echelongraph-mcp 2.7.1 → 2.7.2

package/CHANGELOG.md

@@ -6,6 +6,26 @@ with a provenance attestation by the release workflow of
 [github.com/echelongraph/echelongraph-mcp](https://github.com/echelongraph/echelongraph-mcp),
 from the commit tagged `v<version>`.
 
+## 2.7.2 — 2026-10-11
+
+- exposure_radar flags every radar whose last completed check is past its threshold, not only the
+  two whose answer carries a liveness verdict. kev_exposure and exposed_databases (12-hour cycles)
+  are flagged after 24 hours, leaked_credentials (a 10-minute cycle) after 1 hour; shadow_ai and
+  mcp_servers keep the API's own poller.running and enabled verdicts, and fall back to 30 and 45
+  minutes only where the answer gives none. A flagged radar's sentence gives the age and the cycle
+  and says its numbers may be stale. The age is taken against the clock when the answer is
+  composed, never the stats cache's generated_at. The closing sentence "Each radar refreshes on its
+  own schedule." is gone: it said the radars were refreshing while four of the five were stopped.
+  It now lists the radars that may be stale, or names each threshold when none is. A test reads
+  each radar's cadence from core-backend and fails when a threshold is under twice it (#3010).
+- README: the freshness sentence says a radar refreshes only while it runs (#3010). The setup steps
+  say to quit the client fully and reopen it, and no longer give a tool count to look for: `npx`
+  runs the newest release and a connector the hosted endpoint's, so a number could differ from a
+  working install's and read as a failure (#2813).
+- cve_intel: each exploits row carries `source_published_at`, the source's own date for the
+  reference (null where the source gives none), and `eg_first_seen_at`, when EchelonGraph recorded
+  it. `first_seen_at` is kept, deprecated, as `source_published_at` under its old key (#2876).
+
 ## 2.7.1 — 2026-10-06
 
 - README: the server serves five prompts, not four; `workload_triage` (added in 2.7.0) is now in

package/README.md

@@ -34,9 +34,9 @@ API call a tool needs to answer.
 ## Quick start
 
 The local server runs through `npx` and needs Node.js 20 or later; nothing is installed
-globally. Claude Desktop's one-click extension, below, needs neither. Add one of the blocks below to your client, restart it, then ask: *"Is
-CVE-2023-44487 actively exploited, and how many exposed services does EchelonGraph's radar
-have on record for it?"*
+globally. Claude Desktop's one-click extension, below, needs neither. Add one of the blocks below
+to your client, quit it fully and reopen it, then ask: *"Is CVE-2023-44487 actively exploited, and
+how many exposed services does EchelonGraph's radar have on record for it?"*
 
 ### Claude Desktop
 
@@ -97,8 +97,8 @@ are claude.ai's (see "Remote (no install)" below).
    Claude → Quit Claude (⌘Q); on Windows right-click the Claude icon in the system tray and choose
    Quit. The first start can take longer while `npx` downloads the package.
 5. **Check that it worked.** Settings → Developer lists `echelongraph` as running, and the tools
-   menu in the chat box lists EchelonGraph's 16 tools. Then ask the question at the top of this
-   section.
+   menu in the chat box lists EchelonGraph's tools, the ones under "Tools" below. Then ask the
+   question at the top of this section.
 
 #### Troubleshooting Claude Desktop
 
@@ -263,8 +263,10 @@ answer of which EchelonGraph holds none, whose `held_since` is after 1 January o
 or not known, or whose history is still being read: no advisory from such a vendor is not a finding
 that it published none.
 
-Every figure is as fresh as the schedule that refreshes it. The CVE feed is polled from its
-sources on a schedule; each radar refreshes on its own.
+Every figure is as fresh as the last check that produced it. The CVE feed is polled from its
+sources on a schedule. Each radar has its own schedule and refreshes only while it runs, and
+`exposure_radar`'s `freshness` gives each radar's last completed check (`last_run_at`) where the
+API serves one.
 
