Stack Facts

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key. Sources: OSV.dev, CISA KEV, endoflife.date, LiteLLM and models.dev.

Skills

• stackfacts_eol_product
  List every release cycle of a product (Node.js, Python, Ubuntu…) and if it is still supported: EOL (end-of-life) date, support status, LTS, latest version.
  EOLend-of-life datessupport statusis <product> <version> still supportedrelease cyclesLTSendoflife.date
• stackfacts_eol_cycle
  Check if a version is still supported (is python 3.12 still supported?): one release cycle, its EOL (end-of-life) date, support status, LTS, latest patch.
  is <product> <version> still supportedEOLend-of-life datesupport statussupport untillatest patch versionLTS
• stackfacts_eol_check
  Check runtimes and OS versions for EOL: is each still supported? Up to 50 product@version pairs, end-of-life date, support status; unknowns get suggestions.
  check my stack for end-of-life versionsis <product> <version> still supportedEOLsupport statusdependency EOL auditbatch end-of-life check
• stackfacts_eol_image
  Check a container image for EOL: is node:18-alpine still supported? Maps its runtime, Java and base OS to end-of-life date and support status.
  is my docker image end-of-lifecontainer base image EOLis <product> <version> still supportedDockerfile FROM auditEOLsupport statusbase OS end-of-life
• stackfacts_eol_snapshot
  Download the signed EOL (end-of-life) snapshot (endoflife.date, MIT): support status of every product and cycle, still supported or not, plus its manifest.
  EOLend-of-life dataset downloadsupport statusis <product> <version> still supportedendoflife.date bulksigned snapshot
• stackfacts_kev_lookup
  Check if a CVE is actively exploited (CISA KEV): in_kev, date added, remediation due date, required action and known ransomware use.
  check if a CVE is actively exploited (CISA KEV)known exploited vulnerabilityCISA KEV lookupCVE exploited in the wild
• stackfacts_kev_check
  Check up to 100 CVEs at once against CISA KEV (known exploited vulnerabilities); returns in_kev and the KEV details for each one.
  check if a CVE is actively exploited (CISA KEV)batch CVE checkvulnerability scan triageknown exploited vulnerabilities
• stackfacts_kev_changes
  List CVEs added to, removed from or changed in CISA KEV since a snapshot_id, so an agent can poll for newly exploited vulnerabilities.
  new CISA KEV entriesnewly exploited vulnerabilitiesKEV change feedcheck if a CVE is actively exploited (CISA KEV)
• stackfacts_kev_snapshot
  Download the full signed CISA KEV snapshot: every known exploited vulnerability, with a manifest to verify the sha256 and signature.
  CISA KEV downloadknown exploited vulnerabilities catalogsigned snapshot
• stackfacts_models_lookup
  Get an LLM model's price per million tokens (input, output, cached), context window, max output, capabilities and model deprecation date.
  price per million tokenscontext windowmodel deprecation dateLLM pricingmax output tokens
• stackfacts_models_estimate
  Estimate the USD cost of an LLM call from input, output and cached token counts, exact to the micro-dollar, with the price lines used.
  LLM cost estimateprice per million tokenstoken cost calculatorhow much will this prompt cost
• stackfacts_models_cheapest
  Find the cheapest model with tools and 128k context, or any limits you set: ranks the 10 cheapest LLMs by blended price per million tokens.
  cheapest model with tools and 128k contextcheapest LLMprice per million tokenscontext windowmodel comparison
• stackfacts_models_changes
  List LLM models added, removed or changed (price per million tokens, context window, model deprecation date) since a snapshot_id.
  LLM price changesmodel deprecation datenew LLM modelsprice per million tokens
• stackfacts_models_watch
  Check LLMs for what changed since your last call: changed records (with today's price and limits), removals, deprecated or soon deprecated, with snapshot dates.
