echelongraph-mcp 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,11 +1,36 @@
 # Changelog
 
 Every version of `echelongraph-mcp` published to npm, newest first. Dates are the npm publish
-dates (UTC). Issue numbers refer to EchelonGraph's tracker. Since 2.3.3 each version is published
+dates (UTC). Issue numbers (#NNNN) refer to EchelonGraph's internal issue tracker, which is not public: they are not issues of the public repository, and cannot be followed from it. Since 2.3.3 each version is published
 with a provenance attestation by the release workflow of
 [github.com/echelongraph/echelongraph-mcp](https://github.com/echelongraph/echelongraph-mcp),
 from the commit tagged `v<version>`.
 
+## 2.6.0 — 2026-10-04
+
+- `check_sbom` checks up to 2,000 distinct purls per call, instead of refusing more than 200: it
+  sends them as consecutive batches of at most 200, merges the answers (rows in input order with
+  `index` counted across batches; summary counts and `not_assessed_by_reason` summed; `partial`
+  true when any batch's was), and waits out a 429's `Retry-After` within 50 seconds per call.
+  When a wait would pass that, or a batch after the first fails, it answers what it has, with the
+  purls not sent counted in `coverage.not_sent`, the reason in `coverage.not_sent_reason`, and
+  the list in `data.not_sent_purls`, never dropped silently. More than 2,000 is refused. New
+  coverage fields: `distinct_purls`, `batch_size`, `batches`, `batches_sent`, `not_sent`,
+  `not_sent_reason`, `rate_limit_waits`, `waited_ms`. The `sbom_review` prompt says so (#2734).
+- `kev_recent` reads an RFC 3339 timestamp for `since` or `until` (such as the
+  `kev_added_date` `get_cve` returns, `2024-04-12T00:00:00Z`) as its UTC date; other text is still
+  refused. The `triage_cve` prompt's step 6 says to pass the date part of `kev_added_date` (#2736).
+- README: the hosted endpoint, `https://mcp.echelongraph.io/mcp`, is described as in service,
+  no longer as being rolled out (#2739).
+- This changelog's preamble says the issue numbers refer to EchelonGraph's internal tracker,
+  which is not public (#2740).
+
+## 2.5.1 — 2026-10-04
+
+- `search_cves` sends its search text in the `X-EG-Search` request header instead of the URL
+  query string, so the text is kept out of request URLs, which the hosting platform's tracing
+  records (#1983). Severity, minimum CVSS, sort and limit stay in the query string.
+
 ## 2.5.0 — 2026-10-04
 
 - Four prompts (`triage_cve`, `kev_weekly_brief`, `am_i_affected`, `sbom_review`) and three

package/README.md

@@ -111,9 +111,9 @@ The same 14 tools, four prompts and three resources are served over Streamable H
 https://mcp.echelongraph.io/mcp
 ```
 
-Keyless, no sign-in, stateless; both protocol eras. The hosted endpoint is being rolled out:
-until `https://mcp.echelongraph.io/health` answers `{"status":"ok",…}`, use the `npx` setup
-above.
+Keyless, no sign-in, stateless; both protocol eras. The hosted endpoint is in service:
+`https://mcp.echelongraph.io/health` answers `{"status":"ok","version":…}` with the package
+version it runs.
 
 - **claude.ai** (Free, Pro, Max, Team and Enterprise plans):
   Customize → Connectors → **+ Add** → **Add custom connector**. Name it `EchelonGraph`, paste
@@ -162,7 +162,7 @@ The example questions are ones a client can answer with that tool alone.
 | `kev_recent` | Recent CISA KEV additions | The CVEs CISA has added to its Known Exploited Vulnerabilities catalog, newest first (`kev_added_date`), from EchelonGraph's copy of the catalog, polled from CISA every 5 minutes: due date, vendor, product, known ransomware use, EchelonGraph's severity, CVSS, EPSS and `eg_kev_tier`, and `our_first_seen_kev`. Filter by date range, ransomware and vendor; page with `limit` and `next_cursor`. Dated by `last_successful_fetch_at`, our last successful fetch of CISA's feed; the filters travel as request headers, never in the URL. | *Which CVEs has CISA added to KEV since 1 September, and which have known ransomware use?* |
 | `epss_history` | EPSS change history for one CVE | How one CVE's EPSS score has changed, as EchelonGraph recorded it: one point per recorded change (`series_kind` `change_only`), never a daily series, with the value now and `series_starts_at`, when recording began; before it a missing point means not recorded, not unchanged. | *How has CVE-2023-44487's EPSS score changed, as EchelonGraph recorded it?* |
 | `check_affected` | Am I affected? (product or package at a version) | Whether a product (its NVD CPE product token) or a registry package (`ecosystem` and `package`) at a given version is affected by known CVEs, from the matcher behind echelongraph.io/am-i-affected: `assessed` first (false: not evaluated, with `not_assessed_reason`, and a count of 0 then is not "not affected"), the matching CVEs with `kev_listed`, `ransomware`, `epss_score`, `effective_score` and `score_assessed`, and advisories it cannot decide counted as `undetermined_count`, never as safe. What you look up travels in request headers, never in the URL. | *Is openssl 3.0.0 affected by known CVEs? Is lodash 4.17.15 on npm?* |
-| `check_sbom` | Check an SBOM against the advisory corpus | A dependency list checked against EchelonGraph's advisory corpus (OSV.dev records), one verdict per component: `affected`, `not_affected`, `undetermined` or `not_assessed`, each with its `not_assessed_reason`. Pass up to 200 purls, or a CycloneDX JSON or SPDX JSON document: the purls are read from it on your machine and only they are sent, in a POST body; the document is not. A deb, apk or rpm purl without a `distro` qualifier naming its release is not assessed (`distro_release_unknown`): EchelonGraph does not guess a release. Only `not_affected` is clean. No ranking, no score. | *Check this CycloneDX SBOM against the advisory corpus.* |
