ContrastAPI

CVE Lookup

cve_lookup

Read-onlyIdempotent

Retrieve detailed CVE data by ID: description, CVSS v3.1 + vector, CVSS v2 (always emitted), EPSS score + percentile, CISA KEV status (expanded: due_date, required_action, ransomware flag, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed when in_kev=true), NVD vulnerability_status (Analyzed/Modified/Awaiting Analysis/Deferred/Rejected/Withdrawn), cve_tags ('disputed' triggers [DISPUTED] summary prefix), affected products (CPE), references, patch availability, related CVEs. By default affected_products is truncated to the first 20 entries (total_products reports the honest count) and references to the first 10 (total_references reports the honest count). Pass include_affected_products=true and/or include_full_references=true for the complete lists. Pass include_reference_tags=true to receive structured references_full=[{url, tags, source}] (NVD upstream tags + source provenance) — also activates tag-first patch detection. Pass include_severity_breakdown=true to receive severity_sources/consensus/disagreement (multi-source view of NVD/MITRE/GHSA/OSV severity assessments). Use for single-CVE details; use cve_search for queries by product/severity. Response carries next_calls — chain with kev_detail when kev.in_kev=true, with cwe_lookup on each CWE in cwes (up to 3 pivots), and with exploit_lookup for public PoC availability. Free: 30/hr, Pro: 500/hr. Returns {cve_id, summary, description, severity, cvss_v3, cvss_v2, cvss_v2_vector, cvss_breakdown, cwe_id, cwes, vulnerability_status, cve_tags, published, modified, sources, first_seen_source, first_seen_at, epss, kev (in_kev, date_added, due_date, required_action, known_ransomware_use, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed), affected_products (first 20 by default), total_products, references (first 10 by default), total_references, total_references_unique, references_full (only when include_reference_tags=true), severity_sources/severity_consensus/severity_disagreement (only when include_severity_breakdown=true), patch_available, related_cves, verdict, next_calls}.

Input Schema

TableJSON Schema

Name	Required	Description
`cve_id`	Yes	CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2024-3094', 'CVE-2023-44487')
`include_reference_tags`	No	Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) (default: True). Inspects which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection is tag-first when refs_with_tags is populated; legacy cached rows fall back to regex. Set False to skip the structured shape for legacy clients.
`include_full_references`	No	Return the full references list (default: True, returns all references). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected. Set False to truncate to first 10 entries when bandwidth-bound.
`include_affected_products`	No	Return the full affected_products list (default: False, returns first 20). Set True for bulk audits or dependency scanning of Log4j-class CVEs with 50+ products.
`include_severity_breakdown`	No	Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: True). Surfaces vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE). Set False to skip if downstream cannot tolerate the extra fields.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed25 schema fields changedJun 2, 2026
- changedOutput schema / properties / result / properties / cve_tags / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cvss_breakdown / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cvss_v2 / type
```
Previous value: -"number"New value: +[
+  "number",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cvss_v2_vector / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cvss_v3 / type
```
Previous value: -"number"New value: +[
+  "number",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cwe_id / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / cwes / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / description / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / first_seen_at / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / first_seen_source / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / modified / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / patch_available / type
```
Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / patch_url / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / published / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / references_full / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / related_cves / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / severity / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / severity_consensus / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / severity_disagreement / type
```
Previous value: -"boolean"New value: +[
+  "boolean",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / severity_sources / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / summary / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / total_references_unique / type
```
Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / verdict / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / vulnerability_status / type
```
Previous value: -"string"New value: +[
+  "string",
+  "null"
+]
```
Changed23 schema fields changedMay 25, 2026
- changedOutput schema / properties / result / properties / cve_tags / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / cvss_v2 / type
```
Previous value: -"object"New value: +"number"
```
- changedOutput schema / properties / result / properties / cvss_v2_vector / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / cvss_v3 / type
```
Previous value: -"object"New value: +"number"
```
- changedOutput schema / properties / result / properties / cwe_id / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / cwes / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / description / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / first_seen_at / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / first_seen_source / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / modified / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / patch_available / type
```
Previous value: -"object"New value: +"boolean"
```
- changedOutput schema / properties / result / properties / patch_url / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / published / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / references_full / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / related_cves / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / severity / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / severity_consensus / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / severity_disagreement / type
```
Previous value: -"object"New value: +"boolean"
```
- changedOutput schema / properties / result / properties / severity_sources / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / summary / type
```
Previous value: -"object"New value: +"string"
```
- changedOutput schema / properties / result / properties / total_references_unique / type
```
Previous value: -"object"New value: +"integer"
```
- changedOutput schema / properties / result / properties / vulnerability_status / type
```
Previous value: -"object"New value: +"string"
```

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "affected_products": {
+          "type": "array"
+        },
+        "cve_id": {
+          "type": "string"
+        },
+        "cve_tags": {
+          "type": "object"
+        },
+        "cvss_breakdown": {
+          "type": "object"
+        },
+        "cvss_v2": {
+          "type": "object"
+        },
+        "cvss_v2_vector": {
+          "type": "object"
+        },
+        "cvss_v3": {
+          "type": "object"
+        },
+        "cwe_id": {
+          "type": "object"
+        },
+        "cwes": {
+          "type": "object"
+        },
+        "description": {
+          "type": "object"
+        },
+        "epss": {
+          "type": "object"
+        },
+        "first_seen_at": {
+          "type": "object"
+        },
+        "first_seen_source": {
+          "type": "object"
+        },
+        "kev": {
+          "type": "object"
+        },
+        "modified": {
+          "type": "object"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "patch_available": {
+          "type": "object"
+        },
+        "patch_url": {
+          "type": "object"
+        },
+        "published": {
+          "type": "object"
+        },
+        "references": {
+          "type": "array"
+        },
+        "references_full": {
+          "type": "object"
+        },
+        "related_cves": {
+          "type": "object"
+        },
+        "severity": {
+          "type": "object"
+        },
+        "severity_consensus": {
+          "type": "object"
+        },
+        "severity_disagreement": {
+          "type": "object"
+        },
+        "severity_sources": {
+          "type": "object"
+        },
+        "sources": {
+          "type": "array"
+        },
+        "summary": {
+          "type": "object"
+        },
+        "total_products": {