 ### How `cve_summary` reads its counts
 

package/dist/index.js

@@ -1206,6 +1206,86 @@ function lastCheck(radar, data) {
         `${radar}.last_run_at is not the time of every record the ${radar} numbers count, which cover everything still on record, not only what that check found; nor is it ${radar}.generated_at, when the API computed those numbers.`,
     ];
 }
+// ── Staleness: a radar whose last completed check is older than its cycle allows (#3010) ──
+//
+// Through 2.7.1 the note flagged only the two radars whose answer carries a liveness verdict
+// (shadow_ai's poller.running, mcp_servers.enabled), and every answer ended "Each radar refreshes
+// on its own schedule.". So during the #2975 scanning pause exposed_databases (77 h since its last
+// completed check) and leaked_credentials (68 h) read as current. Each radar now has a threshold
+// keyed to the cadence core-backend runs it at (cmd/server/main.go builds each poller; an interval
+// of 0 takes the package's defaultInterval):
+//   kev_exposure        kevexposure/poller.go defaultInterval, 12 h: 24 h, two cycles
+//   exposed_databases   exposeddb/poller.go defaultInterval, 12 h: 24 h, two cycles
+//   leaked_credentials  leakedcreds/poller.go defaultInterval, 10 min: 1 h, six cycles, so a stopped
+//                       radar shows within the hour and a slow cycle or two never trips it
+//   shadow_ai           the API's own poller.running (shadowctlog pollerSilentAfter, 30 min) first;
+//                       only when the answer gives no verdict, 30 minutes by poller.last_run_at
+//   mcp_servers         the API's own enabled (aiexposure liveWindow, 45 min) first; only when the
+//                       answer gives no verdict, 45 minutes by last_run_at
+// These are copies of numbers core-backend owns, so test/radar-staleness.test.mjs reads the Go files
+// and fails when a threshold is under twice the cadence it parses, when a cycle named here is not
+// the one it parses, when a radar has no entry, or when a constant can no longer be parsed.
+//
+// The age is taken against this server's clock when the answer is composed, never against a
+// radar's generated_at: that is when the API's stats cache computed the totals, and the cache is
+// stale-while-revalidate (core-backend internal/cache/swr.go keeps serving its last value while a
+// refresh fails), so it can lag the answer by hours and would understate the age. last_run_at is
+// read fresh (the API omits it when its last good read is more than two minutes old). The note
+// gives the age and the cycle, says the numbers may be stale, and gives no cause: the answer gives
+// none.
+const MINUTE = 60_000;
+const HOUR = 60 * MINUTE;
+export const STALE_AFTER = {
+    kev_exposure: { after: 24 * HOUR, cycle: 12 * HOUR },
+    exposed_databases: { after: 24 * HOUR, cycle: 12 * HOUR },
+    leaked_credentials: { after: HOUR, cycle: 10 * MINUTE },
+    shadow_ai: { after: 30 * MINUTE },
+    mcp_servers: { after: 45 * MINUTE },
+};
+const counted = (n, unit) => `${n} ${unit}${n === 1 ? "" : "s"}`;
+// A threshold or a cycle: "24 hours", "1 hour", "45 minutes"; as an adjective, "12-hour".
+const span = (ms) => (ms % HOUR === 0 ? counted(ms / HOUR, "hour") : counted(Math.round(ms / MINUTE), "minute"));
+const spanAdj = (ms) => (ms % HOUR === 0 ? `${ms / HOUR}-hour` : `${Math.round(ms / MINUTE)}-minute`);
+// An age, rounded: minutes under two hours, hours under a week, days past that.
+const age = (ms) => ms < 2 * HOUR ? counted(Math.round(ms / MINUTE), "minute") : ms < 168 * HOUR ? counted(Math.round(ms / HOUR), "hour") : counted(Math.round(ms / (24 * HOUR)), "day");
+// How long before `now` the instant `at` was, when that is past the radar's threshold; otherwise
+// (or when `at` is not a real instant) undefined.
+function staleBy(radar, at, now) {
+    if (typeof at !== "string" || !realInstant(at))
+        return undefined;
+    const ms = now - Date.parse(at);
+    return ms > STALE_AFTER[radar].after ? ms : undefined;
+}
+// The note's sentence for a stats radar whose relayed last_run_at is past its threshold. It does not
+// repeat the stamp, which lastCheck prints once.
+function staleCheck(radar, data, now) {
+    const ms = staleBy(radar, data.last_run_at, now);
+    if (ms === undefined)
+        return [];
+    const { after, cycle } = STALE_AFTER[radar];
+    const times = after / cycle === 2 ? "twice" : `${after / cycle} times`;
