EchelonGraph MCP Server gives any MCP client free, keyless, read-only access to EchelonGraph's CVE Pulse feed plus per-CVE internet-exposure data.
CVE feed lookup: cve_summary (feed counts by severity band, rejected and unscored totals, last update), search_cves (filter by severity, min CVSS, text; sort and page), get_cve (one CVE's record: CVSS v3/v4, EchelonGraph score and confidence, EPSS, KEV status and CISA's verbatim text, GHSA, references, CPE data, fix summary, dates).
Weakness class: get_cwe — one CWE's MITRE name/description and a page of 50 CVEs classified under it (KEV-listed first, then score).
Exposure footprint: cve_exposure (exposed ip:port services, country/product breakdown, ransomware flag for one CVE) and exposure_radar (aggregate totals: KEV-exposed services, unauthenticated data stores, leaked credentials, shadow AI, MCP servers found in Certificate Transparency).
Exploitation and likelihood: kev_recent (newest CISA KEV additions, filterable by date, ransomware, vendor) and epss_history (one CVE's recorded EPSS change history with coverage caveats).
Am I affected / SBOM and lockfile checks: check_affected (a product CPE or registry package at a version), check_sbom (up to 2,000 purls or a CycloneDX/SPDX JSON document), scan_manifest (1–20 lockfiles or pinned manifests: requirements.txt, go.mod, package-lock.json, Cargo.lock, Gemfile.lock, composer.lock, poetry.lock, gradle.lockfile) — each verdict labelled affected/not_affected/undetermined/not_assessed, only not_affected being clean.
Exploits, fixes and advisories: cve_intel (CWEs, exploit code and Nuclei templates, affected packages with fixed branches), cve_remediation (how a CVE is fixed per its sources, plus an installed version's verdict and fixed_in), vendor_advisories_for_cve, get_vendor_advisory and search_vendor_advisories.
Prompts (slash-command workflows): triage_cve, kev_weekly_brief, am_i_affected, sbom_review, workload_triage.
Resources: echelongraph://methodology, echelongraph://sources and the cve://{cve_id} template.
Deployment: runs locally over stdio via npx echelongraph-mcp (Node.js 20+), a Claude Desktop one-click extension, or the keyless hosted Streamable HTTP endpoint at https://mcp.echelongraph.io/mcp.
Trustworthy results: every answer carries state, measured_at, method, coverage, freshness and notes, so a zero or an outage is never read as an all-clear; long answers are cut to 30,000 characters unless full: true.
Provides tools to search and retrieve Cisco vendor advisories, including advisory details, severity, CVSS scores, affected products, and associated CVEs.
Provides exposure radar data for unauthenticated ClickHouse instances, including counts of exposed services and top countries/engines from EchelonGraph's internet-exposure scans.
Integrates with GitHub advisory data (GHSA) for vendor advisories and with public GitHub push events for leaked credential detection.
Provides tools to search and retrieve Palo Alto Networks vendor advisories, including advisory details, severity, CVSS scores, affected products, and associated CVEs.
Provides tools to search and retrieve Red Hat vendor advisories (e.g., RHSA), including advisory details, severity, CVSS scores, affected products, and associated CVEs.
Provides exposure radar data for unauthenticated Redis instances, including counts of exposed services and top countries/engines from EchelonGraph's internet-exposure scans.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@EchelonGraph MCP Server show me the internet exposure footprint for CVE-2021-44228"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CVE and internet-exposure data for Claude, Cursor, VS Code, Cline, and any MCP client, straight from EchelonGraph's free public feed.
It exposes EchelonGraph's CVE Pulse (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, fused into one score) plus a per-CVE internet-exposure footprint: how many internet-facing services (distinct ip:port) EchelonGraph's KEV-exposure radar has on record running a version that maps to the CVE. Exposure counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan).
Its 16 tools look up one CVE (record, exploit code and fixed versions, how it is fixed as its
sources state it, EPSS history, vendor advisories, exposure footprint), list CISA's newest KEV additions, check whether a product or
package version is affected, check an SBOM or a project's lockfiles, and read a CWE and its CVEs. Every result says how
it was measured (state, measured_at, method, coverage, freshness, notes), so a model
cannot mistake an outage or an unassessed lookup for an all-clear.
It also serves five prompts, ready-made workflows a client can show as slash commands
(triage_cve, kev_weekly_brief, am_i_affected, sbom_review, workload_triage; see "Prompts"), two resources
(echelongraph://methodology and echelongraph://sources) and one resource template
(cve://{cve_id}; see "Resources").
Free and keyless: no API key, no auth, read-only. The server makes no request other than the API call a tool needs to answer.
npm: echelongraph-mcp · Official MCP
Registry: io.echelongraph/echelongraph-mcp · Docs: https://echelongraph.io/pulse/mcp
Source: https://github.com/echelongraph/echelongraph-mcp · Changes: CHANGELOG.md · Security: SECURITY.md
The local server runs through npx and needs Node.js 20 or later; nothing is installed
globally. Claude Desktop's one-click extension, below, needs neither. Add one of the blocks below
to your client, quit it fully and reopen it, then ask: "Is CVE-2023-44487 actively exploited, and
how many exposed services does EchelonGraph's radar have on record for it?"
Three ways in. The first two need no Node.js: a one-click extension that runs the server on your
machine, and a custom connector to the hosted endpoint. The third runs the server through npx.
1. Install in Claude Desktop
(one click, no Node.js). The link downloads echelongraph-mcp.mcpb, a Claude Desktop extension.
Open it, or in Claude Desktop choose Settings → Extensions → Advanced settings → Install Extension
and pick it, then choose Install. Claude Desktop runs the server with the Node.js it ships and
writes its own configuration: no PATH and no JSON to edit. To update, install the next release's
bundle the same way. Every new release on GitHub carries the bundle (releases up to 2.6.5 do not),
built from the release's tag by the workflow that publishes the npm package, and signed with a SLSA
build-provenance attestation. To check a download:
gh attestation verify echelongraph-mcp.mcpb --repo echelongraph/echelongraph-mcp.
2. Custom connector (no install). Claude Desktop uses your claude.ai account's connectors:
Customize → Connectors → + Add → Add custom connector. Name it EchelonGraph, paste
https://mcp.echelongraph.io/mcp, choose No sign in, and add it. No Node.js, no PATH and no
JSON to edit. A connector added on claude.ai shows up in Claude Desktop too, and the plan rules
are claude.ai's (see "Remote (no install)" below).
3. Local server through npx.
Check Node.js. In Terminal (macOS) or PowerShell (Windows), run node -v. It must print
v20 or later. If it prints an older version or command not found, install the LTS release
from https://nodejs.org, or on macOS with Homebrew run brew install node.
Open the config file in a plain-text editor. Settings → Developer → Edit Config shows
claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json;
Windows: %APPDATA%\Claude\claude_desktop_config.json). Open it in a plain-text editor such as
VS Code, Notepad or nano. TextEdit on macOS turns " into curly quotes (“ ”) when Smart
Quotes is on, and the JSON then breaks without an error: turn it off under Edit → Substitutions
→ Smart Quotes, or use another editor.
Merge, do not replace. The file usually exists already and holds Claude Desktop's own
settings (for example a "preferences" object). Keep everything in it. Add an "mcpServers"
key at the top level, next to the keys already there; if "mcpServers" is already there, add
the "echelongraph" entry inside it. Mind the comma between entries. The result looks like
this, with your own settings where preferences is:
{
"preferences": {
"…": "the settings already in your file stay as they are"
},
"mcpServers": {
"echelongraph": {
"command": "npx",
"args": ["-y", "echelongraph-mcp"]
}
}
}To check that the file parses, run this in Terminal (macOS):
node -e "JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'))" "$HOME/Library/Application Support/Claude/claude_desktop_config.json"or this in PowerShell (Windows):
node -e "JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'))" "$env:APPDATA\Claude\claude_desktop_config.json"No output means valid JSON. A SyntaxError means the file is broken (often curly quotes or a
missing comma); ENOENT means there is no file at that path yet.
Quit fully, then reopen. Closing the window leaves the old config loaded. On macOS choose
Claude → Quit Claude (⌘Q); on Windows right-click the Claude icon in the system tray and choose
Quit. The first start can take longer while npx downloads the package.
Check that it worked. Settings → Developer lists echelongraph as running, and the tools
menu in the chat box lists EchelonGraph's tools, the ones under "Tools" below. Then ask the
question at the top of this section.
spawn npx ENOENT (or the server shows as failed). On macOS, an app opened from the Dock
does not get your shell's PATH, so Claude Desktop cannot find npx where Homebrew (Apple
silicon: /opt/homebrew/bin; Intel: /usr/local/bin) or nvm put it. Run which npx in
Terminal, then give Claude Desktop that absolute path as "command", and the folder it is in as
PATH under "env" (npx starts node from that same folder). With Homebrew on Apple silicon:
{
"mcpServers": {
"echelongraph": {
"command": "/opt/homebrew/bin/npx",
"args": ["-y", "echelongraph-mcp"],
"env": { "PATH": "/opt/homebrew/bin:/usr/bin:/bin" }
}
}
}With nvm, use the full path which npx prints (JSON does not expand ~). Then quit fully and
reopen. On Windows, install Node.js with the installer from nodejs.org, which adds npx to the
system PATH, then quit Claude Desktop fully and reopen it.
The server does not appear at all. The file is not valid JSON (a missing comma, or curly quotes), or the app was not fully quit: see steps 2 to 4.
Logs. macOS: ~/Library/Logs/Claude/mcp-server-echelongraph.log (this server's output) and
~/Library/Logs/Claude/mcp.log (connections). Windows: %APPDATA%\Claude\logs\, with the same
file names.
claude mcp add --transport stdio echelongraph -- npx -y echelongraph-mcpAdd --scope user before the -- to make it available in every project, or --scope project
to share it through the project's .mcp.json. Claude Code hands the model each result's
structuredContent, which this server holds to 30,000 characters unless a call passes full: true
(see "Long answers"); MAX_MCP_OUTPUT_TOKENS (25,000 tokens by default) is the cap Claude Code
applies to a tool's output, and raising it lets a full: true answer through.
~/.cursor/mcp.json (every project) or .cursor/mcp.json (one project):
{
"mcpServers": {
"echelongraph": {
"command": "npx",
"args": ["-y", "echelongraph-mcp"]
}
}
}.vscode/mcp.json in the workspace (VS Code's key is servers, not mcpServers):
{
"servers": {
"echelongraph": {
"command": "npx",
"args": ["-y", "echelongraph-mcp"]
}
}
}or from a terminal:
code --add-mcp '{"name":"echelongraph","command":"npx","args":["-y","echelongraph-mcp"]}'Clients that read an mcpServers block (Windsurf's mcp_config.json, Cline's MCP settings,
and most others) take the same block as Cursor above.
The same 16 tools, five prompts, two resources and one resource template are served over Streamable HTTP at:
https://mcp.echelongraph.io/mcpKeyless, no sign-in, stateless; both protocol eras. The hosted endpoint is in service:
https://mcp.echelongraph.io/health answers {"status":"ok","version":…} with the package
version it runs.
claude.ai (Free, Pro, Max, Team and Enterprise plans):
Customize → Connectors → + Add → Add custom connector. Name it EchelonGraph, paste
the URL, choose No sign in, and add it. On Team and Enterprise an Owner adds it for the
organization first, and each member then connects it. Free plans allow one custom connector.