+          "type": "integer"
+        },
+        "total_references": {
+          "type": "integer"
+        },
+        "total_references_unique": {
+          "type": "object"
+        },
+        "verdict": {
+          "type": "object"
+        },
+        "vulnerability_status": {
+          "type": "object"
+        }
+      },
+      "required": [
+        "cve_id"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -{
-  "$defs": {
-    "CveResponse": {
-      "properties": {
-        "affected_products": {
-          "items": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "cve_id": {
-          "type": "string"
-        },
-        "cve_tags": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cvss_breakdown": {
-          "anyOf": [
-            {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cvss_v2": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cvss_v2_vector": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cvss_v3": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwe_id": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "epss": {
-          "$ref": "#/$defs/EpssInfo"
-        },
-        "first_seen_at": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "first_seen_source": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "kev": {
-          "$ref": "#/$defs/KevInfo"
-        },
-        "modified": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "patch_available": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "patch_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "published": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "references": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "references_full": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/ReferenceItem"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "related_cves": {
-          "anyOf": [
-            {
-              "items": {
-                "additionalProperties": true,
-                "type": "object"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "severity": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "severity_consensus": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "severity_disagreement": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "severity_sources": {
-          "anyOf": [
-            {
-              "items": {
-                "additionalProperties": true,
-                "type": "object"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "sources": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "summary": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "total_products": {
-          "type": "integer"
-        },
-        "total_references": {
-          "type": "integer"
-        },
-        "total_references_unique": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vulnerability_status": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "cve_id"
-      ],
-      "type": "object"
-    },
-    "EpssInfo": {
-      "properties": {
-        "percentile": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "score": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "KevInfo": {
-      "properties": {
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_added": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_removed": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "due_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "in_kev": {
-          "type": "boolean"
-        },
-        "known_ransomware_use": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "notes": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "product": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "required_action": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "short_description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vendor_project": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vulnerability_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "ReferenceItem": {
-      "properties": {
-        "source": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "tags": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "url": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "url"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/CveResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Changed189 schema fields changedMay 17, 2026

removedOutput schema / $defs / CveResponse / properties / affected_products / description

Removed value: -"CPE affected products. Truncated to first 20 by default. For GET /v1/cve/{cve_id}, use ?include_affected_products=true; for POST /v1/cves/bulk, set body field \"include_affected_products\": true."

removedOutput schema / $defs / CveResponse / properties / affected_products / title
```
Removed value: -"Affected Products"
```
removedOutput schema / $defs / CveResponse / properties / cve_id / description
```
Removed value: -"Canonical CVE identifier, e.g. 'CVE-2021-44228'."
```
removedOutput schema / $defs / CveResponse / properties / cve_id / title
```
Removed value: -"Cve Id"
```
removedOutput schema / $defs / CveResponse / properties / cve_tags / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cve_tags / description

Removed value: -"NVD cveTags (e.g. 'disputed', 'unsupported-when-assigned', 'exclusively-hosted-service'). When 'disputed' is present, summary is prefixed with [DISPUTED]."

removedOutput schema / $defs / CveResponse / properties / cve_tags / title
```
Removed value: -"Cve Tags"
```
removedOutput schema / $defs / CveResponse / properties / cvss_breakdown / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cvss_breakdown / description

Removed value: -"Per-metric CVSS v3 breakdown (attack_vector, attack_complexity, privileges_required, user_interaction, scope, confidentiality, integrity, availability). Keys present only when parsed from vector string."

removedOutput schema / $defs / CveResponse / properties / cvss_breakdown / title
```
Removed value: -"Cvss Breakdown"
```
removedOutput schema / $defs / CveResponse / properties / cvss_v2 / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cvss_v2 / description

Removed value: -"CVSS v2.0 base score (0.0-10.0). Always present (additive, non-opt-in); null for CVEs with no v2 metric or for legacy cached rows synced before v1.29.x. Pre-2010 CVEs and select dual-scored entries have v2-only or v2+v3 metrics."

removedOutput schema / $defs / CveResponse / properties / cvss_v2 / title
```
Removed value: -"Cvss V2"
```
removedOutput schema / $defs / CveResponse / properties / cvss_v2_vector / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cvss_v2_vector / description

Removed value: -"CVSS v2.0 vector string, e.g. 'AV:N/AC:L/Au:N/C:C/I:C/A:C'. Null when cvss_v2 is None."

removedOutput schema / $defs / CveResponse / properties / cvss_v2_vector / title
```
Removed value: -"Cvss V2 Vector"
```
removedOutput schema / $defs / CveResponse / properties / cvss_v3 / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cvss_v3 / description

Removed value: -"CVSS v3.x base score (0.0-10.0). Null if no CVSS data available."

removedOutput schema / $defs / CveResponse / properties / cvss_v3 / title
```
Removed value: -"Cvss V3"
```
removedOutput schema / $defs / CveResponse / properties / cwe_id / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cwe_id / description

Removed value: -"Primary CWE identifier, e.g. 'CWE-502'. First CWE when multiple are assigned."

removedOutput schema / $defs / CveResponse / properties / cwe_id / title
```
Removed value: -"Cwe Id"
```
removedOutput schema / $defs / CveResponse / properties / cwes / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / cwes / description

Removed value: -"All CWE identifiers assigned to this CVE, Primary first then Secondary. Null on legacy cache rows; cwe_id is always populated when cwes is non-empty."

removedOutput schema / $defs / CveResponse / properties / cwes / title
```
Removed value: -"Cwes"
```
removedOutput schema / $defs / CveResponse / properties / description / default
```
Removed value: -null
```
removedOutput schema / $defs / CveResponse / properties / description / description
```
Removed value: -"Full vulnerability description sourced from NVD/MITRE/GHSA."
```
removedOutput schema / $defs / CveResponse / properties / description / title
```
Removed value: -"Description"
```

removedOutput schema / $defs / CveResponse / properties / epss / description

Removed value: -"Exploit Prediction Scoring System: score (0.0-1.0 probability) and percentile (0.0-100.0)."

removedOutput schema / $defs / CveResponse / properties / first_seen_at / default
```
Removed value: -null
```
removedOutput schema / $defs / CveResponse / properties / first_seen_at / description
```
Removed value: -"ISO 8601 timestamp when this CVE was first ingested locally."
```
removedOutput schema / $defs / CveResponse / properties / first_seen_at / title
```
Removed value: -"First Seen At"
```
removedOutput schema / $defs / CveResponse / properties / first_seen_source / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / first_seen_source / description

Removed value: -"First source that introduced this CVE into the local DB (for provenance/auditing)."