+| `check_sbom` | Check an SBOM against the advisory corpus | A dependency list checked against EchelonGraph's advisory corpus (OSV.dev records), one verdict per component: `affected`, `not_affected`, `undetermined` or `not_assessed`, each with its `not_assessed_reason`. Pass up to 2,000 distinct purls, or a CycloneDX JSON or SPDX JSON document: the purls are read from it on your machine and only they are sent, in POST bodies of at most 200 each, one after another; the document is not. When the API's per-component rate limit answers 429, the tool waits the `Retry-After` it names, within 50 seconds per call; past that it answers what it has, with the purls not sent counted in `coverage.not_sent`, the reason in `coverage.not_sent_reason`, and the list in `data.not_sent_purls`, never dropped silently. A deb, apk or rpm purl without a `distro` qualifier naming its release is not assessed (`distro_release_unknown`): EchelonGraph does not guess a release. Only `not_affected` is clean. No ranking, no score. | *Check this CycloneDX SBOM against the advisory corpus.* |
 | `cve_intel` | CVE weakness, exploits and packages | Weakness, public exploit code, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment: `cwes`, `exploits` (at most 10, verified first) with `exploits_total`, `exploits_capped`, `exploits_by_kind` and `exploits_by_status`, `affected_packages`, `fixed_versions` and `timeline`. `verified_status` is the label stored with each reference, not a guarantee that the exploit works. An empty `exploits` list is not evidence that no public exploit exists; a section the API could not read is named in `coverage.sections_failed`, never relayed as an empty list. | *Is there public exploit code for CVE-2021-44228, and which versions fix it?* |
 | `get_cwe` | CWE and its CVEs | One CWE (weakness class) and the CVEs classified under it: `name` and `description` from the MITRE CWE catalog EchelonGraph embeds, `total`, and one page of 50 `cves`, ordered as `order` states (CISA-KEV-listed first, then EchelonGraph score). A `total` of 0 says that no CVE in EchelonGraph's feed is classified under that CWE, not that none exists. | *Which CVEs are classified under CWE-79, CISA-KEV-listed first?* |
 | `vendor_advisories_for_cve` | Vendor advisories for one CVE | The vendor-published advisories (Microsoft MSRC, Red Hat, Cisco, Palo Alto Networks, GitHub GHSA and the other feeds EchelonGraph polls) that name one CVE, newest first, at most 20. | *Which vendor advisories name CVE-2024-3400?* |
@@ -626,11 +626,11 @@ Where each tool's input travels:
 | Input | Where it is sent |
 |---|---|
 | A CVE ID (`get_cve`, `cve_exposure`, `epss_history`, `cve_intel`, `vendor_advisories_for_cve`), a CWE ID and page (`get_cwe`), a vendor and advisory ID (`get_vendor_advisory`) | The URL path. |
-| `search_cves`: the search text, severity, minimum CVSS, sort and limit | The URL query string. |
+| `search_cves`: `search` | The `X-EG-Search` request header, never the URL. Its severity, minimum CVSS, sort and limit go in the query string. |
 | `search_vendor_advisories`: `query` | The `X-EG-Advisory-Search` request header, never the URL. Its vendor, severity, CVE filter, limit and offset go in the query string. |
 | `check_affected`: `product`, `version`, `ecosystem`, `package` | The `X-EG-Product`, `X-EG-Version`, `X-EG-Ecosystem` and `X-EG-Package` request headers, never the URL. |
 | `kev_recent`: `since`, `until`, `ransomware`, `vendor`, `limit`, `cursor` | The `X-EG-Since`, `X-EG-Until`, `X-EG-Ransomware`, `X-EG-Vendor`, `X-EG-Limit` and `X-EG-Cursor` request headers, never the URL. |
-| `check_sbom`: `purls`, or an `sbom` document | The purls, in a POST body. A CycloneDX or SPDX document is read on your machine and only the purls in it are sent; the document is not. |
+| `check_sbom`: `purls`, or an `sbom` document | The purls, in POST bodies of at most 200 each. A CycloneDX or SPDX document is read on your machine and only the purls in it are sent; the document is not. |
 | `cve_summary`, `exposure_radar` | No input. |
 
 The API marks its answers to header-carried lookups `no-store`, so no shared cache keeps them,
@@ -663,7 +663,13 @@ Because the count is shared, heavy use of one path also uses up the lower ceilin
 that, 500 requests per second per caller is a burst cap on each serving instance, and
 `check_sbom`'s batch route is charged per component: 1,200 components a minute per caller.
 Over a limit the API answers 429 with `Retry-After`, and the tool returns a failure
-(`state` `failed`, `error.status` 429), never empty data. The API's own documentation of these
+(`state` `failed`, `error.status` 429), never empty data. `check_sbom` is the exception: it
+sends a long list as batches of 200, waits out a 429's `Retry-After` and sends the batch again,
+within 50 seconds per call (MCP clients time a call out at about 60 s). From a fresh budget a
+list of up to 1,200 distinct purls finishes in one call; a longer one (the cap is 2,000) is
+checked in two calls a minute apart. When a wait would pass the 50 seconds, it
+answers the batches it has as `measured` with `coverage.partial` true and the rest counted in
+`coverage.not_sent` (`not_sent_reason` `time_budget`); only a 429 on the first batch is a failure. The API's own documentation of these
 limits: <https://echelongraph.io/pulse/api>.
 
 The hosted endpoint adds its own limit before the API's: 120 MCP requests a minute per client

package/dist/index.js

@@ -154,6 +154,17 @@ function apiMessage(body) {
     }
     return snippet(body);
 }
+// A Retry-After header as whole seconds from now: delta-seconds, or an HTTP-date (RFC 9110
+// 10.2.3). undefined when absent or unreadable.
