echelongraph-mcp 2.6.0 → 2.6.2

package/CHANGELOG.md

@@ -6,6 +6,36 @@ with a provenance attestation by the release workflow of
 [github.com/echelongraph/echelongraph-mcp](https://github.com/echelongraph/echelongraph-mcp),
 from the commit tagged `v<version>`.
 
+## 2.6.2 — 2026-10-04
+
+- `kev_recent` reads an RFC 3339 `since` or `until` as the date written in it, dropping the time
+  and offset. It used to convert the timestamp to UTC first, so `2024-04-12T00:00:00+02:00` was
+  answered for 2024-04-11, and `2024-04-12T23:30:00-05:00` for 2024-04-13, while still reporting
+  a measured result. `kev_added_date` is a calendar date, so the written date is the one meant.
+  `Z` timestamps, such as those `get_cve` returns, are unaffected (#2755).
+- Hosted endpoint only: a `tools/call` of `check_sbom`, or a `prompts/get` of `sbom_review`, may
+  now send a request body of up to 6 MiB, so a real CycloneDX or SPDX document (up to the tool's
+  5,000,000-character cap) is accepted over `https://mcp.echelongraph.io/mcp`; before, any body
+  over 64 KiB was refused, and only a purl list fit. Every other request keeps the 64 KiB cap.
+  Each server instance serves at most two such large bodies at once; a third is answered HTTP 503
+  with `Retry-After` and JSON-RPC error `-32030`. The per-client limit is unchanged (120 requests
+  a minute). New settings `MCP_MAX_SBOM_BODY_BYTES` and `MCP_LARGE_BODY_SLOTS`. The `check_sbom`
+  description and the README say that over the hosted endpoint the document reaches
+  EchelonGraph's server, which reads the purls from it and neither logs nor keeps it (#2747).
+- `cve_summary` says what the answer's `poller` block is: the in-memory counters of the NVD
+  poller of the one API instance that answered, since it last started, zeroed on every restart,
+  never the feed's size, intake, reliability or freshness. The note says so whenever the block is
+  present, quoting `cves_ingested`, `poll_count` and `poll_errors`; the description and the
+  outputSchema describe the block and each counter. The JSON is still relayed as sent (#2647).
+
+## 2.6.1 — 2026-10-04
+
+- Hosted endpoint only: when the production synthetic calls `https://mcp.echelongraph.io/mcp`, the
+  endpoint marks its own API calls with a fixed `echelongraph-mcp-synthetic/1.0` token, so the
+  synthetic is never counted as hosted use. The client's own text is never passed through. The
+  `mcp_request` log line gains `client_public` (#2737).
+- stdio behaviour is unchanged.
+
 ## 2.6.0 — 2026-10-04
 
 - `check_sbom` checks up to 2,000 distinct purls per call, instead of refusing more than 200: it

package/README.md

@@ -162,7 +162,7 @@ The example questions are ones a client can answer with that tool alone.
 | `kev_recent` | Recent CISA KEV additions | The CVEs CISA has added to its Known Exploited Vulnerabilities catalog, newest first (`kev_added_date`), from EchelonGraph's copy of the catalog, polled from CISA every 5 minutes: due date, vendor, product, known ransomware use, EchelonGraph's severity, CVSS, EPSS and `eg_kev_tier`, and `our_first_seen_kev`. Filter by date range, ransomware and vendor; page with `limit` and `next_cursor`. Dated by `last_successful_fetch_at`, our last successful fetch of CISA's feed; the filters travel as request headers, never in the URL. | *Which CVEs has CISA added to KEV since 1 September, and which have known ransomware use?* |
 | `epss_history` | EPSS change history for one CVE | How one CVE's EPSS score has changed, as EchelonGraph recorded it: one point per recorded change (`series_kind` `change_only`), never a daily series, with the value now and `series_starts_at`, when recording began; before it a missing point means not recorded, not unchanged. | *How has CVE-2023-44487's EPSS score changed, as EchelonGraph recorded it?* |
 | `check_affected` | Am I affected? (product or package at a version) | Whether a product (its NVD CPE product token) or a registry package (`ecosystem` and `package`) at a given version is affected by known CVEs, from the matcher behind echelongraph.io/am-i-affected: `assessed` first (false: not evaluated, with `not_assessed_reason`, and a count of 0 then is not "not affected"), the matching CVEs with `kev_listed`, `ransomware`, `epss_score`, `effective_score` and `score_assessed`, and advisories it cannot decide counted as `undetermined_count`, never as safe. What you look up travels in request headers, never in the URL. | *Is openssl 3.0.0 affected by known CVEs? Is lodash 4.17.15 on npm?* |
-| `check_sbom` | Check an SBOM against the advisory corpus | A dependency list checked against EchelonGraph's advisory corpus (OSV.dev records), one verdict per component: `affected`, `not_affected`, `undetermined` or `not_assessed`, each with its `not_assessed_reason`. Pass up to 2,000 distinct purls, or a CycloneDX JSON or SPDX JSON document: the purls are read from it on your machine and only they are sent, in POST bodies of at most 200 each, one after another; the document is not. When the API's per-component rate limit answers 429, the tool waits the `Retry-After` it names, within 50 seconds per call; past that it answers what it has, with the purls not sent counted in `coverage.not_sent`, the reason in `coverage.not_sent_reason`, and the list in `data.not_sent_purls`, never dropped silently. A deb, apk or rpm purl without a `distro` qualifier naming its release is not assessed (`distro_release_unknown`): EchelonGraph does not guess a release. Only `not_affected` is clean. No ranking, no score. | *Check this CycloneDX SBOM against the advisory corpus.* |
+| `check_sbom` | Check an SBOM against the advisory corpus | A dependency list checked against EchelonGraph's advisory corpus (OSV.dev records), one verdict per component: `affected`, `not_affected`, `undetermined` or `not_assessed`, each with its `not_assessed_reason`. Pass up to 2,000 distinct purls, or a CycloneDX JSON or SPDX JSON document: the purls are read from it by the MCP server (on your machine when it runs from npm) and only they are sent to the API, in POST bodies of at most 200 each, one after another; the document is not. When the API's per-component rate limit answers 429, the tool waits the `Retry-After` it names, within 50 seconds per call; past that it answers what it has, with the purls not sent counted in `coverage.not_sent`, the reason in `coverage.not_sent_reason`, and the list in `data.not_sent_purls`, never dropped silently. A deb, apk or rpm purl without a `distro` qualifier naming its release is not assessed (`distro_release_unknown`): EchelonGraph does not guess a release. Only `not_affected` is clean. No ranking, no score. | *Check this CycloneDX SBOM against the advisory corpus.* |
 | `cve_intel` | CVE weakness, exploits and packages | Weakness, public exploit code, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment: `cwes`, `exploits` (at most 10, verified first) with `exploits_total`, `exploits_capped`, `exploits_by_kind` and `exploits_by_status`, `affected_packages`, `fixed_versions` and `timeline`. `verified_status` is the label stored with each reference, not a guarantee that the exploit works. An empty `exploits` list is not evidence that no public exploit exists; a section the API could not read is named in `coverage.sections_failed`, never relayed as an empty list. | *Is there public exploit code for CVE-2021-44228, and which versions fix it?* |
 | `get_cwe` | CWE and its CVEs | One CWE (weakness class) and the CVEs classified under it: `name` and `description` from the MITRE CWE catalog EchelonGraph embeds, `total`, and one page of 50 `cves`, ordered as `order` states (CISA-KEV-listed first, then EchelonGraph score). A `total` of 0 says that no CVE in EchelonGraph's feed is classified under that CWE, not that none exists. | *Which CVEs are classified under CWE-79, CISA-KEV-listed first?* |
 | `vendor_advisories_for_cve` | Vendor advisories for one CVE | The vendor-published advisories (Microsoft MSRC, Red Hat, Cisco, Palo Alto Networks, GitHub GHSA and the other feeds EchelonGraph polls) that name one CVE, newest first, at most 20. | *Which vendor advisories name CVE-2024-3400?* |
@@ -630,7 +630,7 @@ Where each tool's input travels:
 | `search_vendor_advisories`: `query` | The `X-EG-Advisory-Search` request header, never the URL. Its vendor, severity, CVE filter, limit and offset go in the query string. |
 | `check_affected`: `product`, `version`, `ecosystem`, `package` | The `X-EG-Product`, `X-EG-Version`, `X-EG-Ecosystem` and `X-EG-Package` request headers, never the URL. |
 | `kev_recent`: `since`, `until`, `ransomware`, `vendor`, `limit`, `cursor` | The `X-EG-Since`, `X-EG-Until`, `X-EG-Ransomware`, `X-EG-Vendor`, `X-EG-Limit` and `X-EG-Cursor` request headers, never the URL. |
-| `check_sbom`: `purls`, or an `sbom` document | The purls, in POST bodies of at most 200 each. A CycloneDX or SPDX document is read on your machine and only the purls in it are sent; the document is not. |
+| `check_sbom`: `purls`, or an `sbom` document | The purls, in POST bodies of at most 200 each. A CycloneDX or SPDX document is read on your machine and only the purls in it are sent; the document is not. (Over the hosted endpoint the document goes to EchelonGraph's server instead: see below.) |
 | `cve_summary`, `exposure_radar` | No input. |
 
