EchelonGraph CVE & Exposure

Search vendor advisories

search_vendor_advisories

Read-onlyIdempotent

Search or list vendor-published advisories, newest first. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, vendor_advisory_id, affected_products and cve_ids (search_match substring). A query of 1 or 2 characters matches whole words only (search_match word): it must equal, ignoring case, a whole word (a run of letters and digits) of one of those, so xz finds xz-utils but not xzibit, and a 1- or 2-character query with any other character, such as c#, matches nothing. Filter by vendor (slug), by severity band, and by whether the advisory names any CVE ID. Advisories their vendor withdrew are left out. Returns advisories, each with vendor, vendor_advisory_id, title, severity, cvss_v3_score, cve_ids, summary and affected_products where present, and the answer's total, total_capped, limit, offset, search_applied and search_match. A search counts at most 1,000 matches: past that, total is 1000 and total_capped is true, which means 1,000 or more (the note writes 1,000+), never exactly 1,000; paging past it still works. Without a query, total is the exact count and total_capped is false. Each advisory carries vendor_published_at (the vendor's date), our_first_seen_at (when EchelonGraph first recorded it) and withdrawn (true: the vendor rescinded it; the note names each such advisory). The query is sent in a request header, never in the URL. coverage repeats total, total_capped, limit, offset, search_applied and search_match, and gives returned, the rows in this page, and vendor_windows, each vendor's window in what EchelonGraph holds (only that vendor's when vendor is given): vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried). An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none. measured_at is null. Its structured result carries state (measured), measured_at, method, coverage, freshness (null: the answer carries no poll-completion time) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); data in the structured result always holds it whole. Cut, each row keeps vendor, vendor_advisory_id, title, severity and cve_ids at least, its strings and lists shortened, or rows are left out and the note gives the offset to call next.

Input Schema

TableJSON Schema

Name	Required	Description
`limit`	No	page size (default 20, max 50)
`query`	No	free text, at most 100 bytes: a product, an advisory ID, a CVE ID or a keyword, e.g. 'exchange server'; 1 or 2 characters match whole words only
`offset`	No	rows to skip (default 0)
`vendor`	No	a vendor slug, e.g. microsoft, redhat, github
`has_cve`	No	true: only advisories naming a CVE; false: only those naming none
`severity`	No	one severity band

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedOct 4, 2026

changedInput schema / properties / query / description

Previous value: -"free text, at most 100 bytes: a product, an advisory ID, a CVE ID or a keyword, e.g. 'exchange server'"New value: +"free text, at most 100 bytes: a product, an advisory ID, a CVE ID or a keyword, e.g. 'exchange server'; 1 or 2 characters match whole words only"

