This server lets AI agents query endoflife.ai lifecycle data over MCP — checking EOL status, risk scores, and upgrade paths for software products.
check_eol: Find out if a specific product version is end-of-life, with EOL date, days remaining/overdue, and latest release.
get_risk_score: Get a 0–100 EOL Risk Score™ with a four-factor breakdown (EOL recency, attack surface, CISA KEV exposure, extended support) for a product or version.
scan_stack: Audit an entire software stack at once, returning risk scores for each component (up to 5 free, 50 with Pro).
list_products: Search the 480+ tracked products to resolve canonical slugs.
get_product_lifecycle: Get full version history and EOL schedule for a product, including dates and support status.
get_kev_exposure: See every CISA KEV entry attributed to a product, including due dates and required actions, plus exploited/unpatchable entries.
get_upcoming_eol: List everything reaching EOL in the next N days, catalog-wide or for selected products.
get_edge_device_status: Check the EOS Edge Device feed with BOD 26-02 statuses, filterable by platform/status/model.
get_upgrade_path: Find supported targets, site recommendations, and vendor-stated successors.
check_sbom: Submit a CycloneDX or SPDX SBOM, get components resolved/scored via package URLs or names, with unmatched items listed and reasons.
Resources & Prompts: Read LLMs.txt, KEV feeds, edge device feeds via MCP resources; use prompts for stack audits, EOL calendars, and edge device reviews.
Runs anywhere: Available as a hosted MCP endpoint, a local container, or a Cloudflare Worker.
This server has a remotely hosted endpoint. Open its connector listing for connection details, authentication requirements, and setup instructions:
Exposes endoflife.ai's lifecycle intelligence to AI agents over the Model Context
Protocol (MCP, Streamable HTTP transport). A dependency-free Cloudflare Worker
that wraps the public api.endoflife.ai/v1 endpoints and the site's published
feeds — no data duplicated, every answer carries a source URL.
Current version: 1.4.0 (SERVER_INFO.version in src/index.js, server.json,
package.json, the Dockerfile ARG VERSION, and the site's
endoflife/.well-known/mcp/server-card.json — keep them in step; the registry and
Glama read server.json).
1.4.0: check_sbom is a thin proxy to the API's POST /v1/sbom (one resolver for
every surface; versions keep their release family, e.g. python 3.12, ubuntu 20.04).
Above the tier cap it returns the scored subset plus limit_note and
not_scored_count; scan_stack scores the first N the tier allows and lists the rest
in not_checked. Until 1.4.0 check_sbom cut every version to its major number and a
keyless SBOM with more than 5 matched components returned nothing.
Tool | What it does | Backed by |
| Is product X version Y end-of-life? |
|
| EOL Risk Score (0–100) + factor breakdown |
|
| Score a whole stack at once |
|
| Search the 700+ tracked products → resolve slugs |
|
| Full version history + dates for one product |
|
| Every CISA KEV entry attributed to a product (date added, due date, required action verbatim) + Exploited & Unpatchable entries |
|
| Everything reaching EOL in the next N days (catalog-wide or a product list) |
|
| EOS Edge Device feed with BOD 26-02 statuses, filter by platform / status / model |
|
| Supported targets, the site's recommendation, vendor-stated successor |
|
| CycloneDX / SPDX JSON → components resolved by package URL (exact, purl-map.json) or by name when no purl → scored up to the tier cap, the rest counted in a note; unmatched listed with a reason, never guessed |
|
Every tool advertises annotations (readOnlyHint, idempotentHint) and a
permissive outputSchema; results are returned both as JSON text and as
structuredContent. Lookup misses return "did you mean" slug suggestions
(prefix / substring / edit-distance ≤ 2 against the live product list).
Resources (resources/list / resources/read): llms.txt, the EOS Edge Device
feed, Exploited & Unpatchable, KEV by product, the edge change log.
Prompts (prompts/list / prompts/get): audit_stack, eol_calendar,
edge_device_review.
Endpoints: POST / (JSON-RPC), GET / (info page), GET /health (liveness JSON),
GET /.well-known/mcp/server-card.json (discovery card).
Related MCP server: @4da/mcp-server
With the USAGE Analytics Engine binding (see wrangler.toml, dataset
endoflife_mcp_usage) each method / tool call writes one data point: tool name,
client user agent, ok/error, keyed/anon, latency in ms. No request bodies. Query
via the Cloudflare Analytics Engine SQL API, e.g.
SELECT blob1 AS tool, count() AS calls, sum(_sample_interval) AS weighted
FROM endoflife_mcp_usage WHERE timestamp > NOW() - INTERVAL '7' DAY
GROUP BY tool ORDER BY calls DESCThe binding is optional; the code no-ops without it.
Production deploys run from GitHub Actions, never a local wrangler:
gh workflow run mcp-server-deploy.yml(.github/workflows/mcp-server-deploy.yml, pinned wrangler; needs the
CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID repository secrets.) Local
wrangler dev still works for development; the API service binding and the
USAGE dataset are declared for both the default and production environments.
The route in wrangler.toml needs mcp.endoflife.ai to resolve through Cloudflare:
an AAAA record, name mcp, IPv6 100::, proxied. Already in place.
