ContrastAPI

CVE Leading

cve_leading

Read-onlyIdempotent

List CVEs indexed from MITRE/GHSA BEFORE NVD publication (early-warning, freshest data). By default each result is slim (no description, no cvss_breakdown, no affected_products list, no references) — pass include='full' for the same payload shape as cve_lookup; for drill-down on a single CVE prefer cve_lookup. Use for threat intelligence on emerging CVEs; use cve_search for published NVD data. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, next_offset, verdict, hint}.

Input Schema

TableJSON Schema

Name	Required	Description
`limit`	No	Maximum results to return. Range: 1-200.
`offset`	No	Skip N results for pagination.
`include`	No	Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Verdict is at the response root, not per-row (deduplicated for ~40% payload savings). Allowed: '' or 'full'.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedJun 2, 2026
- changedOutput schema / properties / result / properties / hint / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / next_offset / type
```
Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / query_echo / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / verdict / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
Changed2 schema fields changedMay 25, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / next_offset / type
```
Previous value: -"object"New value: +"integer"
```

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "count": {
+          "type": "integer"
+        },
+        "hint": {
+          "type": "object"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "next_offset": {
+          "type": "object"
+        },
+        "offset": {
+          "type": "integer"
+        },
+        "query_echo": {
+          "type": "object"
+        },
+        "results": {
+          "type": "array"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "total": {
+          "type": "integer"
+        },
+        "truncated": {
+          "type": "boolean"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -{
-  "$defs": {
-    "CveSearchItem": {
-      "additionalProperties": true,
-      "properties": {
-        "cve_id": {
-          "type": "string"
-        },
-        "cvss_v3": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwe_id": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "epss": {
-          "$ref": "#/$defs/EpssInfo"
-        },
-        "kev": {
-          "$ref": "#/$defs/KevInfo"
-        },
-        "modified": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "published": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "references_count": {
-          "type": "integer"
-        },
-        "severity": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "sources": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "summary": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "total_products": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "cve_id"
-      ],
-      "type": "object"
-    },
-    "CveSearchResponse": {
-      "properties": {
-        "count": {
-          "type": "integer"
-        },
-        "hint": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SearchHint"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_offset": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "offset": {
-          "type": "integer"
-        },
-        "query_echo": {
-          "anyOf": [
-            {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "results": {
-          "items": {
-            "$ref": "#/$defs/CveSearchItem"
-          },
-          "type": "array"
-        },
-        "summary": {
-          "type": "string"
-        },
-        "total": {
-          "type": "integer"
-        },
-        "truncated": {
-          "type": "boolean"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "EpssInfo": {
-      "properties": {
-        "percentile": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "score": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "KevInfo": {
-      "properties": {
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_added": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_removed": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "due_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "in_kev": {
-          "type": "boolean"
-        },
-        "known_ransomware_use": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "notes": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "product": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "required_action": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "short_description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vendor_project": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vulnerability_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "SearchHint": {
-      "additionalProperties": true,
-      "properties": {
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "const": "cve_lookup",
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/CveSearchResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Changed161 schema fields changedMay 17, 2026
- removedOutput schema / $defs / CveSearchItem / description
```
Removed value: -"Slim per-result shape for cve_search list items.\n\nDefault cve_search response uses this shape (description / cvss_breakdown /\naffected_products / references / first_seen_* are dropped). Pass cve_search\n?include=full to get the full CveResponse shape — extra=\"allow\" lets the\nfull-mode fields pass through without a schema fork."
```
- removedOutput schema / $defs / CveSearchItem / properties / cve_id / description
```
Removed value: -"Canonical CVE identifier, e.g. 'CVE-2021-44228'."
```
- removedOutput schema / $defs / CveSearchItem / properties / cve_id / title
```
Removed value: -"Cve Id"
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / description
```
Removed value: -"CVSS v3.x base score (0.0-10.0)."
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / title
```
Removed value: -"Cvss V3"
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / description
```
Removed value: -"Primary CWE identifier (legacy single-value field). Equals cwes[0] when cwes is present. Kept for backward-compat; consumers should prefer cwes."
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / title
```
Removed value: -"Cwe Id"
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / description
```
Removed value: -"Multi-CWE list as published by NVD. Mirrors cve_lookup.cwes (v1.28.0 multi-CWE adoption). Null/omitted when DB row has no multi-CWE list — legacy cwe_id still emitted."
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / title
```
Removed value: -"Cwes"
```
- removedOutput schema / $defs / CveSearchItem / properties / epss / description
```
Removed value: -"EPSS score + percentile."
```
- removedOutput schema / $defs / CveSearchItem / properties / kev / description
```
Removed value: -"CISA KEV status."
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / description
```
Removed value: -"ISO 8601 last-modified timestamp."
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / title
```
Removed value: -"Modified"
```