+    return [`${radar}.last_run_at is about ${age(ms)} before this answer, more than ${times} the radar's ${spanAdj(cycle)} cycle, so the ${radar} numbers may be stale.`];
+}
+// The last sentence of every answer. "Each radar refreshes on its own schedule." said the radars
+// were refreshing whatever their last completed checks said. This says only what the answer
+// shows: each radar has a cycle of its own (not that it is running on it), and either the radars
+// that may be stale, the same ones whose own sentences above say so, or that nothing shows one past
+// its threshold, with each threshold named. "Nothing shows" stays true when the API serves no
+// last_run_at (#2335: the note then says nothing about a last completed check), and the envelope's
+// own note (RADAR_FRESHNESS_NOTE) already points to freshness on every answer.
+function freshnessClose(stale) {
+    if (stale.length)
+        return `Each radar has its own cycle, and ${stale.length} of the ${RADARS.length} radars may be stale: ${listed(stale)}.`;
+    const byAfter = new Map();
+    for (const [name] of RADARS) {
+        const s = STALE_AFTER[name];
+        if (s.cycle !== undefined)
+            byAfter.set(s.after, [...(byAfter.get(s.after) ?? []), name]);
+    }
+    const timed = [...byAfter].map(([after, names]) => `${span(after)} for ${listed(names)}`);
+    const verdicts = `for shadow_ai and mcp_servers, the API's own poller.running and enabled verdicts, or ${span(STALE_AFTER.shadow_ai.after)} and ${span(STALE_AFTER.mcp_servers.after)} where the answer gives none`;
+    return `Each radar has its own cycle, and neither freshness nor anything else in this answer shows a radar past its threshold for calling its numbers stale (${timed.join(", ")}; ${verdicts}).`;
+}
 // The first row of a relayed ranking, for the note: "(first: http_server, 9120 services)".
 function firstOf(rows, label, count, unit) {
     const top = Array.isArray(rows) ? rows[0] : undefined;
@@ -1288,7 +1368,7 @@ function newestKEVRow(r) {
         row.exposed_hosts = hosts;
     return { row, state, outside: tracked === false };
 }
-function readKEVExposure(body) {
+function readKEVExposure(body, now) {
     const { data, unknown, unusable, undated } = readRadar(body, KEV_SPEC);
     const sentences = [];
     const n = (k) => numIn(data, k);
@@ -1346,8 +1426,10 @@ function readKEVExposure(body) {
     }
     sentences.push(...windowSentences("kev_exposure", { window: data.window, undated, bad: false }, "when Shodan collected the banners of the oldest and the newest of the service×CVE pairs counted, Shodan's own times, not when EchelonGraph stored or re-checked a pair"));
     sentences.push(...lastCheck("kev_exposure", data));
+    const stale = staleCheck("kev_exposure", data, now);
+    sentences.push(...stale);
     sentences.push(...leftOut("kev_exposure", unknown, unusable));
-    return { data, sentences };
+    return { data, sentences, stale: stale.length > 0 };
 }
 // ── exposed_databases: GET /api/v1/public/exposed-databases/stats (#2313 item 7) ──
 //
@@ -1375,7 +1457,7 @@ const EXPOSED_DB_SPEC = {
     instants: ["generated_at", "last_run_at"],
     window: "observed_window",
 };
-function readExposedDatabases(body) {
+function readExposedDatabases(body, now) {
     const { data, unknown, unusable, undated } = readRadar(body, EXPOSED_DB_SPEC);
     const sentences = [];
     const n = (k) => numIn(data, k);
@@ -1401,8 +1483,10 @@ function readExposedDatabases(body) {
     }
     sentences.push(...windowSentences("exposed_databases", { window: data.window, undated, bad: false }, "when EchelonGraph's check last confirmed the oldest and the newest of the services counted answering without authentication"));
     sentences.push(...lastCheck("exposed_databases", data));
+    const stale = staleCheck("exposed_databases", data, now);
+    sentences.push(...stale);
     sentences.push(...leftOut("exposed_databases", unknown, unusable));
-    return { data, sentences };
+    return { data, sentences, stale: stale.length > 0 };
 }
 // ── leaked_credentials: GET /api/v1/public/leaked-credentials/stats (#2313 item 7) ──
 //
@@ -1425,7 +1509,7 @@ const LEAKED_CREDS_SPEC = {
     instants: ["generated_at", "last_run_at"],
     window: "observed_window",
 };
-function readLeakedCredentials(body) {
+function readLeakedCredentials(body, now) {
     const { data, unknown, unusable, undated } = readRadar(body, LEAKED_CREDS_SPEC);
