Log inSubmit server
Endoflife.ai — Software Lifecycle Intelligence logo

Endoflife.ai — Software Lifecycle Intelligence

Check software EOL status, risk, lifecycle schedules, KEV exposure, stack inventories, SBOMs, and edge-device support.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Endoflife.ai — Software Lifecycle Intelligence

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "endoflife-ai-software-lifecycle-intelligence": {
      "command": "npx",
      "args": [
        "-y",
        "endoflife-mcp"
      ],
      "env": {
        "ENDOFLIFE_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 10 tools correctly (4d ago).

Overview

endoflife.ai — Software Lifecycle Intelligence MCP server exposes software lifecycle data and risk analysis to AI agents over Streamable HTTP. It checks version support, scores EOL risk, audits stacks and CycloneDX or SPDX SBOMs, tracks exploited vulnerabilities, and reports upcoming EOL dates. Use it when an agent needs sourced lifecycle answers for dependencies, infrastructure, appliances, or upgrade planning. The hosted endpoint works without a key for individual use, while self-hosted deployments can forward an API key to the upstream service.

Use cases

  • Check whether a dependency version is still supported
  • Audit a package or container stack for EOL risk
  • Scan a CycloneDX or SPDX SBOM
  • Find products reaching EOL this quarter
  • Review edge devices against support deadlines

Key features

  • Version EOL status and source URLs
  • Four-factor EOL Risk Scores
  • Stack and SBOM auditing
  • CISA KEV and exploited-vulnerability exposure
  • Upcoming EOL and lifecycle history queries
  • Edge-device status and upgrade paths

Tools10

What Endoflife.ai — Software Lifecycle Intelligence lets your agent do. Expand a tool for its parameters.

Verified live~1.6k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 57d

What it can do

From the 10 tools this server returned when we ran it; 10 declare their own safety hints.

Makes network requests · 1Read-only tools · 10
Tool definitions changed on 2026-10-22. Review them if you approved this server earlier.
Network at startup4 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age62 days
Maintainers1

Observed 2026-11-04 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 19h ago via OSV.dev · endoflife-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads442Package downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed10Callable tools this server registers over MCP.

How Endoflife.ai — Software Lifecycle Intelligence works

What endoflife.ai — Software Lifecycle Intelligence does

endoflife.ai — Software Lifecycle Intelligence provides read-only MCP tools for investigating software support status, lifecycle dates, and security-related risk. It tracks more than 700 products and returns source URLs with lifecycle answers. The service can identify whether a product version is supported, show its EOL date, report days remaining or past EOL, and identify the latest release.

Risk analysis includes a score from 0 to 100 and a breakdown covering EOL recency, attack surface, CISA Known Exploited Vulnerabilities exposure, and extended support. A stack scan accepts products with optional versions, while SBOM analysis accepts CycloneDX or SPDX JSON. Components that cannot be matched are reported rather than guessed.

The tools also cover complete product version histories, upcoming EOL events, exploited-vulnerability records, edge-device end-of-support status, and upgrade targets. Edge-device results use the status vocabulary from CISA BOD 26-02 and can be filtered by platform, vendor, status, or model line.

How it works

The server runs as a dependency-free Cloudflare Worker and exposes MCP through Streamable HTTP. It proxies endoflife.ai API endpoints and published feeds rather than maintaining a separate copy of the lifecycle data. Calls are read-only, idempotent, and return both JSON text and structured content. Product lookup supports substring search, and lookup misses can include suggested canonical slugs.

Use list_products before other product-specific calls when the product name may not match the tracked slug. check_eol answers a specific support question; get_risk_score quantifies a version or product; scan_stack and check_sbom assess inventories; and get_upgrade_path identifies supported releases after an EOL result. get_kev_exposure adds CISA KEV and Exploited & Unpatchable records.

Setup and configuration

The hosted MCP endpoint is https://mcp.endoflife.ai. Clients with remote MCP support can use that URL directly. Other clients can connect through an MCP remote bridge using the endpoint as its target. The repository also includes a Node-based container implementation with / for MCP JSON-RPC, /health for health checks, and a discovery-card endpoint.

For a self-hosted deployment, set ENDOFLIFE_API_KEY. The server forwards that key as X-API-Key when a request does not provide its own key. Anonymous self-hosted data requests are scheduled to stop working on November 16, 2026 at 00:00 UTC; the hosted endpoint remains keyless for its stated individual-use allowance. Free and paid API tiers impose different request and per-call limits, so larger stack or SBOM audits may require a paid tier.

Tools and capabilities

  • Check version EOL status, dates, latest releases, and evidence sources.
  • Calculate risk scores with four-factor explanations.
  • Scan product lists, CycloneDX documents, and SPDX documents.
  • Search tracked products and retrieve full lifecycle histories.
  • Find KEV exposure, exploited and unpatchable entries, and upcoming EOL dates.
  • Review edge-device support status and identify upgrade paths.

Limitations and notes

Call-size limits depend on the API tier. Without a key, stack and SBOM calls are limited; higher tiers allow more items, and excess entries are reported as not checked or not scored. SBOM matching resolves versions to release families and leaves unmatched components visible.

The server depends on the upstream API and published feeds. Self-hosted production deployment requires the repository's API service binding for the upstream Worker setup. Optional usage telemetry records tool name, client user agent, success or error, key status, and latency, but not request bodies. The endoflife.ai — Software Lifecycle Intelligence MCP server is suited to lifecycle and exposure assessment; it does not perform upgrades or modify the systems it reviews.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Endoflife.ai — Software Lifecycle Intelligence

endoflife.ai — Software Lifecycle Intelligence is an MCP server that connects AI agents to endoflife.ai lifecycle data and published feeds. Its main tools check EOL status, calculate risk scores, scan stacks and SBOMs, list products, inspect KEV exposure, find upcoming EOL dates, review edge-device status, and suggest upgrade paths.

Use the hosted endpoint at https://mcp.endoflife.ai through an MCP client that supports remote MCP, or run the repository's Node container for self-hosting. The container exposes Streamable HTTP JSON-RPC and health endpoints. Self-hosted deployments should set ENDOFLIFE_API_KEY for API access after November 16, 2026.

Yes, it works with Cursor through MCP configuration. Configure the server with the hosted URL, or use an MCP remote bridge with the hosted endpoint as its target. The repository documents Cursor alongside Claude Desktop and VS Code.

Call `check_sbom` with CycloneDX or SPDX JSON as a string or object. The tool maps components to tracked products, scores matched components up to the API tier limit, and reports unmatched components without guessing. Larger inputs return the scored subset and a count or note for components not scored.

Call `list_products` with an optional substring query before using product-specific tools. It returns matching canonical slugs, such as resolving a search for "postgres" to `postgresql`. Lookup misses can also return suggestions based on prefix, substring, or close edit distance.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewEndoflife.ai — Software Lifecycle Intelligence AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/endoflife-ai-software-lifecycle-intelligence?style=directory)](https://allmcps.com/mcp/endoflife-ai-software-lifecycle-intelligence)
HTML Embed
<a href="https://allmcps.com/mcp/endoflife-ai-software-lifecycle-intelligence"><img src="https://allmcps.com/api/badge/endoflife-ai-software-lifecycle-intelligence?style=directory" alt="Endoflife.ai — Software Lifecycle Intelligence on AllMCPs" /></a>