- removedOutput schema / $defs / CveSearchItem / properties / published / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / published / description
```
Removed value: -"ISO 8601 publication timestamp."
```
- removedOutput schema / $defs / CveSearchItem / properties / published / title
```
Removed value: -"Published"
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / description
```
Removed value: -"Honest count of upstream references for this CVE. Use this to decide whether a cve_lookup pivot is worthwhile (e.g. >0 refs → drill down; 0 → skip). The reference list itself is NOT included in slim search items — pass include=full or call cve_lookup to retrieve URLs."
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / title
```
Removed value: -"References Count"
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / description
```
Removed value: -"CVSS v3 severity label."
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / title
```
Removed value: -"Severity"
```
- removedOutput schema / $defs / CveSearchItem / properties / sources / description
```
Removed value: -"Source feeds for this CVE row."
```
- removedOutput schema / $defs / CveSearchItem / properties / sources / title
```
Removed value: -"Sources"
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / description
```
Removed value: -"Human-readable one-line summary."
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / title
```
Removed value: -"Summary"
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / description
```
Removed value: -"Honest count of affected products in DB."
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / title
```
Removed value: -"Total Products"
```
- removedOutput schema / $defs / CveSearchItem / title
```
Removed value: -"CveSearchItem"
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / description
```
Removed value: -"Number of CVEs in this page (== len(results)). Capped by `limit`."
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / title
```
Removed value: -"Count"
```
- removedOutput schema / $defs / CveSearchResponse / properties / hint / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / hint / description
```
Removed value: -"Pivot/refine hint emitted when the query returned 0 results or is overly broad."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / description
```
Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / description
```
Removed value: -"Offset to pass on the next page. Null when truncated=False (no more results)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / title
```
Removed value: -"Next Offset"
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / description
```
Removed value: -"Offset of the first item in this page (echoed from input)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / title
```
Removed value: -"Offset"
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / description
```
Removed value: -"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, cvss_min, cvss_max, sort, limit, offset, tagged. Useful for verifying the parsed query matched the intent."
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / title
```
Removed value: -"Query Echo"
```
- removedOutput schema / $defs / CveSearchResponse / properties / results / description
```
Removed value: -"Per-CVE slim records — see CveSearchItem."
```
- removedOutput schema / $defs / CveSearchResponse / properties / results / title
```
Removed value: -"Results"
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / default
```
Removed value: -""
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / description
```
Removed value: -"One-line summary like '50 CVEs returned, 1234 total (product=nginx, severity=HIGH)'."
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / title
```
Removed value: -"Summary"
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / description
```
Removed value: -"Total CVE matches in the database for the query — the honest pre-pagination count."
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / title
```
Removed value: -"Total"
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / default
```
Removed value: -false
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / description
```
Removed value: -"True when total > offset + count (more pages available — use next_offset)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / title
```
Removed value: -"Truncated"
```
- removedOutput schema / $defs / CveSearchResponse / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / CveSearchResponse / title
```
Removed value: -"CveSearchResponse"
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / default
```
Removed value: -null
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / description
```
Removed value: -"EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk."
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / title
```
Removed value: -"Percentile"
```
- removedOutput schema / $defs / EpssInfo / properties / score / default
```
Removed value: -null
```
- removedOutput schema / $defs / EpssInfo / properties / score / description
```
Removed value: -"EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days."
```
- removedOutput schema / $defs / EpssInfo / properties / score / title
```
Removed value: -"Score"
```
- removedOutput schema / $defs / EpssInfo / title
```
Removed value: -"EpssInfo"
```
- removedOutput schema / $defs / ErrorDetail / description
```
Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / description
```
Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / title
```
Removed value: -"Code"
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / description
```
Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / title
```
Removed value: -"Docs Url"
```
- removedOutput schema / $defs / ErrorDetail / properties / message / description
```
Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."
```
- removedOutput schema / $defs / ErrorDetail / properties / message / title
```
Removed value: -"Message"
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / description
```
Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / title
```
Removed value: -"Retry After Seconds"
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / description
```
Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / title
```
Removed value: -"Upgrade Url"
```
- removedOutput schema / $defs / ErrorDetail / title
```
Removed value: -"ErrorDetail"
```
- removedOutput schema / $defs / ErrorResponse / description
```
Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."
```
- removedOutput schema / $defs / ErrorResponse / title
```
Removed value: -"ErrorResponse"
```
- removedOutput schema / $defs / KevInfo / properties / cwes / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / cwes / description
```
Removed value: -"CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered)."
```
- removedOutput schema / $defs / KevInfo / properties / cwes / title
```
Removed value: -"Cwes"
```
- removedOutput schema / $defs / KevInfo / properties / date_added / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / date_added / description
```
Removed value: -"ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog."
```