     const sentences = [];
     const n = (k) => numIn(data, k);
@@ -1448,10 +1532,12 @@ function readLeakedCredentials(body) {
     }
     sentences.push(...windowSentences("leaked_credentials", { window: data.window, undated, bad: false }, "when EchelonGraph's detector last found the oldest and the newest of the (repository, secret) pairs counted in a public commit"));
     sentences.push(...lastCheck("leaked_credentials", data));
+    const stale = staleCheck("leaked_credentials", data, now);
+    sentences.push(...stale);
     sentences.push(...leftOut("leaked_credentials", unknown, unusable));
-    return { data, sentences };
+    return { data, sentences, stale: stale.length > 0 };
 }
-function readShadowAI(sa) {
+function readShadowAI(sa, now) {
     const sentences = [];
     const stats = field(sa, "stats");
     const used = new Set();
@@ -1574,6 +1660,10 @@ function readShadowAI(sa) {
         data.authentication = authentication;
     const lastRun = strAt(sa, "poller", "last_run_at");
     const running = boolAt(sa, "poller", "running");
+    // #3010: running is the API's own verdict and decides; only a block with a real last_run_at and
+    // no verdict is judged by STALE_AFTER.shadow_ai, the API's own window, and that time is still
+    // not relayed (the block stays left out) or repeated: the note gives its age.
+    const unjudged = running === undefined ? staleBy("shadow_ai", lastRun, now) : undefined;
     if (realInstant(lastRun) && running === true) {
         data.poller = { running, last_run_at: lastRun };
         sentences.push(`Shadow-AI radar freshness: the radar's leader last completed a Certificate Transparency (crt.sh) discovery cycle at ${lastRun} (poller.running is true: that was within ${SHADOW_AI_SILENT_AFTER} of the API's answer).`);
@@ -1587,10 +1677,13 @@ function readShadowAI(sa) {
     }
     else {
         sentences.push("Shadow-AI radar freshness is unknown: the answer's poller block does not give both a real time at which the radar's leader last completed a cycle (poller.last_run_at) and a running verdict (poller.running), so that block was left out of the data above.");
+        if (unjudged !== undefined) {
+            sentences.push(`The shadow-AI poller block gives no running verdict, but its last_run_at is about ${age(unjudged)} before this answer, more than the ${span(STALE_AFTER.shadow_ai.after)} after which the API reports the radar not running, so the shadow-AI figures may be stale.`);
+        }
     }
     if (realInstant(lastObservation))
         sentences.push(`Latest shadow-AI observation on record: ${lastObservation}.`);
-    return { data, sentences };
+    return { data, sentences, stale: (realInstant(lastRun) && running === false) || unjudged !== undefined };
 }
 // ── mcp_servers: GET /api/v1/public/ai-exposure/stats?service=mcp (#2315) ──
 //
@@ -1716,7 +1809,7 @@ function mcpRefusal(body) {
     }
     return undefined;
 }
-function readMCPServers(src) {
+function readMCPServers(src, now) {
     const data = {};
     const unusable = [];
     const unsummed = [];
@@ -1807,12 +1900,18 @@ function readMCPServers(src) {
     if (typeof at === "string") {
         sentences.push(`mcp_servers last completed check: ${at} (mcp_servers.last_run_at, a timestamp, not a count).`, "mcp_servers.last_run_at is when the AI-exposure radar, which checks other AI services as well as MCP servers, last finished a cycle whose reads succeeded and whose scan opt-out register answered.", "mcp_servers.last_run_at is not the time of every verdict the mcp_servers numbers count (mcp_servers.window says when those were checked); nor is it mcp_servers.counted_at, when the API read those numbers.");
     }
+    // #3010: enabled is the API's own verdict and decides; only an answer without a usable one is
+    // judged by STALE_AFTER.mcp_servers, the API's own window, on the last_run_at relayed above.
+    const unjudged = data.enabled === undefined ? staleBy("mcp_servers", data.last_run_at, now) : undefined;
     if (data.enabled === true) {
         sentences.push(`mcp_servers.enabled is true: the API reports the AI-exposure radar running, a check having completed within ${MCP_ENABLED_WITHIN} of its answer.`);
     }
     else if (data.enabled === false) {
         sentences.push(`mcp_servers.enabled is false: the API does not report the AI-exposure radar running (no check completed within ${MCP_ENABLED_WITHIN} of its answer), so these numbers may be stale.`);