Claude Code:
claude mcp add --transport http echelongraph https://mcp.echelongraph.io/mcpCursor (mcp.json):
{ "mcpServers": { "echelongraph": { "url": "https://mcp.echelongraph.io/mcp" } } }VS Code (.vscode/mcp.json):
{ "servers": { "echelongraph": { "type": "http", "url": "https://mcp.echelongraph.io/mcp" } } }Windsurf (mcp_config.json):
{ "mcpServers": { "echelongraph": { "serverUrl": "https://mcp.echelongraph.io/mcp" } } }The hosted endpoint runs this package's code (dist/http.js, below) against the same public
API, so its answers are the npm package's answers. What it sees and logs is under "Privacy",
and its per-client limit under "Rate limits".
Related MCP server: purify-feeds-mcp
Every tool is read-only (readOnlyHint: true) and declares a title and an outputSchema.
The example questions are ones a client can answer with that tool alone.
Tool | Title | What it answers | Example question |
| CVE feed summary | Counts of active CVEs by severity band, the count with no severity band from any source ( | How many critical CVEs does the feed hold, and when was it last updated? |
| Search CVEs | Search/filter CVEs (severity, min CVSS, text, sort) with EchelonGraph scores and | Find critical CVEs that mention Tomcat with a CVSS of 9 or more. |
| CVE detail | One CVE's record: CVSS v3 and (when scored) v4, the EchelonGraph score and its confidence, whether EchelonGraph has scored it ( | What are CVE-2024-3094's CVSS, EPSS and CISA-KEV status? |
| Internet exposure for one CVE | Internet-exposure footprint for a CVE: exposed service count (distinct ip:port, the | How many exposed services does EchelonGraph's radar have on record for CVE-2023-44487? |
| Exposure radar totals | Aggregate totals across the exposure radars: services running CISA-KEV CVEs; unauthenticated data stores and observability UIs, found through Shodan (LeakIX when Shodan query credits run low) and then confirmed by EchelonGraph's own identified check, which is not a pure read (on Redis it names its client; on ClickHouse its query lands in the server's query log); leaked credentials; shadow AI; and MCP servers found in EchelonGraph's own Certificate Transparency feed, by RFC 9728 verdict, protocol era and transport. Every number is labelled by what it counts, and a field the tool cannot label is left out and named. | How many unauthenticated data stores has EchelonGraph's radar confirmed? |
| Recent CISA KEV additions | The CVEs CISA has added to its Known Exploited Vulnerabilities catalog, newest first ( | Which CVEs has CISA added to KEV since 1 September, and which have known ransomware use? |
| EPSS change history for one CVE | How one CVE's EPSS score has changed, as EchelonGraph recorded it: one point per recorded change ( | How has CVE-2023-44487's EPSS score changed, as EchelonGraph recorded it? |
| Am I affected? (product or package at a version) | Whether a product (its NVD CPE product token) or a registry package ( | Is openssl 3.0.0 affected by known CVEs? Is lodash 4.17.15 on npm? |
| Check an SBOM against the advisory corpus | A dependency list checked against EchelonGraph's advisory corpus (OSV.dev records), one verdict per component: | Check this CycloneDX SBOM against the advisory corpus. |
| Check a lockfile against the advisory corpus | A project's lockfiles or pinned manifests checked against the same advisory corpus, one verdict per dependency, through the same batch route, batches, 50-second budget and | Check this package-lock.json against the advisory corpus. |
| CVE weakness, exploits and packages | Weakness, exploit code and detection templates (a Nuclei template checks whether a system is affected; it is not necessarily exploit code, and the note counts templates apart), affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment: | Is there public exploit code for CVE-2021-44228, and which versions fix it? |
| How one CVE is fixed | How one CVE is fixed, as its sources state it, in one answer; every text is relayed as its source states it, untested by EchelonGraph: | How is CVE-2021-44228 fixed, as its sources state it? |
| CWE and its CVEs | One CWE (weakness class) and the CVEs classified under it: | Which CVEs are classified under CWE-79, CISA-KEV-listed first? |
| Vendor advisories for one CVE | The vendor-published advisories (Microsoft MSRC, Red Hat, Cisco, Palo Alto Networks, GitHub GHSA and the other feeds EchelonGraph polls) that name one CVE, newest first, at most 20, each with | Which vendor advisories name CVE-2024-3400? |
| Vendor advisory detail | One vendor advisory in full: description, severity, | Show one of those advisories in full: affected products, remediation and references. |
| Search vendor advisories | Search vendor advisories by text (title, description, vendor, advisory ID, products, CVE IDs), vendor, severity and whether they name a CVE. The search text is sent in a request header, never in the URL. | Search vendor advisories for FortiOS, critical severity only. |
The three vendor-advisory tools relay vendor_published_at (the vendor's date), our_first_seen_at
(when EchelonGraph first recorded the advisory) and withdrawn (the vendor rescinded it; the note
names each one, and the search leaves them out).
Each also relays every vendor's window in coverage (vendor_windows, or vendor_window for the
detail): the advisories held, the earliest and latest vendor_published_at among them,
held_since and history_backfill. held_since is the start of the window EchelonGraph has read the
vendor's advisories from: one published before it may not be held. For a vendor with no history read (history_backfill
not_supported) it can be years after the earliest advisory held: Cisco's poller first read the
advisories Cisco had changed in the last 90 days, Red Hat's and GitHub's the last 7, so an older
advisory the vendor revised later is held while the ones published beside it are not.
vendor_advisories_for_cve lists in vendors_not_fully_held each vendor with no advisory in the
answer of which EchelonGraph holds none, whose held_since is after 1 January of the CVE ID's year
or not known, or whose history is still being read: no advisory from such a vendor is not a finding
that it published none.
Every figure is as fresh as the last check that produced it. The CVE feed is polled from its
sources on a schedule. Each radar has its own schedule and refreshes only while it runs, and
exposure_radar's freshness gives each radar's last completed check (last_run_at) where the
API serves one.
What each tool relays, field by field, and what each number counts, is in the pages below, which
ship in the package's docs/ folder:
How cve_summary reads its counts:
summary.none counts CVEs not yet scored, not CVEs rated None, and summary.nvd_critical to
summary.nvd_none count by NVD's severity label (or a pre-NVD label standing in), as provenance.
How get_cve and search_cves read the EchelonGraph score:
score_assessed: false is not yet scored, never a score of 0.
What patch_available says,
and the evidence patch_evidence names, the CVE record's own fix statement among it
(cna_solution, description_fix): false means no fix evidence is on record, not that no fix
exists.
How cve_exposure counts:
a count of ip:port services, not machines, inferred from banner versions in a sample of Shodan
data, and for a CVE outside the radar's tracked set NOT ASSESSED: its 0 is not a measurement.
How exposure_radar counts:
every number of its five radars, each labelled by what it counts.
How check_affected decides:
read assessed before count; a registry match's fixed_in is the lowest version above it that
no affected interval of the record holds, or null with fixed_in_reason.
Ready-made workflows a client can show as slash commands. Each prompt names the tools to call, in
order, and tells the model to read every result's state, measured_at, method, coverage
and notes: not_assessed is never reported as clean, a count of 0 under assessed: false is
never "not affected", and each figure cites its measured_at. A prompt makes no API request.
Prompt | Arguments | What it asks the model to do |
|
|
|
|
| Work out the start date from |
|
|
|
|
| Pass the document to |
|
| Rank your own pods, CI job containers or images: list the workloads and decide their exposure with your own tools, make an SBOM of each image digest, and pass |
Two resources, which resources/list lists, and one resource template, which
resources/templates/list lists (a client reads cve://CVE-2024-3400, for example):
Resource | What it holds |
| What each envelope field and |
| What the API reports about its feeds when the resource is read: the NVD poller's |
| One CVE as |
Every tool answers in one of two shapes, so a model reading the result cannot mistake an outage for an all-clear:
Success — the first text block is the API's JSON verbatim (cut to fit 30,000 characters
when it is longer: see "Long answers" below); the second is a one-line
note saying the call succeeded, which base URL answered, and what it found; the third is
the structured result as JSON, less what the first two already say (below). When the
feed genuinely holds nothing for the query the note says so in words ("we looked and
found nothing … not a lookup failure"), because a measured zero is a measurement. The
exceptions to verbatim are cve_summary, which leaves out a poller field the answer sends
in a JSON type other than its outputSchema's (or a poller that is neither a JSON object nor
null) and names it in the note, and exposure_radar: each radar is cut to the fields
docs/exposure-radar.md
lists, and each kev_exposure.newest_kev row gains an exposure_state. Its shadow_ai counts
are regrouped as that page says, and its poller block carries only running and
last_run_at, or is dropped when it carries no real completion time. The block's other fields describe the server instance that
answered, not the radar. Its last_run_at is when the radar's leader last
completed a Certificate Transparency (crt.sh) cycle, and its running is true only when
that was within 30 minutes of the answer. When running is true, the note says the
radar's leader last completed a cycle at that time; when it is false, the note says no
cycle has completed since that time; when last_run_at is absent, the note says the
radar's freshness is unknown and the block is left out. An older API answered from
whichever server instance served the request, and a follower instance sent
running: false with the zero time 0001-01-01T00:00:00Z; that too is unknown freshness,
never presented as a stopped radar.
Failure — an MCP error result (isError: true) whenever the lookup did not complete:
the host could not be reached, it answered non-2xx, it took longer than the timeout, or
it answered 2xx with a body that is not a JSON object. The text names the tool, the
cause (status code or error kind), the path, and the base URL, and says it is not a
finding; the second text block is the structured result as JSON, less the message's
sentences (below). A failure is never rendered as a success with null fields.
Both shapes also carry a structured result, below, and repeat it in their last text block, less
what an earlier block already says, so a client that passes only content to the model still
sees how the answer was measured. The first text block (the API's JSON, or the failure) and the
note after it are where 1.x put them.
A model pays for every character it reads, and clients differ in which part of a result they hand it, so each part is held to the same budget, 30,000 characters, and each is cut on its own terms:
Claude Code hands the model structuredContent, not the text blocks, and sizes it against
MAX_MCP_OUTPUT_TOKENS (25,000 tokens by default): it warns past 10,000 tokens and, past the cap,
saves the result to a file and hands the model its path instead. Through 2.7.x
structuredContent.data was always the answer whole: get_cve for CVE-2021-44228 was 65,540
characters of structuredContent on production's answer of 2026-10-11, beside a first text block
of 23,759, and Claude Code saved it to a file. Since 3.0.0 the structured result is cut to fit
(below). MAX_MCP_OUTPUT_TOKENS, set in the environment Claude Code starts in, raises its cap.
A client that passes only the text blocks (content) reads the first text block, cut to fit
as described after the next item.
A program that reads structuredContent.data and needs the answer whole, however long,
passes full: true: every tool takes it. A client that sizes structured results, as Claude Code
does, can refuse such an answer past its cap.