- removedOutput schema / $defs / KevInfo / properties / date_added / title
```
Removed value: -"Date Added"
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / description
```
Removed value: -"ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV."
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / title
```
Removed value: -"Date Removed"
```
- removedOutput schema / $defs / KevInfo / properties / due_date / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / due_date / description
```
Removed value: -"Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021)."
```
- removedOutput schema / $defs / KevInfo / properties / due_date / title
```
Removed value: -"Due Date"
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / default
```
Removed value: -false
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / description
```
Removed value: -"True when CISA has confirmed this CVE is being actively exploited in the wild."
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / title
```
Removed value: -"In Kev"
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / description
```
Removed value: -"True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV."
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / title
```
Removed value: -"Known Ransomware Use"
```
- removedOutput schema / $defs / KevInfo / properties / notes / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / notes / description
```
Removed value: -"Reference URLs published by CISA, separated by '; '."
```
- removedOutput schema / $defs / KevInfo / properties / notes / title
```
Removed value: -"Notes"
```
- removedOutput schema / $defs / KevInfo / properties / product / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / product / description
```
Removed value: -"Affected product name as published by CISA (mirrors kev_detail.product)."
```
- removedOutput schema / $defs / KevInfo / properties / product / title
```
Removed value: -"Product"
```
- removedOutput schema / $defs / KevInfo / properties / required_action / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / required_action / description
```
Removed value: -"CISA-specified remediation action text (mirrors kev_detail.required_action)."
```
- removedOutput schema / $defs / KevInfo / properties / required_action / title
```
Removed value: -"Required Action"
```
- removedOutput schema / $defs / KevInfo / properties / short_description / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / short_description / description
```
Removed value: -"CISA's one-sentence summary (mirrors kev_detail.short_description)."
```
- removedOutput schema / $defs / KevInfo / properties / short_description / title
```
Removed value: -"Short Description"
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / description
```
Removed value: -"Vendor or project name as published by CISA (mirrors kev_detail.vendor_project)."
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / title
```
Removed value: -"Vendor Project"
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / description
```
Removed value: -"Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'."
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / title
```
Removed value: -"Vulnerability Name"
```
- removedOutput schema / $defs / KevInfo / title
```
Removed value: -"KevInfo"
```
- removedOutput schema / $defs / PivotHint / description
```
Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."
```
- removedOutput schema / $defs / PivotHint / properties / input / description
```
Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."
```
- removedOutput schema / $defs / PivotHint / properties / input / title
```
Removed value: -"Input"
```
- removedOutput schema / $defs / PivotHint / properties / params / default
```
Removed value: -null
```
- removedOutput schema / $defs / PivotHint / properties / params / description
```
Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."
```
- removedOutput schema / $defs / PivotHint / properties / params / title
```
Removed value: -"Params"
```
- removedOutput schema / $defs / PivotHint / properties / reason / description
```
Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."
```
- removedOutput schema / $defs / PivotHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / PivotHint / properties / tool / description
```
Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."
```
- removedOutput schema / $defs / PivotHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / PivotHint / title
```
Removed value: -"PivotHint"
```
- removedOutput schema / $defs / SearchHint / description
```
Removed value: -"Footer hint emitted on list responses (cve_search, cve_leading) to point\nLLM agents at the natural drill-down tool. Distinct from PivotHint: there is\nno `input` field because the hint is global to the list — the agent picks a\nresult of interest and passes its ID to the named tool."
```
- removedOutput schema / $defs / SearchHint / properties / reason / description
```
Removed value: -"Short rationale explaining what the drill-down tool adds beyond the slim list items (e.g. full description, affected_products, references, exploit/KEV/CWE pivots)."
```
- removedOutput schema / $defs / SearchHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / SearchHint / properties / tool / description
```
Removed value: -"Drill-down tool to call with any result ID from the list. Constrained to cve_lookup today; expand the Literal as new list endpoints get list-level hints."
```
- removedOutput schema / $defs / SearchHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / SearchHint / title
```
Removed value: -"SearchHint"
```
- removedOutput schema / $defs / Verdict / properties / completeness / default
```
Removed value: -"complete"
```
- removedOutput schema / $defs / Verdict / properties / completeness / description
```
Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."
```
- removedOutput schema / $defs / Verdict / properties / completeness / title
```
Removed value: -"Completeness"
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / description
```
Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / title
```
Removed value: -"Data Age Seconds"
```
- removedOutput schema / $defs / Verdict / properties / deterministic / description
```
Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."
```
- removedOutput schema / $defs / Verdict / properties / deterministic / title
```
Removed value: -"Deterministic"
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / description
```
Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / title
```
Removed value: -"Falsifiable Fields"
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / description
```
Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / title
```
Removed value: -"Sources Queried"
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / description
```
Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / title
```
Removed value: -"Sources Unavailable"
```
- removedOutput schema / $defs / Verdict / title
```
Removed value: -"Verdict"
```
- removedOutput schema / properties / result / title
```
Removed value: -"Result"
```
- removedOutput schema / title
```
Removed value: -"cve_leadingOutput"
```