changedOutput schema / oneOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "coverage": {
-        "anyOf": [
-          {
-            "additionalProperties": false,
-            "properties": {
-              "limit": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "offset": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "returned": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "search_applied": {
-                "type": [
-                  "boolean",
-                  "null"
-                ]
-              },
-              "total": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              }
-            },
-            "required": [
-              "total",
-              "returned",
-              "limit",
-              "offset",
-              "search_applied"
-            ],
-            "type": "object"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "description": "What the answer covers; null where the answer says nothing about it."
-      },
-      "data": {
-        "additionalProperties": {},
-        "properties": {
-          "advisories": {
-            "anyOf": [
-              {
-                "items": {
-                  "additionalProperties": {},
-                  "properties": {
-                    "advisory_id": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "affected_products": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "type": "string"
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "cve_ids": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "type": "string"
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "cvss_v3_score": {
-                      "type": [
-                        "number",
-                        "null"
-                      ]
-                    },
-                    "our_first_seen_at": {
-                      "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "severity": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "summary": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "title": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_advisory_id": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_display_name": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_published_at": {
-                      "description": "The date the vendor gives for the advisory.",
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "withdrawn": {
-                      "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
-                      "type": [
-                        "boolean",
-                        "null"
-                      ]
-                    }
-                  },
-                  "type": "object"
-                },
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "limit": {
-            "type": [
-              "number",
-              "null"
-            ]
-          },
-          "offset": {
-            "type": [
-              "number",
-              "null"
-            ]
-          },
-          "search_applied": {
-            "description": "Whether a free-text search filtered this answer.",
-            "type": [
-              "boolean",
-              "null"
-            ]
-          },
-          "total": {
-            "type": [
-              "number",
-              "null"
-            ]
-          }
-        },
-        "type": "object"
-      },
-      "freshness": {
-        "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
-        "type": "null"
-      },
-      "measured_at": {
-        "anyOf": [
-          {
-            "description": "An RFC 3339 instant.",
-            "type": "string"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
-      },
-      "method": {
-        "description": "How the numbers were produced.",
-        "type": "string"
-      },
-      "notes": {
-        "description": "Caveats, one sentence each.",
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "state": {
-        "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
-        "enum": [
-          "measured",
-          "not_assessed"
-        ],
-        "type": "string"
-      }
-    },
-    "required": [
-      "state",
-      "measured_at",
-      "method",
-      "coverage",
-      "freshness",
-      "notes",
-      "data"
-    ],
-    "type": "object"
-  },
-  {
-    "additionalProperties": false,
-    "properties": {
-      "coverage": {
-        "anyOf": [
-          {
-            "additionalProperties": false,
-            "properties": {
-              "limit": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "offset": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "returned": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "search_applied": {
-                "type": [
-                  "boolean",
-                  "null"
-                ]
-              },
-              "total": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              }
-            },
-            "required": [
-              "total",
-              "returned",
-              "limit",
-              "offset",
-              "search_applied"
-            ],
-            "type": "object"
-          },
-          {
-            "type": "null"
-          }
-        ]
-      },
-      "error": {
-        "additionalProperties": false,
-        "properties": {
-          "kind": {
-            "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
-            "enum": [
-              "network",
-              "timeout",
-              "http",
-              "not_json",
-              "not_object",
-              "invalid_input",
-              "internal",
-              "unexpected_shape",
-              "radars"
-            ],
-            "type": "string"
-          },
-          "message": {
-            "description": "The cause: the API's own message, or what went wrong.",
-            "type": "string"
-          },
-          "path": {
-            "description": "The API path requested, when a request was made.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "status": {
-            "anyOf": [
-              {
-                "maximum": 9007199254740991,
-                "minimum": -9007199254740991,
-                "type": "integer"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The HTTP status, when the API answered one."
-          }
-        },
-        "required": [
-          "kind",
-          "path",
-          "status",
-          "message"
-        ],
-        "type": "object"
-      },
-      "freshness": {
-        "type": "null"
-      },
-      "measured_at": {
-        "type": "null"
-      },
-      "method": {
-        "type": "null"
-      },
-      "notes": {
-        "description": "Caveats, one sentence each.",
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "state": {
-        "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
-        "enum": [
-          "failed",
-          "invalid_input"
-        ],
-        "type": "string"
-      }
-    },
-    "required": [
-      "state",
-      "measured_at",
-      "method",
-      "coverage",
-      "freshness",
-      "notes",
-      "error"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "coverage": {
+        "anyOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "limit": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "offset": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "returned": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "search_applied": {
+                "type": [
+                  "boolean",
+                  "null"
+                ]
+              },
+              "search_match": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "word",
+                      "substring"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+              },
+              "total": {
+                "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "total_capped": {
+                "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+                "type": [
+                  "boolean",
+                  "null"
+                ]
+              },
+              "vendor_windows": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "additionalProperties": false,
+                      "properties": {
+                        "advisories": {
+                          "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+                          "type": [
+                            "number",
+                            "null"
+                          ]
+                        },
+                        "earliest_vendor_published_at": {
+                          "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "history_backfill": {
+                          "anyOf": [
+                            {
+                              "anyOf": [
+                                {
+                                  "enum": [
+                                    "complete",
+                                    "in_progress",
+                                    "not_started",
+                                    "not_supported"
+                                  ],
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+                        },
+                        "latest_vendor_published_at": {
+                          "description": "The latest vendor_published_at among them; null when none is held.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "vendor": {
+                          "description": "The vendor slug.",
+                          "type": "string"
+                        },
+                        "vendor_display_name": {
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        }
+                      },
+                      "required": [
+                        "vendor",
+                        "vendor_display_name",
+                        "advisories",
+                        "earliest_vendor_published_at",
+                        "latest_vendor_published_at",
+                        "history_backfill"
+                      ],
+                      "type": "object"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
+              }
+            },
+            "required": [
+              "total",
+              "total_capped",
+              "returned",
+              "limit",
+              "offset",
+              "search_applied",
+              "search_match",
+              "vendor_windows"
+            ],
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "What the answer covers; null where the answer says nothing about it."
+      },
+      "data": {
+        "additionalProperties": {},
+        "properties": {
+          "advisories": {
+            "anyOf": [
+              {
+                "items": {
+                  "additionalProperties": {},
+                  "properties": {
+                    "advisory_id": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "affected_products": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "type": "string"
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "cve_ids": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "type": "string"
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "cvss_v3_score": {
+                      "type": [
+                        "number",
+                        "null"
+                      ]
+                    },
+                    "our_first_seen_at": {
+                      "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "severity": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "summary": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "title": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_advisory_id": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_display_name": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_published_at": {
+                      "description": "The date the vendor gives for the advisory.",
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "withdrawn": {
+                      "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
+                      "type": [
+                        "boolean",
+                        "null"
+                      ]
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "limit": {
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "offset": {
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "search_applied": {
+            "description": "Whether a free-text search filtered this answer.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          },
+          "search_match": {
+            "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "total": {
+            "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
+            "type": [
+              "number",
+              "null"
+            ]
+          },
+          "total_capped": {
+            "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count.",
+            "type": [
+              "boolean",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "freshness": {
+        "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+        "type": "null"
+      },
+      "measured_at": {
+        "anyOf": [
+          {
+            "description": "An RFC 3339 instant.",
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+      },
+      "method": {
+        "description": "How the numbers were produced.",
+        "type": "string"
+      },
+      "notes": {
+        "description": "Caveats, one sentence each.",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+        "enum": [
+          "measured",
+          "not_assessed"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "state",
+      "measured_at",
+      "method",
+      "coverage",
+      "freshness",
+      "notes",
+      "data"
+    ],
+    "type": "object"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "coverage": {
+        "anyOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "limit": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "offset": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "returned": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "search_applied": {
+                "type": [
+                  "boolean",
+                  "null"
+                ]
+              },
+              "search_match": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "word",
+                      "substring"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+              },
+              "total": {
+                "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "total_capped": {
+                "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+                "type": [
+                  "boolean",
+                  "null"
+                ]
+              },
+              "vendor_windows": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "additionalProperties": false,
+                      "properties": {
+                        "advisories": {
+                          "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+                          "type": [
+                            "number",
+                            "null"
+                          ]
+                        },
+                        "earliest_vendor_published_at": {
+                          "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "history_backfill": {
+                          "anyOf": [
+                            {
+                              "anyOf": [
+                                {
+                                  "enum": [
+                                    "complete",
+                                    "in_progress",
+                                    "not_started",
+                                    "not_supported"
+                                  ],
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "string"
+                                }
+                              ]
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+                        },
+                        "latest_vendor_published_at": {
+                          "description": "The latest vendor_published_at among them; null when none is held.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "vendor": {
+                          "description": "The vendor slug.",
+                          "type": "string"
+                        },
+                        "vendor_display_name": {
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        }
+                      },
+                      "required": [
+                        "vendor",
+                        "vendor_display_name",
+                        "advisories",
+                        "earliest_vendor_published_at",
+                        "latest_vendor_published_at",
+                        "history_backfill"
+                      ],
+                      "type": "object"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
+              }
+            },
+            "required": [
+              "total",
+              "total_capped",
+              "returned",
+              "limit",
+              "offset",
+              "search_applied",
+              "search_match",
+              "vendor_windows"
+            ],
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
+      "error": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+            "enum": [
+              "network",
+              "timeout",
+              "http",
+              "not_json",
+              "not_object",
+              "invalid_input",
+              "internal",
+              "unexpected_shape",
+              "radars"
+            ],
+            "type": "string"
+          },
+          "message": {
+            "description": "The cause: the API's own message, or what went wrong.",
+            "type": "string"
+          },
+          "path": {
+            "description": "The API path requested, when a request was made.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "status": {
+            "anyOf": [
+              {
+                "maximum": 9007199254740991,
+                "minimum": -9007199254740991,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The HTTP status, when the API answered one."
+          }
+        },
+        "required": [
+          "kind",
+          "path",
+          "status",
+          "message"
+        ],
+        "type": "object"
+      },
+      "freshness": {
+        "type": "null"
+      },
+      "measured_at": {
+        "type": "null"
+      },
+      "method": {
+        "type": "null"
+      },
+      "notes": {
+        "description": "Caveats, one sentence each.",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+        "enum": [
+          "failed",
+          "invalid_input"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "state",
+      "measured_at",
+      "method",
+      "coverage",
+      "freshness",
+      "notes",
+      "error"
+    ],
+    "type": "object"
+  }
+]

