What Is endoflife.ai?
endoflife.ai is a free software lifecycle intelligence service. It tracks end-of-life dates, support status and lifecycle risk for 500+ software products and their versions, labels every date with its source, joins the data to CISA's Known Exploited Vulnerabilities catalog, and rates each version with its own EOL Risk Score from 0 to 100. The data is available on the website, through a free API, and through an MCP server for AI assistants. It was founded in 2026 by Scott Bissett and is based in Alberta, Canada.
What it does
| Layer | What you get | Where |
|---|---|---|
| Dates | Release, end of support and end-of-life dates for each version of each product, each labelled with where it was read | Product pages such as /nodejs and version pages such as /nodejs/20 |
| Judgment | The EOL Risk Score, a 0 to 100 rating of how risky a version is to run, with its four factors shown | Methodology and a score page per version |
| Exploitation | Which products have entries in CISA's Known Exploited Vulnerabilities catalog, and which exploited flaws have no fix on end-of-life versions | Exploited and Unpatchable |
| Identifiers | CPE and package URL (purl) identifiers, so lifecycle data can be joined to scanner findings and SBOMs | Product pages and the API |
| Tools | An EOL Checker, a Stack Scanner for dependency files, a free API, an MCP server, a GitHub Action and a badge | Checker, Stack Scanner, API, MCP |
| Guides | Reference guides on individual end-of-life events, vendor lifecycle policies and what to do after end of life | Guides |
Where the dates come from
Where a vendor publishes a machine-readable lifecycle page or API, endoflife.ai reads it directly and treats it as the source of record. Those dates are reconciled against the endoflife.date open dataset, which is also the source for products that have no vendor feed yet. Every date on every page, and every answer from the API, says which of these it came from. When two sources disagree, the disagreement is investigated and the result is published as a correction with its source.
The live breakdown, including what share of dates are vendor-sourced, every open disagreement and every published correction, is on the accuracy page. The method is on How it works.
The EOL Risk Score
The EOL Risk Score is endoflife.ai's own measure. It answers a different question from a vulnerability severity score: not "how bad is this flaw?" but "how risky is it to keep running this version?". Four published factors make up the 100 points: how long ago the version reached end of life (40), attack surface (30), exposure in CISA's Known Exploited Vulnerabilities catalog (20) and whether extended support exists (10). Scores are recalculated from the data at every build. The full method is on the Risk Score page.
Who uses it, and how to cite it
Security teams, platform and DevOps engineers, IT asset managers, auditors and AI assistants answering lifecycle questions. To cite a date, link the product or version page, for example https://endoflife.ai/nodejs/20; to cite a score, link the score page. Guidance for assistants is on /ai and in llms.txt.
Frequently Asked Questions
What is endoflife.ai?
endoflife.ai is a free software lifecycle intelligence service. It tracks end-of-life dates, support status and lifecycle risk for 500+ software products and their versions, labels every date with its source, joins the data to CISA's Known Exploited Vulnerabilities catalog, and rates each version with its own EOL Risk Score from 0 to 100. The data is available on the website, through a free API, and through an MCP server for AI assistants.
Is endoflife.ai free?
Yes. The website, the EOL Checker, the Stack Scanner and the score pages are free, and the API has a free tier.
Where does endoflife.ai get its dates?
From two kinds of source. Where a vendor publishes a machine-readable lifecycle page or API, endoflife.ai reads it directly and treats it as the source of record. It reconciles those dates against the endoflife.date open dataset, which is also the source for products with no vendor feed yet. Every date carries a label saying which source it came from, and disagreements are investigated and published as corrections.
Is endoflife.ai the same as endoflife.date?
No. They are separate projects run by different people. endoflife.date is a community-maintained open source dataset of lifecycle dates. endoflife.ai is an independent service that uses that dataset as one of its sources, checks dates against vendors' own pages, contributes corrections back, and adds its own layers: the EOL Risk Score, the exploited-vulnerability join, software identifiers, an API and an MCP server.
What is the EOL Risk Score?
The EOL Risk Score is endoflife.ai's 0 to 100 rating of how risky it is to run a given software version, based on four published factors: how long ago it reached end of life (40 points), attack surface (30), exposure in CISA's Known Exploited Vulnerabilities catalog (20) and whether extended support exists (10).