOS Edge Device Intelligence feed — firewalls, VPN gateways and appliances, ADCs, router and switch operating systems — with end-of-support status in the vocabulary of CISA BOD 26-02 (eos, within-12-months, scheduled, no-date-announced). Filter by platform or vendor name, by status, or by model/line. Each platform carries its KEV summary, vendor-stated successor and provenance. Use for "which of our edge devices are past support or expire within 12 months?".

Parameters3

platform	string	optional	Optional substring matched against platform slug, name, vendor or category, e.g. "fortinet", "ivanti", "vpn".
status	string	optional	Optional status filter.
model	string	optional	Optional substring matched against the line / model name, e.g. "ISA6000", "7.2", "SMA 100".

Raw schema

{
  "type": "object",
  "properties": {
    "platform": {
      "type": "string",
      "description": "Optional substring matched against platform slug, name, vendor or category, e.g. \"fortinet\", \"ivanti\", \"vpn\"."
    },
    "status": {
      "type": "string",
      "enum": [
        "eos",
        "within-12-months",
        "scheduled",
        "no-date-announced"
      ],
      "description": "Optional status filter."
    },
    "model": {
      "type": "string",
      "description": "Optional substring matched against the line / model name, e.g. \"ISA6000\", \"7.2\", \"SMA 100\"."
    }
  },
  "required": []
}

get_upgrade_path

Where to move a product version: the current version's support status and score, the supported releases with the longest remaining support, endoflife.ai's recommended target, and the vendor's stated successor where one is published (edge appliances). Use after check_eol says a version is EOL.

Parameters2

product	string	required	Product slug or name.
version	string	optional	Optional current version/cycle.

Raw schema

{
  "type": "object",
  "properties": {
    "product": {
      "type": "string",
      "description": "Product slug or name."
    },
    "version": {
      "type": "string",
      "description": "Optional current version/cycle."
    }
  },
  "required": [
    "product"
  ]
}

check_sbom

Audit a CycloneDX or SPDX JSON software bill of materials. Components are mapped to tracked products and scored for EOL risk; unmatched components are listed honestly rather than guessed. Pass the SBOM as a JSON string or object. Free tier scores up to 5 matched components per call; Pro up to 50.

Parameters2

sbom	any	required	The SBOM document (JSON string or object). CycloneDX (bomFormat/components) or SPDX (spdxVersion/packages).
max_items	integer	optional	Maximum matched components to score (default 50).

Raw schema

{
  "type": "object",
  "properties": {
    "sbom": {
      "description": "The SBOM document (JSON string or object). CycloneDX (bomFormat/components) or SPDX (spdxVersion/packages)."
    },
    "max_items": {
      "type": "integer",
      "description": "Maximum matched components to score (default 50)."
    }
  },
  "required": [
    "sbom"
  ]
}

README.md8 KBView on GitHub

endoflife.ai — MCP Server

Exposes endoflife.ai's lifecycle intelligence to AI agents over the Model Context Protocol (MCP, Streamable HTTP transport). A dependency-free Cloudflare Worker that wraps the public api.endoflife.ai/v1 endpoints and the site's published feeds — no data duplicated, every answer carries a source URL.

Current version: 1.3.0 (SERVER_INFO.version in src/index.js, server.json, package.json — keep all three in step; CI fails if they disagree; the registry and Glama read server.json).

Tools (all read-only)

Tool	What it does	Backed by
`check_eol`	Is product X version Y end-of-life?	`GET /v1/status/:slug/:version`
`get_risk_score`	EOL Risk Score (0–100) + factor breakdown	`GET /v1/score/:slug[/:version]`
`scan_stack`	Score a whole stack at once	`POST /v1/batch`
`list_products`	Search the 500+ tracked products → resolve slugs	`GET /v1/products`
`get_product_lifecycle`	Full version history + dates for one product	`GET /v1/product/:slug`
`get_kev_exposure`	Every CISA KEV entry attributed to a product (date added, due date, required action verbatim) + Exploited & Unpatchable entries	`endoflife.ai/kev-products.json`, `exploited-and-unpatchable.json`
`get_upcoming_eol`	Everything reaching EOL in the next N days (catalog-wide or a product list)	`endoflife.ai/scanner-db.json`
`get_edge_device_status`	EOS Edge Device feed with BOD 26-02 statuses, filter by platform / status / model	`endoflife.ai/eos-edge-devices.json`
`get_upgrade_path`	Supported targets, the site's recommendation, vendor-stated successor	`GET /v1/product/:slug`, `checker-db.json`, edge feed
`check_sbom`	CycloneDX / SPDX JSON → components resolved by package URL (exact, purl-map.json) or by name when no purl → scored; unmatched listed with a reason, never guessed	`purl-map.json` + `POST /v1/batch`

Every tool advertises annotations (readOnlyHint, idempotentHint) and a permissive outputSchema; results are returned both as JSON text and as structuredContent. Lookup misses return "did you mean" slug suggestions (prefix / substring / edit-distance ≤ 2 against the live product list).

Resources (resources/list / resources/read): llms.txt, the EOS Edge Device feed, Exploited & Unpatchable, KEV by product, the edge change log.

Prompts (prompts/list / prompts/get): audit_stack, eol_calendar, edge_device_review.