 The API marks its answers to header-carried lookups `no-store`, so no shared cache keeps them,
@@ -640,7 +640,11 @@ and request logs and trace spans that record URLs do not hold what was looked up
 server first, which then calls the same API as above. Per request it logs the HTTP method and
 path, the status, the duration, the body size, the JSON-RPC method and (for `tools/call`) the
 tool name, the protocol version, whether an `Origin` header was sent, and the family of your
-client's User-Agent. It never logs tool arguments or a query string. When a client passes the
+client's User-Agent. It never logs tool arguments or a query string. A `check_sbom` document (or
+an `sbom_review` prompt's) is a tool argument like any other here: it is in the request body, so
+the whole document reaches EchelonGraph's server, which reads the purls from it in memory, sends
+only those to the API, and neither logs nor keeps the document. To keep the document on your
+machine, run the npm package, or pass `check_sbom` the purls. When a client passes the
 per-client limit it logs that client's address key. It passes your client's public address to
 the API, in a header the API trusts only with a token it checks, so the API's rate limit counts
 you and not the hosted service.
@@ -675,7 +679,10 @@ limits: <https://echelongraph.io/pulse/api>.
 The hosted endpoint adds its own limit before the API's: 120 MCP requests a minute per client
 address, counted by each server instance, answered over it with HTTP 429, `Retry-After` and a
 JSON-RPC error (code `-32029`) that names the limit and the seconds to wait. A request body over
-64 KiB is refused.
+64 KiB is refused (HTTP 413, code `-32600`), except a `tools/call` of `check_sbom` or a
+`prompts/get` of `sbom_review`, which may be up to 6 MiB: enough for a CycloneDX or SPDX document
+at the tool's 5,000,000-character cap. Each server instance reads at most two such large bodies at
+once; a third is answered HTTP 503 with `Retry-After` and a JSON-RPC error (code `-32030`).
 
 ## Configuration
 
@@ -695,7 +702,9 @@ variables above and:
 |---|---|---|
 | `PORT` | `8080` | The port it listens on. |
 | `MCP_RATE_LIMIT_PER_MIN` | `120` | MCP requests a minute per client address, per instance. |
-| `MCP_MAX_BODY_BYTES` | `65536` | The largest request body it reads. |
+| `MCP_MAX_BODY_BYTES` | `65536` | The largest request body it reads, except for an SBOM (below). |
+| `MCP_MAX_SBOM_BODY_BYTES` | `6291456` | The largest body of a `tools/call` of `check_sbom` or a `prompts/get` of `sbom_review`. |
+| `MCP_LARGE_BODY_SLOTS` | `2` | How many bodies over `MCP_MAX_BODY_BYTES` it reads and serves at once; past that, 503 with `Retry-After`. |
 | `ECHELONGRAPH_FORWARD_TOKEN`, `ECHELONGRAPH_FORWARD_HOST`, `MCP_REQUIRE_FORWARD_TOKEN` | unset | EchelonGraph's hosted deployment only: the token with which it names each client to the API. Leave them unset when you run it yourself; the API then counts every request as coming from your server. |
 