+function retryAfterSeconds(v) {
+    const t = v?.trim();
+    if (!t)
+        return undefined;
+    if (/^\d{1,9}$/.test(t))
+        return Number(t);
+    const at = Date.parse(t);
+    return Number.isFinite(at) ? Math.max(0, Math.ceil((at - Date.now()) / 1000)) : undefined;
+}
 // One request against the API, a GET unless init says otherwise. Never throws: every way the call
 // can fail comes back as a typed Failure so the tool renders it as an error result. A 2xx whose
 // body is not a JSON object (an SPA shell, an edge challenge page, a literal null) is a failure
@@ -190,8 +201,10 @@ export async function api(path, init) {
         catch (e) {
             return timedOut ? timeout() : { ok: false, kind: "network", path, ...m, detail: `reading the body failed: ${describeError(e)}` };
         }
-        if (!res.ok)
-            return { ok: false, kind: "http", path, ...m, status: res.status, detail: apiMessage(body) };
+        if (!res.ok) {
+            const retryAfter = retryAfterSeconds(res.headers.get("retry-after"));
+            return { ok: false, kind: "http", path, ...m, status: res.status, ...(retryAfter === undefined ? {} : { retryAfter }), detail: apiMessage(body) };
+        }
         let data;
         try {
             data = JSON.parse(body);
@@ -220,7 +233,7 @@ export const sentences = (t) => t
 // A timestamp worth relaying as one: see realInstant below.
 export const instantOrNull = (s) => (realInstant(s) ? s : null);
 // One sentence per failure kind: where we looked, for what, and what came back.
-function describeFailure(f) {
+export function describeFailure(f) {
     const verb = f.method ?? "GET";
     const where = `from ${SHOWN_BASE} for ${verb} ${f.path}`;
     switch (f.kind) {
@@ -521,9 +534,10 @@ async function cveSummary() {
 async function searchCVEs(a) {
     const tool = "search_cves";
     try {
+        // #1983: the free-text search travels percent-encoded in X-EG-Search, never in the URL. Cloud
+        // Run keeps every request URL in its trace spans for 30 days and no request header; core-backend
+        // (cve/handler.go listSearchTerm) reads the header first and decodes it with url.PathUnescape.
         const q = new URLSearchParams();
-        if (a.search)
-            q.set("search", a.search);
         if (a.severity)
             q.set("severity", a.severity);
         if (a.min_cvss !== undefined)
@@ -531,7 +545,7 @@ async function searchCVEs(a) {
         if (a.sort)
             q.set("sort", a.sort);
         q.set("limit", String(a.limit ?? 20));
-        const r = await api(`/api/v1/public/cves?${q.toString()}`);
+        const r = await api(`/api/v1/public/cves?${q.toString()}`, a.search ? { headers: { "X-EG-Search": encodeURIComponent(a.search) } } : undefined);
         if (!r.ok)
             return failed(tool, r);
         const head = okHead(tool, r.status);
@@ -2009,7 +2023,7 @@ export function createServer() {
     // #2716: its logic, schemas and description live in tools/check_affected.ts.
     registerCheckAffected(server, { api, succeeded, failed, badInput, crashed, checked, okHead, envelopeSchema, annotations: ANNOTATIONS });
     // #2721: tools/check_sbom.ts, on this file's api(), envelope and failure contract.
-    registerCheckSbom(server, { api, failed, badInput, crashed, checked, succeeded, okHead, envelopeSchema, annotations: ANNOTATIONS });
+    registerCheckSbom(server, { api, failed, describeFailure, badInput, crashed, checked, succeeded, okHead, envelopeSchema, annotations: ANNOTATIONS });
     registerCveIntel(server);
     registerGetCwe(server);
     // #2719: vendor_advisories_for_cve, get_vendor_advisory, search_vendor_advisories.

package/dist/prompts.js

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { MAX_COMPONENTS, MAX_SBOM_CHARS } from "./tools/check_sbom.js";
+import { MAX_COMPONENTS, MAX_PURLS, MAX_SBOM_CHARS } from "./tools/check_sbom.js";
 export const KEV_BRIEF_DEFAULT_DAYS = 7;
 export const KEV_BRIEF_MAX_DAYS = 365;
 // The envelope rules every prompt carries, word for word.
@@ -22,7 +22,7 @@ export function triageCveText(cve) {
         "3. vendor_advisories_for_cve: the vendor advisories that name it. Call get_vendor_advisory for one whose remediation you need in full.",
         "4. epss_history: how its EPSS score changed, one point per recorded change (series_kind change_only): before series_starts_at a missing point means not recorded, not unchanged.",
         "5. cve_exposure: internet exposure on record. exposure_state says what the count is; exposed_hosts counts distinct ip:port services, not machines; the result is not_assessed with measured_at null, so present any count as undated and on record, and exposure_state not_assessed as not assessed.",
-        `6. If get_cve says kev_listed is true: kev_recent with since and until both set to its kev_added_date, to read kev_due_date from the row for ${cve}.`,
+        `6. If get_cve says kev_listed is true: kev_recent with since and until both set to the date part (YYYY-MM-DD) of its kev_added_date (for 2024-04-12T00:00:00Z, 2024-04-12), to read kev_due_date from the row for ${cve}.`,
         ENVELOPE_RULES,
         "Then answer with this template, one line each, naming the tool and the measured_at behind every line:",
         "- Exploited? CISA-KEV listing and its date, known ransomware use, and public exploit code on record.",
@@ -64,7 +64,7 @@ export function amIAffectedText(a) {
 export function sbomReviewText(sbom) {
     return [
         "Review the SBOM below for known vulnerabilities, using the EchelonGraph MCP tools.",
-        `1. Call check_sbom with sbom set to the document below, as given. It reads the document's purls and checks up to ${MAX_COMPONENTS} distinct purls per call; a document with more is refused, not truncated. If it is refused, say why from the result and do not guess at the components.`,
+        `1. Call check_sbom with sbom set to the document below, as given. It reads the document's purls and checks up to ${MAX_PURLS} distinct purls per call, sending them in batches of ${MAX_COMPONENTS}; a document with more is refused, not truncated. If it is refused, say why from the result and do not guess at the components. If coverage.not_sent is above 0, the API's rate limit or the call's time budget stopped it early: say how many purls were not sent and coverage.not_sent_reason, list them as not checked (never as clean), and call check_sbom again with purls set to data.not_sent_purls once, after a minute, merging what it returns.`,
         "2. For each distinct cve_id on a component whose verdict is affected, call get_cve, to read kev_listed, epss_score, score_assessed, echelongraph_score and cvss_v3_score. If there are more than 30 distinct CVEs, do this for 30 of them and list the rest as not looked up, unranked.",
         ENVELOPE_RULES,
         "Read each component's verdict: not_affected is the one clean verdict; undetermined and not_assessed are not clean, and not_assessed_reason says why (for example distro_release_unknown: a deb, apk or rpm purl without a distro qualifier, which EchelonGraph does not guess).",
@@ -125,7 +125,7 @@ export function registerPrompts(server, kit) {
     }, (a) => text(amIAffectedText(a)));
     server.registerPrompt("sbom_review", {
         title: "SBOM review",
-        description: `Review an SBOM (CycloneDX JSON or SPDX JSON text, up to ${MAX_SBOM_CHARS} characters): it is passed to check_sbom, which checks up to ${MAX_COMPONENTS} distinct purls per call, then get_cve for each affected CVE, and a prioritised fix list ordered by CISA-KEV listing, then EPSS, then score, each key stated. undetermined and not_assessed components are listed as not checked, never as clean.`,
+        description: `Review an SBOM (CycloneDX JSON or SPDX JSON text, up to ${MAX_SBOM_CHARS} characters): it is passed to check_sbom, which checks up to ${MAX_PURLS} distinct purls per call in batches of ${MAX_COMPONENTS}, then get_cve for each affected CVE, and a prioritised fix list ordered by CISA-KEV listing, then EPSS, then score, each key stated. undetermined and not_assessed components are listed as not checked, never as clean.`,
         argsSchema: z.object({
             sbom: z
                 .string()

package/dist/tools/check_sbom.js

@@ -1,9 +1,31 @@
 import * as z from "zod";
 export const CHECK_SBOM = "check_sbom";
 export const BATCH_PATH = "/api/v1/public/cves/match/batch";
-// The backend's cap (cveBatchMaxComponents). A document with more is refused here, before any
-// request, and never truncated: a dropped component would read as a clean one.