     }
+    else if (unjudged !== undefined) {
+        sentences.push(`The answer gives no usable mcp_servers.enabled verdict, but mcp_servers.last_run_at is about ${age(unjudged)} before this answer, more than the ${span(STALE_AFTER.mcp_servers.after)} within which the API reports the AI-exposure radar running, so the mcp_servers numbers may be stale.`);
+    }
     if (typeof data.counted_at === "string") {
         sentences.push(`mcp_servers.counted_at (${data.counted_at}) is when the API read these counts: a timestamp, not a count, and not when any verdict was checked.`);
     }
@@ -1822,7 +1921,7 @@ function readMCPServers(src) {
     if (unnamed) {
         sentences.push(`Also left out of mcp_servers: ${unnamed} field${unnamed === 1 ? "" : "s"} whose name is not shaped like a field name, not repeated here, since a name could itself identify a server.`);
     }
-    return { data, sentences };
+    return { data, sentences, stale: data.enabled === false || unjudged !== undefined };
 }
 // #2842: the description is a head that fits the client cut (requiredText.ts); what each radar's
 // numbers count, field by field, is the outputSchema's description of that radar (RADAR_*_FIELDS
@@ -1858,7 +1957,7 @@ const RADAR_MCP_FIELDS = `mcp_servers: counts and timestamps only, no hostname.
 // not_assessed with measured_at null, the window is relayed in data and labelled by the note,
 // and the envelope's own note names it.
 const RADAR_METHOD = "Aggregate counts over what each radar holds on record: kev_exposure, Shodan banners whose version maps to a CISA-KEV-listed CVE; exposed_databases, services found through Shodan (LeakIX when Shodan query credits run low) and confirmed by EchelonGraph's own identified check; leaked_credentials, credential-shaped strings in public GitHub push events; shadow_ai, services found through Certificate Transparency logs and Shodan and checked by EchelonGraph's identified probes; mcp_servers, the latest verdict on record per hostname named like an MCP server in EchelonGraph's own Certificate Transparency feed, from EchelonGraph's identified MCP probe (server/discover, and initialize only if that is refused; never tools/call), where protected means the endpoint's RFC 9728 protected-resource metadata validated.";
-const RADAR_NAMES = RADARS.map(([name]) => name);
+export const RADAR_NAMES = RADARS.map(([name]) => name);
 const RADAR_STATE_NOTE = "state is not_assessed: every radar answered, but none gives one time at which what it counts was observed: kev_exposure, exposed_databases, leaked_credentials, shadow_ai's confirmed_exposed and mcp_servers date what they count at most by a window (kev_exposure.window, exposed_databases.window, leaked_credentials.window, shadow_ai.confirmed_exposed.window, mcp_servers.window), from the oldest observation among the rows counted to the newest, so no count here is presented as a dated measurement and measured_at is null. Each count is what that radar holds on record, and the note labels each one by what it counts.";
 const RADAR_FRESHNESS_NOTE = "freshness gives each radar's last completed check where the API serves one (freshness.kev_exposure.last_run_at, freshness.exposed_databases.last_run_at, freshness.leaked_credentials.last_run_at, freshness.shadow_ai.last_run_at with freshness.shadow_ai.running, and freshness.mcp_servers.last_run_at with freshness.mcp_servers.enabled), and null where it does not.";
 async function exposureRadar() {
@@ -1891,43 +1990,50 @@ async function exposureRadar() {
             const radars = failures.map(([radar, f]) => ({ radar, kind: f.kind, path: f.path, status: f.status ?? null, message: f.detail }));
             return failure("failed", message, { kind: "radars", path: null, status: null, message: `${failures.length} of ${RADARS.length} radars could not be read`, radars }, { radars: RADAR_NAMES, answered, failed: failures.map(([name]) => name) });
         }
-        // Each radar's answer is relayed cut to the fields its reader can label, in RADARS order.
-        const read = {
-            kev_exposure: readKEVExposure(data.kev_exposure),
-            exposed_databases: readExposedDatabases(data.exposed_databases),
-            leaked_credentials: readLeakedCredentials(data.leaked_credentials),
-            shadow_ai: readShadowAI(data.shadow_ai),
