INDIVIDUAL MCP TOOL

get_vendor_advisory

One vendor advisory in full, by vendor and the vendor's advisory ID (the vendor and vendor_advisory_id fields of a row from search_vendor_advisories or vendor_advisories_for_cve): title, description, severity, cvss_v3_score, cve_ids and known_cve_ids (those with a record in EchelonGraph's CVE feed), affected_products, remediation, references, vendor_modified_at, and withdrawn_at and withdrawn_reason when the vendor withdrew it.

echelongraph.ionone authenticationAvailability not checked

LIVE ENDPOINT

https://mcp.echelongraph.io/mcp

No auth detected

Connect to this endpoint to inspect the live schema for get_vendor_advisory and invoke it with your own arguments.

Indexed input schema

{}

Risk classification

Inferred read-only · medium confidence · heuristic, not a guarantee.

No write-capable action terms were found; this is not proof that invocation has no side effects.

Parent server

echelongraph.io

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.echelongraph-mcp]
url = "https://mcp.echelongraph.io/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "echelongraph-mcp": {
      "type": "http",
      "url": "https://mcp.echelongraph.io/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: echelongraph-mcp
Remote MCP URL: https://mcp.echelongraph.io/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "echelongraph-mcp": {
      "url": "https://mcp.echelongraph.io/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "echelongraph-mcp": {
      "type": "http",
      "url": "https://mcp.echelongraph.io/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "echelongraph-mcp",
  "transport": "streamable-http",
  "url": "https://mcp.echelongraph.io/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

Related tools

cve_summary — Summary of EchelonGraph's CVE Pulse feed: summary.
search_cves — Search/list CVEs from EchelonGraph's CVE feed (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, each polled on a schedule).
get_cve — Full record for one CVE: description, severity, cvss_v3_score, cvss_v4_score and cvss_v4_severity (when the record has a CVSS v4 score), echelongraph_score and echelongraph_severity with score_confidence (EchelonGraph's multi-source score) and score_assessed (whether EchelonGraph has scored it), epss_score and epss_percentile, CISA-KEV status (kev_listed, kev_added_date, and kev_ransomware for known ransomware-campaign use), ghsa_id (GitHub GHSA), references, cpe_match (the CPE criteria as one flat list) and cpe_configurations (NVD's configurations as NVD sent them, with each AND/OR operator, negate, versionStartExcluding and matchCriteriaId; absent where EchelonGraph has stored none, which is not a finding that no product is affected), published, modified and updated_at; each field only where the record has it.
cve_exposure — Internet-exposure footprint for one CVE from EchelonGraph's KEV-exposure radar: how many internet-facing services (distinct ip:port, returned as exposed_hosts; a machine answering on two ports counts twice) the radar has on record running a version its CVE matcher maps to this CVE, with a country/product breakdown and a ransomware flag.
exposure_radar — Aggregate totals from EchelonGraph's internet-exposure radars, each refreshed on its own schedule: internet-facing services running actively-exploited (CISA-KEV) CVEs, plus the ransomware-linked subset, derived from Shodan data; unauthenticated data stores and observability UIs, found through Shodan (LeakIX when Shodan query credits run low) and then confirmed by EchelonGraph's own identified check (not a pure read: on Redis it names its client, and on ClickHouse its query is recorded in the server's query log); leaked credentials sampled from public GitHub push events; and shadow AI services found through Certificate Transparency logs and Shodan and then checked by EchelonGraph's identified probes.
kev_recent — The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes.
epss_history — How one CVE's EPSS score (FIRST's exploit-prediction probability, 0 to 1, with its percentile) has changed, as EchelonGraph recorded it: points, oldest first, each with at, epss_score and epss_percentile; current, the record's value now (epss_score, epss_percentile, epss_updated_at); series_kind, always change_only; series_starts_at, when EchelonGraph began recording EPSS changes for any CVE; history_rows, points_truncated and latest_point_matches_current.
check_affected — Whether a product or package at a given version is affected by known CVEs, from the same matcher as echelongraph.