 ## Develop

package/dist/http.js

@@ -23,8 +23,8 @@
 // token fatal at start-up, because without it every remote user would share one API budget.
 import http from "node:http";
 import { createMcpHandler } from "@modelcontextprotocol/server";
-import { forwardToken, markHttpEntrypoint, withClient } from "./runtime.js";
-import { BODY_TOO_LARGE_CODE, DEFAULT_RATE_LIMIT_PER_MIN, FixedWindowLimiter, ORIGIN_REFUSED_CODE, RATE_LIMITED_CODE, bodyFacts, originVerdict, resolveClient, revisionLabel, rpcError, uaFamily, } from "./httpPolicy.js";
+import { forwardToken, markHttpEntrypoint, SYNTHETIC_UA_FAMILY, withClient } from "./runtime.js";
+import { BODY_TOO_LARGE_CODE, BUSY_CODE, DEFAULT_LARGE_BODY_SLOTS, DEFAULT_MAX_BODY_BYTES, DEFAULT_MAX_SBOM_BODY_BYTES, DEFAULT_RATE_LIMIT_PER_MIN, LARGE_BODY_TARGETS_TEXT, Slots, FixedWindowLimiter, ORIGIN_REFUSED_CODE, RATE_LIMITED_CODE, bodyFacts, originVerdict, resolveClient, revisionLabel, rpcError, isLargeBodyTarget, largeBodyAdmissible, uaFamily, } from "./httpPolicy.js";
 // Must run before index.ts is evaluated: it is how index.ts knows not to start stdio.
 markHttpEntrypoint();
 const { createServer, NAME, VERSION, SHOWN_BASE, TIMEOUT_MS } = await import("./index.js");
@@ -37,9 +37,12 @@ const PORT = (() => {
     return Number.isInteger(n) && n >= 0 && n < 65536 && process.env.PORT !== "" && process.env.PORT !== undefined ? n : 8080;
 })();
 const RATE_LIMIT_PER_MIN = positiveInt(process.env.MCP_RATE_LIMIT_PER_MIN, DEFAULT_RATE_LIMIT_PER_MIN);
-// Tool arguments are a CVE ID or a short search; 64 KiB is far above any real request and far
-// below the SDK's 4 MiB default.
-const MAX_BODY_BYTES = positiveInt(process.env.MCP_MAX_BODY_BYTES, 64 * 1024);
+// The body caps and the large-body slots (#2747): see httpPolicy.ts "Request-body caps".
+const MAX_BODY_BYTES = positiveInt(process.env.MCP_MAX_BODY_BYTES, DEFAULT_MAX_BODY_BYTES);
+const MAX_SBOM_BODY_BYTES = Math.max(MAX_BODY_BYTES, positiveInt(process.env.MCP_MAX_SBOM_BODY_BYTES, DEFAULT_MAX_SBOM_BODY_BYTES));
+const LARGE_BODY_SLOTS = positiveInt(process.env.MCP_LARGE_BODY_SLOTS, DEFAULT_LARGE_BODY_SLOTS);
+// A large body's wait for a slot is not queued: the client is told to come back.
+const BUSY_RETRY_AFTER_SEC = 5;
 const MCP_PATH = "/mcp";
 const HEALTH_PATH = "/health";
 // One JSON object per line on stdout: Cloud Logging reads `severity` and `message`.
@@ -57,11 +60,13 @@ const handler = createMcpHandler(createServer, {
     // responseMode stays the SDK default, "auto": a modern request is answered with one JSON body
     // unless a handler emits something before its result (none of these tools does). The legacy
     // leg answers over SSE, as a 2025-era streamable HTTP server does.
-    maxRequestBodySize: MAX_BODY_BYTES,
+    // The largest body readBody can hand on; which request may be that large is decided here first.
+    maxRequestBodySize: MAX_SBOM_BODY_BYTES,
     // Names only: an SDK error message can quote what the client sent.
     onerror: (e) => log("WARNING", "mcp_handler_error", { error_name: e.name }),
 });
 const limiter = new FixedWindowLimiter(RATE_LIMIT_PER_MIN);
+const largeBodies = new Slots(LARGE_BODY_SLOTS);
 // CORS for a browser client on an https Origin (the Origin policy has already admitted it).
 // A wildcard is safe here because nothing is credentialed: no cookies, no auth.
 const CORS_HEADERS = {
@@ -79,39 +84,69 @@ function send(res, status, body, headers = {}) {
     res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers });
     res.end(body);
 }
-// Reads the body up to MAX_BODY_BYTES. Over the cap: "too_large", and the rest is discarded
-// unread (the response closes the connection).
 function readBody(req) {
+    const mayBeLarge = largeBodyAdmissible(header(req, "mcp-method"), header(req, "mcp-name"));
+    const cap = mayBeLarge ? MAX_SBOM_BODY_BYTES : MAX_BODY_BYTES;
     const declared = Number(req.headers["content-length"]);
-    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+    if (Number.isFinite(declared) && declared > cap) {
         req.resume();
         return Promise.resolve("too_large");
     }
+    let slot = false;
+    if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        if (!largeBodies.tryAcquire()) {
+            req.resume();
+            return Promise.resolve("busy");
+        }
+        slot = true;
+    }
     return new Promise((resolve, reject) => {
         const chunks = [];
         let size = 0;
         let done = false;
+        const stop = (r) => {
+            done = true;
+            chunks.length = 0;
+            if (slot)
+                largeBodies.release();
+            slot = false;
+            resolve(r);
+        };
         req.on("data", (chunk) => {
             if (done)
                 return;
             size += chunk.length;
-            if (size > MAX_BODY_BYTES) {
-                done = true;
-                resolve("too_large");
-                return;
+            if (size > cap)
+                return stop("too_large");
+            if (size > MAX_BODY_BYTES && !slot) {
+                if (!largeBodies.tryAcquire())
+                    return stop("busy");
+                slot = true;
             }
             chunks.push(chunk);
         });
         req.on("end", () => {
             if (!done)
-                resolve(Buffer.concat(chunks));
+                resolve({ body: Buffer.concat(chunks), slot });