-            mcp_servers: readMCPServers(data.mcp_servers),
-        };
-        const relayed = {};
-        const said = [];
-        for (const [name] of RADARS) {
-            relayed[name] = read[name].data;
-            said.push(...read[name].sentences);
-        }
-        // Only what the readers relayed: a last_run_at that is not a real instant never got there.
-        const stamp = (radar, ...keys) => instantOrNull(strAt(relayed[radar], ...keys));
-        const running = boolAt(relayed.shadow_ai, "poller", "running");
-        const enabled = boolAt(relayed.mcp_servers, "enabled");
-        return succeeded(relayed, `${okHead(tool)} All ${RADARS.length} radars answered: ${RADARS.map(([name]) => name).join(", ")}. Every number relayed is labelled below by what it counts, and a field this version cannot label is left out and named. ${said.join(" ")} ${RADAR_SOURCES} ${SHODAN_OWNERSHIP} Each radar refreshes on its own schedule.`, {
-            state: "not_assessed",
-            measured_at: null,
-            method: RADAR_METHOD,
-            coverage: { radars: RADAR_NAMES, answered: RADAR_NAMES, failed: [] },
-            freshness: {
-                kev_exposure: { last_run_at: stamp("kev_exposure", "last_run_at") },
-                exposed_databases: { last_run_at: stamp("exposed_databases", "last_run_at") },
-                leaked_credentials: { last_run_at: stamp("leaked_credentials", "last_run_at") },
-                shadow_ai: { last_run_at: stamp("shadow_ai", "poller", "last_run_at"), running: running ?? null },
-                mcp_servers: { last_run_at: stamp("mcp_servers", "last_run_at"), enabled: enabled ?? null },
-            },
-            notes: [RADAR_STATE_NOTE, RADAR_FRESHNESS_NOTE],
-        });
+        return radarAnswer(data, Date.now());
     }
     catch (e) {
         return crashed(tool, e);
     }
 }
+// exposure_radar's answer once every radar has answered (and mcp_servers has passed mcpRefusal):
+// each radar's answer relayed cut to the fields its reader can label, in RADARS order, and the
+// note. `now` is the clock the radars' last completed checks are aged against (#3010; see
+// STALE_AFTER), a parameter so that the suite can set it.
+export function radarAnswer(data, now) {
+    const read = {
+        kev_exposure: readKEVExposure(data.kev_exposure, now),
+        exposed_databases: readExposedDatabases(data.exposed_databases, now),
+        leaked_credentials: readLeakedCredentials(data.leaked_credentials, now),
+        shadow_ai: readShadowAI(data.shadow_ai, now),
+        mcp_servers: readMCPServers(data.mcp_servers, now),
+    };
+    const relayed = {};
+    const said = [];
+    for (const [name] of RADARS) {
+        relayed[name] = read[name].data;
+        said.push(...read[name].sentences);
+    }
+    const stale = RADAR_NAMES.filter((name) => read[name].stale);
+    // Only what the readers relayed: a last_run_at that is not a real instant never got there.
+    const stamp = (radar, ...keys) => instantOrNull(strAt(relayed[radar], ...keys));
+    const running = boolAt(relayed.shadow_ai, "poller", "running");
+    const enabled = boolAt(relayed.mcp_servers, "enabled");
+    return succeeded(relayed, `${okHead("exposure_radar")} All ${RADARS.length} radars answered: ${RADARS.map(([name]) => name).join(", ")}. Every number relayed is labelled below by what it counts, and a field this version cannot label is left out and named. ${said.join(" ")} ${RADAR_SOURCES} ${SHODAN_OWNERSHIP} ${freshnessClose(stale)}`, {
+        state: "not_assessed",
+        measured_at: null,
+        method: RADAR_METHOD,
+        coverage: { radars: RADAR_NAMES, answered: RADAR_NAMES, failed: [] },
+        freshness: {
+            kev_exposure: { last_run_at: stamp("kev_exposure", "last_run_at") },
+            exposed_databases: { last_run_at: stamp("exposed_databases", "last_run_at") },
+            leaked_credentials: { last_run_at: stamp("leaked_credentials", "last_run_at") },
+            shadow_ai: { last_run_at: stamp("shadow_ai", "poller", "last_run_at"), running: running ?? null },
+            mcp_servers: { last_run_at: stamp("mcp_servers", "last_run_at"), enabled: enabled ?? null },
+        },
+        notes: [RADAR_STATE_NOTE, RADAR_FRESHNESS_NOTE],
+    });
+}
 // ── outputSchema: the envelope, per tool (#2311, #2313) ──
 //
 // A discriminated union on state: a success (measured, not_assessed) carries data and a method;