+// The backend's cap per request (cveBatchMaxComponents): the batch size. A longer list is sent
+// as consecutive batches of at most this many, one after another (#2734).
 export const MAX_COMPONENTS = 200;
+// The backend charges the batch route per component: 1,200 components a minute per caller
+// (core-backend internal/waf/weighted.go, CVEMatchBatchComponentsPerWindow). Over it, it answers
+// 429 with Retry-After and looks nothing up.
+export const API_COMPONENTS_PER_MINUTE = 1200;
+// The most distinct purls one call checks: two minutes of that budget. From a fresh budget, 2,000
+// purls are 10 batches: six go at once, the API then asks for a wait of at most a minute, and the
+// other four follow, and waiting out that minute would pass TIME_BUDGET_MS, so the call answers partial:
+// the first 1,200 checked, the rest named for a second call. A list with
+// more is refused before any request, never truncated: a dropped component would read as clean.
+export const MAX_PURLS = 2000;
+// How long one call may spend, waits for Retry-After included. When the next wait would pass it,
+// the call stops and answers what it has, with the purls not sent counted in coverage.not_sent
+// and listed in data.not_sent_purls, never dropped silently.
+// 50 s, not more: MCP clients time a tools/call out (the TypeScript SDK's default request timeout is
+// 60 s), and a call that outlives its client returns nothing at all — not even the partial answer
+// below. From a fresh budget, 1,200 purls (6 batches) go at once; a larger list answers partial
+// with the rest in data.not_sent_purls, for a call a minute later.
+export const TIME_BUDGET_MS = 50_000;
+// Retry-After 0 is waited this long; a 429 without Retry-After is not retried. At most MAX_WAITS
+// waits per call.
+const MIN_WAIT_MS = 1000;
+const MAX_WAITS = 10;
 // The backend's per-purl cap (cveBatchMaxPurlLen).
 const MAX_PURL_LEN = 512;
 // The document's size cap, as JSON text. OWASP Juice Shop 11.1.2's full CycloneDX SBOM (840
@@ -22,7 +44,7 @@ const CLEAN_NOTE = "Only not_affected is a clean verdict, and only for the advis
 const MEASURED_AT_NOTE = "measured_at is null: the corpus rows are read through a cache whose maximum age the answer states (summary.corpus_cache_max_age_ms), so the answer gives no single time at which they were read.";
 const FRESHNESS_NOTE = "freshness is null: the answer carries no time at which the advisory corpus was last refreshed.";
 export const CHECK_SBOM_TITLE = "Check an SBOM against the advisory corpus";
-export const CHECK_SBOM_DESCRIPTION = "Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. Pass purls (package URLs, up to 200) or sbom (a CycloneDX JSON or SPDX JSON document, as JSON text or as an object, up to 5,000,000 characters). The purls are read from the document on this machine and only they are sent, in the body of one POST, never in a URL; the document itself is not sent. A component without a purl is counted and not checked. Each purl is mapped to its OSV ecosystem, package name and version and matched against the affected version ranges EchelonGraph holds from OSV.dev advisory records; there is no ranking and no score. data.results holds one row per component sent, in order, with verdict (affected, not_affected, undetermined or not_assessed), assessed, not_assessed_reason, cve_ids, matches, count, not_affected_count and undetermined_count; data.summary counts the verdicts. not_affected is the only clean verdict. undetermined: advisories name the package but at least one could not be decided at this version and none matched. not_assessed: no verdict at all, because the package is not in the corpus, the purl type has no OSV ecosystem, a deb, apk or rpm purl carries no distro qualifier naming its release (EchelonGraph does not guess one), the version is missing, the lookup failed, or the batch's time budget ran out first (time_budget). Neither undetermined nor not_assessed is clean, and the note gives their counts. A list or document with more than 200 distinct purls is refused, not truncated: split it. Its structured result carries state (measured when at least one component got a verdict, else not_assessed), measured_at (null: the corpus is read through a cache, so no single read time exists), method, coverage (what the input held and what was sent), freshness (null) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
+export const CHECK_SBOM_DESCRIPTION = "Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. Pass purls (package URLs, up to 2,000 distinct) or sbom (a CycloneDX JSON or SPDX JSON document, as JSON text or as an object, up to 5,000,000 characters). The purls are read from the document on this machine and only they are sent, in POST bodies of at most 200 purls each, one after another, never in a URL; the document itself is not sent. A component without a purl is counted and not checked. Each purl is mapped to its OSV ecosystem, package name and version and matched against the affected version ranges EchelonGraph holds from OSV.dev advisory records; there is no ranking and no score. data.results holds one row per component sent, in order (index counts across batches), with verdict (affected, not_affected, undetermined or not_assessed), assessed, not_assessed_reason, cve_ids, matches, count, not_affected_count and undetermined_count; data.summary counts the verdicts, summed over the batches (partial is true when any batch's was). not_affected is the only clean verdict. undetermined: advisories name the package but at least one could not be decided at this version and none matched. not_assessed: no verdict at all, because the package is not in the