Exposes endoflife.ai's lifecycle intelligence to AI agents over the Model Context
Protocol (MCP, Streamable HTTP transport). It's a thin, dependency-free Cloudflare
Worker that wraps the existing api.endoflife.ai/v1 endpoints — no data duplicated.
Tool | What it does | Wraps |
| Is product X version Y end-of-life? |
|
| EOL Risk Score™ (0–100) + factor breakdown |
|
| Score a whole stack at once |
|
| Search the 480+ tracked products → resolve slugs |
|
| Full version history + dates for one product |
|
Related MCP server: EndOfLife MCP Server
Prereq: npm install -g wrangler and wrangler login (once).
cd mcp-server
npm install
# Test immediately on the workers.dev URL:
wrangler deploy # prints https://endoflife-mcp.<your-subdomain>.workers.dev
# Production (custom domain):
wrangler deploy --env productionThe route in wrangler.toml needs mcp.endoflife.ai to resolve through Cloudflare:
Cloudflare dashboard → endoflife.ai zone → DNS → Add record.
Type AAAA, Name mcp, IPv6 100::, Proxied (orange cloud). (This is the standard Cloudflare placeholder for a Worker route — the Worker intercepts before the address is ever used.)
Re-run wrangler deploy --env production.
Until DNS is set, use the workers.dev URL everywhere below.
Claude Desktop / Cursor (claude_desktop_config.json → mcpServers):
{
"mcpServers": {
"endoflife": { "command": "npx", "args": ["mcp-remote", "https://mcp.endoflife.ai"] }
}
}Clients with native remote-MCP support can use the URL directly:
{ "mcpServers": { "endoflife": { "url": "https://mcp.endoflife.ai" } } }# tools/list
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq
# call a tool
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_risk_score","arguments":{"product":"openssl"}}}' | jq
# discovery card
curl -s https://mcp.endoflife.ai/.well-known/mcp/server-card.json | jqFree tier works with no key. Forward an X-API-Key header (your existing Pro keys)
to unlock Pro limits — the Worker passes it straight through to api.endoflife.ai.
Per-client rate limits: Phase 1 relies on the upstream API's limits. If MCP
traffic grows, add a KV rate-limiter here keyed on CF-Connecting-IP (reuse the
API_RATE_LIMIT namespace) before the upstream call.
Registry listings: submit to the public MCP registries once live (see the launch checklist).
Discovery card is also served from the main site at
https://endoflife.ai/.well-known/mcp/server-card.json so agents that probe the
apex domain find it.
Check whether a specific version of a software product is end-of-life (EOL). Returns lifecycle status, the EOL date, days remaining or days past EOL, and the latest release. Use this for "is X version Y still supported?" questions.
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "postgresql", "nodejs", "ubuntu". | |
| version | Yes | Version/cycle, e.g. "14", "18", "20.04". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description lists return values (lifecycle status, EOL date, days remaining, latest release) and indicates it's a read-only query. Does not disclose authentication requirements or rate limits, but sufficient for a simple check tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states purpose and outputs, second gives clear usage example. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description enumerates return values. Covers all necessary information for an agent to understand input, action, and expected output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for both parameters (product and version), including examples. Description does not add additional parameter meaning beyond what schema provides, meeting baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool checks EOL status for a specific product version, with verb 'check' and resource 'version of a software product'. It distinguishes from siblings like list_products and get_product_lifecycle by focusing on a single version's EOL status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Includes explicit usage example ('Use this for "is X version Y still supported?" questions') and context of when to use. Does not explicitly mention when not to use or alternatives, but sibling tool list provides implicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the full version history for one product: every tracked version/cycle with its release date, EOL date, support status, and EOL Risk Score™. Use for "give me the whole EOL schedule for X".
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "postgresql". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description does not disclose behavioral traits such as data freshness, authentication requirements, potential cost, or whether it invokes external APIs. It only describes output, not side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is two sentences with zero wasted words: first sentence defines function, second sentence provides usage context. Each sentence is informative and necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description lists key return fields (release date, EOL date, support status, risk score), which is fairly complete. It could clarify ordering or version count, but for a simple list tool it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage for the one parameter, which is well-described. The description adds no additional semantics beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it retrieves full version history for one product, listing specific fields (release date, EOL date, support status, risk score). It distinguishes from sibling tools like list_products (lists products) and check_eol (single check).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Use for "give me the whole EOL schedule for X"' gives a clear use case, but it does not specify when not to use it or mention alternatives among siblings like check_eol or get_risk_score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the proprietary EOL Risk Score™ (0–100) for a product version, with the four-factor breakdown (EOL recency, attack surface, CISA KEV exposure, extended support). Omit "version" to score the product's highest-risk (most recently end-of-lifed) release. Use this to quantify how dangerous it is to keep running something.