package/dist/resources.js

@@ -63,7 +63,7 @@ A count of 0 is a finding of none when the answer measured it. Under assessed: f
 - check_affected: measured when the answer says assessed true; not_assessed when it says false or does not say. measured_at and freshness are null.
 - check_sbom: measured when at least one component got a verdict, else not_assessed; measured_at null. not_affected is the one clean verdict; undetermined and not_assessed are not clean.
 - scan_manifest: as check_sbom, on the purls this server reads from the lockfiles passed; not_assessed, with no API call, when no entry pins one registry version. Each entry not sent (a range, an unresolved version, a local path, a VCS checkout or a line not read) is listed in data.not_checked with its reason and is not clean; a refused file (package.json, go.sum and the other manifests of ranges) is named in the note, and nothing in it is checked.
-- cve_intel: measured_at null: each row carries its own first_seen_at or enriched_at. An empty exploits list is not evidence that no public exploit exists.
+- cve_intel: measured_at null: each row carries its own dates. An exploits row carries source_published_at, the source's own date for the reference, null when the source publishes none (EchelonGraph does not supply one), and eg_first_seen_at, when EchelonGraph recorded the reference; first_seen_at is deprecated and holds the same value as source_published_at. A timeline row carries enriched_at. An empty exploits list is not evidence that no public exploit exists.
 - cve_remediation: measured with measured_at null, or not_assessed for a CVE record rejected by its numbering authority. Every text is its source's, verbatim and untested by EchelonGraph; each vendor item's kind is the vendor's own category. remediation_state none_in_source or not_parsed, and an empty list, are not a finding that no fix exists.
 - get_cwe: measured_at null: each row carries its own published date. A total of 0 says no CVE in EchelonGraph's feed is classified under that CWE.
 - vendor_advisories_for_cve, search_vendor_advisories: measured_at null (each row carries vendor_published_at and our_first_seen_at). get_vendor_advisory: measured_at is our_first_seen_at, when EchelonGraph first recorded the advisory.