Changed1 schema field changedMay 15, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed4 schema fields changedMay 9, 2026

changedOutput schema / $defs / CveSearchItem / properties / cwe_id / description

Previous value: -"Primary CWE identifier."New value: +"Primary CWE identifier (legacy single-value field). Equals cwes[0] when cwes is present. Kept for backward-compat; consumers should prefer cwes."

addedOutput schema / $defs / CveSearchItem / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Multi-CWE list as published by NVD. Mirrors cve_lookup.cwes (v1.28.0 multi-CWE adoption). Null/omitted when DB row has no multi-CWE list — legacy cwe_id still emitted.",
+  "title": "Cwes"
+}

addedOutput schema / $defs / CveSearchItem / properties / references_count

Added value: +{
+  "default": 0,
+  "description": "Honest count of upstream references for this CVE. Use this to decide whether a cve_lookup pivot is worthwhile (e.g. >0 refs → drill down; 0 → skip). The reference list itself is NOT included in slim search items — pass include=full or call cve_lookup to retrieve URLs.",
+  "title": "References Count",
+  "type": "integer"
+}

changedOutput schema / $defs / CveSearchResponse / properties / query_echo / description

Previous value: -"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, sort, limit, offset. Useful for verifying the parsed query matched the intent."New value: +"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, cvss_min, cvss_max, sort, limit, offset, tagged. Useful for verifying the parsed query matched the intent."

Changed1 schema field changedMay 8, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed10 schema fields changedMay 8, 2026

addedOutput schema / $defs / KevInfo / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered).",
+  "title": "Cwes"
+}

addedOutput schema / $defs / KevInfo / properties / date_removed

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV.",
+  "title": "Date Removed"
+}

addedOutput schema / $defs / KevInfo / properties / due_date

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021).",
+  "title": "Due Date"
+}

addedOutput schema / $defs / KevInfo / properties / known_ransomware_use

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV.",
+  "title": "Known Ransomware Use"
+}

addedOutput schema / $defs / KevInfo / properties / notes

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Reference URLs published by CISA, separated by '; '.",
+  "title": "Notes"
+}