A Node harness exercises every method against the live API and feeds (the module
runs unchanged in Node with env.API = { fetch }):
node scratch/mcp_test.mjs # see the session scratchpad; 22 RPC calls, expects 0 failuresOffline unit tests (fetch mocked, no network): npm test in mcp-server/
(node --test test/).
server.mjs runs the same handler that serves mcp.endoflife.ai inside a plain Node.js process, and Dockerfile packages it on registry.access.redhat.com/ubi9/nodejs-22-minimal for cluster deploys (the form the OpenShift AI MCP catalog expects). No build step, no dependencies; the container talks to https://api.endoflife.ai over HTTPS and runs as the unprivileged UBI user (uid 1001).
docker build -t endoflife-mcp mcp-server/
docker run --rm -p 8080:8080 endoflife-mcp
curl -s localhost:8080/healthEndpoints are the Worker's own: POST / (Streamable HTTP JSON-RPC), GET /health (readiness), GET /.well-known/mcp/server-card.json. Set ENDOFLIFE_API_KEY (docker run -e ENDOFLIFE_API_KEY=...) and the server sends it as X-API-Key on every call that carries no key of its own. A self-hosted server needs it from November 16, 2026 at 00:00 UTC, when the API stops answering data requests without a key; only the hosted endpoint at mcp.endoflife.ai stays keyless. A free key is emailed at once from https://endoflife.ai/api#free-key (150 requests a day, no expiry; higher volume is on a paid key). Validated on RHEL 9 and 10 with Node 20 and 22 by .github/workflows/rhel-validation.yml (evidence in docs/company/redhat-validation-evidence.md).
Claude Desktop / Cursor / VS Code (mcpServers):
{
"mcpServers": {
"endoflife": { "command": "npx", "args": ["mcp-remote", "https://mcp.endoflife.ai"] }
}
}Clients with native remote-MCP support can use the URL directly:
{ "mcpServers": { "endoflife": { "url": "https://mcp.endoflife.ai" } } }# tools/list
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq
# KEV exposure for a product
curl -s https://mcp.endoflife.ai -X POST -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_kev_exposure","arguments":{"product":"ivanti-connect-secure"}}}' | jq
# health + discovery card
curl -s https://mcp.endoflife.ai/health | jq
curl -s https://mcp.endoflife.ai/.well-known/mcp/server-card.json | jqThe read tools work with no key for individual use and evaluation through the hosted
endpoint mcp.endoflife.ai (each agent gets 200 a day and 5 per call). Calling the API
directly, or running this server yourself, works without a key only until November 16,
2026 at 00:00 UTC (anonymous tier: 50 requests a day, 3 components per SBOM or batch
call); from then every data request needs a key (set ENDOFLIFE_API_KEY on a
self-hosted server; free key at https://endoflife.ai/api#free-key). Agents that run inside a
company's tooling, check inventories or call on a schedule are production use and
belong on a paid key: Starter ($89/month, 10,000 requests a day, 25 per call) or
Pro ($199/month, no daily cap, 50 per call), issued at checkout from
https://endoflife.ai/api?utm_source=mcp#get-key. Forward it as an X-API-Key
header; the Worker passes it straight through to api.endoflife.ai.
Same-zone trap: api.endoflife.ai is a Worker on this zone; a plain fetch()
to it goes to origin and fails. The API service binding is mandatory in prod.
Static feeds are fetched from the site origin with cf.cacheTtl = 600 and
memoised in the isolate for 10 minutes.
Per-client rate limits: relies on the upstream API's limits. If MCP traffic
grows, add a KV rate-limiter keyed on CF-Connecting-IP before the upstream call.
Discovery card is also served from the main site at
https://endoflife.ai/.well-known/mcp/server-card.json.
Check whether a specific version of a software product is end-of-life (EOL). Returns lifecycle status, the EOL date, days remaining or days past EOL, and the latest release. Use this for "is X version Y still supported?" questions.
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "postgresql", "nodejs", "ubuntu". | |
| version | Yes | Version/cycle, e.g. "14", "18", "20.04". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description lists return values (lifecycle status, EOL date, days remaining, latest release) and indicates it's a read-only query. Does not disclose authentication requirements or rate limits, but sufficient for a simple check tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states purpose and outputs, second gives clear usage example. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description enumerates return values. Covers all necessary information for an agent to understand input, action, and expected output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage with descriptions for both parameters (product and version), including examples. Description does not add additional parameter meaning beyond what schema provides, meeting baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool checks EOL status for a specific product version, with verb 'check' and resource 'version of a software product'. It distinguishes from siblings like list_products and get_product_lifecycle by focusing on a single version's EOL status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Includes explicit usage example ('Use this for "is X version Y still supported?" questions') and context of when to use. Does not explicitly mention when not to use or alternatives, but sibling tool list provides implicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the full version history for one product: every tracked version/cycle with its release date, EOL date, support status, and EOL Risk Score™. Use for "give me the whole EOL schedule for X".
