EchelonGraph CVE & Exposure — Claude Code MCP server: how to install
Checks vulnerabilities across NVD, KEV, and EPSS while tracking real-world internet exposure from Shodan. Helps audit SBOM files and lockfile dependencies.
claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcpWhat EchelonGraph CVE & Exposure does
This server feeds vulnerability records into your assistant by combining NVD, CISA KEV, EPSS, and GitHub GHSA details into a unified score. It appends live exposure counts based on Shodan scan records for internet-facing systems. You do not need an account or an API token. Every request runs against the free public feed in read-only mode.
The server provides 16 tools to look up single flaws, inspect lockfiles, scan SBOM assets, and query CWE records. It exposes five ready-made prompt workflows alongside reference resources. Returned data objects declare measurement method, timestamp, and coverage metrics to avoid confusing missing data with a clean security bill. Running locally through npx requires Node.js 20 or newer.
What it helps with
- map CVE identifiers to consolidated risk metrics across feeds
- inspect real-world internet exposure using Shodan counts
- audit project lockfiles and SBOM artifacts for known flaws
- fetch recent additions to the CISA KEV catalog
Example prompts for the agent
- Check CVE-2023-44487 and report how many exposed internet hosts match it.
- Review
package-lock.jsonagainst known CVE entries and active exploit status. - List the latest vulnerability additions to the CISA KEV catalog.
How to install EchelonGraph CVE & Exposure
1Platform CLI: remote server
claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp2Platform CLI
claude mcp add --env ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> --env ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> --transport stdio echelongraph-cve-exposure -- npx -y echelongraph-mcpReplace <…> with your own values
1Platform CLI: remote server
codex mcp add echelongraph-cve-exposure --url https://mcp.echelongraph.io/mcp2Platform CLI
codex mcp add echelongraph-cve-exposure --env ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> --env ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> -- npx -y echelongraph-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"echelongraph-cve-exposure": {
"url": "https://mcp.echelongraph.io/mcp"
}
}
}{
"mcpServers": {
"echelongraph-cve-exposure": {
"command": "npx",
"args": [
"-y",
"echelongraph-mcp"
],
"env": {
"ECHELONGRAPH_API_BASE": "<ECHELONGRAPH_API_BASE>",
"ECHELONGRAPH_API_TIMEOUT_MS": "<ECHELONGRAPH_API_TIMEOUT_MS>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"echelongraph-cve-exposure": {
"type": "http",
"url": "https://mcp.echelongraph.io/mcp"
}
}
}{
"servers": {
"echelongraph-cve-exposure": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"echelongraph-mcp"
],
"env": {
"ECHELONGRAPH_API_BASE": "<ECHELONGRAPH_API_BASE>",
"ECHELONGRAPH_API_TIMEOUT_MS": "<ECHELONGRAPH_API_TIMEOUT_MS>"
}
}
}
}Replace <…> with your own values
1Platform CLI: remote server
gemini mcp add -t http echelongraph-cve-exposure https://mcp.echelongraph.io/mcp2Platform CLI
gemini mcp add -e ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> -e ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> echelongraph-cve-exposure npx -y echelongraph-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about EchelonGraph CVE & Exposure
How do I install EchelonGraph CVE & Exposure in Claude Code?
Run claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp.
Does EchelonGraph CVE & Exposure require an API key?
It runs keyless without authentication, making read-only requests to the public API feed.
What are the prerequisites for running locally?
Running the local stdio server via npx requires Node.js 20 or later installed on your system.