addedOutput schema / $defs / KevInfo / properties / product

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Affected product name as published by CISA (mirrors kev_detail.product).",
+  "title": "Product"
+}

addedOutput schema / $defs / KevInfo / properties / required_action

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA-specified remediation action text (mirrors kev_detail.required_action).",
+  "title": "Required Action"
+}

addedOutput schema / $defs / KevInfo / properties / short_description

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA's one-sentence summary (mirrors kev_detail.short_description).",
+  "title": "Short Description"
+}

addedOutput schema / $defs / KevInfo / properties / vendor_project

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Vendor or project name as published by CISA (mirrors kev_detail.vendor_project).",
+  "title": "Vendor Project"
+}

addedOutput schema / $defs / KevInfo / properties / vulnerability_name

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'.",
+  "title": "Vulnerability Name"
+}

Changed2 schema fields changedMay 2, 2026

changedInput schema / properties / include / description

Previous value: -"Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources, verdict). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Allowed: '' or 'full'."New value: +"Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Verdict is at the response root, not per-row (deduplicated for ~40% payload savings). Allowed: '' or 'full'."

removedOutput schema / $defs / CveSearchItem / properties / verdict

Removed value: -{
-  "anyOf": [
-    {
-      "$ref": "#/$defs/Verdict"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null,
-  "description": "Falsifiability metadata."
-}

Changed1 schema field changedMay 2, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed3 schema fields changedMay 1, 2026