  watch LLM prices and deprecationsUse when the models you call may change price or be deprecatedmodel deprecation alertLLM price change monitorwhat changed for my models since my last check
• stackfacts_models_snapshot
  Download the full signed LLM model catalogue (LiteLLM + models.dev, MIT): prices, limits and capabilities, with a verifiable manifest.
  LLM pricing datasetprice per million tokenscontext windowsigned snapshot
• stackfacts_stack_check
  Check dependencies, runtimes and OS versions in one call: OSV for up to 50 purls, EOL for 50 product@version pairs, CISA KEV hits, suggestions for unknowns.
  check my stack for end-of-life versions and exploited CVEsstack auditEOL, package vulnerabilities and KEV in one callis <product> <version> still supporteddependency risk checkknown exploited vulnerabilities
• stackfacts_osv_check
  Check dependencies or a lockfile for vulnerable and malicious packages: up to 50 purls, or a package-lock, yarn.lock, requirements.txt or poetry.lock, on OSV.
  check my dependencies for known vulnerabilitiesis <package> <version> vulnerableOSVpurlnpm PyPI Go crates.io Maven advisoriesGHSAfixed versionknown exploited vulnerabilitiesmalicious package checklockfile scanpackage-lock.json yarn.lock requirements.txt poetry.lock
• stackfacts_preflight
  Call before installing a package an LLM suggested: one npm, PyPI or purl version against OSV, CISA KEV and EOL data. Returns ok, warn or block with reasons.
  call before installing a package an LLM suggestednpm install checkpip install checkpackage preflightmalicious package checkknown exploited vulnerabilitiesOSVpurl
• stackfacts_cve_lookup
  Get any CVE: CISA KEV entry, CVSS score and patch priority, plus every OSV advisory aliased to it, with affected packages and fixed versions.
  get a CVECVE lookupCVE detailsCVE fixed versionCVE affected packagesCVSS scoreOSVCISA KEVCVE priority
• stackfacts_cwe_lookup
  Get one MITRE CWE weakness by id (79 or CWE-79): name, status, description and MITRE link. From the CWE catalogue (v4.20); MITRE notice on every answer.
  CWE lookupCWE weaknesscommon weakness enumerationCWE nameCWE descriptionMITRE CWE
• stackfacts_technique_lookup
  Get one technique by id (T1055.011): name, tactics, platforms, description, mitigations, detection, data sources and link. MITRE ATT&CK v20.0; credited.
  technique lookupadversary techniqueattack technique idtechnique tacticstechnique platformsMITRE technique
• stackfacts_capec_lookup
  Get one MITRE CAPEC attack pattern by id: severity, likelihood, prerequisites, mitigations, related CWE and ATT&CK ids and MITRE link.
  CAPEC lookupCAPEC attack patterncommon attack pattern enumerationattack pattern mitigationsCAPEC descriptionMITRE CAPEC
• stackfacts_domain_lookup
  Get the public suffix, registrable domain and subdomain of a host name from the Mozilla Public Suffix List, with the matching rule and section.
  public suffixregistrable domaineTLD+1domain splitsubdomain parserPublic Suffix Listeffective TLD
• stackfacts_port_lookup
  Get the IANA service name, transport, description and reference for a port number from the IANA Service Name and Transport Protocol Port Number Registry.
  port numberIANAservice namewell-known portsport lookupTCP portUDP portservice names and port numbers
• stackfacts_control_lookup
  Get one NIST SP 800-53 Rev 5 security control or enhancement by id (AC-2, AC-2(1)): title, statement, guidance, related controls and status.
  NIST SP 800-53security controlscontrol cataloguecomplianceOSCALcontrol enhancementFedRAMPaccess control
• stackfacts_bcp47_lookup
  Get an IANA language tag (en-AU, zh-Hant) part by part: type, description, scope, deprecation and preferred value from the Language Subtag Registry.
  BCP 47language taglocaleIANA language subtag registryRFC 5646ISO 639script subtagregion subtag
• stackfacts_tz_lookup
  Get an IANA time zone (Europe/Berlin) or alias: current UTC offset, abbreviation, DST summary and backward-compatible names from tzdata.
