echelongraph-mcp 2.5.0 → 2.5.1

package/CHANGELOG.md

@@ -6,6 +6,12 @@ with a provenance attestation by the release workflow of
 [github.com/echelongraph/echelongraph-mcp](https://github.com/echelongraph/echelongraph-mcp),
 from the commit tagged `v<version>`.
 
+## 2.5.1 — 2026-10-04
+
+- `search_cves` sends its search text in the `X-EG-Search` request header instead of the URL
+  query string, so the text is kept out of request URLs, which the hosting platform's tracing
+  records (#1983). Severity, minimum CVSS, sort and limit stay in the query string.
+
 ## 2.5.0 — 2026-10-04
 
 - Four prompts (`triage_cve`, `kev_weekly_brief`, `am_i_affected`, `sbom_review`) and three

package/README.md

@@ -626,7 +626,7 @@ Where each tool's input travels:
 | Input | Where it is sent |
 |---|---|
 | A CVE ID (`get_cve`, `cve_exposure`, `epss_history`, `cve_intel`, `vendor_advisories_for_cve`), a CWE ID and page (`get_cwe`), a vendor and advisory ID (`get_vendor_advisory`) | The URL path. |
-| `search_cves`: the search text, severity, minimum CVSS, sort and limit | The URL query string. |
+| `search_cves`: `search` | The `X-EG-Search` request header, never the URL. Its severity, minimum CVSS, sort and limit go in the query string. |
 | `search_vendor_advisories`: `query` | The `X-EG-Advisory-Search` request header, never the URL. Its vendor, severity, CVE filter, limit and offset go in the query string. |
 | `check_affected`: `product`, `version`, `ecosystem`, `package` | The `X-EG-Product`, `X-EG-Version`, `X-EG-Ecosystem` and `X-EG-Package` request headers, never the URL. |
 | `kev_recent`: `since`, `until`, `ransomware`, `vendor`, `limit`, `cursor` | The `X-EG-Since`, `X-EG-Until`, `X-EG-Ransomware`, `X-EG-Vendor`, `X-EG-Limit` and `X-EG-Cursor` request headers, never the URL. |

package/dist/index.js

@@ -521,9 +521,10 @@ async function cveSummary() {
 async function searchCVEs(a) {
     const tool = "search_cves";
     try {
+        // #1983: the free-text search travels percent-encoded in X-EG-Search, never in the URL. Cloud
+        // Run keeps every request URL in its trace spans for 30 days and no request header; core-backend
+        // (cve/handler.go listSearchTerm) reads the header first and decodes it with url.PathUnescape.
         const q = new URLSearchParams();
-        if (a.search)
-            q.set("search", a.search);
         if (a.severity)
             q.set("severity", a.severity);
         if (a.min_cvss !== undefined)
@@ -531,7 +532,7 @@ async function searchCVEs(a) {
         if (a.sort)
             q.set("sort", a.sort);
         q.set("limit", String(a.limit ?? 20));
-        const r = await api(`/api/v1/public/cves?${q.toString()}`);
+        const r = await api(`/api/v1/public/cves?${q.toString()}`, a.search ? { headers: { "X-EG-Search": encodeURIComponent(a.search) } } : undefined);
         if (!r.ok)
             return failed(tool, r);
         const head = okHead(tool, r.status);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echelongraph-mcp",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "mcpName": "io.echelongraph/echelongraph-mcp",
   "description": "EchelonGraph CVE and internet-exposure data as an MCP server: CVEs with EchelonGraph multi-source scores, CISA-KEV and EPSS, plus a per-CVE internet-exposure footprint derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Free and keyless, for Claude, Cursor and any MCP client.",
   "type": "module",

package/server.json

@@ -17,7 +17,7 @@
       ]
     }
   ],
-  "version": "2.5.0",
+  "version": "2.5.1",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "echelongraph-mcp",
-      "version": "2.5.0",
+      "version": "2.5.1",
       "transport": {
         "type": "stdio"
       },