         });
         req.on("error", (e) => {
-            if (!done)
-                reject(e);
+            if (done)
+                return;
+            done = true;
+            if (slot)
+                largeBodies.release();
+            reject(e);
         });
     });
 }
+function header(req, name) {
+    const v = req.headers[name];
+    return Array.isArray(v) ? v.join(", ") : v;
+}
+function tooLarge(res, cors) {
+    send(res, 413, rpcError(BODY_TOO_LARGE_CODE, `Request body too large: at most ${MAX_BODY_BYTES} bytes, or ${MAX_SBOM_BODY_BYTES} bytes for ${LARGE_BODY_TARGETS_TEXT}. A larger SBOM can be passed to check_sbom as its purls.`, { max_bytes: MAX_BODY_BYTES, max_bytes_sbom: MAX_SBOM_BODY_BYTES }), { ...cors, Connection: "close" });
+    return { status: 413, refused: "body_size" };
+}
 async function serveMcp(req, res, pathname) {
     const method = req.method ?? "GET";
     const origin = req.headers.origin;
@@ -135,14 +170,39 @@ async function serveMcp(req, res, pathname) {
         return { status: 429, throttled: true };
     }
     let body;
+    let facts;
+    let slot = false;
     if (method === "POST") {
         const read = await readBody(req);
-        if (read === "too_large") {
-            send(res, 413, rpcError(BODY_TOO_LARGE_CODE, `Request body too large: at most ${MAX_BODY_BYTES} bytes.`), { ...cors, Connection: "close" });
-            return { status: 413, refused: "body_size" };
+        if (read === "too_large")
+            return tooLarge(res, cors);
+        if (read === "busy") {
+            send(res, 503, rpcError(BUSY_CODE, `Server busy: this instance is already reading its ${LARGE_BODY_SLOTS} large request bodies at once. Retry after ${BUSY_RETRY_AFTER_SEC} s, or pass check_sbom the SBOM's purls.`, { retry_after_seconds: BUSY_RETRY_AFTER_SEC }), { ...cors, "Retry-After": String(BUSY_RETRY_AFTER_SEC), Connection: "close" });
+            log("WARNING", "mcp_large_body_busy", { slots: LARGE_BODY_SLOTS });
+            return { status: 503, refused: "large_body_busy" };
+        }
+        body = read.body;
+        slot = read.slot;
+        facts = bodyFacts(body);
+        // Past the general cap, the body itself must be what the headers (if any) said: one of
+        // LARGE_BODY_TARGETS. A 2025-era client sends no Mcp-Method, so this is where its large body
+        // is held to that.
+        if (body.length > MAX_BODY_BYTES && !isLargeBodyTarget(facts)) {
+            if (slot)
+                largeBodies.release();
+            return { ...tooLarge(res, cors), body, facts };
         }
-        body = read;
     }
+    try {
+        return { ...(await relay(req, res, pathname, method, cors, client, body)), facts };
+    }
+    finally {
+        if (slot)
+            largeBodies.release();
+    }
+}
+// Hands one admitted request to the SDK's handler and streams its answer back.
+async function relay(req, res, pathname, method, cors, client, body) {
     const headers = new Headers();
     for (const [k, v] of Object.entries(req.headers)) {
         if (v === undefined || HOP_BY_HOP.has(k))
@@ -158,7 +218,11 @@ async function serveMcp(req, res, pathname) {
         body: body && body.length > 0 ? new Uint8Array(body) : undefined,
         signal: abort.signal,
     });
-    const response = await withClient(client.forwardAddress, () => handler.fetch(request));
+    // #2737: the production synthetic names itself by its user-agent family; its API calls then
+    // carry the synthetic's fixed token (runtime.ts upstreamUserAgent), so they are never counted
+    // as hosted adoption.
+    const synthetic = uaFamily(req.headers["user-agent"]) === SYNTHETIC_UA_FAMILY;
+    const response = await withClient(client.forwardAddress, () => handler.fetch(request), { synthetic });
     const out = { ...cors };
     response.headers.forEach((v, k) => {
         out[k] = v;
@@ -169,7 +233,7 @@ async function serveMcp(req, res, pathname) {
             res.write(chunk);
     }
     res.end();
-    return { status: response.status, body };
+    return { status: response.status, body, clientPublic: client.forwardAddress !== undefined };
 }
 const server = http.createServer((req, res) => {
     const start = process.hrtime.bigint();
@@ -183,7 +247,7 @@ const server = http.createServer((req, res) => {
     }
     const method = req.method ?? "GET";
     const finish = (o) => {
-        const facts = o.body ? bodyFacts(o.body) : { rpc_method: "(none)" };
+        const facts = o.facts ?? (o.body ? bodyFacts(o.body) : { rpc_method: "(none)" });
         log("INFO", "mcp_request", {
             method,
             path: pathname === MCP_PATH || pathname === HEALTH_PATH ? pathname : "(other)",
@@ -196,6 +260,7 @@ const server = http.createServer((req, res) => {
             throttled: o.throttled === true,
             refused: o.refused ?? "",
             ua_family: uaFamily(req.headers["user-agent"]),
+            client_public: o.clientPublic === true,
         });
     };
     if (pathname === HEALTH_PATH) {
@@ -230,6 +295,8 @@ server.listen(PORT, () => {
         forward_token_configured: forwardToken() !== "",
         rate_limit_per_min: RATE_LIMIT_PER_MIN,
         max_body_bytes: MAX_BODY_BYTES,
+        max_sbom_body_bytes: MAX_SBOM_BODY_BYTES,
+        large_body_slots: LARGE_BODY_SLOTS,
     });
 });
 const shutdown = () => {