The structured result. When the whole of it (the envelope, its notes and data, as compact JSON)
would pass 30,000 characters and the call does not say full: true, data is cut, in an order each
tool states. Where one row is large, every row is first thinned, all rows kept: check_sbom and
scan_manifest keep each row's index, purl, verdict, not_assessed_reason, cve_ids,
matched_package and matched_via, and per match cve_id, kev_listed, ransomware, epss_score,
effective_score, score_assessed, fixed_in and fixed_in_reason, every field a prompt reads from
a match, then each row's matches to at most the same
number, its first, a row so cut carrying matches_truncated (its total, and the KEV-listed and
ransomware CVE IDs and fixed_in versions of all its matches), then each match to cve_id,
kev_listed, ransomware, fixed_in and effective_score, then each row to index, purl,
verdict, not_assessed_reason and cve_ids (rows leave at the compact level; the rows kept
take back detail in order); check_affected keeps each
match's scores, flags, criteria and fixed_in, then fewer; cve_remediation drops each item's
product_ids, then its text, keeping every advisory's state, kinds, URLs and fixed builds
(get_vendor_advisory returns each text), thins fixed_branches (then caps each
package's ranges) and patches, then cuts fix_references, then patches, then
fixed_branches, advisories last, the note naming vendor_advisories_for_cve, which
lists them all; search_cves keeps each row's
description and scores, then the scores alone; the vendor-advisory
tools drop affected_products, then summary. Only then do rows leave: check_sbom and
scan_manifest cut not_checked, then not_sent_purls, whole or none (the note says how to
get it), then drop the not_affected rows,
then the not_assessed ones (data.summary counts every verdict), and only then affected rows,
from the end; check_affected drops its excluded and undetermined samples first and its
cve_ids, which names every match, last; the other row tools drop rows from the end, and those that
page say the offset or limit to read them from (search_cves and search_vendor_advisories
also the page size whose rows fit data whole, counted on the rows whole). get_cve cuts
cpe_match and references, each to at most the same number of entries, then
cpe_configurations; exposure_radar cuts its daily and weekly series, each keeping its newest
entries, then every ranking, then kev_exposure.newest_kev; then any other list at the top of
data is cut the same way. The room left once a list fits goes back to the lists emptied before
it, as many of their entries as fit (their first, a series its newest). No string is shortened and no value changes (a thinned row
keeps some of its fields, each optional in the outputSchema, so data still validates;
a cut adds only matches_truncated and fixed_branches_truncated). The result
then says data_truncated: true (false on every other success), truncated gives each list cut,
by its path in data, with its total, the number returned and, where its entries are thinned,
thinned: true, and the note ends with sentences starting DATA CUT that say what was cut, how to
read the rest and that the same call with full: true returns data whole.
The first text block. Through 2.6.2 it was the API's JSON whatever its size: on production's
answers of 2026-10-04 a default search_cves page for "openssl" was 133,300 characters of text,
get_cve for CVE-2021-44228 80,897, check_affected for the Linux kernel at 5.10.0 364,408,
kev_recent at its largest page 105,925 and search_vendor_advisories at its largest page
103,147. So when the API's JSON is longer than 30,000 characters, the first text block holds it
cut to fit, cut from the answer whole (not from the cut data), the same way with or without
full: true. First the same JSON is laid out with
each row on a line of its own, which drops no character of the answer but the indentation. If
that is still too long, a tool that returns a list of rows cuts each row to the fields it names,
most kept first (search_cves keeps cve_id, severity, cvss_v3_score, echelongraph_score,
score_assessed, epss_score, kev_listed and the first 200 characters of the description,
among others), with every long string ending in "…". A list beside the rows is cut before any
row field the first level keeps, and before any row leaves the text: check_affected's
excluded and undetermined samples keep their first 10 entries, each its cve_id and
reason, and its cve_ids (each match's cve_id, in order) its first 10, so that every CPE
match stays in the text, each with at least cve_id, kev_listed, ransomware, epss_score,
effective_score and score_assessed (and fixed_in on a registry match; a registry list near
the cap of 200 can leave its last matches out, 15 of 200 beside 50 undetermined, and the note
says how many), and check_sbom's not_sent_purls keeps its first 10, the note saying from
which position of the input the purls not sent run, and in what order the input's purls are
counted, so that a second call can send them without reading the list. scan_manifest cuts its
rows as check_sbom does, and its not_checked list keeps its first 20 entries. When even the leanest cut is too long, rows are left out of the text
(check_sbom and scan_manifest leave out the not_affected rows first, then the not_assessed ones), and the
note says how to read them: the offset to call next, or a smaller limit. Any other answer
keeps the first entries of each of its lists (get_cve's cpe_match and references). The note
then ends with one sentence starting TEXT CUT that says what the first text block leaves out
and which tool returns a row (get_cve, get_vendor_advisory, check_affected, and
cve_intel a CVE's fixed versions): whole in that tool's structuredContent.data with
full: true, since its own first text block is cut past 30,000 characters too. An answer that
fits is sent as before, pretty-printed and whole. The same answer is always cut the same way. The
cve://{cve_id} resource reads get_cve's record whole and cuts its data as get_cve's first
text block is cut, and says so: data_truncated: true, truncated naming each list it cut, and a
note starting DATA CUT. The prompts ask only for what the
text keeps: kev_weekly_brief reads kev_recent 50 rows a page, which the text holds whole;
triage_cve reads CISA's due date from get_cve; and sbom_review reads each match's fixed_in,
and cve_intel's fixed_branches where the text keeps no match for a component.
Since 2.0.0 every result, success or failure, carries structuredContent, and every tool
declares its shape as an outputSchema in tools/list, with a title and the annotations
readOnlyHint: true, destructiveHint: false, idempotentHint: true and
openWorldHint: true (hints, which a client treats as untrusted).
Field | What it holds |
|
|
| When the underlying observation was made, as the API states it. |
| How the numbers were produced. |
| What the answer covers, where the tool can say: |
| The producing radar's last completed check ( |
| The caveats, one sentence each: what the envelope itself needs saying, then the note from the text block. |
| On a success only: |
| When |
| On a success only: the API's JSON, whole with |
| On a failure only: |
The last text block of every result is this structured result serialized as JSON, less what
an earlier text block already says verbatim, since a client may pass only content to the
model. It carries the same state, measured_at, coverage and freshness (on a success
data_truncated and truncated, and on a failure error), key for key. It leaves out data, which is a success's first text block, and the
note's sentences, which are the text block just before it (on a failure, the message) and
with which notes ends: its notes holds only the sentences the envelope adds about itself,
and is left out when there are none. It leaves out method too where that note quotes it verbatim, as
cve_exposure's does ("Method: …"). So the text blocks together carry the structured result, but
for what a TEXT CUT leaves out of the answer (see "Long answers"), and cannot disagree with it;
beside a DATA CUT, the first text block is cut from the answer whole, not from the cut data. Before 2.2.0 this block repeated the whole note, so every note was sent twice.
| What it means |
| A measurement of what was asked. An exposure count is |
| The answer holds no dated measurement of what was asked, so no count in it is presented as one: the radar does not look for this CVE, the answer does not say whether it does, or the answer does not say when what it counts was observed. It can still relay a count, as what the source holds on record, undated: |
| The lookup did not complete. Not a finding. |
| The input was refused, by this server or by the API, so nothing was looked up. Not a finding. |
What each tool's state, measured_at, coverage and freshness hold, tool by tool, is in
docs/structured-results.md.
Every field comes from what the API sends; where the API does not say, the field is null and a
note says so.
A success whose fields do not fit the tool's outputSchema (a field of a type the schema does
not allow) is returned as a failure with error.kind unexpected_shape, never relayed, with one
exception: a cve_summary poller field of another JSON type is left out of data and named in
the note, and the rest of the answer is relayed, summary with it. A
field the API adds later is still relayed by every tool that relays the API's JSON as data, and
exposure_radar and cve_intel, which relay a selection, leave it out and name what they leave out.
The server answers both eras of the Model Context Protocol on stdio:
2026-07-28: a client that opens with server/discover receives a DiscoverResult listing
2026-07-28, the tools, prompts and resources capabilities and the server instructions, and then sends each request
with the per-request _meta envelope.
2025 and earlier: a client that opens with initialize, as every 1.x SDK client does,
negotiates 2025-11-25, 2025-06-18, 2025-03-26 or 2024-11-05; a version the server does
not know is answered with 2025-11-25.
The first message of a connection picks its era. The DiscoverResult lists only 2026-07-28,
as the SDK builds it: the 2025-era versions are reached through initialize. Both handshakes
carry the package's name and version (serverInfo), and every API request carries them in its
User-Agent, echelongraph-mcp/<version>.
Both handshakes also carry the server instructions: the data is public; that Shodan data is
Shodan's; what state, measured_at and freshness mean, and that each result carries them in
its structured result and again in its text; and that exposure numbers are aggregate counts of
ip:port services, not an internet-wide census.
The instructions and every tool description are at most 2,048 characters, the length at which
Claude Code cuts each of them before the model reads it (its CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH,
default 2048), so no client that cuts there loses a sentence. A description says what its tool
returns and the rules that keep a zero, a false or a failure from reading as a finding; what each
field counts, in full, is in the tool's outputSchema, and the result's note says it again for the
numbers it relays.
The npm package (stdio). The server runs on your machine and sends HTTPS requests to one
host, ECHELONGRAPH_API_BASE (default https://app.echelongraph.io), one per API call a tool
makes (exposure_radar makes five; every other tool makes one). No telemetry: it sends nothing
else, to EchelonGraph or anyone. Every request carries the User-Agent
echelongraph-mcp/<version> (+https://echelongraph.io/pulse/mcp), with the
ECHELONGRAPH_MCP_UA token ahead of it when you set one, so the API's access log can count use
per version. Like any HTTPS request, it also reaches the API from your network address.
Where each tool's input travels:
Input | Where it is sent |
A CVE ID ( | The URL path. |
| The |
| The |
| The |
| The |
| The |
| The purls, in POST bodies of at most 200 each. A CycloneDX or SPDX document is read on your machine and only the purls in it are sent; the document is not. (Over the hosted endpoint the document goes to EchelonGraph's server instead: see below.) |
| The purls read from the files, in POST bodies of at most 200 each; the filenames, the files' text and the entries not checked are not sent on to the API. Run from npm, the server that reads them is on your machine; over the hosted endpoint it is EchelonGraph's, and the files are the request body (see below). |
| No input. |
The API marks its answers to header-carried lookups no-store, so no shared cache keeps them,
and request logs and trace spans that record URLs do not hold what was looked up there.
The hosted endpoint. A request to https://mcp.echelongraph.io/mcp reaches EchelonGraph's
server first, which then calls the same API as above. Per request it logs the HTTP method and
path, the status, the duration, the body size, the JSON-RPC method and (for tools/call) the
tool name, the protocol version, whether an Origin header was sent, and the family of your
client's User-Agent. It never logs tool arguments or a query string. A check_sbom document (or
an sbom_review prompt's) is a tool argument like any other here: it is in the request body, so
the whole document reaches EchelonGraph's server, which reads the purls from it in memory, sends
only those to the API, and neither logs nor keeps the document. To keep the document on your
machine, run the npm package, or pass check_sbom the purls. scan_manifest's files are the
same: their whole text is in the request body, which EchelonGraph's server reads into purls in
memory, sending only those to the API, and neither logs nor keeps the files. To keep lockfiles on
your machine, run the npm package. When a client passes the
per-client limit it logs that client's address key. It passes your client's public address to
the API, in a header the API trusts only with a token it checks, so the API's rate limit counts
you and not the hosted service. The API's access line then records each of those calls under
your address (an IPv6 address by its /64) with its URL path: for a CVE, CWE or advisory lookup,
the ID you asked about. It does not record the query string or the header-carried terms above
(for search_cves, whether a term was given and its length, not the term), and of check_sbom's
and scan_manifest's purls it records how many, not which.
EchelonGraph's privacy policy: https://echelongraph.io/privacy.
No API key, so the API limits each caller, one IPv4 address or one IPv6 /64 network, counting
all its requests together in a 60-second window: 12,000 a minute to /api/v1/public/cves and the
paths under it, 6,000 to the CWE, vendor-advisory, KEV and shadow-AI paths, and 600 to any other
public path; check_sbom's and scan_manifest's batch route is charged per component, 1,200
components a minute. Over a limit the tool returns a failure (state failed, error.status
429), never empty data; check_sbom and scan_manifest wait out a 429's Retry-After within
50 seconds a call, and answer what they have, the rest counted in coverage.not_sent. The hosted
endpoint adds 120 MCP requests a minute per client address, and refuses a request body over 64 KiB
(6 MiB for a check_sbom or scan_manifest call, or an sbom_review prompt). Every limit, path
by path, with what a tool answers past each:
docs/rate-limits.md.