First observedOct 4, 2026

TDQS

A4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover safety (readOnly, idempotent, openWorld, non-destructive), so the description carries extra weight and delivers it: withdrawn advisories are excluded, searches cap at 1,000 matches with total_capped semantics, and JSON is truncated past 30,000 characters. It also discloses coverage freshness/history_backfill states and the note/text-block structure, far beyond the annotation bar.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The opening is well front-loaded, but the body is a dense multi-hundred-word blob with no structural breaks, and it re-specifies return fields and the coverage/notes duplication even though an output schema already exists. Much is justified by complexity, yet several sentences restate rather than add.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool this complex it leaves little unsaid: matching rules, filters, exclusion of withdrawn advisories, caps, paging, coverage windows and truncation behavior are all addressed. An agent has enough to call and interpret it correctly, with the output schema covering the return shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real query semantics beyond the schema: 3+ characters match as a case-insensitive substring, 1-2 characters match whole words only (xz finds xz-utils but not xzibit, c# matches nothing). That meaningfully extends the schema's terse 'query' text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a specific verb and resource ('Search or list vendor-published advisories, newest first') with ordering/scoping baked in. It clearly reads as a broad advisory-search tool, but it never explicitly distinguishes itself from close siblings like get_vendor_advisory or vendor_advisories_for_cve.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description extensively explains how filtering works (vendor slug, severity band, has_cve) and how queries match, which implies when the tool is applicable. However, it never states when to reach for this tool over alternatives such as search_cves or get_vendor_advisory, and gives no when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All EchelonGraph CVE & Exposure tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.