package/dist/httpPolicy.js

@@ -10,6 +10,7 @@ import { isIP } from "node:net";
 export const ORIGIN_REFUSED_CODE = -32000; // the SDK's own code for an Origin refusal (originValidationResponse)
 export const RATE_LIMITED_CODE = -32029; // implementation-defined server error range (-32000..-32099); "429"
 export const BODY_TOO_LARGE_CODE = -32600; // Invalid Request
+export const BUSY_CODE = -32030; // implementation-defined server error range; "503", no large-body slot free (#2747)
 export function rpcError(code, message, data) {
     return JSON.stringify({ jsonrpc: "2.0", id: null, error: { code, message, ...(data ? { data } : {}) } });
 }
@@ -198,6 +199,80 @@ export class FixedWindowLimiter {
         }
     }
 }
+// ── Request-body caps (#2747) ──
+//
+// Two caps, because one tool's input is a document and every other tool's is a CVE ID or a short
+// search.
+//
+//   - 64 KiB for every request: far above any real request but an SBOM's, and the cap the
+//     endpoint shipped with (#2316).
+//   - 6 MiB for one tools/call of check_sbom, or one prompts/get of sbom_review, which takes the
+//     same document to hand to check_sbom (LARGE_BODY_TARGETS). The sbom argument is up to MAX_SBOM_CHARS
+//     (5,000,000) characters, and over this endpoint that document IS the JSON-RPC body: JSON
+//     text passed as a string is escaped once more (every '"' and newline doubles), which for a
+//     pretty-printed CycloneDX document is about 10% (a 4,998,809-character one is a 5,470,320-byte
+//     body; test/http.test.mjs holds the cap above it). Below Cloud Run's 32 MiB HTTP/1 request
+//     limit. OWASP Juice Shop 11.1.2's 0.74 MB SBOM, which the 64 KiB cap refused, fits eight
+//     times over; a 2,000-component one in the same shape is a ~2 MB body.
+//
+// Which request may be large is decided before it is read where the client says so (a
+// 2026-07-28 client sends Mcp-Method and Mcp-Name; another value is held to 64 KiB without
+// reading on), and from the body itself otherwise: a body past 64 KiB that is not one of
+// LARGE_BODY_TARGETS is refused 413 once read.
+//
+// Memory, not the cap, is what bounds this. An instance has 256 MiB and serves up to 250
+// requests at once (deploy-all.sh SVC_MEMORY / SVC_CONCURRENCY); a check_sbom call holds the raw
+// body, its JSON parse here, the SDK's own parse, the tool's parse of the document and the answer.
+// Measured 2026-10-04 on dist/http.js, Node 22, peak RSS (VmHWM) over an idle ~80 MB: one
+// 2,000-purl ~2 MB body +62 MB; one 5.47 MB body +76 MB; two 5.47 MB bodies at once 209 MB in
+// all, also with V8's old space held to 64 MB: ~59 MB of 256 MiB left for everything else, so
+// not a third. So a body past 64 KiB must hold one of DEFAULT_LARGE_BODY_SLOTS (2) slots per
+// instance for as long as it is read and served; with none free it is answered 503 with
+// Retry-After, never queued. The per-client limit still counts each large request as one
+// request, before its body is read.
+export const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+export const DEFAULT_MAX_SBOM_BODY_BYTES = 6 * 1024 * 1024;
+export const DEFAULT_LARGE_BODY_SLOTS = 2;
+/** The requests whose body may pass DEFAULT_MAX_BODY_BYTES: JSON-RPC method → the one tool or prompt name. */
+export const LARGE_BODY_TARGETS = { "tools/call": "check_sbom", "prompts/get": "sbom_review" };
+/** LARGE_BODY_TARGETS in words, for the refusals. */
+export const LARGE_BODY_TARGETS_TEXT = Object.entries(LARGE_BODY_TARGETS)
+    .map(([m, n]) => `a ${m} of ${n}`)
+    .join(" or ");
+/** Whether a request's own Mcp-Method / Mcp-Name headers leave it free to be one of LARGE_BODY_TARGETS. Absent headers do (a 2025-era client sends neither). */
+export function largeBodyAdmissible(mcpMethod, mcpName) {
+    const name = mcpName?.trim();
+    if (mcpMethod === undefined)
+        return name === undefined || Object.values(LARGE_BODY_TARGETS).includes(name);
+    const want = Object.hasOwn(LARGE_BODY_TARGETS, mcpMethod.trim()) ? LARGE_BODY_TARGETS[mcpMethod.trim()] : undefined;
+    return want !== undefined && (name === undefined || name === want);
+}
+/** Whether a read body is one of LARGE_BODY_TARGETS, by its bodyFacts. */
+export function isLargeBodyTarget(facts) {
+    const name = facts.rpc_method === "tools/call" ? facts.tool : facts.rpc_method === "prompts/get" ? facts.prompt : undefined;
+    return name !== undefined && Object.hasOwn(LARGE_BODY_TARGETS, facts.rpc_method) && LARGE_BODY_TARGETS[facts.rpc_method] === name;
+}
+/** A counting semaphore that never waits: tryAcquire answers at once. */
+export class Slots {
+    max;
+    used = 0;
+    constructor(max) {
+        this.max = max;
+    }
+    tryAcquire() {
+        if (this.used >= this.max)
+            return false;
+        this.used++;
+        return true;
+    }
+    release() {
+        if (this.used > 0)
+            this.used--;
+    }
+    get inUse() {
+        return this.used;
+    }
+}
 // ── Bounded access-log fields ──
 //
 // The access line carries no body, no query string, no argument and no client address: only
@@ -206,7 +281,7 @@ const RPC_METHOD = /^[a-z][a-z/_]{0,39}$/i;
 const TOOL_NAME = /^[a-z][a-z0-9_]{0,39}$/;
 const REVISION = /^\d{4}-\d{2}-\d{2}$/;
 const UA_FAMILY = /^[A-Za-z0-9._-]{1,40}$/;
-/** The JSON-RPC method and, for tools/call, the tool name, shape-checked; never anything else from the body. */
+/** The JSON-RPC method and, for tools/call, the tool name (for prompts/get, the prompt name), shape-checked; never anything else from the body. */
 export function bodyFacts(body) {
     if (!body || body.length === 0)
         return { rpc_method: "(none)" };
@@ -226,10 +301,11 @@ export function bodyFacts(body) {
         return { rpc_method: "(response)" };
     if (!RPC_METHOD.test(m))
         return { rpc_method: "(other)" };
-    if (m !== "tools/call")
+    if (m !== "tools/call" && m !== "prompts/get")
         return { rpc_method: m };
     const name = parsed.params?.name;
-    return { rpc_method: m, tool: typeof name === "string" && TOOL_NAME.test(name) ? name : "(other)" };
+    const shaped = typeof name === "string" && TOOL_NAME.test(name) ? name : "(other)";
+    return m === "tools/call" ? { rpc_method: m, tool: shaped } : { rpc_method: m, prompt: shaped };
 }
 export function revisionLabel(v) {
     if (v === undefined)

package/dist/index.js

@@ -52,7 +52,7 @@ import { registerCheckAffected } from "./tools/check_affected.js";
 import { registerCheckSbom } from "./tools/check_sbom.js";
 import { registerCveIntel } from "./tools/cve_intel.js";
 import { registerGetCwe } from "./tools/get_cwe.js";
-import { isHttpEntrypoint, upstreamHeaders } from "./runtime.js";
+import { isHttpEntrypoint, upstreamHeaders, upstreamUserAgent } from "./runtime.js";
 import { registerVendorAdvisoryTools } from "./tools/vendor_advisories.js";
 import { registerPrompts } from "./prompts.js";
 import { registerResources } from "./resources.js";
@@ -186,8 +186,9 @@ export async function api(path, init) {
                 method: init?.method,
                 body: init?.body,
                 // upstreamHeaders: empty on stdio; on the hosted endpoint, the forward token and the
-                // end client's address (runtime.ts, #2316).
-                headers: { ...upstreamHeaders(`${BASE}${path}`), ...(init?.headers ?? {}), "User-Agent": UA, Accept: "application/json" },
+                // end client's address (runtime.ts, #2316). upstreamUserAgent: UA, unless the hosted
+                // endpoint is answering the production synthetic (#2737).
+                headers: { ...upstreamHeaders(`${BASE}${path}`), ...(init?.headers ?? {}), "User-Agent": upstreamUserAgent(UA), Accept: "application/json" },
                 signal: ctrl.signal,
             });
         }
@@ -377,7 +378,8 @@ export const realInstant = (s) => s !== undefined && Date.parse(s) > 0;
 // get_cve, and none for a search page, whose rows each carry their own. None of them serves a
 // fleet-wide time at which the feed's pollers last completed, so freshness is null: the
 // summary's poller.last_poll_at is the answering instance's own NVD poller (cve/poller.go
-// Stats, in memory), and is relayed in data but not presented as the feed's freshness.
+// Stats, in memory), and is relayed in data but not presented as the feed's freshness; the note
+// says what the whole poller block is (summaryPollerNote, #2647).
 const CVE_FEED_METHOD = "EchelonGraph's CVE Pulse feed: CVE records compiled from NVD, MITRE-CNA pre-NVD records, CISA-KEV, EPSS and GitHub GHSA, each polled from its source on a schedule.";
 const NO_FEED_FRESHNESS = "freshness is null: the CVE feed's answer carries no time at which its pollers last completed a poll for the feed as a whole.";
 function scoreStateOf(rec) {
@@ -494,6 +496,29 @@ function summaryRejectedNote(d) {
         return "";
     return ` summary.rejected (${rejected}) counts CVE records rejected (withdrawn) by their numbering authority, not active CVEs: report them as withdrawn records, never as vulnerabilities.`;
 }
+// ── poller, one instance's counters (#2647) ──
+//
+// The summary answer carries a poller block beside summary: cves_ingested, cves_skipped,
+// http_retries, interval, last_poll_at, last_poll_dur_ms, poll_count and poll_errors. They are
+// core-backend cve/poller.go Stats: the in-memory counters of the NVD poller of the ONE API
+// instance that answered, since that instance last started, and every restart zeroes them. So
+// cves_ingested 7195 (production, 2026-09-30T10:02:13Z) is what that instance ingested since it
+// started, not the feed's size or intake, and poll_errors is not the feed's reliability. Through
+// 2.6.1 the tool relayed the block with no word about it. The JSON is still relayed as sent; the
+// outputSchema describes the block, and whenever the answer carries one the note says what it is,
+// with the counters a model would quote, and an answer without it gets no sentence.
+const POLLER_QUOTED = ["cves_ingested", "poll_count", "poll_errors"];
+function summaryPollerNote(d) {
+    const poller = field(d, "poller");
+    if (!isPlainObject(poller) || Object.keys(poller).length === 0)
+        return "";
+    const quoted = POLLER_QUOTED.flatMap((k) => {
+        const n = numAt(poller, k);
+        return n === undefined ? [] : [`poller.${k} ${n}`];
+    });
+    const counters = quoted.length > 0 ? ` (${quoted.join(", ")})` : "";
+    return ` poller is one API instance's NVD poller, counted in that instance's memory since it last started and zeroed on every restart: report its counters${counters} as that instance's, never as the feed's size, intake or reliability, and poller.last_poll_at as that instance's last poll, never as the feed's freshness.`;
+}
 async function cveSummary() {
     const tool = "cve_summary";
     try {
@@ -516,8 +541,9 @@ async function cveSummary() {
             ],
         };
         const total = numAt(r.data, "summary", "total");
-        // What summary.none (#2610), the NVD histogram and summary.rejected (#2641) count.
-        const labels = `${summaryNoneNote(r.data)}${summaryNVDNote(r.data)}${summaryRejectedNote(r.data)}`;
+        // What summary.none (#2610), the NVD histogram and summary.rejected (#2641) count, and what
+        // the poller block is (#2647).
+        const labels = `${summaryNoneNote(r.data)}${summaryNVDNote(r.data)}${summaryRejectedNote(r.data)}${summaryPollerNote(r.data)}`;
         if (total === undefined)
             return succeeded(r.data, `${head}${labels}`, env);
         if (total === 0) {
@@ -1772,6 +1798,10 @@ const CVERecord = z.looseObject({
     modified: opt(z.string()),
     updated_at: opt(z.string()),
 });
+// #2647: what cve_summary says the poller block is (summaryPollerNote). Like the #2641 strings
+// beside SUMMARY_NONE_DESCRIPTION, it uses none of #2610's six words ("any", "not", "rating",
+// "scored", "source", "yet"). Declared here, before the outputSchema that describes poller with it.
+const SUMMARY_POLLER_DESCRIPTION = "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so.";
 // One of the NVD histogram's four labelled buckets (#2641).
 const nvdBand = (label) => opt(z.number()).describe(`Of the active CVEs total counts, those whose NVD CVSS severity label is ${label}: NVD's label, as provenance, never EchelonGraph's severity band.`);
 const CVE_SUMMARY_OUTPUT = envelopeSchema({
@@ -1797,6 +1827,21 @@ const CVE_SUMMARY_OUTPUT = envelopeSchema({
             last_updated: opt(z.string()),
         })
             .optional(),
+        // #2647: one instance's counters, never the feed's (see summaryPollerNote).
+        poller: z
+            .looseObject({
+            cves_ingested: opt(z.number()).describe("CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake."),
+            cves_skipped: opt(z.number()).describe("CVE records this instance's NVD poller skipped since the instance last started."),
+            http_retries: opt(z.number()).describe("HTTP retries this instance's NVD poller made since the instance last started."),
+            interval: opt(z.string()).describe("How often this instance's NVD poller polls."),
+            last_poll_at: opt(z.string()).describe("When this instance's NVD poller last polled: never the feed's freshness."),
+            last_poll_dur_ms: opt(z.number()).describe("How long that poll took, in milliseconds."),
+            poll_count: opt(z.number()).describe("Polls this instance's NVD poller made since the instance last started."),
+            poll_errors: opt(z.number()).describe("Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability."),
+        })
+            .nullable()
+            .optional()
+            .describe(SUMMARY_POLLER_DESCRIPTION),
     }),
     coverage: null,
     freshness: null,
@@ -1981,7 +2026,7 @@ export function createServer() {
     const server = new McpServer({ name: NAME, version: VERSION }, { instructions: INSTRUCTIONS, capabilities: { tools: { listChanged: false }, prompts: { listChanged: false }, resources: { listChanged: false } } });
     server.registerTool("cve_summary", {
         title: "CVE feed summary",
-        description: `Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. ${SUMMARY_NONE_DESCRIPTION} ${SUMMARY_NVD_DESCRIPTION} ${SUMMARY_REJECTED_DESCRIPTION} The feed is polled from its sources on a schedule, so this is the state as of that update. ${FEED_ENVELOPE}`,
+        description: `Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. ${SUMMARY_NONE_DESCRIPTION} ${SUMMARY_NVD_DESCRIPTION} ${SUMMARY_REJECTED_DESCRIPTION} ${SUMMARY_POLLER_DESCRIPTION} The feed is polled from its sources on a schedule, so this is the state as of that update. ${FEED_ENVELOPE}`,
         outputSchema: CVE_SUMMARY_OUTPUT,
         annotations: ANNOTATIONS,
     }, async () => checked("cve_summary", CVE_SUMMARY_OUTPUT, await cveSummary()));

package/dist/runtime.js

@@ -22,8 +22,25 @@ export function isHttpEntrypoint() {
 // withClient(), and the SDK dispatches the tool handler inside that same async context, so
 // api() can read it without the tool module passing it through every function.
 const clientStore = new AsyncLocalStorage();
-export function withClient(clientIp, fn) {
-    return clientStore.run({ clientIp }, fn);
+export function withClient(clientIp, fn, opts = {}) {
+    return clientStore.run({ clientIp, synthetic: opts.synthetic === true }, fn);
+}
+// #2737: the production MCP synthetic probes this endpoint too, and its calls must reach the API
+// under its own family, never as hosted MCP adoption. The synthetic names itself to this service
+// with this family as its User-Agent's leading token; http.ts marks such a request (synthetic:
+// true) and upstreamUserAgent() then puts this FIXED token ahead of the service's own user-agent,
+// exactly as ECHELONGRAPH_MCP_UA does for the npm package. The client's text is never relayed: a
+// request either carries this one constant or nothing. Anyone can claim the family, as anyone can
+// send it to the API directly; the consequence is an undercounted adoption number, never a bypass
+// (core-backend: user-agent classification is for counting only).
+export const SYNTHETIC_UA_FAMILY = "echelongraph-mcp-synthetic";
+export const SYNTHETIC_UA_TOKEN = `${SYNTHETIC_UA_FAMILY}/1.0`;
+/** The User-Agent for one API call: `ua`, led by the synthetic's token when the request is the synthetic's. */
+export function upstreamUserAgent(ua) {
+    if (!httpEntrypoint || clientStore.getStore()?.synthetic !== true)
+        return ua;
+    const lead = ua.split(/[/\s]/, 1)[0];
+    return lead === SYNTHETIC_UA_FAMILY ? ua : `${SYNTHETIC_UA_TOKEN} ${ua}`;
 }
 /** The header that carries the forward token, and the one that names the client (core-backend waf/mcpforward.go). */
 export const FORWARD_TOKEN_HEADER = "X-EG-MCP-Forward";