The API's own documentation of these limits: https://echelongraph.io/pulse/api.
The npm package (stdio):
Env var | Default | Purpose |
|
| Override the API base (self-host / proxy). A credential in the URL is masked wherever a result quotes the base. |
|
| Per-request timeout. A slower answer is reported as a failed lookup, not as empty data. |
| unset | One product token (for example |
The HTTP entrypoint, dist/http.js (npm run start:http), serves the same tools over
Streamable HTTP on POST /mcp, with a liveness check on GET /health. In a container with
little memory, start it with V8's heap capped below the container's limit, as EchelonGraph's
hosted deployment does in 256 MiB (node --max-old-space-size=104 --max-semi-space-size=16 dist/http.js): Node
otherwise sizes its heap from the memory the system reports, which in a container can be the
host's, and the container is then killed before V8 collects.
It reads the three variables above and:
Env var | Default | Purpose |
|
| The port it listens on. |
|
| MCP requests a minute per client address, per instance. |
|
| The largest request body it reads, except for an SBOM (below). |
|
| The largest body of a |
|
| How many bodies over |
|
| How many requests it serves at once, not counting |
|
| How long a request waits to be served before it is answered 503 with |
| unset |
|
| unset | EchelonGraph's hosted deployment only: the token with which it names each client to the API. Leave them unset when you run it yourself; the API then counts every request as coming from your server. |
npm install
npm run build # tsc → dist/
npm test # build, then the behavioural suite over both protocol eras, against a stub API (no network needed)
npm run smoke # spawn the server + call cve_exposure against the production APInpm run smoke calls the production API with this package's User-Agent. Run from our own
workspace, whose egress address the API recognises as ours, its requests are counted as our own
traffic and appear in no adoption count. Run from any other machine, they are counted as external
MCP adoption unless you set ECHELONGRAPH_MCP_UA (for example
ECHELONGRAPH_MCP_UA=my-smoke/1.0 npm run smoke), which files them under that token's family
instead. npm test never leaves the machine.
npm test runs the suite once over a 2026-07-28 server/discover and once over a 2025-06-18
initialize, plus the era tests. To run it against an installed package rather than dist/,
set ECHELONGRAPH_MCP_BIN to that package's echelongraph-mcp bin: the tests then run the bin
directly, as npx does, and read that package's own files.
Semantic versioning: a major version changes protocol behaviour or drops a Node.js version, a
minor version adds tools or fields, a patch fixes wording or behaviour without changing a tool's
shape. Every release is published to npm with a provenance attestation by the public repo's
release workflow, from the commit tagged v<version>. Changes per version:
CHANGELOG.md.
Since 3.0.2 a success's outputSchema admits top-level fields it does not name, so a field added
in a minor release does not fail a client still holding the tool list it read before. A client
that shows "does not match the tool's output schema" after an upgrade is validating against the
schema of the version it listed: reconnect it (Claude Code: /mcp, then reconnect echelongraph) or restart it. Each tool's data
schema stays closed: a field added inside it needs that reconnect too.
Report a vulnerability privately to support@echelongraph.io, not in a public issue. The policy, the supported versions and the scope are in SECURITY.md.
The code is MIT-licensed.
The CVE Pulse compilation (how EchelonGraph combines its CVE sources, and the EchelonGraph score) is © EchelonGraph, served under the CVE Pulse free-access terms; the source records it compiles stay under their publishers' terms.
Exposure counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). EchelonGraph claims no ownership of it or copyright in it.
Whether a product or package at a given version is affected by known CVEs, from the same matcher as echelongraph.io/am-i-affected. The CPE path takes product (an NVD CPE product token, such as nginx) and version, and returns the CVEs whose NVD CPE match criteria include that product at that version; each match names the vendor NVD asserts (cpe_vendor) and whether it was verified (vendor_unknown). The registry path takes ecosystem (npm, PyPI, Maven and other OSV ecosystem names), package and version, and decides each OSV advisory EchelonGraph holds for that package as affected, not affected or undetermined. count depends on assessed: assessed false means the lookup did not evaluate this component, not_assessed_reason says why, and a count of 0 there is not a finding of not affected. An advisory undecidable at this version is reported as undetermined (undetermined_count, and up to 50 of them in undetermined), never as safe. Each match carries cve_id, kev_listed, ransomware, epss_score, effective_score, effective_severity and score_assessed (false: not yet scored, so echelongraph_score is withheld). A registry match also carries interval, the advisory interval holding it, and fixed_in, the lowest unaffected version above it, or null with fixed_in_reason; a CPE match carries no fixed_in. All four inputs travel in request headers, never in the URL. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, the excluded and undetermined samples keep their first 10 entries, each its cve_id and reason, cve_ids keeps its first 10, and each match keeps cve_id, kev_listed, ransomware, epss_score, effective_score, score_assessed and fixed_in at least. Every CPE match stays in the text; near the cap, a registry list's last matches can leave it, and the note says how many.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| package | No | Registry path: the package name in that ecosystem, such as lodash. | |
| product | No | CPE path: the NVD CPE product token, such as openssl, nginx or linux_kernel. Leave out for the registry path. | |
| version | Yes | The version to check, such as 3.0.0. | |
| ecosystem | No | Registry path: the package's ecosystem, such as npm, PyPI or Maven. Give with package, not with product. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, openWorld, non-destructive), and the description adds substantial behavioral context beyond them: truncation at 30,000 characters with the exact fields each list keeps, the meaning of assessed=false and count=0, undetermined advisories never being reported as safe, and that all inputs travel in request headers. This is well past the bar set by the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded, but the body is a dense run-on that packs truncation rules, cut-field lists and score semantics into a single paragraph, and repeats truncation detail already present in the 'full' schema description. Much of it earns its place given the tool's complexity, but it is not easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with an output schema, five parameters, no nested objects and high complexity, the description is complete: it covers both lookup paths, truncation behavior, undetermined vs not-affected outcomes, header transport, and score gating. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds cross-parameter semantics the schema does not: product selects the CPE path and must not be combined with ecosystem/package, and it explains the output fields (fixed_in, fixed_in_reason, interval, undetermined_count) that parameters drive. Slight tension with 'all four inputs' when the schema lists five parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check whether affected) and resource (a product or package at a given version), and goes further by naming the two distinct modes — the CPE path (product+version) and the registry path (ecosystem+package+version). An agent can tell what this does and how it maps to the NVD/OSV data model without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear mode-selection guidance: use the CPE path when you have a product token, the registry path when you have an ecosystem+package. However, it never contrasts itself against closely related siblings such as check_sbom or scan_manifest, so an agent gets no explicit routing rule between this tool and those.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check a dependency list against EchelonGraph's advisory corpus, one verdict per component. For container images and Kubernetes pods, the input is an SBOM of each image, or its purls. Pass purls (package URLs, up to 2,000 distinct) or sbom (a CycloneDX or SPDX JSON document, up to 5,000,000 characters). This server reads the purls from the document; only they are sent to the API, in POST bodies of at most 200, never in a URL; the document itself is not sent on. Run from npm, this server is on your machine; over the hosted endpoint (mcp.echelongraph.io) it is EchelonGraph's, and the document is the request body, accepted up to 6 MiB. data.results holds one row per component sent, in order, with verdict (affected, not_affected, undetermined or not_assessed), not_assessed_reason, cve_ids, matched_package and matched_via (a deb or apk purl's upstream qualifier matches as its source package); each match carries fixed_in (the next unaffected version) or null with fixed_in_reason. data.summary counts the verdicts. not_affected is the only clean verdict: not_assessed (no verdict, as for a deb, apk or rpm purl without a distro qualifier naming its release, which EchelonGraph does not guess) and undetermined are not, and the note counts both. The API allows 1,200 components a minute per caller; on a 429 the tool waits out Retry-After, up to 50 seconds a call, then answers what it has, the rest in data.not_sent_purls, unchecked and not clean. Input with more than 2,000 distinct purls is refused, not truncated. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps index, purl, verdict, not_assessed_reason and cve_ids at least, each match its fixed_in while kept; not_affected rows leave the text first, then not_assessed ones; not_sent_purls keeps its first 10.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| sbom | No | a CycloneDX JSON or SPDX JSON document, as JSON text or as an object; its purls are read by this MCP server and only they are sent to the API; over the hosted endpoint (mcp.echelongraph.io) the document is the request body | |
| purls | No | package URLs to check, e.g. pkg:npm/lodash@4.17.20 or pkg:deb/debian/openssl@3.0.11-1~deb12u1?distro=debian-12 (up to 2,000 distinct, sent in batches of 200) |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, openWorld, idempotent, and non-destructive behavior, but the description adds extensive operational context: batching, rate limits, Retry-After handling, truncation rules, input limits, and the exact semantics of clean versus unclean verdicts. This is well beyond what the annotations provide and gives the agent the information needed to anticipate behavior under load or size constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose and then proceeds through inputs and edge-case behavior in a dense but generally purposeful sequence. It is very long for a tool description, and a bulleted structure would improve scannability, but most sentences carry distinct constraints rather than repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description covers the important behavioral edges: input limits, delivery differences between local and hosted modes, verdict taxonomy, rate-limit behavior, and truncation behavior. With an output schema present, it does not need to explain return values, yet it still clarifies the most important result semantics without being incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, but the description adds substantial meaning beyond the schema: purls are capped at 2,000 distinct and sent in batches of 200; sbom accepts CycloneDX or SPDX JSON as text or object; and full controls structured-result truncation. These operational details are not fully conveyed by the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb (Check) and resource (SBOM/dependency list) against an advisory corpus, with the output shape ('one verdict per component') made explicit. It is easy to distinguish from CVE- and advisory-centric siblings by subject, but it never names an alternative or states how it differs from scan_manifest, so it falls short of explicit sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it is for container images and Kubernetes pods, and accepts either an SBOM document or purls. It does not, however, compare itself to alternatives such as scan_manifest or state when not to use it, so it lacks explicit routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Internet-exposure footprint for one CVE from EchelonGraph's KEV-exposure radar: how many internet-facing services (distinct ip:port, returned as exposed_hosts; a machine answering on two ports counts twice) the radar has on record running a version its CVE matcher maps to this CVE, with a country/product breakdown and a ransomware flag. Aggregate and host-redacted; free and keyless. Method: exposure counts are derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Every 12 h, when Shodan query credits allow, the radar runs one Shodan query per tracked product, reads up to 100 ip:port services per query, and keeps a service when its banner version matches a CISA-KEV or high-EPSS CVE; a service whose row has not been written or refreshed for 21 days is dropped. The radar only looks for its tracked set of CVEs: for a CVE outside that set the note says NOT ASSESSED (exposure_state not_assessed), and its 0 is not a measurement. last_seen is when EchelonGraph last wrote or refreshed a service's row, not when the service was observed: a port still listed by Shodan InternetDB refreshes it without re-reading the banner, so a patched service can stay counted while its port stays open. A count is therefore a banner-version inference over a sample, not an exploit test and not an internet-wide census. Its structured result's state is not_assessed with measured_at null, since the answer dates no observation; the count is still relayed, labelled, as what the radar holds on record. exposure_state says what the count is: exposed, measured_zero, not_assessed or tracking_unknown; coverage.in_scope is the API's tracked verdict; freshness is null; data is the API's JSON. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2023-44487 |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, idempotent, non-destructive), but the description goes far beyond them: Shodan-derived sampling methodology, 12h refresh / 21-day drop cadence, 100-service-per-query cap, the meaning of last_seen (write time, not observation time), and the caveat that counts are banner-version inference, not exploit tests or a census. This is exactly the extra behavioral context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first clause and most sentences carry genuine information, but the body is a very dense ~2k-character wall mixing methodology, caveats, and truncation semantics that would be better split or trimmed for an agent context budget. It is informative but overloaded rather than economically sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that has an output schema, the description still resolves every ambiguity an agent would hit: state values, coverage, freshness null, the not_assessed paradox, and truncation. Nothing needed to interpret or call the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds operational meaning beyond the schema: it explains what the TEXT CUT / DATA CUT labels mean in the response and how full:true interacts with them, plus the MAX_MCP_OUTPUT_TOKENS sizing concern. Marginal but real added value over the schema's own field docs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource+scope: 'internet-exposure footprint for one CVE' returning a count of internet-facing services (distinct ip:port). It also implicitly differentiates itself from the aggregate sibling exposure_radar by scoping to a single CVE and flagging NOT ASSESSED for CVEs outside the tracked set.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context for when the answer is meaningful – only for the radar's tracked CVE set, otherwise exposure_state is not_assessed and the 0 is explicitly 'not a measurement'. However, it never names a sibling alternative (e.g. exposure_radar) or states an explicit when-not-to-use condition, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Weakness, exploit code, detection templates, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if none), eg_first_seen_at (when EchelonGraph recorded it) and verified_status; at most 10, verified first) with exploits_total, exploits_capped, exploits_by_kind and exploits_by_status, affected_packages (ecosystem, package_name, version_range, fixed_version, fixed_branches), fixed_versions (each fixed version with the vulnerable_range it fixes) and timeline (newest enrichment-history rows, with timeline_total). fixed_branches lists each affected range on record (from introduced ("0" is the first version) to below fixed, or through last_affected, with advisory_id (its OSV record) and source); in the ecosystem's version order, an affected version's fix is the first fixed above it that no range of its row holds (none past a range with no fixed). fixed_version is one range's fix, kept for compatibility, not the fix for every affected range. fixed_branches [] is not a finding that no fix exists. verified_status is the source's label, not a guarantee the exploit works on a given system. An empty exploits list is not evidence that no public exploit exists: it covers only the sources EchelonGraph ingests, and which are polled depends on the deployment. A section the API could not read is named in coverage.sections_failed and left out of data, never relayed as an empty list. Its structured result carries notes, with data, which the first text block holds whole up to 30,000 characters; its coverage names the sections relayed, failed and left out. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2021-44228 |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare a safe idempotent read, and the description goes well beyond them: exploits capped at 10 with verified first, exploits_total/capped breakdowns, that an empty exploits list is not proof of absence, that unreadable sections appear in coverage.sections_failed rather than as empty lists, and the 30,000-character TEXT CUT/DATA CUT truncation contract. These are exactly the operational caveats an agent needs and cannot get from the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The content is front-loaded with a contents sentence, but it then collapses into very long, densely nested run-on sentences mixing field semantics, truncation rules, and caveats. Much of the information is necessary, yet the wall-of-text formatting makes it hard to parse and would benefit from structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't explain return values, yet it adds the important coverage-failure and truncation contracts that the schema alone would not convey. It is thorough about caps and failure modes, leaving only sibling routing unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both cve_id and full thoroughly. The description restates the full-flag truncation behavior in prose, adding slight framing about client output caps, but largely duplicates what the schema provides; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (one CVE) and enumerates the exact payload: cwes, exploits, affected_packages, fixed_versions and timeline from EchelonGraph per-CVE enrichment. An agent can tell it returns enrichment data rather than a summary, but the description never explicitly differentiates it from close siblings like get_cve, cve_summary, or cve_remediation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to prefer cve_intel over get_cve, cve_summary, cve_remediation, or check_affected, despite those siblings clearly overlapping. The reader must infer the routing decision purely from the enumerated return sections.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
How one CVE is fixed, as its sources state it, in one answer. Every text is relayed as stated by its source; EchelonGraph has not tested it. An empty list or a remediation_state of none_in_source or not_parsed is not a finding that no fix exists. Returns fix_status (the API's fix-status rule, as CVE Pulse shows it: state and basis), cisa (for a KEV-listed CVE CISA's required_action, due_date, short_description and notes_urls, verbatim; CISA's required_action is directed at US federal civilian agencies (under BOD 26-04, which replaced BOD 22-01 on 10 June 2026) and is not EchelonGraph's advice.), fixed_branches (each affected package with fixed_branches: every affected range, introduced and fixed or last_affected, and fixed_version, one range's fix), vendor_remediations (each vendor advisory naming the CVE, newest first, at most 20, with remediation_state, remediation_kinds and items, each with kind, source_category, text and url), fix_references (references NVD or the CNA tagged Patch or Mitigation), patches, coverage and failed_sections. kind is the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. remediation_state is parsed, none_in_source (none listed for this CVE), not_parsed (that vendor's remediation is not read) or withdrawn. ecosystem, package and version (all three or none, sent in request headers, never in the URL) add installed, the verdict at that version, and fixed_in, the lowest unaffected version above it, or null with fixed_in_reason. A section the API could not read is named in failed_sections, not relayed as empty. A REJECTED CVE answers not_assessed. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, vendor texts are shortened first; kinds, states and URLs are kept.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2021-44228 | |
| package | No | Installed version, with ecosystem and version: the package name in that ecosystem, such as org.apache.logging.log4j:log4j-core. Sent in a request header. | |
| version | No | Installed version, with ecosystem and package: the version installed, such as 2.14.1. Sent in a request header. | |
| ecosystem | No | Installed version, with package and version: the package's ecosystem, such as npm, PyPI or Maven. Sent in a request header. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only, non-destructive, idempotent nature. Description adds important behavior: data relayed verbatim without testing, empty results not meaning no fix, failed sections named, truncation behavior explained. Good beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very dense, long sentences with many parenthetical details. Not front-loaded; key purpose is buried. Could be much clearer with structured sections.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values needn't be explained, but description explains many. Covers edge cases like REJECTED CVE, truncation, failed sections. Somewhat verbose but complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description mentions how ecosystem/package/version add 'installed' and 'fixed_in', and explains 'full' parameter's effect on truncation, adding some meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: relays how one CVE is fixed per its sources. Distinguishes from siblings like get_cve or cve_intel by focusing on remediation, though doesn't explicitly name the alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance, no mention of alternatives like check_affected or vendor_advisories_for_cve. Implied that this is for remediation info, but no routing help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Summary of EchelonGraph's CVE Pulse feed: summary.total active CVEs, their counts by severity band (summary.critical, summary.high, summary.medium, summary.low), the count with no band (summary.none), and summary.last_updated, the newest modification time among those records. summary.none is not a severity rating of None: it counts the active CVEs with no severity band from any source, that is, CVEs not yet scored, and the answer may carry the same count again as summary.unscored. Whenever summary.none is above zero the note says so, and names those CVEs not yet scored, not CVEs rated None. summary.nvd_critical, summary.nvd_high, summary.nvd_medium, summary.nvd_low and summary.nvd_none count the same active CVEs as summary.total by NVD's CVSS severity label: provenance, never EchelonGraph's severity band. summary.nvd_none is neither a count of CVEs rated None nor the count of CVEs with no severity, which is summary.none. summary.rejected counts the CVE records rejected (withdrawn) by their numbering authority, which summary.total and the other counts above leave out: they are withdrawn records, none of them a vulnerability. poller holds the in-memory counters of the NVD poller of the one API instance that answered, counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. The feed is polled from its sources on a schedule; this is the state as of that update. Its structured result's state is measured, with freshness null (the feed serves no poll-completion time) and data equal to the API's JSON less each poller field (or the whole poller) the note names as left out. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive/open-world, and the description adds a great deal beyond them: semantics of the easily conflated summary.none vs nvd_none vs unscored, the fact that rejected records are excluded from total, the instance-scoped, restart-zeroed nature of poller, the note's behavior around unnamed/omitted fields, the structured-result shape (state=measured, freshness=null, data equals JSON minus dropped poller fields), the 30,000-character cut with TEXT CUT/DATA CUT markers, and the full:true override. This is the kind of context annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loading is good (purpose first, parameter behavior last), but the disambiguation prose around none/unscored/nvd_none is repetitive and runs long, and the poller paragraph is a tangent in the main description. Dense but not disorganized; several sentences could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one optional parameter, no nested objects, an output schema present, and a fairly involved return payload with truncation and poller-scoping quirks, the description covers everything an agent needs: field semantics, exclusion rules, note conventions, truncation and the full escape hatch. Nothing material is left ambiguous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter full is already documented in the schema; the description nonetheless explains the consequence of omitting it (DATA CUT behavior, data_truncated/truncated fields) and why whole data is for a program, adding operational meaning beyond the schema text. Slightly redundant with the schema, so not a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific framing: 'Summary of EchelonGraph's CVE Pulse feed,' then enumerates exactly which counters the response carries (total, severity bands, none, last_updated, the nvd_* provenance counts, rejected, poller). It is clearly a single aggregate-summary tool, distinguishable from per-CVE siblings like get_cve or search_cves. It never explicitly contrasts against those siblings, which keeps it short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is clear by implication: this is the place to get aggregate feed counts rather than per-CVE records, and the 'Whenever summary.none is above zero the note says so' and 'Whenever the answer carries poller the note says so' lines tell the agent what conditions produce which content. There is no explicit 'use this instead of X' routing, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
How one CVE's EPSS score (FIRST's exploit-prediction probability, 0 to 1, with its percentile) has changed, as EchelonGraph recorded it: points, oldest first, each with at, epss_score, epss_percentile and score_date (FIRST's score date, null where the record does not hold it); current, the record's value now (epss_score, epss_percentile, epss_updated_at); series_kind, always change_only; series_starts_at, when EchelonGraph began recording EPSS changes for any CVE; complete_since, from when the record holds every change; coverage, which FIRST score dates the record holds; history_rows, points_truncated and latest_point_matches_current. Pass a CVE ID like CVE-2023-44487. The series is change-only: a point is a recorded change, and a day without a point is not a recorded value. A daily series interpolated from it holds values EchelonGraph never recorded, so the series is never a daily series. Before series_starts_at nothing was recorded, so a missing point there means not recorded, not unchanged, and the value in force before a CVE's first point is not in the series. Between series_starts_at and complete_since the record misses changes, so a missing point there does not mean unchanged either; only from complete_since on is every change a point. coverage.days_missing and coverage.days_partial name the FIRST score dates the record does not hold, or holds for some CVEs only. latest_point_matches_current false means a change is missing from the series. Its structured result's measured_at is current.epss_updated_at (when EchelonGraph last wrote a changed value, not FIRST's score date), its coverage says which part of the record is complete and which score dates it holds, and its freshness is null. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2023-44487 |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the read-only/idempotent annotations, it discloses substantial behavior: the 30,000-character JSON cut with TEXT CUT / DATA CUT markers, the meaning of missing points before series_starts_at and before complete_since, latest_point_matches_current=false as a signal of a missed change, and measured_at/freshness semantics. This is well past what the annotations carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every clause is relevant, but the description is a very long semicolon-chained run-on and the first sentence crams the entire output shape before the practical guidance. It is thorough rather than front-loaded and would benefit from being broken into scannable units.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with an output schema and full annotation coverage, the description supplies everything an agent needs to call it and read the result correctly, including truncation, coverage, and completeness caveats.