The EchelonGraph MCP server connects EchelonGraph's free public data to any MCP client for querying CVEs and internet exposure. The data fuses NVD, MITRE-CNA pre-NVD, CISA KEV, EPSS, and GitHub GHSA to form the CVE Pulse score; it also provides the exposure footprint of a single CVE, that is, how many publicly accessible ip:port services run versions corresponding to a given CVE, with exposure counts coming from Shodan data.
Main capabilities: 16 read-only tools can query a single CVE record, exploit code and fixed versions, remediation methods explained by source, EPSS history, vendor advisories, and exposure footprint; list the latest CISA KEV entries; determine whether a product or package version is affected; check an SBOM or project lock file; and read CWEs and their CVEs. Every result is annotated with how it was measured (state, measured_at, method, coverage, freshness, notes), avoiding treating failure or non-assessment as no risk. There are also 5 prompt workflows (triage_cve, kev_weekly_brief, am_i_affected, sbom_review, workload_triage), 2 resources (echelongraph://methodology, echelongraph://sources), and 1 resource template (cve://{cve_id}).
How to use: free, no API key required, no authentication required, read-only. Three ways to connect: Claude Desktop one-click extension (no Node.js required); custom connector, paste https://mcp.echelongraph.io/mcp and choose no login required; run locally via npx, requiring Node.js 20 or higher, for example configuring command as npx and args as ["-y","echelongraph-mcp"] in mcpServers. The remote endpoint also provides all tools.
Limitations: the tools are read-only and do not modify anything. Some CVEs may not yet be scored, and a score cannot be treated as 0; patch_available being false only means there is no evidence of a fix, not that no fix exists; exposure counts are based on sampling of Shodan data and count ip:port services rather than machines, and CVEs outside radar tracking will return NOT ASSESSED. The coverage window for vendor advisories is limited, and absence from the collection cannot be used to infer that the vendor has not published an advisory. Specific pricing, fees, and similar information are not provided.