addedOutput schema / $defs

Added value: +{
+  "CveSearchItem": {
+    "additionalProperties": true,
+    "description": "Slim per-result shape for cve_search list items.\n\nDefault cve_search response uses this shape (description / cvss_breakdown /\naffected_products / references / first_seen_* are dropped). Pass cve_search\n?include=full to get the full CveResponse shape — extra=\"allow\" lets the\nfull-mode fields pass through without a schema fork.",
+    "properties": {
+      "cve_id": {
+        "description": "Canonical CVE identifier, e.g. 'CVE-2021-44228'.",
+        "title": "Cve Id",
+        "type": "string"
+      },
+      "cvss_v3": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3.x base score (0.0-10.0).",
+        "title": "Cvss V3"
+      },
+      "cwe_id": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Primary CWE identifier.",
+        "title": "Cwe Id"
+      },
+      "epss": {
+        "$ref": "#/$defs/EpssInfo",
+        "description": "EPSS score + percentile."
+      },
+      "kev": {
+        "$ref": "#/$defs/KevInfo",
+        "description": "CISA KEV status."
+      },
+      "modified": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 last-modified timestamp.",
+        "title": "Modified"
+      },
+      "published": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 publication timestamp.",
+        "title": "Published"
+      },
+      "severity": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3 severity label.",
+        "title": "Severity"
+      },
+      "sources": {
+        "description": "Source feeds for this CVE row.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources",
+        "type": "array"
+      },
+      "summary": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable one-line summary.",
+        "title": "Summary"
+      },
+      "total_products": {
+        "default": 0,
+        "description": "Honest count of affected products in DB.",
+        "title": "Total Products",
+        "type": "integer"
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata."
+      }
+    },
+    "required": [
+      "cve_id"
+    ],
+    "title": "CveSearchItem",
+    "type": "object"
+  },
+  "CveSearchResponse": {
+    "properties": {
+      "count": {
+        "default": 0,
+        "description": "Number of CVEs in this page (== len(results)). Capped by `limit`.",
+        "title": "Count",
+        "type": "integer"
+      },
+      "hint": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/SearchHint"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pivot/refine hint emitted when the query returned 0 results or is overly broad."
+      },
+      "next_calls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/PivotHint"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user.",
+        "title": "Next Calls"
+      },
+      "next_offset": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Offset to pass on the next page. Null when truncated=False (no more results).",
+        "title": "Next Offset"
+      },
+      "offset": {
+        "default": 0,
+        "description": "Offset of the first item in this page (echoed from input).",
+        "title": "Offset",
+        "type": "integer"
+      },
+      "query_echo": {
+        "anyOf": [
+          {
+            "additionalProperties": true,
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, sort, limit, offset. Useful for verifying the parsed query matched the intent.",
+        "title": "Query Echo"
+      },
+      "results": {
+        "description": "Per-CVE slim records — see CveSearchItem.",
+        "items": {
+          "$ref": "#/$defs/CveSearchItem"
+        },
+        "title": "Results",
+        "type": "array"
+      },
+      "summary": {
+        "default": "",
+        "description": "One-line summary like '50 CVEs returned, 1234 total (product=nginx, severity=HIGH)'.",
+        "title": "Summary",
+        "type": "string"
+      },
+      "total": {
+        "default": 0,
+        "description": "Total CVE matches in the database for the query — the honest pre-pagination count.",
+        "title": "Total",
+        "type": "integer"
+      },
+      "truncated": {
+        "default": false,
+        "description": "True when total > offset + count (more pages available — use next_offset).",
+        "title": "Truncated",
+        "type": "boolean"
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
+      }
+    },
+    "title": "CveSearchResponse",
+    "type": "object"
+  },
+  "EpssInfo": {
+    "properties": {
+      "percentile": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk.",
+        "title": "Percentile"
+      },
+      "score": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days.",
+        "title": "Score"
+      }
+    },
+    "title": "EpssInfo",
+    "type": "object"
+  },
+  "ErrorDetail": {
+    "description": "Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`.",
+    "properties": {
+      "code": {
+        "description": "Stable machine-readable failure category. Agents key retry/upgrade decisions off this.",
+        "enum": [
+          "invalid_argument",
+          "not_found",
+          "rate_limit_exceeded",
+          "auth_required",
+          "tier_limit",
+          "upstream_timeout",
+          "upstream_error",
+          "internal_error"
+        ],
+        "title": "Code",
+        "type": "string"
+      },
+      "docs_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Documentation pointer (e.g. tool input contract) when code='invalid_argument'.",
+        "title": "Docs Url"
+      },
+      "message": {
+        "description": "Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses.",
+        "maxLength": 500,
+        "title": "Message",
+        "type": "string"
+      },
+      "retry_after_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "When code='rate_limit_exceeded', the minimum seconds to wait before retrying.",
+        "title": "Retry After Seconds"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier.",
+        "title": "Upgrade Url"
+      }
+    },
+    "required": [
+      "code",
+      "message"
+    ],
+    "title": "ErrorDetail",
+    "type": "object"
+  },
+  "ErrorResponse": {
+    "description": "MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body.",
+    "properties": {
+      "error": {
+        "$ref": "#/$defs/ErrorDetail"
+      }
+    },
+    "required": [
+      "error"
+    ],
+    "title": "ErrorResponse",
+    "type": "object"
+  },
+  "KevInfo": {
+    "properties": {
+      "date_added": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog.",
+        "title": "Date Added"
+      },
+      "in_kev": {
+        "default": false,
+        "description": "True when CISA has confirmed this CVE is being actively exploited in the wild.",
+        "title": "In Kev",
+        "type": "boolean"
+      }
+    },
+    "title": "KevInfo",
+    "type": "object"
+  },
+  "PivotHint": {
+    "additionalProperties": true,
+    "description": "A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context.",
+    "properties": {
+      "input": {
+        "description": "Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument.",
+        "title": "Input",
+        "type": "string"
+      },
+      "params": {
+        "anyOf": [
+          {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed.",
+        "title": "Params"
+      },
+      "reason": {
+        "description": "Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'.",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "description": "Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal.",
+        "enum": [
+          "cve_lookup",
+          "cve_search",
+          "cve_leading",
+          "bulk_cve_lookup",
+          "exploit_lookup",
+          "kev_detail",
+          "cwe_lookup",
+          "subdomain_enum",
+          "ssl_check",
+          "tech_fingerprint",
+          "asn_lookup",
+          "ip_lookup",
+          "ioc_lookup",
+          "bulk_ioc_lookup",
+          "hash_lookup",
+          "threat_intel",
+          "threat_report",
+          "audit_domain",
+          "domain_report",
+          "dns_lookup",
+          "whois_lookup",
+          "wayback_lookup",
+          "scan_headers",
+          "check_headers",
+          "check_secrets",
+          "check_injection",
+          "check_dependencies",
+          "email_mx",
+          "email_disposable",
+          "phone_lookup",
+          "username_lookup",
+          "password_check",
+          "phishing_check",
+          "atlas_technique_lookup",
+          "atlas_technique_search",
+          "bulk_atlas_technique_lookup",
+          "atlas_case_study_lookup",
+          "atlas_case_study_search",
+          "d3fend_defense_lookup",
+          "d3fend_defense_search",
+          "d3fend_defense_for_attack",
+          "d3fend_attack_coverage"
+        ],
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "input",
+      "reason"
+    ],
+    "title": "PivotHint",
+    "type": "object"
+  },
+  "SearchHint": {
+    "additionalProperties": true,
+    "description": "Footer hint emitted on list responses (cve_search, cve_leading) to point\nLLM agents at the natural drill-down tool. Distinct from PivotHint: there is\nno `input` field because the hint is global to the list — the agent picks a\nresult of interest and passes its ID to the named tool.",
+    "properties": {
+      "reason": {
+        "description": "Short rationale explaining what the drill-down tool adds beyond the slim list items (e.g. full description, affected_products, references, exploit/KEV/CWE pivots).",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "const": "cve_lookup",
+        "description": "Drill-down tool to call with any result ID from the list. Constrained to cve_lookup today; expand the Literal as new list endpoints get list-level hints.",
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "reason"
+    ],
+    "title": "SearchHint",
+    "type": "object"
+  },
+  "Verdict": {
+    "properties": {
+      "completeness": {
+        "default": "complete",
+        "description": "'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing.",
+        "enum": [
+          "complete",
+          "partial",
+          "minimal"
+        ],
+        "title": "Completeness",
+        "type": "string"
+      },
+      "data_age_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness.",
+        "title": "Data Age Seconds"
+      },
+      "deterministic": {
+        "description": "True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output.",
+        "title": "Deterministic",
+        "type": "boolean"
+      },
+      "falsifiable_fields": {
+        "description": "Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Falsifiable Fields",
+        "type": "array"
+      },
+      "sources_queried": {
+        "description": "Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Queried",
+        "type": "array"
+      },
+      "sources_unavailable": {
+        "description": "Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Unavailable",
+        "type": "array"
+      }
+    },
+    "required": [
+      "deterministic"
+    ],
+    "title": "Verdict",
+    "type": "object"
+  }
+}