package/dist/tools/cve_intel.js

@@ -25,6 +25,12 @@
 // does not say which ran, so no text here says a source is polled: it names the sources the data
 // model holds, and says coverage depends on which pollers run.
 //
+// Exploit dates (#2876). Until #2876 the collectors made dates up: a nuclei row's first_seen_at
+// was 1 January of its CVE's year, and a Metasploit row's was the vulnerability's disclosure
+// date. Each row now carries source_published_at (the source's own date, null where it gives
+// none) and eg_first_seen_at (when EchelonGraph recorded it); first_seen_at, deprecated, is
+// source_published_at under its old key. All three are relayed as sent, null included.
+//
 // Fixed versions (#2817). /enrichment keeps one affected_packages row per (CVE, ecosystem,
 // package), and its fixed_version is one range's fix: the last range's as the advisory was read
 // (core-backend cve/backfill_osv_packages.go summariseAffected). For CVE-2021-44228 production
@@ -70,7 +76,10 @@ const TIMELINE_RELAYED = 20;
 const CVE_INTEL_METHOD = "EchelonGraph's per-CVE enrichment (GET /api/v1/public/cves/:id/enrichment). cwes: CWE classifications stored from NVD, GitHub (GHSA) and CVE.org records, each with the source that gave it, named from the MITRE CWE catalog EchelonGraph embeds. exploits: public exploit references from EchelonGraph's cve_exploits records, whose data model holds Metasploit modules (metasploit), Exploit-DB entries (exploit_db), nuclei templates (nuclei_template), GitHub proof-of-concept repositories (github_poc) and vendor proofs of concept (vendor_poc), filled by a curated seed and by one poller per automated source, each run only where it is enabled, so which sources are current depends on the deployment. affected_packages and fixed_versions: package-ecosystem advisory data, each row naming its source. timeline: EchelonGraph's enrichment history for the CVE, newest first.";
 const VERIFIED_STATUS_DESCRIPTION = "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.";
 const FIXED_BRANCHES_DESCRIPTION = 'fixed_branches lists each affected range of the package on record: introduced, and fixed (the range\'s fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader\'s label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem\'s version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced ("0" is the first version) and below fixed, or at or below last_affected; that range\'s fixed is the fix for it, and a version in no range is outside every range on record. fixed_branches is null where the package\'s ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range\'s fix, kept for compatibility (one per package: the range the loader kept, the advisory\'s last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0.';
-export const CVE_INTEL_DESCRIPTION = `Weakness, public exploit code, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, first_seen_at and verified_status; at most 10, verified first) with exploits_total, exploits_capped, exploits_by_kind and exploits_by_status, affected_packages (ecosystem, package_name, version_range, fixed_version, fixed_branches), fixed_versions (one row per fixed version, with the vulnerable_range it fixes) and timeline (the newest enrichment-history rows, with timeline_total). fixed_branches lists each affected range of the package on record (introduced, and fixed or last_affected, with advisory_id (the OSV record that published the range) and source); in the ecosystem's version order, a version is in a range when it is at or above introduced ("0" is the first version) and below fixed, or at or below last_affected; that range's fixed is the fix for it. fixed_version is one range's fix, kept for compatibility, not the fix for every affected range. fixed_branches [] is not a finding that no fix exists. verified_status is a label from the source, not a guarantee the exploit works on a given system. An empty exploits list is not evidence that no public exploit exists: it covers only the sources EchelonGraph ingests, and which of them are polled depends on the deployment. A section the API could not read is named in coverage.sections_failed and left out of data, never relayed as an empty list. Pass a CVE ID like CVE-2021-44228. Its structured result carries notes, with data, which the first text block holds whole up to 30,000 characters; its coverage names the sections relayed, failed and left out. ${TEXT_BUDGET_DESCRIPTION}`;
+// #2876: the exploit dates are named for what they are. Within the 100 characters of headroom
+// under the 2048-character client cut (prompts-resources.test.mjs), the room came from tighter
+// glosses and from the input hint, which inputSchema's cve_id description carries.
+export const CVE_INTEL_DESCRIPTION = `Weakness, public exploit code, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if none), eg_first_seen_at (when EchelonGraph recorded it) and verified_status; at most 10, verified first) with exploits_total, exploits_capped, exploits_by_kind and exploits_by_status, affected_packages (ecosystem, package_name, version_range, fixed_version, fixed_branches), fixed_versions (each fixed version with the vulnerable_range it fixes) and timeline (the newest enrichment-history rows, with timeline_total). fixed_branches lists each affected range on record (introduced, and fixed or last_affected, with advisory_id (its OSV record) and source); in the ecosystem's version order, a version is in a range when it is at or above introduced ("0" is the first version) and below fixed, or at or below last_affected; that range's fixed is the fix for it. fixed_version is one range's fix, kept for compatibility, not the fix for every affected range. fixed_branches [] is not a finding that no fix exists. verified_status is the source's label, not a guarantee the exploit works on a given system. An empty exploits list is not evidence that no public exploit exists: it covers only the sources EchelonGraph ingests, and which are polled depends on the deployment. A section the API could not read is named in coverage.sections_failed and left out of data, never relayed as an empty list. Its structured result carries notes, with data, which the first text block holds whole up to 30,000 characters; its coverage names the sections relayed, failed and left out. ${TEXT_BUDGET_DESCRIPTION}`;
 // ── outputSchema ──
 const Rows = (shape) => z.array(z.looseObject(shape));
 const CountMap = z.record(z.string(), z.number());
@@ -87,7 +96,11 @@ function schemas() {
             source_name: opt(z.string()),
             source_url: opt(z.string()),
             description: opt(z.string()),
-            first_seen_at: opt(z.string()),
+            source_published_at: opt(z.string()).describe("The source's own date for the reference (Exploit-DB's date_published, a GitHub proof-of-concept repository's created_at, or the first commit of a nuclei template or Metasploit module where EchelonGraph derived it from the source's git history); null where the source gives none, and EchelonGraph supplies no stand-in date."),
+            // Optional, not nullable: core-backend always serves it since #2876 (cve_exploits.created_at);
+            // an API older than #2876 leaves it out.
+            eg_first_seen_at: z.string().optional().describe("When EchelonGraph first recorded the reference, as a UTC timestamp: a date of EchelonGraph's, not the source's."),
+            first_seen_at: opt(z.string()).describe("Deprecated: the same value as source_published_at, null when that is."),
             verified_status: opt(z.string()).describe(VERIFIED_STATUS_DESCRIPTION),
         }).optional(),
         exploits_total: z.number().int().nullable().optional().describe("Every exploit reference on record for the CVE, not only those listed in exploits."),
@@ -323,7 +336,7 @@ export async function cveIntel(cve_id) {
             coverage,
             freshness: null,
             notes: [
-                "measured_at is null: the answer has no single observation time; each row carries its own (first_seen_at, enriched_at).",
+                "measured_at is null: the answer has no single observation time; each row carries its own (source_published_at and eg_first_seen_at, enriched_at).",
                 "freshness is null: the answer does not say when each source was last polled.",
             ],
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "echelongraph-mcp",
-  "version": "2.7.1",
+  "version": "2.7.2",
   "mcpName": "io.echelongraph/echelongraph-mcp",
   "description": "MCP server for CVE lookups: EchelonGraph scores, CISA KEV, EPSS, CWE, exploits, version and SBOM checks, vendor advisories, and per-CVE exposure derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Keyless.",
   "type": "module",

package/server.json

@@ -17,7 +17,7 @@
       ]
     }
   ],
-  "version": "2.7.1",
+  "version": "2.7.2",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "echelongraph-mcp",
-      "version": "2.7.1",
+      "version": "2.7.2",
       "transport": {
         "type": "stdio"
       },