removedOutput schema / $defs / CveResponse / properties / first_seen_source / title
```
Removed value: -"First Seen Source"
```

removedOutput schema / $defs / CveResponse / properties / kev / description

Removed value: -"CISA Known Exploited Vulnerabilities catalog: in_kev flag, date_added, plus 10 fields populated when in_kev=true (due_date, required_action, known_ransomware_use, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed)."

removedOutput schema / $defs / CveResponse / properties / modified / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / modified / description

Removed value: -"ISO 8601 last-modified timestamp; advances on NVD/MITRE revisions."

removedOutput schema / $defs / CveResponse / properties / modified / title
```
Removed value: -"Modified"
```
removedOutput schema / $defs / CveResponse / properties / next_calls / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / next_calls / description

Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."

removedOutput schema / $defs / CveResponse / properties / next_calls / title
```
Removed value: -"Next Calls"
```
removedOutput schema / $defs / CveResponse / properties / patch_available / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / patch_available / description

Removed value: -"True when a vendor patch URL was detected in references (allowlisted vendor patterns). Null when enrichment was not requested."

removedOutput schema / $defs / CveResponse / properties / patch_available / title
```
Removed value: -"Patch Available"
```
removedOutput schema / $defs / CveResponse / properties / patch_url / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / patch_url / description

Removed value: -"First matched vendor patch/advisory URL from an allowlist (GitHub, RedHat, Ubuntu, Debian, Microsoft MSRC, Apple, Fortinet, Linux kernel.org, Cisco). Open-redirect params are filtered. Verify the host before clicking. Null when no match."

removedOutput schema / $defs / CveResponse / properties / patch_url / title
```
Removed value: -"Patch Url"
```
removedOutput schema / $defs / CveResponse / properties / published / default
```
Removed value: -null
```
removedOutput schema / $defs / CveResponse / properties / published / description
```
Removed value: -"ISO 8601 publication timestamp from NVD/MITRE."
```
removedOutput schema / $defs / CveResponse / properties / published / title
```
Removed value: -"Published"
```

removedOutput schema / $defs / CveResponse / properties / references / description

Removed value: -"Advisory URLs (vendor bulletins, patch commits, exploit PoCs, analysis writeups). Truncated to first 10 by default. For GET /v1/cve/{cve_id}, use ?include_full_references=true; for POST /v1/cves/bulk, set body field \"include_full_references\": true. Patch URL detection always runs against the full list — patch_url/patch_available are unaffected by the cap."

removedOutput schema / $defs / CveResponse / properties / references / title
```
Removed value: -"References"
```
removedOutput schema / $defs / CveResponse / properties / references_full / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / references_full / description

Removed value: -"Structured references with NVD reference tags + source provenance. Populated only when ?include_reference_tags=true (or body field include_reference_tags=true for bulk_cve_lookup). Default None for backward compat. Same truncation as `references` field — use include_full_references=true for the complete list."

removedOutput schema / $defs / CveResponse / properties / references_full / title
```
Removed value: -"References Full"
```
removedOutput schema / $defs / CveResponse / properties / related_cves / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / related_cves / description

Removed value: -"Up to 5 CVEs sharing affected products, ordered by severity DESC. Each item: {cve_id, severity, cvss_v3}. Null when enrichment was not requested."

removedOutput schema / $defs / CveResponse / properties / related_cves / title
```
Removed value: -"Related Cves"
```
removedOutput schema / $defs / CveResponse / properties / severity / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / severity / description

Removed value: -"CVSS v3 severity label: 'critical', 'high', 'medium', 'low', or 'none'."

removedOutput schema / $defs / CveResponse / properties / severity / title
```
Removed value: -"Severity"
```
removedOutput schema / $defs / CveResponse / properties / severity_consensus / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / severity_consensus / description

Removed value: -"Majority-bucket consensus severity computed from severity_sources. On a tie, the highest severity wins (CRITICAL > HIGH > MEDIUM > LOW > NONE). Null when severity_breakdown was not requested or when no source reported a severity."

removedOutput schema / $defs / CveResponse / properties / severity_consensus / title
```
Removed value: -"Severity Consensus"
```
removedOutput schema / $defs / CveResponse / properties / severity_disagreement / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / severity_disagreement / description

Removed value: -"True when 2+ severity buckets appear across severity_sources entries — counts both across-source disagreement (NVD CRITICAL vs GHSA HIGH) and within-source v2-vs-v3 disagreement (v2 HIGH vs v3 MEDIUM on the same NVD entry). Null when severity_breakdown was not requested."

removedOutput schema / $defs / CveResponse / properties / severity_disagreement / title
```
Removed value: -"Severity Disagreement"
```
removedOutput schema / $defs / CveResponse / properties / severity_sources / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / severity_sources / description

Removed value: -"Multi-source severity breakdown (one entry per source: nvd, mitre, ghsa, osv). Populated only when ?include_severity_breakdown=true (or body field include_severity_breakdown=true for bulk_cve_lookup). Each entry has {source, severity, cvss_v3, cvss_v2}. Use to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH)."

removedOutput schema / $defs / CveResponse / properties / severity_sources / title
```
Removed value: -"Severity Sources"
```

removedOutput schema / $defs / CveResponse / properties / sources / description

Removed value: -"Data sources that wrote the CVE record itself: 'nvd', 'mitre', 'ghsa', 'osv'. EPSS and KEV are tracked separately — see the top-level epss.* and kev.* fields, not this list."

removedOutput schema / $defs / CveResponse / properties / sources / title
```
Removed value: -"Sources"
```
removedOutput schema / $defs / CveResponse / properties / summary / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / summary / description

Removed value: -"Human-readable one-line summary built from severity, CVSS, KEV status, and EPSS."

removedOutput schema / $defs / CveResponse / properties / summary / title
```
Removed value: -"Summary"
```
removedOutput schema / $defs / CveResponse / properties / total_products / default
```
Removed value: -0
```

removedOutput schema / $defs / CveResponse / properties / total_products / description

Removed value: -"Honest count of all affected products in the CVE database. Always present (emitted even when 0); matches len(affected_products) when not truncated."

removedOutput schema / $defs / CveResponse / properties / total_products / title
```
Removed value: -"Total Products"
```
removedOutput schema / $defs / CveResponse / properties / total_references / default
```
Removed value: -0
```

removedOutput schema / $defs / CveResponse / properties / total_references / description

Removed value: -"Honest count of all references in the CVE database. Always present (emitted even when 0); matches len(references) when not truncated."

removedOutput schema / $defs / CveResponse / properties / total_references / title
```
Removed value: -"Total References"
```
removedOutput schema / $defs / CveResponse / properties / total_references_unique / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / total_references_unique / description

Removed value: -"Unique-URL upstream count from refs_with_tags (Batch 6A). None for legacy cached rows synced before v1.29.x; populated after the next sync run for all 4 sources (NVD/MITRE/GHSA/OSV)."

removedOutput schema / $defs / CveResponse / properties / total_references_unique / title
```
Removed value: -"Total References Unique"
```
removedOutput schema / $defs / CveResponse / properties / verdict / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / verdict / description

Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."

removedOutput schema / $defs / CveResponse / properties / vulnerability_status / default
```
Removed value: -null
```

removedOutput schema / $defs / CveResponse / properties / vulnerability_status / description

Removed value: -"NVD lifecycle status: 'Analyzed', 'Modified', 'Awaiting Analysis', 'Deferred', 'Rejected', 'Withdrawn'. Drives verdict.completeness downgrade for Rejected/Withdrawn/Awaiting Analysis."

removedOutput schema / $defs / CveResponse / properties / vulnerability_status / title
```
Removed value: -"Vulnerability Status"
```
removedOutput schema / $defs / CveResponse / title
```
Removed value: -"CveResponse"
```
removedOutput schema / $defs / EpssInfo / properties / percentile / default
```
Removed value: -null
```

removedOutput schema / $defs / EpssInfo / properties / percentile / description

Removed value: -"EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk."

removedOutput schema / $defs / EpssInfo / properties / percentile / title
```
Removed value: -"Percentile"
```
removedOutput schema / $defs / EpssInfo / properties / score / default
```
Removed value: -null
```

removedOutput schema / $defs / EpssInfo / properties / score / description

Removed value: -"EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days."

removedOutput schema / $defs / EpssInfo / properties / score / title
```
Removed value: -"Score"
```
removedOutput schema / $defs / EpssInfo / title
```
Removed value: -"EpssInfo"
```

removedOutput schema / $defs / ErrorDetail / description

Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."

removedOutput schema / $defs / ErrorDetail / properties / code / description

Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."

removedOutput schema / $defs / ErrorDetail / properties / code / title
```
Removed value: -"Code"
```
removedOutput schema / $defs / ErrorDetail / properties / docs_url / default
```
Removed value: -null
```

removedOutput schema / $defs / ErrorDetail / properties / docs_url / description

Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."

removedOutput schema / $defs / ErrorDetail / properties / docs_url / title
```
Removed value: -"Docs Url"
```

removedOutput schema / $defs / ErrorDetail / properties / message / description

Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."

removedOutput schema / $defs / ErrorDetail / properties / message / title
```
Removed value: -"Message"
```
removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / default
```
Removed value: -null
```

removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / description

Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."

removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / title
```
Removed value: -"Retry After Seconds"
```
removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / default
```
Removed value: -null
```

removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / description

Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."

removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / title
```
Removed value: -"Upgrade Url"
```
removedOutput schema / $defs / ErrorDetail / title
```
Removed value: -"ErrorDetail"
```

removedOutput schema / $defs / ErrorResponse / description

Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."

removedOutput schema / $defs / ErrorResponse / title
```
Removed value: -"ErrorResponse"
```
removedOutput schema / $defs / KevInfo / properties / cwes / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / cwes / description

Removed value: -"CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered)."

removedOutput schema / $defs / KevInfo / properties / cwes / title
```
Removed value: -"Cwes"
```
removedOutput schema / $defs / KevInfo / properties / date_added / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / date_added / description

Removed value: -"ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog."

removedOutput schema / $defs / KevInfo / properties / date_added / title
```
Removed value: -"Date Added"
```
removedOutput schema / $defs / KevInfo / properties / date_removed / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / date_removed / description

Removed value: -"ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV."

removedOutput schema / $defs / KevInfo / properties / date_removed / title
```
Removed value: -"Date Removed"
```
removedOutput schema / $defs / KevInfo / properties / due_date / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / due_date / description

Removed value: -"Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021)."

removedOutput schema / $defs / KevInfo / properties / due_date / title
```
Removed value: -"Due Date"
```
removedOutput schema / $defs / KevInfo / properties / in_kev / default
```
Removed value: -false
```

removedOutput schema / $defs / KevInfo / properties / in_kev / description

Removed value: -"True when CISA has confirmed this CVE is being actively exploited in the wild."

removedOutput schema / $defs / KevInfo / properties / in_kev / title
```
Removed value: -"In Kev"
```
removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / description

Removed value: -"True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV."

removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / title
```
Removed value: -"Known Ransomware Use"
```
removedOutput schema / $defs / KevInfo / properties / notes / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / notes / description

Removed value: -"Reference URLs published by CISA, separated by '; '."

removedOutput schema / $defs / KevInfo / properties / notes / title
```
Removed value: -"Notes"
```
removedOutput schema / $defs / KevInfo / properties / product / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / product / description

Removed value: -"Affected product name as published by CISA (mirrors kev_detail.product)."

removedOutput schema / $defs / KevInfo / properties / product / title
```
Removed value: -"Product"
```
removedOutput schema / $defs / KevInfo / properties / required_action / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / required_action / description

Removed value: -"CISA-specified remediation action text (mirrors kev_detail.required_action)."

removedOutput schema / $defs / KevInfo / properties / required_action / title
```
Removed value: -"Required Action"
```
removedOutput schema / $defs / KevInfo / properties / short_description / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / short_description / description

Removed value: -"CISA's one-sentence summary (mirrors kev_detail.short_description)."

removedOutput schema / $defs / KevInfo / properties / short_description / title
```
Removed value: -"Short Description"
```
removedOutput schema / $defs / KevInfo / properties / vendor_project / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / vendor_project / description

Removed value: -"Vendor or project name as published by CISA (mirrors kev_detail.vendor_project)."

removedOutput schema / $defs / KevInfo / properties / vendor_project / title
```
Removed value: -"Vendor Project"
```
removedOutput schema / $defs / KevInfo / properties / vulnerability_name / default
```
Removed value: -null
```

removedOutput schema / $defs / KevInfo / properties / vulnerability_name / description

Removed value: -"Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'."

removedOutput schema / $defs / KevInfo / properties / vulnerability_name / title
```
Removed value: -"Vulnerability Name"
```
removedOutput schema / $defs / KevInfo / title
```
Removed value: -"KevInfo"
```

removedOutput schema / $defs / PivotHint / description

Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."

removedOutput schema / $defs / PivotHint / properties / input / description

Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."

removedOutput schema / $defs / PivotHint / properties / input / title
```
Removed value: -"Input"
```
removedOutput schema / $defs / PivotHint / properties / params / default
```
Removed value: -null
```

removedOutput schema / $defs / PivotHint / properties / params / description

Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."

removedOutput schema / $defs / PivotHint / properties / params / title
```
Removed value: -"Params"
```

removedOutput schema / $defs / PivotHint / properties / reason / description

Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."

removedOutput schema / $defs / PivotHint / properties / reason / title
```
Removed value: -"Reason"
```

removedOutput schema / $defs / PivotHint / properties / tool / description

Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."

removedOutput schema / $defs / PivotHint / properties / tool / title
```
Removed value: -"Tool"
```
removedOutput schema / $defs / PivotHint / title
```
Removed value: -"PivotHint"
```

removedOutput schema / $defs / ReferenceItem / description

Removed value: -"Structured reference object with NVD upstream tags + source provenance.\nEmitted in CveResponse.references_full when ?include_reference_tags=true."

removedOutput schema / $defs / ReferenceItem / properties / source / default
```
Removed value: -null
```

removedOutput schema / $defs / ReferenceItem / properties / source / description

Removed value: -"Upstream source identifier. NVD: raw 'source' field (UUID/email of the CVE Numbering Authority); MITRE/GHSA/OSV: parser-name normalized to 'mitre'/'ghsa'/'osv'."

removedOutput schema / $defs / ReferenceItem / properties / source / title
```
Removed value: -"Source"
```

removedOutput schema / $defs / ReferenceItem / properties / tags / description

Removed value: -"NVD reference tags: Patch, Vendor Advisory, Mailing List, Exploit, Third Party Advisory, Issue Tracking, Release Notes, Technical Description, US Government Resource, VDB Entry. Empty list for MITRE/GHSA/OSV refs (those upstream feeds don't carry tags)."

removedOutput schema / $defs / ReferenceItem / properties / tags / title
```
Removed value: -"Tags"
```

removedOutput schema / $defs / ReferenceItem / properties / url / description

Removed value: -"Reference URL (advisory, patch commit, exploit PoC, mailing list, etc.)"

removedOutput schema / $defs / ReferenceItem / properties / url / title
```
Removed value: -"Url"
```
removedOutput schema / $defs / ReferenceItem / title
```
Removed value: -"ReferenceItem"
```
removedOutput schema / $defs / Verdict / properties / completeness / default
```
Removed value: -"complete"
```

removedOutput schema / $defs / Verdict / properties / completeness / description

Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."

removedOutput schema / $defs / Verdict / properties / completeness / title
```
Removed value: -"Completeness"
```
removedOutput schema / $defs / Verdict / properties / data_age_seconds / default
```
Removed value: -null
```

removedOutput schema / $defs / Verdict / properties / data_age_seconds / description

Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."

removedOutput schema / $defs / Verdict / properties / data_age_seconds / title
```
Removed value: -"Data Age Seconds"
```

removedOutput schema / $defs / Verdict / properties / deterministic / description

Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."

removedOutput schema / $defs / Verdict / properties / deterministic / title
```
Removed value: -"Deterministic"
```

removedOutput schema / $defs / Verdict / properties / falsifiable_fields / description

Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."

removedOutput schema / $defs / Verdict / properties / falsifiable_fields / title
```
Removed value: -"Falsifiable Fields"
```

removedOutput schema / $defs / Verdict / properties / sources_queried / description

Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."

removedOutput schema / $defs / Verdict / properties / sources_queried / title
```
Removed value: -"Sources Queried"
```

removedOutput schema / $defs / Verdict / properties / sources_unavailable / description

Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."

removedOutput schema / $defs / Verdict / properties / sources_unavailable / title
```
Removed value: -"Sources Unavailable"
```
removedOutput schema / $defs / Verdict / title
```
Removed value: -"Verdict"
```
removedOutput schema / properties / result / title
```
Removed value: -"Result"
```
removedOutput schema / title
```
Removed value: -"cve_lookupOutput"
```

Changed1 schema field changedMay 15, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed6 schema fields changedMay 8, 2026

changedInput schema / properties / include_full_references / default
```
Previous value: -falseNew value: +true
```

changedInput schema / properties / include_full_references / description

Previous value: -"Return the full references list (default: False, returns first 10). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected by the cap. Set True only when you need the complete advisory URL set (older + high-profile CVEs accumulate 30-60+)."New value: +"Return the full references list (default: True, returns all references). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected. Set False to truncate to first 10 entries when bandwidth-bound."

changedInput schema / properties / include_reference_tags / default
```
Previous value: -falseNew value: +true
```

changedInput schema / properties / include_reference_tags / description

Previous value: -"Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) instead of plain URL list (default: False). Set True to inspect which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection becomes tag-first when refs_with_tags is populated (NVD Patch/Vendor Advisory whitelist); legacy cached rows fall back to Batch 1 regex patterns automatically."New value: +"Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) (default: True). Inspects which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection is tag-first when refs_with_tags is populated; legacy cached rows fall back to regex. Set False to skip the structured shape for legacy clients."

changedInput schema / properties / include_severity_breakdown / default
```
Previous value: -falseNew value: +true
```

changedInput schema / properties / include_severity_breakdown / description

Previous value: -"Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: False). Set True to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE)."New value: +"Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: True). Surfaces vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE). Set False to skip if downstream cannot tolerate the extra fields."

Changed1 schema field changedMay 8, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed23 schema fields changedMay 8, 2026

addedInput schema / properties / include_reference_tags

Added value: +{
+  "default": false,
+  "description": "Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) instead of plain URL list (default: False). Set True to inspect which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection becomes tag-first when refs_with_tags is populated (NVD Patch/Vendor Advisory whitelist); legacy cached rows fall back to Batch 1 regex patterns automatically.",
+  "title": "Include Reference Tags",
+  "type": "boolean"
+}

addedInput schema / properties / include_severity_breakdown

Added value: +{
+  "default": false,
+  "description": "Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: False). Set True to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE).",
+  "title": "Include Severity Breakdown",
+  "type": "boolean"
+}

addedOutput schema / $defs / CveResponse / properties / cve_tags

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "NVD cveTags (e.g. 'disputed', 'unsupported-when-assigned', 'exclusively-hosted-service'). When 'disputed' is present, summary is prefixed with [DISPUTED].",
+  "title": "Cve Tags"
+}

addedOutput schema / $defs / CveResponse / properties / cvss_v2

Added value: +{
+  "anyOf": [
+    {
+      "type": "number"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CVSS v2.0 base score (0.0-10.0). Always present (additive, non-opt-in); null for CVEs with no v2 metric or for legacy cached rows synced before v1.29.x. Pre-2010 CVEs and select dual-scored entries have v2-only or v2+v3 metrics.",
+  "title": "Cvss V2"
+}

addedOutput schema / $defs / CveResponse / properties / cvss_v2_vector

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CVSS v2.0 vector string, e.g. 'AV:N/AC:L/Au:N/C:C/I:C/A:C'. Null when cvss_v2 is None.",
+  "title": "Cvss V2 Vector"
+}

changedOutput schema / $defs / CveResponse / properties / kev / description

Previous value: -"CISA Known Exploited Vulnerabilities catalog: in_kev flag and date_added (ISO 8601)."New value: +"CISA Known Exploited Vulnerabilities catalog: in_kev flag, date_added, plus 10 fields populated when in_kev=true (due_date, required_action, known_ransomware_use, vendor_project, product, vulnerability_name, short_description, notes, cwes, date_removed)."

addedOutput schema / $defs / CveResponse / properties / references_full

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "$ref": "#/$defs/ReferenceItem"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Structured references with NVD reference tags + source provenance. Populated only when ?include_reference_tags=true (or body field include_reference_tags=true for bulk_cve_lookup). Default None for backward compat. Same truncation as `references` field — use include_full_references=true for the complete list.",
+  "title": "References Full"
+}

addedOutput schema / $defs / CveResponse / properties / severity_consensus

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Majority-bucket consensus severity computed from severity_sources. On a tie, the highest severity wins (CRITICAL > HIGH > MEDIUM > LOW > NONE). Null when severity_breakdown was not requested or when no source reported a severity.",
+  "title": "Severity Consensus"
+}

addedOutput schema / $defs / CveResponse / properties / severity_disagreement

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "True when 2+ severity buckets appear across severity_sources entries — counts both across-source disagreement (NVD CRITICAL vs GHSA HIGH) and within-source v2-vs-v3 disagreement (v2 HIGH vs v3 MEDIUM on the same NVD entry). Null when severity_breakdown was not requested.",
+  "title": "Severity Disagreement"
+}

addedOutput schema / $defs / CveResponse / properties / severity_sources

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "additionalProperties": true,
+        "type": "object"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Multi-source severity breakdown (one entry per source: nvd, mitre, ghsa, osv). Populated only when ?include_severity_breakdown=true (or body field include_severity_breakdown=true for bulk_cve_lookup). Each entry has {source, severity, cvss_v3, cvss_v2}. Use to inspect vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH).",
+  "title": "Severity Sources"
+}

addedOutput schema / $defs / CveResponse / properties / total_references_unique

Added value: +{
+  "anyOf": [
+    {
+      "type": "integer"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Unique-URL upstream count from refs_with_tags (Batch 6A). None for legacy cached rows synced before v1.29.x; populated after the next sync run for all 4 sources (NVD/MITRE/GHSA/OSV).",
+  "title": "Total References Unique"
+}

addedOutput schema / $defs / CveResponse / properties / vulnerability_status

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "NVD lifecycle status: 'Analyzed', 'Modified', 'Awaiting Analysis', 'Deferred', 'Rejected', 'Withdrawn'. Drives verdict.completeness downgrade for Rejected/Withdrawn/Awaiting Analysis.",
+  "title": "Vulnerability Status"
+}

addedOutput schema / $defs / KevInfo / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered).",
+  "title": "Cwes"
+}

addedOutput schema / $defs / KevInfo / properties / date_removed

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV.",
+  "title": "Date Removed"
+}

addedOutput schema / $defs / KevInfo / properties / due_date

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021).",
+  "title": "Due Date"
+}

addedOutput schema / $defs / KevInfo / properties / known_ransomware_use

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV.",
+  "title": "Known Ransomware Use"
+}

addedOutput schema / $defs / KevInfo / properties / notes

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Reference URLs published by CISA, separated by '; '.",
+  "title": "Notes"
+}

addedOutput schema / $defs / KevInfo / properties / product

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Affected product name as published by CISA (mirrors kev_detail.product).",
+  "title": "Product"
+}

addedOutput schema / $defs / KevInfo / properties / required_action

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA-specified remediation action text (mirrors kev_detail.required_action).",
+  "title": "Required Action"
+}

addedOutput schema / $defs / KevInfo / properties / short_description

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA's one-sentence summary (mirrors kev_detail.short_description).",
+  "title": "Short Description"
+}

addedOutput schema / $defs / KevInfo / properties / vendor_project

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Vendor or project name as published by CISA (mirrors kev_detail.vendor_project).",
+  "title": "Vendor Project"
+}

addedOutput schema / $defs / KevInfo / properties / vulnerability_name

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'.",
+  "title": "Vulnerability Name"
+}

addedOutput schema / $defs / ReferenceItem

Added value: +{
+  "description": "Structured reference object with NVD upstream tags + source provenance.\nEmitted in CveResponse.references_full when ?include_reference_tags=true.",
+  "properties": {
+    "source": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "default": null,
+      "description": "Upstream source identifier. NVD: raw 'source' field (UUID/email of the CVE Numbering Authority); MITRE/GHSA/OSV: parser-name normalized to 'mitre'/'ghsa'/'osv'.",
+      "title": "Source"
+    },
+    "tags": {
+      "description": "NVD reference tags: Patch, Vendor Advisory, Mailing List, Exploit, Third Party Advisory, Issue Tracking, Release Notes, Technical Description, US Government Resource, VDB Entry. Empty list for MITRE/GHSA/OSV refs (those upstream feeds don't carry tags).",
+      "items": {
+        "type": "string"
+      },
+      "title": "Tags",
+      "type": "array"
+    },
+    "url": {
+      "description": "Reference URL (advisory, patch commit, exploit PoC, mailing list, etc.)",
+      "title": "Url",
+      "type": "string"
+    }
+  },
+  "required": [
+    "url"
+  ],
+  "title": "ReferenceItem",
+  "type": "object"
+}

Changed2 schema fields changedMay 7, 2026

addedOutput schema / $defs / CveResponse / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "All CWE identifiers assigned to this CVE, Primary first then Secondary. Null on legacy cache rows; cwe_id is always populated when cwes is non-empty.",
+  "title": "Cwes"
+}

changedOutput schema / $defs / CveResponse / properties / patch_url / description

Previous value: -"First matched vendor patch/advisory URL (conservative: RedHat, MSRC, Apache, Ubuntu, Debian, GitHub commits, GitLab commits). Null when no match."New value: +"First matched vendor patch/advisory URL from an allowlist (GitHub, RedHat, Ubuntu, Debian, Microsoft MSRC, Apple, Fortinet, Linux kernel.org, Cisco). Open-redirect params are filtered. Verify the host before clicking. Null when no match."

Changed1 schema field changedMay 2, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed3 schema fields changedMay 1, 2026

addedOutput schema / $defs

Added value: +{
+  "CveResponse": {
+    "properties": {
+      "affected_products": {
+        "description": "CPE affected products. Truncated to first 20 by default. For GET /v1/cve/{cve_id}, use ?include_affected_products=true; for POST /v1/cves/bulk, set body field \"include_affected_products\": true.",
+        "items": {
+          "additionalProperties": true,
+          "type": "object"
+        },
+        "title": "Affected Products",
+        "type": "array"
+      },
+      "cve_id": {
+        "description": "Canonical CVE identifier, e.g. 'CVE-2021-44228'.",
+        "title": "Cve Id",
+        "type": "string"
+      },
+      "cvss_breakdown": {
+        "anyOf": [
+          {
+            "additionalProperties": true,
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Per-metric CVSS v3 breakdown (attack_vector, attack_complexity, privileges_required, user_interaction, scope, confidentiality, integrity, availability). Keys present only when parsed from vector string.",
+        "title": "Cvss Breakdown"
+      },
+      "cvss_v3": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3.x base score (0.0-10.0). Null if no CVSS data available.",
+        "title": "Cvss V3"
+      },
+      "cwe_id": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Primary CWE identifier, e.g. 'CWE-502'. First CWE when multiple are assigned.",
+        "title": "Cwe Id"
+      },
+      "description": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Full vulnerability description sourced from NVD/MITRE/GHSA.",
+        "title": "Description"
+      },
+      "epss": {
+        "$ref": "#/$defs/EpssInfo",
+        "description": "Exploit Prediction Scoring System: score (0.0-1.0 probability) and percentile (0.0-100.0)."
+      },
+      "first_seen_at": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 timestamp when this CVE was first ingested locally.",
+        "title": "First Seen At"
+      },
+      "first_seen_source": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "First source that introduced this CVE into the local DB (for provenance/auditing).",
+        "title": "First Seen Source"
+      },
+      "kev": {
+        "$ref": "#/$defs/KevInfo",
+        "description": "CISA Known Exploited Vulnerabilities catalog: in_kev flag and date_added (ISO 8601)."
+      },
+      "modified": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 last-modified timestamp; advances on NVD/MITRE revisions.",
+        "title": "Modified"
+      },
+      "next_calls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/PivotHint"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user.",
+        "title": "Next Calls"
+      },
+      "patch_available": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "True when a vendor patch URL was detected in references (allowlisted vendor patterns). Null when enrichment was not requested.",
+        "title": "Patch Available"
+      },
+      "patch_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "First matched vendor patch/advisory URL (conservative: RedHat, MSRC, Apache, Ubuntu, Debian, GitHub commits, GitLab commits). Null when no match.",
+        "title": "Patch Url"
+      },
+      "published": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 publication timestamp from NVD/MITRE.",
+        "title": "Published"
+      },
+      "references": {
+        "description": "Advisory URLs (vendor bulletins, patch commits, exploit PoCs, analysis writeups). Truncated to first 10 by default. For GET /v1/cve/{cve_id}, use ?include_full_references=true; for POST /v1/cves/bulk, set body field \"include_full_references\": true. Patch URL detection always runs against the full list — patch_url/patch_available are unaffected by the cap.",
+        "items": {
+          "type": "string"
+        },
+        "title": "References",
+        "type": "array"
+      },
+      "related_cves": {
+        "anyOf": [
+          {
+            "items": {
+              "additionalProperties": true,
+              "type": "object"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Up to 5 CVEs sharing affected products, ordered by severity DESC. Each item: {cve_id, severity, cvss_v3}. Null when enrichment was not requested.",
+        "title": "Related Cves"
+      },
+      "severity": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3 severity label: 'critical', 'high', 'medium', 'low', or 'none'.",
+        "title": "Severity"
+      },
+      "sources": {
+        "description": "Data sources that wrote the CVE record itself: 'nvd', 'mitre', 'ghsa', 'osv'. EPSS and KEV are tracked separately — see the top-level epss.* and kev.* fields, not this list.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources",
+        "type": "array"
+      },
+      "summary": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable one-line summary built from severity, CVSS, KEV status, and EPSS.",
+        "title": "Summary"
+      },
+      "total_products": {
+        "default": 0,
+        "description": "Honest count of all affected products in the CVE database. Always present (emitted even when 0); matches len(affected_products) when not truncated.",
+        "title": "Total Products",
+        "type": "integer"
+      },
+      "total_references": {
+        "default": 0,
+        "description": "Honest count of all references in the CVE database. Always present (emitted even when 0); matches len(references) when not truncated.",
+        "title": "Total References",
+        "type": "integer"
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
+      }
+    },
+    "required": [
+      "cve_id"
+    ],
+    "title": "CveResponse",
+    "type": "object"
+  },
+  "EpssInfo": {
+    "properties": {
+      "percentile": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk.",
+        "title": "Percentile"
+      },
+      "score": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days.",
+        "title": "Score"
+      }
+    },
+    "title": "EpssInfo",
+    "type": "object"
+  },
+  "ErrorDetail": {
+    "description": "Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`.",
+    "properties": {
+      "code": {
+        "description": "Stable machine-readable failure category. Agents key retry/upgrade decisions off this.",
+        "enum": [
+          "invalid_argument",
+          "not_found",
+          "rate_limit_exceeded",
+          "auth_required",
+          "tier_limit",
+          "upstream_timeout",
+          "upstream_error",
+          "internal_error"
+        ],
+        "title": "Code",
+        "type": "string"
+      },
+      "docs_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Documentation pointer (e.g. tool input contract) when code='invalid_argument'.",
+        "title": "Docs Url"
+      },
+      "message": {
+        "description": "Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses.",
+        "maxLength": 500,
+        "title": "Message",
+        "type": "string"
+      },
+      "retry_after_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "When code='rate_limit_exceeded', the minimum seconds to wait before retrying.",
+        "title": "Retry After Seconds"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier.",
+        "title": "Upgrade Url"
+      }
+    },
+    "required": [
+      "code",
+      "message"
+    ],
+    "title": "ErrorDetail",
+    "type": "object"
+  },
+  "ErrorResponse": {
+    "description": "MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body.",
+    "properties": {
+      "error": {
+        "$ref": "#/$defs/ErrorDetail"
+      }
+    },
+    "required": [
+      "error"
+    ],
+    "title": "ErrorResponse",
+    "type": "object"
+  },
+  "KevInfo": {
+    "properties": {
+      "date_added": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog.",
+        "title": "Date Added"
+      },
+      "in_kev": {
+        "default": false,
+        "description": "True when CISA has confirmed this CVE is being actively exploited in the wild.",
+        "title": "In Kev",
+        "type": "boolean"
+      }
+    },
+    "title": "KevInfo",
+    "type": "object"
+  },
+  "PivotHint": {
+    "additionalProperties": true,
+    "description": "A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context.",
+    "properties": {
+      "input": {
+        "description": "Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument.",
+        "title": "Input",
+        "type": "string"
+      },
+      "params": {
+        "anyOf": [
+          {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed.",
+        "title": "Params"
+      },
+      "reason": {
+        "description": "Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'.",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "description": "Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal.",
+        "enum": [
+          "cve_lookup",
+          "cve_search",
+          "cve_leading",
+          "bulk_cve_lookup",
+          "exploit_lookup",
+          "kev_detail",
+          "cwe_lookup",
+          "subdomain_enum",
+          "ssl_check",
+          "tech_fingerprint",
+          "asn_lookup",
+          "ip_lookup",
+          "ioc_lookup",
+          "bulk_ioc_lookup",
+          "hash_lookup",
+          "threat_intel",
+          "threat_report",
+          "audit_domain",
+          "domain_report",
+          "dns_lookup",
+          "whois_lookup",
+          "wayback_lookup",
+          "scan_headers",
+          "check_headers",
+          "check_secrets",
+          "check_injection",
+          "check_dependencies",
+          "email_mx",
+          "email_disposable",
+          "phone_lookup",
+          "username_lookup",
+          "password_check",
+          "phishing_check",
+          "atlas_technique_lookup",
+          "atlas_technique_search",
+          "bulk_atlas_technique_lookup",
+          "atlas_case_study_lookup",
+          "atlas_case_study_search",
+          "d3fend_defense_lookup",
+          "d3fend_defense_search",
+          "d3fend_defense_for_attack",
+          "d3fend_attack_coverage"
+        ],
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "input",
+      "reason"
+    ],
+    "title": "PivotHint",
+    "type": "object"
+  },
+  "Verdict": {
+    "properties": {
+      "completeness": {
+        "default": "complete",
+        "description": "'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing.",
+        "enum": [
+          "complete",
+          "partial",
+          "minimal"
+        ],
+        "title": "Completeness",
+        "type": "string"
+      },
+      "data_age_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness.",
+        "title": "Data Age Seconds"
+      },
+      "deterministic": {
+        "description": "True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output.",
+        "title": "Deterministic",
+        "type": "boolean"
+      },
+      "falsifiable_fields": {
+        "description": "Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Falsifiable Fields",
+        "type": "array"
+      },
+      "sources_queried": {
+        "description": "Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Queried",
+        "type": "array"
+      },
+      "sources_unavailable": {
+        "description": "Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Unavailable",
+        "type": "array"
+      }
+    },
+    "required": [
+      "deterministic"
+    ],
+    "title": "Verdict",
+    "type": "object"
+  }
+}

addedOutput schema / properties / result / anyOf

Added value: +[
+  {
+    "$ref": "#/$defs/CveResponse"
+  },
+  {
+    "$ref": "#/$defs/ErrorResponse"
+  }
+]

removedOutput schema / properties / result / type
```
Removed value: -"string"
```

Changed1 schema field changedApr 25, 2026

addedInput schema / properties / include_full_references

Added value: +{
+  "default": false,
+  "description": "Return the full references list (default: False, returns first 10). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected by the cap. Set True only when you need the complete advisory URL set (older + high-profile CVEs accumulate 30-60+).",
+  "title": "Include Full References",
+  "type": "boolean"
+}

Changed1 schema field changedApr 24, 2026

addedInput schema / properties / include_affected_products

Added value: +{
+  "default": false,
+  "description": "Return the full affected_products list (default: False, returns first 20). Set True for bulk audits or dependency scanning of Log4j-class CVEs with 50+ products.",
+  "title": "Include Affected Products",
+  "type": "boolean"
+}

First observedApr 11, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and idempotent hints, and the description adds rich behavioral context: default truncation of affected_products/references with 'honest count', behavior of include_* flags, tag-first patch detection, severity consensus logic, and rate limits. It also notes the 'disputed' tag effect on summary prefix.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense, using semicolons and lists to pack many details. Every sentence adds value—no redundancy or fluff. It is front-loaded with the core purpose and then expands into optional behaviors, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 parameters, an output schema, and complex behaviors, the description covers the key use cases, return shape highlights, defaults, rate limits, and chaining opportunities. It fully supports an agent in deciding when and how to invoke the tool, even without seeing the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds valuable context beyond the schema: e.g., 'By default affected_products is truncated to the first 20 entries', 'total_reports the honest count', and 'tag-first patch detection'. It clarifies the purpose and side effects of the boolean parameters without repeating their full schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Retrieve detailed CVE data by ID', giving a specific verb, resource, and lookup key. It also explicitly distinguishes itself from cve_search: 'Use for single-CVE details; use cve_search for queries by product/severity.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states when to use this tool ('single-CVE details') and when to use an alternative ('use cve_search for queries by product/severity'). It also explains when to pass optional flags (e.g., include_affected_products for bulk audits) and how to chain next_calls with kev_detail, cwe_lookup, and exploit_lookup.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ContrastAPI tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

CVE Lookup

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

Resources