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (cve_id and full) are already documented in the schema, including full's truncation behavior. The description's 'Pass a CVE ID like CVE-2023-44487' adds nothing the schema lacks, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening states a specific verb (how the EPSS score 'has changed') and resource (one CVE's EPSS score as recorded by EchelonGraph), and the change-only framing distinguishes it from a point-in-time tool like get_cve or cve_intel. An agent can tell what this returns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context ('Pass a CVE ID like CVE-2023-44487') and an implicit when-not warning ('the series is never a daily series', don't interpolate), which steers interpretation. It never names a sibling tool or states an explicit alternative for point-in-time EPSS, so routing guidance is contextual rather than comparative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Aggregate totals from EchelonGraph's internet-exposure radars: kev_exposure, internet-facing services running actively-exploited (CISA-KEV) CVEs, plus the ransomware-linked subset, derived from Shodan data; exposed_databases, unauthenticated data stores and observability UIs, found through Shodan (LeakIX when Shodan query credits run low) and then confirmed by EchelonGraph's own identified check (not a pure read: on Redis it names its client, and on ClickHouse its query is recorded in the server's query log); leaked_credentials, sampled from public GitHub push events; and shadow_ai, services found through Certificate Transparency logs and Shodan and then checked by EchelonGraph's identified probes. Shodan data is owned by Shodan, which holds its copyright (© Shodan). It also gives MCP-server counts: hostnames named like an MCP server in EchelonGraph's own Certificate Transparency feed (no Shodan data), each counted once by its latest verdict from EchelonGraph's identified MCP probe, which never sends tools/call. Service counts are distinct ip:port services, not machines. The result's note, and the outputSchema's description of each radar, label every number by what it counts. Of the shadow_ai numbers, only confirmed_exposed counts exposed services. A kev_exposure.newest_kev CVE whose exposure_state is not_assessed has no measurement in the answer: its 0 is not one. Its structured result's state is not_assessed with measured_at null, since no radar dates what it counts; each count is still relayed as what that radar holds on record. freshness gives each radar's last_run_at where the API serves one; coverage names the radars that answered. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, but the description says the exposed_databases confirmation is "not a pure read" and describes side effects: on Redis it "names its client," and on ClickHouse "its query is recorded in the server's query log." This directly contradicts the read-only annotation, so the rubric requires a score of 1 despite the otherwise rich behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is an enormous, dense paragraph with nested parentheticals and semicolon-separated clauses. While the purpose is front-loaded, the lack of structure and extreme length make it difficult for an agent to scan quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex aggregation tool with an output schema already defining return values, the description supplies unusually complete context: data provenance, count semantics, truncation behavior, freshness, coverage, and caveats. An agent has everything needed to interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter, full, and the schema description coverage is 100%, so the baseline is 3. The main description repeats the full:true truncation behavior but adds no syntax or semantics beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "Aggregate totals from EchelonGraph's internet-exposure radars," naming the radar categories it returns. It clearly distinguishes this exposure-radar tool from the CVE-focused sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never states when to use this tool versus alternatives such as cve_exposure, cve_intel, or check_affected. There are no exclusions, prerequisites, or routing hints for an agent choosing among the 16 sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One CVE's record: description, severity, cvss_v3_score, cvss_v4_score and cvss_v4_severity, echelongraph_score, echelongraph_severity and score_confidence, epss_score and epss_percentile, CISA-KEV status (kev_listed, kev_added_date, kev_due_date, kev_ransomware) and, if KEV-listed, CISA's own text relayed verbatim (kev_required_action, not EchelonGraph's advice; kev_short_description; kev_notes_urls), ghsa_id, references, cpe_match (one flat list) and cpe_configurations (NVD's configurations as NVD sent them, with each AND/OR operator; absent where none is stored, which is not a finding that no product is affected), remediation (a capped summary of its fix), published, modified and updated_at; each field only where the record has it. Pass a CVE ID like CVE-2023-44487. echelongraph_score, echelongraph_severity and echelongraph_risk are EchelonGraph's score only when score_assessed is true. With score_assessed false the CVE is NOT YET SCORED, not scored 0: any of those three it carries (0, NONE, 0) is a placeholder, not a rating, and does not mean the CVE is harmless; score_unassessed_reason says why, and the note labels each such CVE NOT YET SCORED. An answer with no score_assessed (an API older than that field) does not say whether the CVE was scored, the note says so, and a 0 there is not a rating either. patch_available is true when EchelonGraph holds, or once held, fix evidence for the CVE; patch_evidence is what it holds now, strongest first. patch_available false means no fix evidence is on record, which is not a finding that no fix exists. Its freshness is null: the feed serves no poll-completion time. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each list in the record keeps its first entries, and the note names each list cut with its full length.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2023-44487 |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover safety (readOnly, idempotent, non-destructive), and the description goes well beyond them: it discloses the score_assessed placeholder semantics, patch_available/patch_evidence meaning, the null freshness value, and detailed 30,000-character truncation behavior (TEXT CUT / DATA CUT, per-list capping). This is unusually rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Content is dense and mostly earns its place for a data-heavy tool, but it is delivered as one sprawling semicolon-chained paragraph that is hard to parse. It is front-loaded with the field list, but structure and readability suffer.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema already exists, the extensive field enumeration is partly redundant, but the description still fully covers the caveats an agent needs (scoring placeholders, KEV verbatim text, truncation). Nothing material is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds practical meaning to `full` by explaining the DATA CUT tradeoff against client output caps. The cve_id example is redundant with the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description makes clear this returns a single CVE's full record by ID, enumerating the fields (description, severity, CVSS scores, KEV status, references, cpe data, remediation, timestamps). The verb 'get/retrieve' is implicit rather than stated, but the resource and scope are unambiguous and distinguishable from list/search siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says to 'Pass a CVE ID like CVE-2023-44487', which implies the trigger condition, but it never contrasts with siblings like cve_intel, cve_summary, or search_cves, nor states when not to use it. Usage is implied rather than guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One CWE (weakness class) and the CVEs classified under it. Returns cwe_id, name and description (from the MITRE CWE catalog EchelonGraph embeds, version catalog_version), total (the active CVEs in EchelonGraph's feed that an NVD, GitHub or CVE.org record classifies under it, rejected and reserved records left out), and cves, one page of 50: each with cve_id, severity, cvss_v3_score, echelongraph_score, echelongraph_severity, score_assessed, kev_listed, published and a shortened description. order says how the rows are sorted (CISA-KEV-listed first, then EchelonGraph score); an answer without order does not state its order, and the note says so. page is the page served, page_size its size and max_page the last page the API serves: a later page is answered as max_page, so past max_page pages total counts CVEs no page lists. echelongraph_score is EchelonGraph's score only when score_assessed is true; the note labels each row that is NOT YET SCORED. A total of 0 says that no CVE in EchelonGraph's feed is classified under that CWE, not that none exists. Pass cwe_id like CWE-79 (or 79) and an optional page (1-200). Its structured result carries state (measured), measured_at (null), method, coverage (total, returned, page, page_requested, page_size, max_page), freshness (null) and notes, with data equal to the API's JSON; the result's last text block repeats it without data (the first text block) and without the note's sentences (the text block before it), with which notes ends. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| page | No | page of 50 CVEs (default 1, max 200) | |
| cwe_id | Yes | a CWE ID, e.g. CWE-79 (or 79) |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent/openWorld annotations, the description discloses genuinely non-obvious behavior: page requests past max_page are clamped to max_page, total=0 means 'none in EchelonGraph's feed' rather than 'none exists', echelongraph_score is only valid when score_assessed is true, and results past 30,000 characters are cut (DATA CUT / TEXT CUT) with a note explaining what was dropped. This is exactly the extra context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence is well front-loaded, but the body is a single sprawling block that mixes return-field enumeration, pagination semantics, scoring caveats and truncation mechanics with little structural separation. Much of the content is substantive, yet the sheer density and length make it hard to scan and it is not appropriately sized for its content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with an output schema, the description still covers everything an agent needs: pagination edge cases, ordering and the note when order is absent, scoring validity, truncation behavior and the shape of the structured result. Nothing required to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema: the clamping behavior for out-of-range pages ('a later page is answered as max_page, so past max_page pages total counts CVEs no page lists') and the rationale for full: true. The cwe_id format and page bounds are restated from the schema, which earns no extra credit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence names a specific verb and resource ('One CWE (weakness class) and the CVEs classified under it'), which immediately separates it from the single-CVE sibling get_cve and the broader search_cves. An agent can tell what this returns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the resource scope (fetch a CWE class plus its classified CVEs) and by 'Pass cwe_id like CWE-79 (or 79) and an optional page', but the description never explicitly states when to choose this over get_cve, search_cves, or cve_summary. There are no stated exclusions or alternative-routing rules, so an agent must infer the niche.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
One vendor advisory in full, by vendor and the vendor's advisory ID (the vendor and vendor_advisory_id of a vendor advisory row): title, description, severity, cvss_v3_score, cve_ids and known_cve_ids (those with a record in EchelonGraph's CVE feed), affected_products, remediation, references, vendor_modified_at, and withdrawn_at and withdrawn_reason when the vendor withdrew it. remediations lists each remediation the vendor lists, with kind (the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other), source_category, text, url and the cve_ids and product_ids it covers; each text is the vendor's, verbatim, untested by EchelonGraph. remediation_state is parsed, none_in_source, not_parsed or withdrawn: none_in_source and not_parsed are not a finding that no fix exists. Each advisory carries vendor_published_at (the vendor's date), our_first_seen_at (when EchelonGraph first recorded it) and withdrawn (true: the vendor rescinded it). Each advisory also carries rejected_cve_ids: the CVE IDs it names whose CVE record was rejected (withdrawn) by its numbering authority, which are not active vulnerabilities. coverage.vendor_window is that vendor's window in what EchelonGraph holds: vendor, advisories, earliest_vendor_published_at, latest_vendor_published_at, held_since (where that window begins) and history_backfill (in_progress or not_started: older advisories not all held yet); null when the windows could not be read or carry none for that vendor. measured_at is our_first_seen_at. Its freshness is null: the answer carries no poll-completion time. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| vendor | Yes | the vendor slug, e.g. microsoft, redhat, github | |
| advisory_id | Yes | the vendor's advisory ID, e.g. RHSA-2024:1234 or GHSA-xxxx-xxxx-xxxx |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, openWorld, non-destructive), so the bar is lower, yet the description adds real behavioral context: the 30,000-char TEXT CUT/DATA CUT truncation and the meaning of full:true, freshness being null, withdrawn/rejected semantics, and the warning that remediation_state none_in_source/not_parsed is not a finding that no fix exists. Much of the remaining text is output-field enumeration rather than behavior, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
After a crisp first clause the description becomes a massive run-on enumerating nearly every output field, which is largely redundant given an output schema exists. It is neither front-loaded nor economical; sentences sprawl across dozens of comma-joined clauses.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only single-record get with a full output schema and complete annotation coverage, the description is more than sufficient on the data side and even documents truncation edge cases. What it lacks is the routing/usage context (when to prefer this over the search siblings), so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description restates the truncation behavior linked to full:true, but the schema already documents full, vendor, and advisory_id in detail; the description adds little meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a specific verb+resource+key: 'One vendor advisory in full, by vendor and the vendor's advisory ID.' This clearly distinguishes a single-record lookup from the search/for-CVE siblings (search_vendor_advisories, vendor_advisories_for_cve). It stops short of explicitly naming those alternatives, so it does not reach 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the retrieval key (you must already have the vendor slug and advisory ID), and there is a fragment of guidance in the 'unless full: true' note. There is no explicit when-to-use/when-not statement nor a pointer to the search sibling for discovering IDs, so this is implied usage at best.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first, from EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes. Each kev row gives cve_id, kev_added_date (CISA's dateAdded), kev_due_date, kev_vendor, kev_product, kev_vuln_name and kev_ransomware (known ransomware-campaign use), EchelonGraph's severity, cvss_v3_score, epss_score, epss_percentile and eg_kev_tier for the CVE, and our_first_seen_kev, when EchelonGraph's poller first recorded the CVE entering the catalog (null where no such record exists). Filter by since and until (YYYY-MM-DD, inclusive, on kev_added_date), ransomware, and vendor (an exact, case-insensitive match on kev_vendor); page with limit (1 to 200, default 50) and cursor, passing back the previous page's next_cursor with the same filters. total counts the CVEs matching the filters; kev_listed_total counts every CVE EchelonGraph holds as KEV-listed, and catalog.catalog_count is CISA's own count in the catalog last fetched, so a gap between the two is entries not yet in EchelonGraph's CVE table, which no page returns. CISA's requiredAction, shortDescription and notes are not in these rows: each CVE's own record carries them, verbatim and labelled as CISA's. Its structured result's measured_at is our last successful fetch of CISA's feed (null when the API does not say), coverage counts the CISA KEV catalog (total, returned, kev_listed_total, catalog_count, limit, has_more) and freshness gives last_successful_fetch_at, catalog_version and date_released. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps cve_id, kev_added_date, kev_vendor and kev_ransomware at least, or rows are left out, and next_cursor still continues after the page's last row, not the text's.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| limit | No | page size (default 50, max 200) | |