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "postgresql". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description does not disclose behavioral traits such as data freshness, authentication requirements, potential cost, or whether it invokes external APIs. It only describes output, not side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is two sentences with zero wasted words: first sentence defines function, second sentence provides usage context. Each sentence is informative and necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description lists key return fields (release date, EOL date, support status, risk score), which is fairly complete. It could clarify ordering or version count, but for a simple list tool it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% coverage for the one parameter, which is well-described. The description adds no additional semantics beyond what the schema provides, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it retrieves full version history for one product, listing specific fields (release date, EOL date, support status, risk score). It distinguishes from sibling tools like list_products (lists products) and check_eol (single check).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Use for "give me the whole EOL schedule for X"' gives a clear use case, but it does not specify when not to use it or mention alternatives among siblings like check_eol or get_risk_score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the proprietary EOL Risk Score™ (0–100) for a product version, with the four-factor breakdown (EOL recency, attack surface, CISA KEV exposure, extended support). Omit "version" to score the product's highest-risk (most recently end-of-lifed) release. Use this to quantify how dangerous it is to keep running something.
| Name | Required | Description | Default |
|---|---|---|---|
| product | Yes | Product slug or name, e.g. "openssl", "python". | |
| version | No | Optional version/cycle. Omit for the highest-risk release. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the output as a score 0–100 with a four-factor breakdown, and explains behavior when version is omitted. Although no annotations exist, the description adequately conveys the tool's read-only nature and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundant words. First sentence states purpose and output, second provides a usage tip. Perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return format (score and breakdown) sufficiently. It covers the key usage scenarios and parameter behavior, though it could briefly mention any prerequisites or limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already describes the parameters (product slug, optional version). The description repeats the hint about omitting version but adds no new semantic detail beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states what the tool does: 'Get the proprietary EOL Risk Score™ (0–100) for a product version' with a breakdown of four factors. It distinguishes from siblings like list_products and get_product_lifecycle by focusing on risk quantification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use ('Omit version to score the product's highest-risk release' and 'use this to quantify how dangerous it is to keep running something'), though it does not explicitly exclude scenarios or mention siblings as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List or search the products endoflife.ai tracks (480+). Pass an optional "query" substring to find the canonical slug for a product before calling the other tools (e.g. "postgres" → "postgresql"). Returns matching product slugs.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Optional case-insensitive substring filter. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It states the tool returns matching product slugs and supports case-insensitive substring filtering. However, it does not disclose potential limits like pagination, or the behavior when no query is provided (e.g., returns all). This is adequate but lacks full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no extraneous information. It is front-loaded with the primary action, then provides usage detail and what is returned. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (one optional parameter, no output schema), the description covers the main points: what it does, how to use the parameter, and the return value. It does not mention pagination or rate limits, but for a list/search tool of 480+ items, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already describes the query parameter. The description adds valued context by explaining the parameter's purpose (finding canonical slug for sibling tools) and providing a concrete example, going beyond the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool lists or searches products from endoflife.ai (480+), and distinguishes from siblings by explaining it retrieves canonical slugs for use with other tools. The example 'postgres' → 'postgresql' clarifies the resource and action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly suggests using this tool 'before calling the other tools' to find the canonical slug, providing a specific use case. It does not explicitly list alternatives or when not to use, but the context is well understood.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Audit a whole stack at once. Provide a list of products (optionally with versions) — e.g. parsed from a package.json, Dockerfile, or SBOM — and get an EOL Risk Score for each, so you can see what is unsupported and dangerous in one call. Free tier: up to 5 items; Pro: up to 50.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | List of stack components to score. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden. It discloses that the tool returns an EOL Risk Score per item, allows optional versions, and specifies tier limitations. No contradictory statements or hidden behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first covers purpose and examples, second covers tier limits. No filler, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description adequately explains input format, output (EOL Risk Score per item), and constraints. Could detail return structure more, but sufficient for the agent to understand usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both 'product' and 'version'. The description adds real-world examples (package.json, Dockerfile, SBOM) and explains the effect of omitting version (gets highest-risk release), going beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Audit' and the resource 'a whole stack', and explains it returns an EOL Risk Score for each product. It distinguishes itself from siblings like list_products and get_product_lifecycle by emphasizing batch processing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use: when you want to audit a stack at once, with examples like package.json, Dockerfile, or SBOM. Also mentions tier limits (free up to 5, Pro up to 50). Does not explicitly exclude single-product cases but the sibling tools handle those.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.2check_eolget_product_lifecycleget_risk_scorelist_productsscan_stackScored across 5 tools
Each tool has a clear, distinct purpose: listing products, getting full lifecycle, checking EOL for a specific version, getting risk scores, and scanning a stack. No overlap in functionality.
All tool names follow a consistent snake_case verb_noun pattern (e.g., list_products, check_eol, scan_stack), making them predictable and easy to understand.
Five tools cover the core EOL domain without being too few or too many. Each tool earns its place, providing essential operations for managing end-of-life information.
The tool set covers the full workflow: discovering products, retrieving lifecycle details, checking EOL status, quantifying risk, and auditing a stack. No obvious missing operations.
Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.
AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.
Open-source licence risk checks for AI coding agents and dependency trees.
Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap.