Added value: +[
+  {
+    "description": "Exact package tuple.",
+    "properties": {
+      "ecosystem": {
+        "description": "Case-sensitive ecosystem identifier from osv_list_ecosystems.",
+        "pattern": "\\S",
+        "type": "string"
+      },
+      "name": {
+        "description": "Exact package name in its ecosystem.",
+        "pattern": "\\S",
+        "type": "string"
+      },
+      "purl": {
+        "description": "Use purl instead of the tuple, never together with name or ecosystem.",
+        "type": "string"
+      },
+      "version": {
+        "description": "Exact package version, never a range.",
+        "pattern": "\\S",
+        "type": "string"
+      }
+    },
+    "required": [
+      "name",
+      "ecosystem",
+      "version"
+    ],
+    "type": "object"
+  },
+  {
+    "additionalProperties": false,
+    "description": "PURL alternative with exactly one version source.",
+    "properties": {
+      "purl": {
+        "description": "Complete Package URL, such as pkg:pypi/jinja2@3.1.4. Supply its version either here or separately, exactly once.",
+        "type": "string"
+      },
+      "version": {
+        "description": "Exact version only when the PURL does not embed one.",
+        "pattern": "\\S",
+        "type": "string"
+      }
+    },
+    "required": [
+      "purl"
+    ],
+    "type": "object"
+  }
+]

Removed value: -{
-  "ecosystem": {
-    "description": "Ecosystem identifier. Case-sensitive exact match. Use osv_list_ecosystems to validate.",
-    "pattern": "\\S",
-    "type": "string"
-  },
-  "name": {
-    "description": "Package name as it appears in the ecosystem.",
-    "pattern": "\\S",
-    "type": "string"
-  },
-  "version": {
-    "description": "Exact version string to check.",
-    "pattern": "\\S",
-    "type": "string"
-  }
-}

Removed value: -[
-  "name",
-  "ecosystem",
-  "version"
-]

Removed value: -"object"

Previous value: -"Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array."New value: +"Repeat the original packages array with page: overflow.page first. Continue using path, offset: page.nextOffset and revision: page.revision. /results/17/... keeps original row index 17; start deferred children without a revision."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Previous value: -"First retrieval arguments; repeat the original tool input."New value: +"Repeat the original tool input with page: overflow.page. Later select path, offset: page.nextOffset and revision: page.revision; do not pass the output page object."

Previous value: -"Entry offset, or Unicode code-point offset for text."New value: +"Start at zero; on later calls set this to the previous page.nextOffset until it is null. Text offsets count Unicode code points."

Previous value: -"RFC 6901 pointer into normalized output; empty string selects its root."New value: +"Field pointer announced by overflow or entries[].deferred.path; empty string selects the root. Keep the same path while following nextOffset."

Previous value: -"Revision returned for this node; omit on first retrieval."New value: +"Use page.revision only when continuing the same path. Omit on the first call to any deferred child path; restart without it after stale_page_revision."

Added value: +{
+  "description": "Original PURL when supplied; name, ecosystem and version show its effective coordinate on success.",
+  "type": "string"
+}

Previous value: -"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS/KEV/EPSS context."New value: +"CVE IDs and other aliases. Accepted by nist-nvd-mcp-server for CVSS scores and CISA KEV status."

Added value: +{
+  "additionalProperties": false,
+  "description": "Retrieve original-index rows at /results or a selected /results/17/... node with the original packages array.",
+  "properties": {
+    "offset": {
+      "default": 0,
+      "description": "Entry offset, or Unicode code-point offset for text.",
+      "maximum": 9007199254740991,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "path": {
+      "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+      "maxLength": 1024,
+      "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+      "type": "string"
+    },
+    "revision": {
+      "description": "Revision returned for this node; omit on first retrieval.",
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "required": [
+    "path"
+  ],
+  "type": "object"
+}

Previous value: -[
-  {
-    "not": {
-      "required": [
-        "error"
-      ]
-    },
-    "required": [
-      "results",
-      "summary"
-    ]
-  },
-  {
-    "required": [
-      "error"
-    ]
-  }
-]New value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    }
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Previous value: -"Machine-readable failure mode."New value: +"Machine-readable failure mode. Declared by this tool: `invalid_page_path`: The pointer is unknown or cannot fit a bounded page. `stale_page_revision`: The re-fetched node or input order changed. Other values are possible when a failure originates below the handler."

Added value: +[
+  "invalid_page_path",
+  "stale_page_revision"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Transmission overflow disclosure; independent of upstream truncation.",
+  "properties": {
+    "complete": {
+      "description": "Complete top-level fields retained in this response.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "notice": {
+      "description": "Transmission omission and fresh re-fetch semantics.",
+      "type": "string"
+    },
+    "omitted": {
+      "description": "Omitted values, all addressable through page.path.",
+      "items": {
+        "additionalProperties": false,
+        "description": "An oversized child; parent offset advances past this descriptor.",
+        "properties": {
+          "path": {
+            "description": "Exact child pointer to retrieve separately.",
+            "type": "string"
+          },
+          "total": {
+            "description": "Number of child entries or Unicode code points; one for scalars.",
+            "type": "number"
+          },
+          "type": {
+            "description": "Child value kind.",
+            "enum": [
+              "array",
+              "object",
+              "string",
+              "scalar"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "type",
+          "total"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "page": {
+      "additionalProperties": false,
+      "description": "First retrieval arguments; repeat the original tool input.",
+      "properties": {
+        "offset": {
+          "default": 0,
+          "description": "Entry offset, or Unicode code-point offset for text.",
+          "maximum": 9007199254740991,
+          "minimum": 0,
+          "type": "integer"
+        },
+        "path": {
+          "description": "RFC 6901 pointer into normalized output; empty string selects its root.",
+          "maxLength": 1024,
+          "pattern": "^(?:\\/(?:[^~]|~[01])*)?$",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Revision returned for this node; omit on first retrieval.",
+          "pattern": "^[a-f0-9]{64}$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "offset"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "complete",
+    "omitted",
+    "page",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": false,
+  "description": "One bounded page of an addressed normalized node.",
+  "properties": {
+    "entries": {
+      "description": "Source-order entries for arrays, objects and scalars.",
+      "items": {
+        "additionalProperties": false,
+        "description": "One source entry, complete or deferred.",
+        "properties": {
+          "deferred": {
+            "additionalProperties": false,
+            "description": "Retrievable child descriptor when its value does not fit.",
+            "properties": {
+              "path": {
+                "description": "Exact child pointer to retrieve separately.",
+                "type": "string"
+              },
+              "total": {
+                "description": "Number of child entries or Unicode code points; one for scalars.",
+                "type": "number"
+              },
+              "type": {
+                "description": "Child value kind.",
+                "enum": [
+                  "array",
+                  "object",
+                  "string",
+                  "scalar"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "path",
+              "type",
+              "total"
+            ],
+            "type": "object"
+          },
+          "key": {
+            "description": "Object key or original array index.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Complete child value, unmodified."
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "nextOffset": {
+      "description": "Next offset, strictly greater or null when finished.",
+      "type": [
+        "number",
+        "null"
+      ]
+    },
+    "notice": {
+      "description": "Fresh re-fetch disclosure; no saved historical snapshot.",
+      "type": "string"
+    },
+    "offset": {
+      "description": "Starting entry or code-point offset.",
+      "type": "number"
+    },
+    "path": {
+      "description": "Addressed JSON pointer.",
+      "type": "string"
+    },
+    "revision": {
+      "description": "SHA-256 revision of the addressed normalized node; batch collection uses original input order.",
+      "type": "string"
+    },
+    "text": {
+      "description": "Verbatim Unicode code-point slice for strings.",
+      "type": "string"
+    },
+    "total": {
+      "description": "Total entries or Unicode code points.",
+      "type": "number"
+    },
+    "type": {
+      "description": "Addressed value kind.",
+      "enum": [
+        "array",
+        "object",
+        "string",
+        "scalar"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "path",
+    "type",
+    "offset",
+    "total",
+    "nextOffset",
+    "revision",
+    "notice"
+  ],
+  "type": "object"
+}

Added value: +{
+  "additionalProperties": {},
+  "description": "Compact view; overflow identifies omissions. This is not the complete record.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}

Removed value: -1

Removed value: -1

Removed value: -1

Previous value: -"First safe version(s) to upgrade to. Empty if no fix exists."New value: +"Every fixed version the advisory lists for this row's package, in record order — one per affected interval, typically one per release line. Excludes other packages' fixes and GIT commits. Empty when the advisory lists no fix for this package."

Previous value: -"A first-safe version string."New value: +"A version that fixes the vulnerability for this package."

Previous value: -"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null."New value: +"Severity label: \"LOW\", \"MODERATE\", \"HIGH\", \"CRITICAL\", or null. Same derivation as osv_query_package: database_specific.severity, then an Ubuntu priority, then the highest CVSS v3/v4 score, using this row's package-level severity entries when the record has none."

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

Added value: +[
+  "string",
+  "null"
+]

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +false

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Added value: +[
+  {
+    "not": {
+      "required": [
+        "error"
+      ]
+    },
+    "required": [
+      "results",
+      "summary"
+    ]
+  },
+  {
+    "required": [
+      "error"
+    ]
+  }
+]

Added value: +{
+  "additionalProperties": {},
+  "description": "Present when the call failed. Absent on success.",
+  "properties": {
+    "code": {
+      "description": "JSON-RPC error code for this failure.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "data": {
+      "additionalProperties": {},
+      "properties": {
+        "reason": {
+          "description": "Machine-readable failure mode.",
+          "type": "string"
+        },
+        "recovery": {
+          "additionalProperties": {},
+          "description": "Actionable next step for the caller.",
+          "properties": {
+            "hint": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "hint"
+          ],
+          "type": "object"
+        },
+        "retryable": {
+          "description": "Whether retrying may succeed.",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "message": {
+      "description": "Human-readable description of what went wrong.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+}

Removed value: -[
-  "results",
-  "summary"
-]

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +1

Added value: +"\\S"

Added value: +{
+  "description": "True when OSV paginated beyond the fetch cap for this package — its result may be INCOMPLETE. A truncated row with no vulnerabilities is NOT confirmed clean.",
+  "type": "boolean"
+}

Previous value: -[
-  "name",
-  "ecosystem",
-  "version",
-  "vulnerable",
-  "error",
-  "vulnCount",
-  "vulns"
-]New value: +[
+  "name",
+  "ecosystem",
+  "version",
+  "vulnerable",
+  "truncated",
+  "error",
+  "vulnCount",
+  "vulns"
+]

Previous value: -"Packages with no vulnerabilities."New value: +"Packages confirmed clean — no vulnerabilities, no error, and not truncated."

Added value: +{
+  "description": "Packages whose OSV results were truncated (may be incomplete). A truncated package with no findings is NOT counted as clean.",
+  "type": "number"
+}

Previous value: -[
-  "totalPackages",
-  "vulnerableCount",
-  "cleanCount",
-  "errorCount",
-  "totalVulns",
-  "worstSeverity"
-]New value: +[
+  "totalPackages",
+  "vulnerableCount",
+  "cleanCount",
+  "truncatedCount",
+  "errorCount",
+  "totalVulns",
+  "worstSeverity"
+]

Added value: +{
+  "description": "Compact scan summary (package and outcome counts), echoed on edge-case batches for content-only clients.",
+  "type": "string"
+}

Added value: +{
+  "description": "Present on all-clean or all-errors batches — the aggregate outcome for content-only clients.",
+  "type": "string"
+}

Removed value: -{
-  "description": "Reuse an existing DataCanvas table token to append results. Omit to create a new canvas. Only relevant when package count >= 200.",
-  "type": "string"
-}

Removed value: -{
-  "description": "DataCanvas table token. Present when the package count is >= 200 or a canvas_id was provided. Use to run SQL queries across the full result set via the canvas tools.",
-  "type": "string"
-}