| since | No | earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it, with the time and offset dropped; anything else is refused) | |
| until | No | latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it, with the time and offset dropped; anything else is refused) | |
| cursor | No | next_cursor from the previous page | |
| vendor | No | CISA vendorProject, an exact case-insensitive match, e.g. 'Microsoft' | |
| ransomware | No | true: only CVEs with known ransomware-campaign use; false: only those without |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, openWorld, non-destructive), but the description adds substantial behavior the annotations cannot: the 5-minute poll cadence, the distinction between total, kev_listed_total and catalog.catalog_count (and why a gap means entries not yet in the CVE table, 'which no page returns'), and the 30,000-character truncation regime including that next_cursor continues after the page's last row rather than the text's.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is front-loaded with the resource and ordering, but it is a single very long block, and a sizable portion enumerates every returned field (cve_id, kev_added_date, kev_vendor, epss_score, eg_kev_tier, our_first_seen_kev, etc.) that the output schema already carries. The truncation and count-gap material earns its place; the field roll-call largely does not.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter, read-only, paginated catalog feed with a rich output schema and strong annotations, the description supplies everything an agent needs: data provenance and freshness, filter semantics, pagination contract, the meaning of the two competing totals, and explicit truncation behavior with a full:true escape hatch. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: since/until are inclusive and applied to kev_added_date, vendor is an exact case-insensitive match on kev_vendor, and cursor must be passed back with the same filters. These add constraints beyond the schema's field-level text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource and ordering ('The CVEs CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, newest first') and identifies the data source and its freshness ('EchelonGraph's copy of that catalog, which polls CISA's feed every 5 minutes'). It also carves out its boundary explicitly, stating that requiredAction/shortDescription/notes are not in these rows and live on each CVE's own record, which functionally distinguishes it from the per-CVE sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete operating context: filter with since/until (inclusive, on kev_added_date), ransomware, and vendor (exact case-insensitive), and page by passing the previous page's next_cursor back 'with the same filters'. It also implicitly routes the agent elsewhere for CISA's requiredAction/shortDescription/notes. It stops short of naming an alternative sibling tool or stating explicit when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check a project's lockfile or pinned manifest against EchelonGraph's advisory corpus, one verdict per dependency. Pass files: 1 to 20 of filename and content, up to 5,000,000 characters in all; the filename, or format, gives the format. Read: requirements.txt (== and === pins only), go.mod (require, after replace and exclude), package-lock.json and npm-shrinkwrap.json (v1 to v3), Cargo.lock, Gemfile.lock, composer.lock, poetry.lock and gradle.lockfile. package.json, pyproject.toml, Pipfile, Gemfile, Cargo.toml, composer.json and build.gradle hold ranges and are refused, naming the lockfile to pass; go.sum is refused: it lists versions the build does not select. This server reads the files into purls and only the purls are sent to the API, in POST bodies of at most 200, never in a URL; filenames and file contents are not sent on. Run from npm, this server is on your machine; over the hosted endpoint (mcp.echelongraph.io) it is EchelonGraph's, and the files are the request body, accepted up to 6 MiB. data.results holds one row per distinct purl, with verdict (affected, not_affected, undetermined or not_assessed), not_assessed_reason, cve_ids and matched_via; each match carries kev_listed, epss_score and fixed_in or null with fixed_in_reason. not_affected is the only clean verdict. data.not_checked lists each entry not sent, with file, line and reason: version_unpinned (a range), version_unresolved, local_path, vcs_source or unsupported_line; not_checked entries are not clean. At most 2,000 distinct purls per call, within 50 seconds; data.not_sent_purls lists any not sent, unchecked and not clean. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps index, purl, verdict, not_assessed_reason and cve_ids at least; not_checked keeps its first 20.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| files | Yes | 1 to 20 files, up to 5,000,000 characters of content in all; read by this MCP server into purls, and only the purls are sent to the API; over the hosted endpoint (mcp.echelongraph.io) the files are the request body |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only/idempotent safety, but the description adds substantial non-obvious behavior: privacy disclosure that only purls are POSTed and filenames/contents are not sent, a 2,000-purl / 50-second cap, truncation semantics (TEXT CUT / DATA CUT with full: true escape), and the critical verdict rule that 'not_affected is the only clean verdict' and not_checked entries are not clean.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, but the body is a very long, densely packed run-on stream of facts (formats, privacy, limits, truncation) with several sentence-level redundancies against the schema's own field descriptions (file counts, hosted-endpoint note). Information-dense but hard to scan, so not concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists, return values needn't be restated, yet the description still covers the fields that matter for interpretation (verdict enum semantics, not_assessed_reason, fixed_in, not_sent_purls) plus limits, privacy and truncation. An agent has everything needed to call it correctly and read the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema: it explains that filename picks the format unless format overrides, and spells out the operational consequence of full (whole vs. cut structured data and client cap behavior). It does not add much on content/filename fields themselves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Check a project's lockfile or pinned manifest against EchelonGraph's advisory corpus') and states the unit of output ('one verdict per dependency'). This clearly separates it from sibling tools like check_sbom and check_affected without the agent needing to open a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use guidance via accepted formats and explicit refusals (package.json, pyproject.toml, Pipfile etc. 'hold ranges and are refused, naming the lockfile to pass'; go.sum refused with a reason). It stops short of naming sibling tools as alternatives, so it is clear context rather than full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search/list CVEs from EchelonGraph's CVE feed (NVD + MITRE-CNA pre-NVD + CISA-KEV + EPSS + GitHub GHSA, each polled on a schedule). Filter by severity, minimum CVSS, free text, and sort; page with limit and offset. Returns cves, each with cve_id, severity, cvss_v3_score, echelongraph_score and score_assessed (whether EchelonGraph has scored it), epss_score and kev_listed where the record has them, and the list's total, total_counted (false: total is not a count), total_is_lower_bound (true: at least total), search_relaxed, limit and offset. echelongraph_score, echelongraph_severity and echelongraph_risk are EchelonGraph's score only when score_assessed is true. With score_assessed false the CVE is NOT YET SCORED, not scored 0: any of those three it carries (0, NONE, 0) is a placeholder, not a rating, and does not mean the CVE is harmless; score_unassessed_reason says why, and the note labels each such CVE NOT YET SCORED. An answer with no score_assessed (an API older than that field) does not say whether the CVE was scored, the note says so, and a 0 there is not a rating either. patch_available is true when EchelonGraph holds, or once held, fix evidence for the CVE; patch_evidence is what it holds now, strongest first. patch_available false means no fix evidence is on record, which is not a finding that no fix exists. Its freshness is null: the feed serves no poll-completion time. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps at least the fields named above and the first 200 characters of its description (100 on a page too long for that), or rows are left out and the note gives the offset to call next.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| sort | No | sort order (default: published) | |
| limit | No | page size (default 20, max 50) | |
| offset | No | rows to skip (default 0) | |
| search | No | free-text search (product, vendor, or keyword, e.g. 'tomcat') | |
| min_cvss | No | minimum CVSS score | |
| severity | No | filter to one severity |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds substantial non-obvious behavior: score_assessed semantics (unscored is NOT scored 0), placeholder caveats, patch_available meaning, null freshness, and the 30,000-character TEXT CUT / DATA CUT truncation rules. This is rich context well beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded, but the body runs long and dense with repetitive clauses about field semantics, much of which duplicates the existing output schema. Every sentence carries real semantic content, but the volume is heavier than the tool's selection task requires.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with multiple upstream feeds, scoring semantics, and truncation behavior, the description covers the tricky edge cases (unscored CVEs, patch evidence absence, cut output and continuation offsets) that an agent could otherwise misread. With an output schema present, the return-value detail is extra but not harmful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, and the schema already documents sort, limit, offset, search, min_cvss, severity, and full. The description mostly restates filter/paging behavior and adds only the 'unless full: true' caveat, so it does not meaningfully exceed the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource ('Search/list CVEs from EchelonGraph's CVE feed') and enumerates the underlying sources, so the agent knows exactly what corpus this queries. It implicitly separates itself from the singular get_cve sibling via 'search/list', but never names an alternative tool explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the filter/paging parameters ('Filter by severity, minimum CVSS, free text, and sort; page with limit and offset'). There is no statement of when to choose this over cve_intel, cve_summary, or get_cve, and no when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search or list vendor-published advisories, newest first. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, IDs and affected_products (search_match substring). A query of 1 or 2 characters matches whole words only (search_match word). Filter by vendor (slug), severity band and whether the advisory names any CVE ID. Advisories their vendor withdrew are left out. Returns advisories, each with vendor, vendor_advisory_id, title, severity, cvss_v3_score, cve_ids, summary and affected_products where present, and total, total_capped, limit, offset, search_applied and search_match. A search counts at most 1,000 matches: past that, total is 1000 and total_capped is true, which means 1,000 or more (the note writes 1,000+), never exactly 1,000. Each advisory also carries rejected_cve_ids: the CVE IDs it names whose CVE record was rejected (withdrawn) by its numbering authority, which are not active vulnerabilities. The query is sent in a request header, never in the URL. coverage repeats those beside returned, and gives vendor_windows, each vendor's window in what EchelonGraph holds: vendor, advisories, earliest_vendor_published_at, latest_vendor_published_at, held_since (where that window begins) and history_backfill (in_progress or not_started: older advisories not all held yet). An advisory published before its vendor's held_since may not be held, so no advisory from a vendor is not a finding that it published none. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps vendor, vendor_advisory_id, title, severity and cve_ids at least, its strings and lists shortened, or rows are left out and the note gives the offset to call next.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| limit | No | page size (default 20, max 50) | |
| query | No | free text, at most 100 bytes: a product, an advisory ID, a CVE ID or a keyword, e.g. 'exchange server'; 1 or 2 characters match whole words only | |
| offset | No | rows to skip (default 0) | |
| vendor | No | a vendor slug, e.g. microsoft, redhat, github | |
| has_cve | No | true: only advisories naming a CVE; false: only those naming none | |
| severity | No | one severity band |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds significant context beyond annotations: withdrawn advisories are excluded, rejected_cve_ids semantics, 1,000-match cap with total_capped, coverage window and held_since meaning, 30k cut behavior. Annotations already give readOnly/openWorld/idempotent, so the description earns credit for the extra domain-specific behavior. It is weaker on permissions/rate limits, but this is a read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with search behavior, but very long and dense, stacking many edge cases (total_capped, rejected_cve_ids, coverage, truncation, DATA CUT/TEXT CUT) into one paragraph. Much earns its place but could be structured into bullets or shortened; some repetition around truncation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 params with full schema coverage and an output schema, the description covers all material behavior an agent needs: matching rules, filters, exclusions, pagination caps, return fields, coverage semantics, and truncation fallback. Nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description still adds meaning: query length behavior (1-2 chars whole words, 3+ substring), case-insensitive fields matched, vendor slug filtering, severity band, has_cve semantics, and mentions query is sent in a request header not URL. These go beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search or list vendor-published advisories') and specifies ordering ('newest first'). The sibling get_vendor_advisory and vendor_advisories_for_cve are related but the description does not explicitly contrast with them, though it broadly distinguishes search/listing from retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage as a search/list tool, but no explicit when-to-use vs alternatives. It does not say to use get_vendor_advisory for a single advisory or vendor_advisories_for_cve to pivot from a CVE, which would help route the agent among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