Endpoints: POST / (JSON-RPC), GET / (info page), GET /health (liveness JSON), GET /.well-known/mcp/server-card.json (discovery card).

Usage telemetry

With the USAGE Analytics Engine binding (see wrangler.toml, dataset endoflife_mcp_usage) each method / tool call writes one data point: tool name, client user agent, ok/error, keyed/anon, latency in ms. No request bodies. Query via the Cloudflare Analytics Engine SQL API, e.g.

sql

SELECT blob1 AS tool, count() AS calls, sum(_sample_interval) AS weighted
FROM endoflife_mcp_usage WHERE timestamp > NOW() - INTERVAL '7' DAY
GROUP BY tool ORDER BY calls DESC

The binding is optional; the code no-ops without it.

Deploy

The hosted server at mcp.endoflife.ai is deployed by the maintainers from the endoflife.ai site repository's GitHub Actions workflow (pinned wrangler, Cloudflare credentials held there as repository secrets); this public repository carries no deploy workflow of its own. To run your own copy, wrangler deploy from this repository works with your own Cloudflare account, and wrangler dev runs it locally; the API service binding and the USAGE dataset in wrangler.toml are declared for both the default and production environments.

Custom domain (mcp.endoflife.ai)

The route in wrangler.toml needs mcp.endoflife.ai to resolve through Cloudflare: an AAAA record, name mcp, IPv6 100::, proxied. Already in place.

Test before deploying

CI (.github/workflows/ci.yml) runs on every push and pull request and once a day: syntax checks, manifest validity, the version-agreement check, and a live smoke test that calls the deployed server's tools. The same smoke test runs locally:

bash

node --check src/index.js && node --check stdio.js
node .github/scripts/smoke.mjs   # real tool calls against mcp.endoflife.ai, expects 0 failures

Run as a container (Red Hat UBI)

server.mjs runs the same handler that serves mcp.endoflife.ai inside a plain Node.js process, and Dockerfile packages it on registry.access.redhat.com/ubi9/nodejs-22-minimal for cluster deploys (the form the OpenShift AI MCP catalog expects). No build step, no dependencies; the container talks to https://api.endoflife.ai over HTTPS and runs as the unprivileged UBI user (uid 1001).

code

docker build -t endoflife-mcp .
docker run --rm -p 8080:8080 endoflife-mcp
curl -s localhost:8080/health

Endpoints are the Worker's own: POST / (Streamable HTTP JSON-RPC), GET /health (readiness), GET /.well-known/mcp/server-card.json. Set ENDOFLIFE_API_KEY to forward a Pro key. The image is built on Red Hat UBI 9 with Node 22; the maintainers run it on RHEL 9 and 10 as part of their Red Hat partner validation, which lives outside this repository.

Connect from an MCP client

Claude Desktop / Cursor / VS Code (mcpServers):

json

{
  "mcpServers": {
    "endoflife": { "command": "npx", "args": ["mcp-remote", "https://mcp.endoflife.ai"] }
  }
}

Clients with native remote-MCP support can use the URL directly:

json

{ "mcpServers": { "endoflife": { "url": "https://mcp.endoflife.ai" } } }

Test without a client

bash

# tools/list
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

# KEV exposure for a product
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_kev_exposure","arguments":{"product":"ivanti-connect-secure"}}}' | jq

# health + discovery card
curl -s https://mcp.endoflife.ai/health | jq
curl -s https://mcp.endoflife.ai/.well-known/mcp/server-card.json | jq

Auth & tiers

The read tools work with no key for individual use and evaluation (anonymous tier: 50 requests a day, 3 components per SBOM or batch call; the hosted endpoint gives each agent 200 a day). Agents that run inside a company's tooling, check inventories or call on a schedule are production use and belong on a paid key: Starter ($89/month, 10,000 requests a day, 25 per call) or Pro ($199/month, no daily cap, 50 per call), issued at checkout from https://endoflife.ai/api?utm_source=mcp#get-key. Forward it as an X-API-Key header; the Worker passes it straight through to api.endoflife.ai.

Notes

Same-zone trap: api.endoflife.ai is a Worker on this zone; a plain fetch() to it goes to origin and fails. The API service binding is mandatory in prod.
Static feeds are fetched from the site origin with cf.cacheTtl = 600 and memoised in the isolate for 10 minutes.
Per-client rate limits: relies on the upstream API's limits. If MCP traffic grows, add a KV rate-limiter keyed on CF-Connecting-IP before the upstream call.
Discovery card is also served from the main site at https://endoflife.ai/.well-known/mcp/server-card.json.

Install

Tools (10)

check_eolget_risk_scorescan_stacklist_productsget_product_lifecycleget_kev_exposureget_upcoming_eolget_edge_device_status

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.endoflife.ai

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "endoflife-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.endoflife.ai"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

check_eol

get_risk_score

scan_stack

list_products

get_product_lifecycle

get_kev_exposure

get_upcoming_eol

get_edge_device_status

get_upgrade_path

check_sbom

endoflife.ai — MCP Server

Tools (all read-only)

Usage telemetry

Deploy

Custom domain (mcp.endoflife.ai)

Test before deploying

Run as a container (Red Hat UBI)

Connect from an MCP client

Test without a client

Auth & tiers

Notes

Install

Remote endpoint

Related servers