addedOutput schema / properties / result / anyOf

Added value: +[
+  {
+    "$ref": "#/$defs/CveSearchResponse"
+  },
+  {
+    "$ref": "#/$defs/ErrorResponse"
+  }
+]

removedOutput schema / properties / result / type
```
Removed value: -"string"
```

Changed1 schema field changedApr 26, 2026

addedInput schema / properties / include

Added value: +{
+  "default": "",
+  "description": "Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources, verdict). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Allowed: '' or 'full'.",
+  "enum": [
+    "",
+    "full"
+  ],
+  "title": "Include",
+  "type": "string"
+}

AddedApr 16, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=true), the description adds substantial behavioral context: the verdict is at the response root applying to the batch, the global hint pointing to cve_lookup, rate limits (30/hr free, 500/hr Pro), and the slim vs. full payload behavior. This goes well beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and information-rich, front-loaded with the core purpose. Every sentence earns its place (usage, payload behavior, response structure, rate limits), though it is slightly long. It could be tightened but remains efficient for the complexity it covers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (pagination, include modes, response shape, verdict placement, hint), the description covers all essential aspects: purpose, alternatives, payload details, rate limits, and return object. The output schema also exists, so the description appropriately complements rather than duplicates return value documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds value by explaining the trade-off of the include parameter ('slim default avoids description/summary duplication that bloats 50-item leading lists') and clarifying that 'full' gives the 'same payload shape as cve_lookup'. This contextualizes parameter choices beyond the schema's raw definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and identifies the exact resource ('CVEs indexed from MITRE/GHSA BEFORE NVD publication'), which clearly distinguishes it from sibling tools like cve_search (published NVD data) and cve_lookup (drill-down). This is a model of purpose clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is given: 'Use for threat intelligence on emerging CVEs; use cve_search for published NVD data' and 'for drill-down on a single CVE prefer cve_lookup'. This directly addresses when to use this tool versus alternatives, exceeding basic usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ContrastAPI tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

CVE Leading

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

Resources