# EchelonGraph CVE & Exposure

Checks vulnerabilities across NVD, KEV, and EPSS while tracking real-world internet exposure from Shodan. Helps audit SBOM files and lockfile dependencies.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: echelongraph
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/echelongraph/echelongraph-mcp
- Updated: 2026-10-17
- HTML: https://affpapa.org/en/nevibecode/mcp/echelongraph-cve-exposure

## What it does

This server feeds vulnerability records into your assistant by combining NVD, CISA KEV, EPSS, and GitHub GHSA details into a unified score. It appends live exposure counts based on Shodan scan records for internet-facing systems. You do not need an account or an API token. Every request runs against the free public feed in read-only mode.

The server provides 16 tools to look up single flaws, inspect lockfiles, scan SBOM assets, and query CWE records. It exposes five ready-made prompt workflows alongside reference resources. Returned data objects declare measurement method, timestamp, and coverage metrics to avoid confusing missing data with a clean security bill. Running locally through `npx` requires Node.js 20 or newer.

## Requirements
- Needs: Node.js (commands run via npx)
- Remote server: `https://mcp.echelongraph.io/mcp`
- Environment variables: `ECHELONGRAPH_API_BASE`, `ECHELONGRAPH_API_TIMEOUT_MS` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http echelongraph-mcp https://mcp.echelongraph.io/mcp
```

2. **Platform CLI**
```bash
claude mcp add --env ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> --env ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> --transport stdio echelongraph-cve-exposure -- npx -y echelongraph-mcp
```
Replace <…> with your own values

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add echelongraph-cve-exposure --url https://mcp.echelongraph.io/mcp
```

2. **Platform CLI**
```bash
codex mcp add echelongraph-cve-exposure --env ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> --env ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> -- npx -y echelongraph-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "echelongraph-cve-exposure": {
            "url": "https://mcp.echelongraph.io/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "echelongraph-cve-exposure": {
            "command": "npx",
            "args": [
                "-y",
                "echelongraph-mcp"
            ],
            "env": {
                "ECHELONGRAPH_API_BASE": "<ECHELONGRAPH_API_BASE>",
                "ECHELONGRAPH_API_TIMEOUT_MS": "<ECHELONGRAPH_API_TIMEOUT_MS>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "echelongraph-cve-exposure": {
            "type": "http",
            "url": "https://mcp.echelongraph.io/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "echelongraph-cve-exposure": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "echelongraph-mcp"
            ],
            "env": {
                "ECHELONGRAPH_API_BASE": "<ECHELONGRAPH_API_BASE>",
                "ECHELONGRAPH_API_TIMEOUT_MS": "<ECHELONGRAPH_API_TIMEOUT_MS>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http echelongraph-cve-exposure https://mcp.echelongraph.io/mcp
```

2. **Platform CLI**
```bash
gemini mcp add -e ECHELONGRAPH_API_BASE=<ECHELONGRAPH_API_BASE> -e ECHELONGRAPH_API_TIMEOUT_MS=<ECHELONGRAPH_API_TIMEOUT_MS> echelongraph-cve-exposure npx -y echelongraph-mcp
```
Replace <…> with your own values

## When to use it
- map CVE identifiers to consolidated risk metrics across feeds
- inspect real-world internet exposure using Shodan counts
- audit project lockfiles and SBOM artifacts for known flaws
- fetch recent additions to the CISA KEV catalog

## Example prompts
- Check CVE-2023-44487 and report how many exposed internet hosts match it.
- Review `package-lock.json` against known CVE entries and active exploit status.
- List the latest vulnerability additions to the CISA KEV catalog.

## Similar
- [shodan](https://affpapa.org/en/nevibecode/mcp/w0h1v-shodan.md) — MCP server · ★ 180
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [patch-tuesday](https://affpapa.org/en/nevibecode/mcp/patch-tuesday.md) — MCP server · ★ 5
- [finding-triage](https://affpapa.org/en/nevibecode/skills/finding-triage.md) — skill · 360 installs
- [vuln-research](https://affpapa.org/en/nevibecode/skills/vuln-research.md) — skill · 350 installs
- [VulnCheck](https://affpapa.org/en/nevibecode/mcp/vulncheck.md) — MCP server · ★ 13

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md