EchelonGraph MCP server

Real-time CVE & internet-exposure intelligence for Claude, Cursor, Cline, and any MCP client — straight from EchelonGraph's free public feed.

It exposes EchelonGraph's CVE Pulse (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, fused into one score) plus the one thing no other CVE source has: the live internet-exposure footprint of a CVE — how many internet-exposed hosts are running an affected version right now.

No API key. No auth. Read-only.

Tools

| Tool | What it does | |---|---| | cve_summary | Live counts of active CVEs by severity + feed freshness. | | search_cves | Search/filter CVEs (severity, min CVSS, text, sort) with EchelonGraph scores. | | get_cve | Full detail for one CVE (CVSS v3/v4, EG score, EPSS, KEV+ransomware, GHSA, CWE, references). | | cve_exposure | Unique: live internet-exposure footprint for a CVE — exposed host count + country/product breakdown. | | exposure_radar | Live totals across the exposure radars (shadow AI, KEV-exploited hosts, open databases, leaked creds). |

Install

Add it to your MCP client's config. It runs via npx — no global install needed.

Claude Desktop

claude_desktop_config.json → mcpServers:

{
  "mcpServers": {
    "echelongraph": {
      "command": "npx",
      "args": ["-y", "echelongraph-mcp"]
    }
  }
}

Cursor / Cline / Windsurf

~/.cursor/mcp.json (or the client's MCP settings):

{
  "mcpServers": {
    "echelongraph": {
      "command": "npx",
      "args": ["-y", "echelongraph-mcp"]
    }
  }
}

Restart the client, then ask: "Is CVE-2023-44487 actively exploited, and how exposed is the internet to it?"

Configuration

| Env var | Default | Purpose | |---|---|---| | ECHELONGRAPH_API_BASE | https://app.echelongraph.io | Override the API base (self-host / proxy). |

Develop

npm install
npm run build      # tsc → dist/
npm run smoke      # spawn the server + call cve_exposure against the live API

License

MIT · Data © EchelonGraph, served under the CVE Pulse free-access terms.