corpus, the purl type has no OSV ecosystem, a deb, apk or rpm purl carries no distro qualifier naming its release (EchelonGraph does not guess one), the version is missing, the lookup failed, or the batch's time budget ran out first (time_budget). Neither undetermined nor not_assessed is clean, and the note gives their counts. The API allows 1,200 components a minute per caller; when it answers 429 with Retry-After, the tool waits as asked and sends the batch again, within 50 seconds per call. When the next wait would pass that, or a batch after the first fails, the tool stops and answers what it has: coverage.not_sent counts the purls not sent and coverage.not_sent_reason says why (time_budget, rate_limited or request_failed), data.not_sent_purls lists them for a later call, and they are not checked and not clean. A list or document with more than 2,000 distinct purls is refused, not truncated: split it. Its structured result carries state (measured when at least one component got a verdict, else not_assessed), measured_at (null: the corpus is read through a cache, so no single read time exists), method, coverage (what the input held, what was sent in how many batches, and what was not sent and why), freshness (null) and notes, with data equal to the API's JSON (for more than one batch, the batches' answers merged); the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
 const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function dedupe(all) {
     const seen = new Set();
@@ -146,21 +168,31 @@ const count = (o, k) => {
     return typeof v === "number" && Number.isFinite(v) ? v : undefined;
 };
 const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
-function noteFor(head, x, d) {
+function noteFor(head, x, d, g) {
     const s = field(d, "summary");
     const affected = count(s, "affected") ?? 0;
     const notAffected = count(s, "not_affected") ?? 0;
     const undetermined = count(s, "undetermined") ?? 0;
     const notAssessed = count(s, "not_assessed") ?? 0;
-    const components = count(s, "components") ?? x.purls.length;
+    const components = count(s, "components") ?? g.sent;
     const out = [head];
     if (x.input === "purls") {
-        out.push(`Sent ${plural(x.purls.length, "purl", "purls")}${x.duplicates_removed ? ` (${plural(x.duplicates_removed, "duplicate was", "duplicates were")} sent once)` : ""}.`);
+        out.push(`Sent ${plural(g.sent, "purl", "purls")}${x.duplicates_removed ? ` (${plural(x.duplicates_removed, "duplicate was", "duplicates were")} sent once)` : ""}.`);
     }
     else {
         const kind = x.input === "cyclonedx" ? "CycloneDX" : "SPDX";
         const unit = x.input === "cyclonedx" ? "component" : "package";
-        out.push(`Read ${plural(x.components_in_document ?? 0, unit, `${unit}s`)} from the ${kind} document: ${x.with_purl} with a purl${x.without_purl ? `, and ${x.without_purl} without one, which ${x.without_purl === 1 ? "was" : "were"} not checked and ${x.without_purl === 1 ? "is" : "are"} not clean` : ""}${x.duplicates_removed ? `; ${plural(x.duplicates_removed, "duplicate purl was", "duplicate purls were")} sent once` : ""}; sent ${x.purls.length}.`);
+        out.push(`Read ${plural(x.components_in_document ?? 0, unit, `${unit}s`)} from the ${kind} document: ${x.with_purl} with a purl${x.without_purl ? `, and ${x.without_purl} without one, which ${x.without_purl === 1 ? "was" : "were"} not checked and ${x.without_purl === 1 ? "is" : "are"} not clean` : ""}${x.duplicates_removed ? `; ${plural(x.duplicates_removed, "duplicate purl was", "duplicate purls were")} sent once` : ""}; sent ${g.sent}.`);
+    }
+    if (g.batches > 1) {
+        out.push(`The ${x.purls.length} distinct purls make ${g.batches} batches of at most ${MAX_COMPONENTS}, sent one after another; the API answered ${g.batches_sent} of them, and data.summary sums those answers.`);
+    }
+    if (g.waits > 0) {
+        out.push(`The API's component budget (${API_COMPONENTS_PER_MINUTE} components a minute) ran out ${g.waits === 1 ? "once" : `${g.waits} times`}: the tool waited ${Math.round(g.waited_ms / 1000)} s in all, as its Retry-After asked, and sent the batch again.`);
+    }
+    const notSent = g.not_sent_purls.length;
+    if (notSent > 0) {
+        out.push(`${plural(notSent, "purl was", "purls were")} NOT sent (not_sent_reason ${g.not_sent_reason}: ${g.not_sent_detail}), so ${notSent === 1 ? "it is" : "they are"} not checked and not clean; data.not_sent_purls lists ${notSent === 1 ? "it" : "them"}: call check_sbom again with purls set to that list${g.not_sent_reason === "request_failed" ? "" : " after a minute"}.`);
     }
     out.push(`Of the ${components} components checked: ${affected} affected, ${notAffected} not affected, ${undetermined} undetermined, ${notAssessed} not assessed.`);
     const by = field(s, "not_assessed_by_reason");
@@ -192,8 +224,76 @@ function noteFor(head, x, d) {
     }
     return { note: out.join(" "), assessed: affected + notAffected + undetermined };
 }
+// Summary fields summed over the batches, and bounds that hold per batch (the largest held for all).
+const SUMMED = ["components", "affected", "not_affected", "undetermined", "not_assessed", "lookups", "elapsed_ms"];
+const MAXED = ["time_budget_ms", "corpus_cache_max_age_ms"];
+// The batches' answers as one (#2734): results concatenated with index counted across batches
+// (batch b's row i becomes index b*MAX_COMPONENTS+i, its position in the list sent), summaries
+// summed, not_assessed_by_reason summed per reason, partial true when any batch's was, answered_at
+// the last batch's. A count some batch did not send is left out, never summed as 0.