package/dist/tools/check_sbom.js

@@ -44,7 +44,7 @@ const CLEAN_NOTE = "Only not_affected is a clean verdict, and only for the advis
 const MEASURED_AT_NOTE = "measured_at is null: the corpus rows are read through a cache whose maximum age the answer states (summary.corpus_cache_max_age_ms), so the answer gives no single time at which they were read.";
 const FRESHNESS_NOTE = "freshness is null: the answer carries no time at which the advisory corpus was last refreshed.";
 export const CHECK_SBOM_TITLE = "Check an SBOM against the advisory corpus";
-export const CHECK_SBOM_DESCRIPTION = "Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. Pass purls (package URLs, up to 2,000 distinct) or sbom (a CycloneDX JSON or SPDX JSON document, as JSON text or as an object, up to 5,000,000 characters). The purls are read from the document on this machine and only they are sent, in POST bodies of at most 200 purls each, one after another, never in a URL; the document itself is not sent. A component without a purl is counted and not checked. Each purl is mapped to its OSV ecosystem, package name and version and matched against the affected version ranges EchelonGraph holds from OSV.dev advisory records; there is no ranking and no score. data.results holds one row per component sent, in order (index counts across batches), with verdict (affected, not_affected, undetermined or not_assessed), assessed, not_assessed_reason, cve_ids, matches, count, not_affected_count and undetermined_count; data.summary counts the verdicts, summed over the batches (partial is true when any batch's was). not_affected is the only clean verdict. undetermined: advisories name the package but at least one could not be decided at this version and none matched. not_assessed: no verdict at all, because the package is not in the corpus, the purl type has no OSV ecosystem, a deb, apk or rpm purl carries no distro qualifier naming its release (EchelonGraph does not guess one), the version is missing, the lookup failed, or the batch's time budget ran out first (time_budget). Neither undetermined nor not_assessed is clean, and the note gives their counts. The API allows 1,200 components a minute per caller; when it answers 429 with Retry-After, the tool waits as asked and sends the batch again, within 50 seconds per call. When the next wait would pass that, or a batch after the first fails, the tool stops and answers what it has: coverage.not_sent counts the purls not sent and coverage.not_sent_reason says why (time_budget, rate_limited or request_failed), data.not_sent_purls lists them for a later call, and they are not checked and not clean. A list or document with more than 2,000 distinct purls is refused, not truncated: split it. Its structured result carries state (measured when at least one component got a verdict, else not_assessed), measured_at (null: the corpus is read through a cache, so no single read time exists), method, coverage (what the input held, what was sent in how many batches, and what was not sent and why), freshness (null) and notes, with data equal to the API's JSON (for more than one batch, the batches' answers merged); the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
+export const CHECK_SBOM_DESCRIPTION = "Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. Pass purls (package URLs, up to 2,000 distinct) or sbom (a CycloneDX JSON or SPDX JSON document, as JSON text or as an object, up to 5,000,000 characters). The purls are read from the document by this MCP server and only they are sent to the API, in POST bodies of at most 200 purls each, one after another, never in a URL; the document itself is not sent on. Run from npm, this server is on your machine; over the hosted endpoint (mcp.echelongraph.io) it is EchelonGraph's, and the document is the request body, accepted up to 6 MiB. A component without a purl is counted and not checked. Each purl is mapped to its OSV ecosystem, package name and version and matched against the affected version ranges EchelonGraph holds from OSV.dev advisory records; there is no ranking and no score. data.results holds one row per component sent, in order (index counts across batches), with verdict (affected, not_affected, undetermined or not_assessed), assessed, not_assessed_reason, cve_ids, matches, count, not_affected_count and undetermined_count; data.summary counts the verdicts, summed over the batches (partial is true when any batch's was). not_affected is the only clean verdict. undetermined: advisories name the package but at least one could not be decided at this version and none matched. not_assessed: no verdict at all, because the package is not in the corpus, the purl type has no OSV ecosystem, a deb, apk or rpm purl carries no distro qualifier naming its release (EchelonGraph does not guess one), the version is missing, the lookup failed, or the batch's time budget ran out first (time_budget). Neither undetermined nor not_assessed is clean, and the note gives their counts. The API allows 1,200 components a minute per caller; when it answers 429 with Retry-After, the tool waits as asked and sends the batch again, within 50 seconds per call. When the next wait would pass that, or a batch after the first fails, the tool stops and answers what it has: coverage.not_sent counts the purls not sent and coverage.not_sent_reason says why (time_budget, rate_limited or request_failed), data.not_sent_purls lists them for a later call, and they are not checked and not clean. A list or document with more than 2,000 distinct purls is refused, not truncated: split it. Its structured result carries state (measured when at least one component got a verdict, else not_assessed), measured_at (null: the corpus is read through a cache, so no single read time exists), method, coverage (what the input held, what was sent in how many batches, and what was not sent and why), freshness (null) and notes, with data equal to the API's JSON (for more than one batch, the batches' answers merged); the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
 const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 function dedupe(all) {
     const seen = new Set();

