Stack Facts

List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.

Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.

Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.

Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.

Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.

Takes no parameters.

Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.

Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.

List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.

Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.

Takes no parameters.

Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.

Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.

Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.

List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.

Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.

Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.

Takes no parameters.

Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.

Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.

Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.

Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.

Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.

Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.

Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.

Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.

Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.

Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.

Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.

Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.

Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.

Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.

Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.

Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.

Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.

Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.

Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.

Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.

Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.

Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.

List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.

Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.

Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.

Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.

Takes no parameters.