+export function mergeAnswers(answers) {
+    const out = { ...answers[0] };
+    const results = [];
+    answers.forEach((a, b) => {
+        const rows = field(a, "results");
+        if (!Array.isArray(rows))
+            return;
+        for (const r of rows) {
+            const i = field(r, "index");
+            results.push(isObj(r) && typeof i === "number" ? { ...r, index: i + b * MAX_COMPONENTS } : r);
+        }
+    });
+    const total = (vs) => vs.every((v) => typeof v === "number" && Number.isFinite(v)) ? vs.reduce((t, v) => t + v, 0) : undefined;
+    const comps = total(answers.map((a) => field(a, "components")));
+    if (comps === undefined)
+        delete out.components;
+    else
+        out.components = comps;
+    const ss = answers.map((a) => field(a, "summary"));
+    if (ss.every(isObj)) {
+        const sums = ss;
+        const m = { ...sums[0] };
+        for (const k of SUMMED) {
+            const t = total(sums.map((x) => x[k]));
+            if (t === undefined)
+                delete m[k];
+            else
+                m[k] = t;
+        }
+        for (const k of MAXED) {
+            const vs = sums.map((x) => x[k]).filter((v) => typeof v === "number");
+            if (vs.length)
+                m[k] = Math.max(...vs);
+        }
+        if (sums.some((x) => typeof x.partial === "boolean"))
+            m.partial = sums.some((x) => x.partial === true);
+        if (sums.some((x) => isObj(x.not_assessed_by_reason))) {
+            const by = {};
+            for (const x of sums) {
+                if (!isObj(x.not_assessed_by_reason))
+                    continue;
+                for (const [r, n] of Object.entries(x.not_assessed_by_reason))
+                    if (typeof n === "number")
+                        by[r] = (by[r] ?? 0) + n;
+            }
+            m.not_assessed_by_reason = by;
+        }
+        out.summary = m;
+    }
+    else {
+        delete out.summary;
+    }
+    const last = answers[answers.length - 1];
+    if (field(last, "answered_at") !== undefined)
+        out.answered_at = field(last, "answered_at");
+    out.results = results;
+    return out;
+}
+const realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export async function checkSbom(deps, a) {
     const tool = CHECK_SBOM;
+    const sleep = deps.sleep ?? realSleep;
+    const now = deps.now ?? Date.now;
     try {
         const x = extract(a);
         if (typeof x === "string")
@@ -201,22 +301,84 @@ export async function checkSbom(deps, a) {
         if (x.purls.length === 0) {
             return deps.badInput(tool, x.input === "purls" ? "purls holds no package URL" : `the document holds ${x.components_in_document ?? 0} components and none carries a purl, so there is nothing to check`);
         }
-        if (x.purls.length > MAX_COMPONENTS) {
-            return deps.badInput(tool, `${x.purls.length} distinct purls; at most ${MAX_COMPONENTS} are checked per call, and none is dropped silently: split the list into calls of ${MAX_COMPONENTS} or fewer`);
+        if (x.purls.length > MAX_PURLS) {
+            return deps.badInput(tool, `${x.purls.length} distinct purls; at most ${MAX_PURLS} are checked per call (in batches of ${MAX_COMPONENTS}, within the API's budget of ${API_COMPONENTS_PER_MINUTE} components a minute), and none is dropped silently: split the list into calls of ${MAX_PURLS} or fewer`);
         }
         const long = x.purls.findIndex((p) => p.length > MAX_PURL_LEN);
         if (long >= 0)
             return deps.badInput(tool, `purl ${long + 1} is longer than ${MAX_PURL_LEN} characters`);
-        const r = await deps.api(BATCH_PATH, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ components: x.purls.map((purl) => ({ purl })) }),
-        });
-        if (!r.ok)
-            return deps.failed(tool, r);
-        const { note, assessed } = noteFor(deps.okHead(tool, r.status), x, r.data);
-        const s = field(r.data, "summary");
-        return deps.succeeded(r.data, note, {
+        const batches = [];
+        for (let i = 0; i < x.purls.length; i += MAX_COMPONENTS)
+            batches.push(x.purls.slice(i, i + MAX_COMPONENTS));
+        const started = now();
+        const budgetS = TIME_BUDGET_MS / 1000;
+        const answers = [];
+        let status = 200;
+        let waits = 0;
+        let waitedMs = 0;
+        let stop = null;
+        // One batch at a time, in order; a 429 with Retry-After is waited out and the same batch sent
+        // again, while the wait fits in the call's budget.
+        while (answers.length < batches.length) {
+            if (answers.length > 0 && now() - started >= TIME_BUDGET_MS) {
+                stop = { reason: "time_budget", detail: `the call's ${budgetS} s budget ran out after ${answers.length} of ${batches.length} batches` };
+                break;
+            }
+            const r = await deps.api(BATCH_PATH, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ components: batches[answers.length].map((purl) => ({ purl })) }),
+            });
+            if (r.ok) {
+                answers.push(r.data);
+                status = r.status;
+                continue;
+            }
+            if (r.kind === "http" && r.status === 429) {
+                if (r.retryAfter === undefined) {
+                    stop = { reason: "rate_limited", detail: "the API answered 429 without a Retry-After to wait for" };
+                }
+                else if (waits >= MAX_WAITS) {
+                    stop = { reason: "rate_limited", detail: `the API answered 429 again after ${MAX_WAITS} waits` };
+                }
+                else {
+                    const waitMs = Math.max(MIN_WAIT_MS, r.retryAfter * 1000);
+                    if (now() - started + waitMs <= TIME_BUDGET_MS) {
+                        await sleep(waitMs);
+                        waits++;
+                        waitedMs += waitMs;
+                        continue;
+                    }
+                    stop = { reason: "time_budget", detail: `the API answered 429 asking for a wait of ${r.retryAfter} s (Retry-After), which would pass the call's ${budgetS} s budget` };
+                }
+            }
+            else {
+                stop = { reason: "request_failed", detail: deps.describeFailure(r).replace(/\.$/, "") };
+            }
+            // Nothing answered yet: nothing was measured, so the failure is the answer.