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "openssl", "python". | |
| version | No | Optional version/cycle. Omit for the highest-risk release. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the output as a score 0–100 with a four-factor breakdown, and explains behavior when version is omitted. Although no annotations exist, the description adequately conveys the tool's read-only nature and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundant words. First sentence states purpose and output, second provides a usage tip. Perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return format (score and breakdown) sufficiently. It covers the key usage scenarios and parameter behavior, though it could briefly mention any prerequisites or limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already describes the parameters (product slug, optional version). The description repeats the hint about omitting version but adds no new semantic detail beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states what the tool does: 'Get the proprietary EOL Risk Score™ (0–100) for a product version' with a breakdown of four factors. It distinguishes from siblings like list_products and get_product_lifecycle by focusing on risk quantification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use ('Omit version to score the product's highest-risk release' and 'use this to quantify how dangerous it is to keep running something'), though it does not explicitly exclude scenarios or mention siblings as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List or search the products endoflife.ai tracks (480+). Pass an optional "query" substring to find the canonical slug for a product before calling the other tools (e.g. "postgres" → "postgresql"). Returns matching product slugs.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Optional case-insensitive substring filter. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states the tool returns matching product slugs and supports case-insensitive substring filtering. However, it does not disclose potential limits like pagination, or the behavior when no query is provided (e.g., returns all). This is adequate but lacks full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no extraneous information. It is front-loaded with the primary action, then provides usage detail and what is returned. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (one optional parameter, no output schema), the description covers the main points: what it does, how to use the parameter, and the return value. It does not mention pagination or rate limits, but for a list/search tool of 480+ items, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already describes the query parameter. The description adds valued context by explaining the parameter's purpose (finding canonical slug for sibling tools) and providing a concrete example, going beyond the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool lists or searches products from endoflife.ai (480+), and distinguishes from siblings by explaining it retrieves canonical slugs for use with other tools. The example 'postgres' → 'postgresql' clarifies the resource and action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly suggests using this tool 'before calling the other tools' to find the canonical slug, providing a specific use case. It does not explicitly list alternatives or when not to use, but the context is well understood.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Audit a whole stack at once. Provide a list of products (optionally with versions) — e.g. parsed from a package.json, Dockerfile, or SBOM — and get an EOL Risk Score for each, so you can see what is unsupported and dangerous in one call. Free tier: up to 5 items; Pro: up to 50.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | List of stack components to score. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden. It discloses that the tool returns an EOL Risk Score per item, allows optional versions, and specifies tier limitations. No contradictory statements or hidden behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first covers purpose and examples, second covers tier limits. No filler, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description adequately explains input format, output (EOL Risk Score per item), and constraints. Could detail return structure more, but sufficient for the agent to understand usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both 'product' and 'version'. The description adds real-world examples (package.json, Dockerfile, SBOM) and explains the effect of omitting version (gets highest-risk release), going beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Audit' and the resource 'a whole stack', and explains it returns an EOL Risk Score for each product. It distinguishes itself from siblings like list_products and get_product_lifecycle by emphasizing batch processing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use: when you want to audit a stack at once, with examples like package.json, Dockerfile, or SBOM. Also mentions tier limits (free up to 5, Pro up to 50). Does not explicitly exclude single-product cases but the sibling tools handle those.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.2check_eolget_product_lifecycleget_risk_scorelist_productsscan_stackScored across 5 tools
Each tool has a clear, distinct purpose: listing products, getting full lifecycle, checking EOL for a specific version, getting risk scores, and scanning a stack. No overlap in functionality.
All tool names follow a consistent snake_case verb_noun pattern (e.g., list_products, check_eol, scan_stack), making them predictable and easy to understand.
Five tools cover the core EOL domain without being too few or too many. Each tool earns its place, providing essential operations for managing end-of-life information.
The tool set covers the full workflow: discovering products, retrieving lifecycle details, checking EOL status, quantifying risk, and auditing a stack. No obvious missing operations.
Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.
AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.
Open-source licence risk checks for AI coding agents and dependency trees.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/endoflife-ai/endoflife-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server