package/dist/tools/kev_recent.js

@@ -6,7 +6,7 @@ const MAX_VENDOR = 128;
 const MAX_CURSOR = 128;
 const KEV_RECENT_METHOD = "EchelonGraph's copy of the CISA KEV catalog: CISA's feed is polled every 5 minutes and each entry is written onto its CVE's record; rows are read from those records, newest kev_added_date first.";
 const KEV_RECENT_COVERAGE = "CISA KEV catalog";
-const KEV_RECENT_DESCRIPTION = "The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each row in kev gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ransomware (known ransomware-campaign use), EchelonGraph's severity, cvss_v3_score, epss_score, epss_percentile and eg_kev_tier for the CVE, and our_first_seen_kev, when EchelonGraph's poller first recorded the CVE entering the catalog (null where no such record exists). Filter by since and until (YYYY-MM-DD, inclusive, on kev_added_date; an RFC 3339 timestamp, such as the kev_added_date 2024-04-12T00:00:00Z that CVE records carry, is read as its UTC date, and anything else is refused), ransomware, and vendor (an exact, case-insensitive match on kev_vendor); page with limit (1 to 200, default 50) and cursor, passing back the previous page's next_cursor with the same filters. Rows within one date are ordered by cve_id. total counts the CVEs matching the filters; kev_listed_total counts every CVE EchelonGraph holds as KEV-listed, and catalog.catalog_count is CISA's own count in the catalog last fetched, so a gap between the two is entries not yet in EchelonGraph's CVE table, which no page returns. CISA's requiredAction and shortDescription are not returned. Its structured result carries state (measured), measured_at (our last successful fetch of CISA's feed, null when the API does not give it), method, coverage (the CISA KEV catalog: total, returned, kev_listed_total, catalog_count, limit, has_more), freshness (last_successful_fetch_at, catalog_version, date_released) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
+const KEV_RECENT_DESCRIPTION = "The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each row in kev gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ransomware (known ransomware-campaign use), EchelonGraph's severity, cvss_v3_score, epss_score, epss_percentile and eg_kev_tier for the CVE, and our_first_seen_kev, when EchelonGraph's poller first recorded the CVE entering the catalog (null where no such record exists). Filter by since and until (YYYY-MM-DD, inclusive, on kev_added_date; an RFC 3339 timestamp, such as the kev_added_date 2024-04-12T00:00:00Z that CVE records carry, is read as the date written in it, with the time and offset dropped, and anything else is refused), ransomware, and vendor (an exact, case-insensitive match on kev_vendor); page with limit (1 to 200, default 50) and cursor, passing back the previous page's next_cursor with the same filters. Rows within one date are ordered by cve_id. total counts the CVEs matching the filters; kev_listed_total counts every CVE EchelonGraph holds as KEV-listed, and catalog.catalog_count is CISA's own count in the catalog last fetched, so a gap between the two is entries not yet in EchelonGraph's CVE table, which no page returns. CISA's requiredAction and shortDescription are not returned. Its structured result carries state (measured), measured_at (our last successful fetch of CISA's feed, null when the API does not give it), method, coverage (the CISA KEV catalog: total, returned, kev_listed_total, catalog_count, limit, has_more), freshness (last_successful_fetch_at, catalog_version, date_released) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends.";
 const opt = (t) => t.nullable().optional();
 const KEVRow = z.looseObject({
     cve_id: opt(z.string()),
@@ -62,17 +62,18 @@ const Freshness = z.strictObject({
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const isDate = (s) => DATE.test(s) && new Date(`${s}T00:00:00Z`).toISOString().slice(0, 10) === s;
 // An RFC 3339 date-time (#2736): get_cve gives kev_added_date as one ("2024-04-12T00:00:00Z"), and a
-// model passes it on as given. It is read as its UTC date; the time of day is dropped.
+// model passes it on as given. It is read as the date WRITTEN in it; the time and offset are dropped.
+// kev_added_date is a calendar date (CISA's dateAdded, a DATE column), not an instant, so
+// "2024-04-12T00:00:00+02:00" means 2024-04-12 — converting it to UTC first answered for
+// 2024-04-11 and still said measured (#2755). The time and offset are still
+// validated, so a malformed timestamp is refused rather than read.
 const RFC3339 = /^(\d{4}-\d{2}-\d{2})T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d{1,9})?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
 // since or until as the YYYY-MM-DD the API takes, or null when it is neither form.
 export function kevDate(raw) {
     if (isDate(raw))
         return raw;
     const m = RFC3339.exec(raw.toUpperCase());
-    if (!m || !isDate(m[1]))
-        return null;
-    const t = Date.parse(raw.toUpperCase());
-    return Number.isFinite(t) ? new Date(t).toISOString().slice(0, 10) : null;
+    return m && isDate(m[1]) ? m[1] : null;
 }
 // A header value must be visible ASCII: fetch refuses others, and that refusal would read as an outage.
 const PRINTABLE = /^[\x20-\x7e]+$/;
@@ -190,8 +191,8 @@ export function registerKevRecent(server, d) {
         title: "Recent CISA KEV additions",
         description: KEV_RECENT_DESCRIPTION,
         inputSchema: z.object({
-            since: z.string().optional().describe("earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as its UTC date)"),
-            until: z.string().optional().describe("latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as its UTC date)"),
+            since: z.string().optional().describe("earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it)"),
+            until: z.string().optional().describe("latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it)"),
             ransomware: z.boolean().optional().describe("true: only CVEs with known ransomware-campaign use; false: only those without"),
             vendor: z.string().optional().describe("CISA vendorProject, an exact case-insensitive match, e.g. 'Microsoft'"),
             limit: z.number().int().min(1).max(KEV_RECENT_MAX_LIMIT).optional().describe("page size (default 50, max 200)"),

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "echelongraph-mcp",
-  "version": "2.6.0",
+  "version": "2.6.2",
   "mcpName": "io.echelongraph/echelongraph-mcp",
-  "description": "EchelonGraph CVE and internet-exposure data as an MCP server: CVEs with EchelonGraph multi-source scores, CISA-KEV and EPSS, plus a per-CVE internet-exposure footprint derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Free and keyless, for Claude, Cursor and any MCP client.",
+  "description": "MCP server for CVE and vulnerability lookups: CVE records with EchelonGraph multi-source scores, CISA KEV, EPSS history, CWE weaknesses, public exploits, version and SBOM checks against the vulnerability advisory corpus, vendor security advisories, and a per-CVE internet-exposure footprint derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Free and keyless, for Claude, Cursor and any MCP client.",
   "type": "module",
   "bin": {
     "echelongraph-mcp": "dist/index.js"
@@ -18,17 +18,29 @@
     "start": "node dist/index.js",
     "start:http": "node dist/http.js",
     "smoke": "node test/smoke.mjs",
+    "text-bound:live": "npm run build && node test/text-bound-live.mjs",
     "test": "npm run build && node --test test/*.test.mjs synthetic/*.test.mjs",
     "synthetic": "node synthetic/run.mjs"
   },
   "keywords": [
     "mcp",
+    "mcp-server",
     "model-context-protocol",
     "cve",
     "vulnerability",
+    "vulnerabilities",
     "security",
+    "cybersecurity",
     "kev",
+    "cisa-kev",
     "epss",
+    "nvd",
+    "ghsa",
+    "cwe",
+    "cvss",
+    "sbom",
+    "security-advisories",
+    "threat-intelligence",
     "exposure",
     "echelongraph",
     "claude",

package/server.json

@@ -17,7 +17,7 @@
       ]
     }
   ],
-  "version": "2.6.0",
+  "version": "2.6.2",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "echelongraph-mcp",
-      "version": "2.6.0",
+      "version": "2.6.2",
       "transport": {
         "type": "stdio"
       },