+            if (answers.length === 0)
+                return deps.failed(tool, r);
+            break;
+        }
+        const notSentPurls = x.purls.slice(answers.length * MAX_COMPONENTS);
+        const g = {
+            batches: batches.length,
+            batches_sent: answers.length,
+            sent: x.purls.length - notSentPurls.length,
+            not_sent_purls: notSentPurls,
+            not_sent_reason: notSentPurls.length ? (stop?.reason ?? null) : null,
+            not_sent_detail: notSentPurls.length ? (stop?.detail ?? null) : null,
+            waits,
+            waited_ms: waitedMs,
+        };
+        // One batch: data is the API's JSON as it came. More: the merged answer.
+        const data = batches.length === 1 ? answers[0] : mergeAnswers(answers);
+        if (notSentPurls.length)
+            data.not_sent_purls = notSentPurls;
+        const { note, assessed } = noteFor(deps.okHead(tool, status), x, data, g);
+        const s = field(data, "summary");
+        const summaryPartial = typeof field(s, "partial") === "boolean" ? field(s, "partial") : null;
+        return deps.succeeded(data, note, {
             state: assessed > 0 ? "measured" : "not_assessed",
             measured_at: null,
             method: METHOD,
@@ -226,9 +388,17 @@ export async function checkSbom(deps, a) {
                 with_purl: x.with_purl,
                 without_purl: x.without_purl,
                 duplicates_removed: x.duplicates_removed,
-                sent: x.purls.length,
+                distinct_purls: x.purls.length,
+                batch_size: MAX_COMPONENTS,
+                batches: g.batches,
+                batches_sent: g.batches_sent,
+                sent: g.sent,
+                not_sent: notSentPurls.length,
+                not_sent_reason: g.not_sent_reason,
+                rate_limit_waits: waits,
+                waited_ms: waitedMs,
                 not_assessed: count(s, "not_assessed") ?? null,
-                partial: typeof field(s, "partial") === "boolean" ? field(s, "partial") : null,
+                partial: notSentPurls.length > 0 ? true : summaryPartial,
             },
             freshness: null,
             notes: [DISTRO_NOTE, CLEAN_NOTE, MEASURED_AT_NOTE, FRESHNESS_NOTE],
@@ -294,6 +464,7 @@ export function checkSbomOutput(envelopeSchema) {
                 .optional(),
             answered_at: opt(z.string()),
             results: z.array(Row).optional(),
+            not_sent_purls: opt(z.array(z.string())).describe("The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."),
         }),
         coverage: z.strictObject({
             input: z.enum(["purls", "cyclonedx", "spdx"]).describe("What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document."),
@@ -301,9 +472,23 @@ export function checkSbomOutput(envelopeSchema) {
             with_purl: z.number().int().describe("Of those, the ones carrying a purl."),
             without_purl: z.number().int().describe("The ones without a purl: not checked, and not clean."),
             duplicates_removed: z.number().int().describe("Purls that appeared more than once and were sent once."),
-            sent: z.number().int().describe("Distinct purls sent and checked."),
+            distinct_purls: z.number().int().describe("Distinct purls to check: sent plus not_sent."),
+            batch_size: z.number().int().describe("The most purls one request carries (the API's cap per request)."),
+            batches: z.number().int().describe("Requests the distinct purls make, at batch_size each."),
+            batches_sent: z.number().int().describe("Of those, the ones the API answered."),
+            sent: z.number().int().describe("Distinct purls sent and answered."),
+            not_sent: z.number().int().describe("Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean."),
+            not_sent_reason: z
+                .enum(["time_budget", "rate_limited", "request_failed"])
+                .nullable()
+                .describe("Why not_sent is above 0: time_budget (the call's 50 s budget ran out, or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."),
+            rate_limit_waits: z.number().int().describe("How many times the API answered 429 and the tool waited its Retry-After before sending the batch again."),
+            waited_ms: z.number().int().describe("Milliseconds spent in those waits."),
             not_assessed: z.number().int().nullable().describe("Of those sent, the components with no verdict, as the answer counts them."),
-            partial: z.boolean().nullable().describe("The answer's summary.partial: true when the time budget ran out first."),
+            partial: z
+                .boolean()
+                .nullable()
+                .describe("true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial."),
         }),
         freshness: null,
     });
@@ -317,7 +502,7 @@ export function registerCheckSbom(server, deps) {
         title: CHECK_SBOM_TITLE,
         description: CHECK_SBOM_DESCRIPTION,
         inputSchema: z.object({
-            purls: z.array(z.string()).optional().describe("package URLs to check, e.g. pkg:npm/lodash@4.17.20 or pkg:deb/debian/openssl@3.0.11-1~deb12u1?distro=debian-12 (up to 200)"),
+            purls: z.array(z.string()).optional().describe("package URLs to check, e.g. pkg:npm/lodash@4.17.20 or pkg:deb/debian/openssl@3.0.11-1~deb12u1?distro=debian-12 (up to 2,000 distinct, sent in batches of 200)"),
             sbom: z
                 .union([z.string(), z.record(z.string(), z.unknown())])
                 .optional()

package/dist/tools/kev_recent.js

@@ -6,7 +6,7 @@ const MAX_VENDOR = 128;
 const MAX_CURSOR = 128;
 const KEV_RECENT_METHOD = "EchelonGraph's copy of the CISA KEV catalog: CISA's feed is polled every 5 minutes and each entry is written onto its CVE's record; rows are read from those records, newest kev_added_date first.";
 const KEV_RECENT_COVERAGE = "CISA KEV catalog";