  time zoneIANA time zonetz databasetzdataUTC offsetdaylight savingDSTtimezone abbreviation
• stackfacts_package_card
  Get an npm or PyPI package's latest version, publish dates, deprecation or yank, SPDX licence, repository and runtime range.
  package metadatalatest versionnpm packagePyPI packagepackage licenceSPDX licencedeprecated packageyanked release
• stackfacts_license_check
  Call before adding a dependency: check SPDX licences or packages against your project licence and use, with a compatibility verdict per item.
  licence compatibilitylicense compatibilitySPDX licence checkGPL compatiblecopyleft licencedependency licenceopen source licence policyAGPL SaaS
• stackfacts_cve_prioritize
  Call before patching: rank up to 100 CVEs by CISA KEV status, then CVSS base score.
  CVE prioritizationexploit predictionKEVvulnerability triagepatch priorityCVE rankingknown exploited
• stackfacts_cve_search
  Find CVEs by keyword or package name in CISA KEV and OSV (not all of NVD), with KEV status and CVSS v3 where an OSV advisory has one.
  CVE searchsearch vulnerabilities by keywordCVEs for a packageKEVknown exploitedvulnerability lookup by productOSV advisories
• stackfacts_package_preflight
  Call before installing an npm or PyPI package: latest or given version, licence, OSV vulns, CISA KEV CVEs, deprecation or yank. Returns ok, caution or block.
  call before npm installcall before pip installpackage preflightis this package safelatest versionpackage licencedeprecated packageknown exploited vulnerabilities
• stackfacts_upgrade_delta
  Check moving an npm or PyPI package from one version to another: advisories fixed or introduced, KEV, licence, runtime. Returns go, review or no_go.
  is this upgrade safenpm upgrade checkpip upgrade checkupgrade package versionversion bump riskvulnerabilities fixed by upgradebreaking upgradedependency upgrade decision
• stackfacts_lockfile_diff
  Check npm or PyPI purl lists or raw lockfiles: upgrades judged on advisories, KEV, licence; same version, other hash = hash_mismatch. Returns go, review, no_go.
  lockfile diffcompare lockfilesdependency diffpackage.json diffrequirements diffdependency update riskpull request dependency checkdependabot review
• stackfacts_stack_watch
  Check dependencies, runtimes and OS versions for what changed since your last call: EOL passed or near, new OSV advisories, new CISA KEV hits. Returns a token.
  watch my stack for end-of-life and new exploited CVEsUse when you need to know what changed in a stack since your last checkstack monitordependency monitorwhat changed since my last checkalert when a version reaches end of lifenew vulnerabilities in my packages
• stackfacts_preview
  Preview a dataset for free: sample end-of-life products, newest CISA KEV entries, LLM prices, a package card or a licence verdict.
  free sampleend-of-life datesCISA KEVprice per million tokens
• stackfacts_try
  Try a paid answer for free on a fixed example: nodejs end-of-life cycles, CVE-2021-44228 in CISA KEV, or openai/gpt-4o prices.
  free exampletry before payingcheck if a CVE is actively exploited (CISA KEV)
• stackfacts_index
  List the valid ids for free: end-of-life product names and aliases, or LLM provider/model ids, so a paid call never misses.
  product listmodel listvalid idsaliases
• stackfacts_validate
  Validate an id for free. Privacy: only an unknown EOL id is logged (access log, miss field); a 400 logs the input name, never its value. No other id is stored.
  validate idcheck before payingproduct exists
• stackfacts_manifest
  Get the signed manifest of a dataset's latest snapshot for free: snapshot_id, sha256, record count, source, licence and signature.
  signed manifestsnapshot_iddata freshnessprovenance
• stackfacts_keys
  Get the Ed25519 public keys (JWK) that verify the signature on every answer and snapshot manifest.
  public keyverify signatureJWKSEd25519

How to call

https://g5joilnmeep4ntz3nwezxt5dmu.srv.us

Listed in

Directories this entry was found in.