-const KEV_RECENT_DESCRIPTION = "The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each row in kev gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ransomware (known ransomware-campaign use), EchelonGraph's severity, cvss_v3_score, epss_score, epss_percentile and eg_kev_tier for the CVE, and our_first_seen_kev, when EchelonGraph's poller first recorded the CVE entering the catalog (null where no such record exists). Filter by since and until (YYYY-MM-DD, inclusive, on kev_added_date), ransomware, and vendor (an exact, case-insensitive match on kev_vendor); page with limit (1 to 200, default 50) and cursor, passing back the previous page's next_cursor with the same filters. Rows within one date are ordered by cve_id. total counts the CVEs matching the filters; kev_listed_total counts every CVE EchelonGraph holds as KEV-listed, and catalog.catalog_count is CISA's own count in the catalog last fetched, so a gap between the two is entries not yet in EchelonGraph's CVE table, which no page returns. CISA's requiredAction and shortDescription are not returned. Its structured result carries state (measured), measured_at (our last successful fetch of CISA's feed, null when the API does not give it), method, coverage (the CISA KEV catalog: total, returned, kev_listed_total, catalog_count, limit, has_more), freshness (last_successful_fetch_at, catalog_version, date_released) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
+const KEV_RECENT_DESCRIPTION = "The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each row in kev gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ransomware (known ransomware-campaign use), EchelonGraph's severity, cvss_v3_score, epss_score, epss_percentile and eg_kev_tier for the CVE, and our_first_seen_kev, when EchelonGraph's poller first recorded the CVE entering the catalog (null where no such record exists). Filter by since and until (YYYY-MM-DD, inclusive, on kev_added_date; an RFC 3339 timestamp, such as the kev_added_date 2024-04-12T00:00:00Z that CVE records carry, is read as its UTC date, and anything else is refused), ransomware, and vendor (an exact, case-insensitive match on kev_vendor); page with limit (1 to 200, default 50) and cursor, passing back the previous page's next_cursor with the same filters. Rows within one date are ordered by cve_id. total counts the CVEs matching the filters; kev_listed_total counts every CVE EchelonGraph holds as KEV-listed, and catalog.catalog_count is CISA's own count in the catalog last fetched, so a gap between the two is entries not yet in EchelonGraph's CVE table, which no page returns. CISA's requiredAction and shortDescription are not returned. Its structured result carries state (measured), measured_at (our last successful fetch of CISA's feed, null when the API does not give it), method, coverage (the CISA KEV catalog: total, returned, kev_listed_total, catalog_count, limit, has_more), freshness (last_successful_fetch_at, catalog_version, date_released) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
 const opt = (t) => t.nullable().optional();
 const KEVRow = z.looseObject({
     cve_id: opt(z.string()),
@@ -61,22 +61,35 @@ const Freshness = z.strictObject({
 // Inputs this side refuses before any request, with the reason.
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const isDate = (s) => DATE.test(s) && new Date(`${s}T00:00:00Z`).toISOString().slice(0, 10) === s;
+// An RFC 3339 date-time (#2736): get_cve gives kev_added_date as one ("2024-04-12T00:00:00Z"), and a
+// model passes it on as given. It is read as its UTC date; the time of day is dropped.
+const RFC3339 = /^(\d{4}-\d{2}-\d{2})T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d{1,9})?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+// since or until as the YYYY-MM-DD the API takes, or null when it is neither form.
+export function kevDate(raw) {
+    if (isDate(raw))
+        return raw;
+    const m = RFC3339.exec(raw.toUpperCase());
+    if (!m || !isDate(m[1]))
+        return null;
+    const t = Date.parse(raw.toUpperCase());
+    return Number.isFinite(t) ? new Date(t).toISOString().slice(0, 10) : null;
+}
 // A header value must be visible ASCII: fetch refuses others, and that refusal would read as an outage.
 const PRINTABLE = /^[\x20-\x7e]+$/;
 function headersFor(a) {
     const h = {};
-    const since = a.since?.trim();
-    const until = a.until?.trim();
-    if (since) {
-        if (!isDate(since))
-            return { why: "since must be a date, YYYY-MM-DD" };
+    const sinceRaw = a.since?.trim();
+    const untilRaw = a.until?.trim();
+    const since = sinceRaw ? kevDate(sinceRaw) : undefined;
+    const until = untilRaw ? kevDate(untilRaw) : undefined;
+    if (since === null)
+        return { why: "since must be a date, YYYY-MM-DD, or an RFC 3339 timestamp such as 2024-04-12T00:00:00Z" };
+    if (until === null)
+        return { why: "until must be a date, YYYY-MM-DD, or an RFC 3339 timestamp such as 2024-04-12T00:00:00Z" };
+    if (since)
         h["X-EG-Since"] = since;
-    }
-    if (until) {
-        if (!isDate(until))
-            return { why: "until must be a date, YYYY-MM-DD" };
+    if (until)
         h["X-EG-Until"] = until;
-    }
     if (since && until && since > until)
         return { why: "since must not be after until" };
     if (a.ransomware !== undefined)
@@ -177,8 +190,8 @@ export function registerKevRecent(server, d) {
         title: "Recent CISA KEV additions",
         description: KEV_RECENT_DESCRIPTION,
         inputSchema: z.object({
-            since: z.string().optional().describe("earliest kev_added_date to include, YYYY-MM-DD"),
-            until: z.string().optional().describe("latest kev_added_date to include, YYYY-MM-DD"),
+            since: z.string().optional().describe("earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as its UTC date)"),
+            until: z.string().optional().describe("latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as its UTC date)"),
             ransomware: z.boolean().optional().describe("true: only CVEs with known ransomware-campaign use; false: only those without"),
             vendor: z.string().optional().describe("CISA vendorProject, an exact case-insensitive match, e.g. 'Microsoft'"),
             limit: z.number().int().min(1).max(KEV_RECENT_MAX_LIMIT).optional().describe("page size (default 50, max 200)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echelongraph-mcp",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "mcpName": "io.echelongraph/echelongraph-mcp",
   "description": "EchelonGraph CVE and internet-exposure data as an MCP server: CVEs with EchelonGraph multi-source scores, CISA-KEV and EPSS, plus a per-CVE internet-exposure footprint derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Free and keyless, for Claude, Cursor and any MCP client.",
   "type": "module",

package/server.json

@@ -17,7 +17,7 @@
       ]
     }
   ],
-  "version": "2.5.0",
+  "version": "2.6.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "echelongraph-mcp",
-      "version": "2.5.0",
+      "version": "2.6.0",
       "transport": {
         "type": "stdio"
       },