The vendor-published advisories that name one CVE, newest first, at most 20: for each, vendor, vendor_display_name, vendor_advisory_id, title, severity and cvss_v3_score where the vendor gives them. Covers the vendor feeds EchelonGraph polls, for example Microsoft MSRC, Red Hat, Cisco, Palo Alto Networks and GitHub GHSA; an empty answer means none of the advisories EchelonGraph holds names the CVE, not that no vendor published one. Each advisory carries vendor_published_at (the vendor's date), our_first_seen_at (when EchelonGraph first recorded it) and withdrawn (true: the vendor rescinded it). Each advisory also carries rejected_cve_ids: the CVE IDs it names whose CVE record was rejected (withdrawn) by its numbering authority, which are not active vulnerabilities. The answer's cve_rejected is true when the CVE record of the CVE asked for was rejected. Each row has remediation_kinds and remediation_state (not_parsed is not none). coverage gives returned, cap, at_cap (true: there may be more) and cve_year; vendor_windows, each vendor's held window: vendor, advisories, earliest_vendor_published_at, latest_vendor_published_at, held_since (where that window begins) and history_backfill (in_progress or not_started: older advisories not all held yet); and vendors_not_fully_held, the vendors absent from the answer of which EchelonGraph holds none, whose held_since is after 1 January of cve_year or not known, or whose history is still being read, which the note names. An advisory published before its vendor's held_since may not be held, so no advisory from a vendor is not a finding that it published none. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, each row keeps vendor, vendor_advisory_id, title, severity and cve_ids at least, its strings and lists shortened.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap. | |
| cve_id | Yes | a CVE ID, e.g. CVE-2024-21412 |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover read-only/idempotent/open-world, and the description adds substantial behavior the annotations cannot carry: the 30,000-character DATA CUT/TEXT CUT behavior and what survives a cut, what an empty result does and does not mean, the meaning of withdrawn, rejected_cve_ids, remediation_state's 'not_parsed is not none', and per-vendor held_since/history_backfill windows. It also warns that pre-held_since advisories may be missing, preventing a false negative conclusion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is correctly front-loaded in the first clause, but the body is a single dense paragraph of run-on clauses stacking truncation, coverage, and window semantics. Most content is defensible given the tool's complexity, yet the structure makes it hard to scan and several clauses (e.g. repeated held_since explanations) restate the same idea.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present the description need not restate return fields, yet the extra behavioral content (truncation contract, empty-answer interpretation, vendor-window semantics) is exactly what the schema and annotations cannot convey. Nothing needed to call or correctly interpret the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning for 'full': it explains what the alternative cut does, that data_truncated/truncated appear, and the MAX_MCP_OUTPUT_TOKENS refusal case. That is more than the schema's own 'data is the answer whole' wording provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource with scope: 'the vendor-published advisories that name one CVE, newest first, at most 20,' then enumerates the exact fields returned. An agent can tell it apart from search_vendor_advisories (multi-CVE search) and get_vendor_advisory (single advisory) from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the scope statement and by the interpretation caveats ('an empty answer means none of the advisories EchelonGraph holds names the CVE'), which is valuable guidance. However, it never explicitly says when to pick this tool over cve_intel, get_vendor_advisory or search_vendor_advisories, nor states prerequisites beyond the CVE ID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v3.0.2check_affected2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "assessed": {
- "description": "The answer's assessed, first: null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "degraded": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookup": {
- "description": "Which lookup path this call asked for.",
- "enum": [
- "cpe",
- "registry"
- ],
- "type": "string"
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "assessed",
- "not_assessed_reason",
- "lookup",
- "match_layer",
- "count",
- "capped",
- "candidates_capped",
- "excluded_count",
- "undetermined_count",
- "not_affected_count",
- "degraded"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories_considered": {
- "type": [
- "number",
- "null"
- ]
- },
- "assessed": {
- "description": "count depends on it. true: the lookup evaluated this component. false: it did not, and count 0 says nothing about whether this version is affected.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidate_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "candidates_capped": {
- "description": "true: not every candidate CVE was loaded.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "description": "true: the match list stopped at its cap.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "degraded": {
- "description": "true: the lookup ran out of time.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "ecosystem_recognised": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded": {},
- "excluded_count": {
- "description": "CPE candidates suppressed by the vendor or platform gate.",
- "type": [
- "number",
- "null"
- ]
- },
- "match_layer": {
- "description": "Which lookup path answered.",
- "type": [
- "string",
- "null"
- ]
- },
- "matches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cpe_vendor": {
- "description": "The vendor NVD's CPE asserts for this match.",
- "type": [
- "string",
- "null"
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v2_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score: present only when score_assessed is true.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "effective_score": {
- "description": "The best real score held for the CVE (EchelonGraph's, else CVSS), the number the matches are ranked by.",
- "type": [
- "number",
- "null"
- ]
- },
- "effective_severity": {
- "description": "The band of effective_score; absent or empty when the CVE has no band at all (unrated, not harmless).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_score": {
- "description": "EPSS exploitation probability, 0 to 1.",
- "type": [
- "number",
- "null"
- ]
- },
- "fixed_in": {
- "description": "Registry match: the fixed bound of the advisory interval that holds this version, always above it. null when that interval records no fix (it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which. Absent on a CPE match.",
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_in_reason": {
- "description": "Why fixed_in is null; absent when fixed_in is a version.",
- "type": [
- "string",
- "null"
- ]
- },
- "interval": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "fixed": {
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "Registry match: the advisory interval that holds this version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
- },
- "kev_listed": {
- "description": "Listed in CISA-KEV: known to be exploited.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "match_confidence": {
- "type": [
- "number",
- "null"
- ]
- },
- "match_method": {
- "type": [
- "string",
- "null"
- ]
- },
- "match_reason": {
- "type": [
- "string",
- "null"
- ]
- },
- "matched_criteria": {
- "type": [
- "string",
- "null"
- ]
- },
- "ransomware": {
- "description": "CISA-KEV records known use in ransomware campaigns.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. false: NOT YET SCORED, and echelongraph_score is withheld.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "description": "NVD's own CVSS v3 band, as provenance: it can be NONE for a CVE NVD rated only under CVSS v2. Rank and display on effective_severity.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_unknown": {
- "description": "true: the vendor was not verified, so the match is real but its attribution to your vendor is not.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "version_evidence": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_affected_count": {
- "description": "Advisories decided as not affecting this version.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "product": {
- "type": [
- "string",
- "null"
- ]
- },
- "product_named_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undecidable_excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undecided_candidate_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undetermined": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "detail": {
- "type": [
- "string",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "reason": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "version": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "assessed": {
- "description": "The answer's assessed, first: null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "degraded": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookup": {
- "description": "Which lookup path this call asked for.",
- "enum": [
- "cpe",
- "registry"
- ],
- "type": "string"
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "assessed",
- "not_assessed_reason",
- "lookup",
- "match_layer",
- "count",
- "capped",
- "candidates_capped",
- "excluded_count",
- "undetermined_count",
- "not_affected_count",
- "degraded"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "assessed": {
+ "description": "The answer's assessed, first: null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "degraded": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookup": {
+ "description": "Which lookup path this call asked for.",
+ "enum": [
+ "cpe",
+ "registry"
+ ],
+ "type": "string"
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "assessed",
+ "not_assessed_reason",
+ "lookup",
+ "match_layer",
+ "count",
+ "capped",
+ "candidates_capped",
+ "excluded_count",
+ "undetermined_count",
+ "not_affected_count",
+ "degraded"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories_considered": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "assessed": {
+ "description": "count depends on it. true: the lookup evaluated this component. false: it did not, and count 0 says nothing about whether this version is affected.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidate_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "description": "true: not every candidate CVE was loaded.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "description": "true: the match list stopped at its cap.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "degraded": {
+ "description": "true: the lookup ran out of time.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ecosystem_recognised": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded": {},
+ "excluded_count": {
+ "description": "CPE candidates suppressed by the vendor or platform gate.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_layer": {
+ "description": "Which lookup path answered.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_vendor": {
+ "description": "The vendor NVD's CPE asserts for this match.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v2_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score: present only when score_assessed is true.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "effective_score": {
+ "description": "The best real score held for the CVE (EchelonGraph's, else CVSS), the number the matches are ranked by.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "effective_severity": {
+ "description": "The band of effective_score; absent or empty when the CVE has no band at all (unrated, not harmless).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "EPSS exploitation probability, 0 to 1.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "fixed_in": {
+ "description": "Registry match: the lowest version above this one that no affected interval of the CVE's record for the package holds, always above it: the fixed bound of the interval that holds this version, moved past any overlapping interval that still holds that bound (fixed_in_detail then names it). null when no such version is on record (an interval on the way records no fix: it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which. Absent on a CPE match.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_detail": {
+ "description": "Set when fixed_in is not the fixed bound of the interval that holds this version: the overlapping intervals of the same record it moved past, which still hold that bound.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Registry match: the advisory interval that holds this version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
+ },
+ "kev_listed": {
+ "description": "Listed in CISA-KEV: known to be exploited.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "match_confidence": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "match_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_criteria": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ransomware": {
+ "description": "CISA-KEV records known use in ransomware campaigns.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. false: NOT YET SCORED, and echelongraph_score is withheld.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "description": "NVD's own CVSS v3 band, as provenance: it can be NONE for a CVE NVD rated only under CVSS v2. Rank and display on effective_severity.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_unknown": {
+ "description": "true: the vendor was not verified, so the match is real but its attribution to your vendor is not.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "version_evidence": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "not_affected_count": {
+ "description": "Advisories decided as not affecting this version.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "product_named_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undecidable_excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undecided_candidate_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "detail": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "assessed": {
+ "description": "The answer's assessed, first: null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "degraded": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookup": {
+ "description": "Which lookup path this call asked for.",
+ "enum": [
+ "cpe",
+ "registry"
+ ],
+ "type": "string"
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "assessed",
+ "not_assessed_reason",
+ "lookup",
+ "match_layer",
+ "count",
+ "capped",
+ "candidates_capped",
+ "excluded_count",
+ "undetermined_count",
+ "not_affected_count",
+ "degraded"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]check_sbom2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "components_in_document": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls that appeared more than once and were sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "input": {
- "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
- "enum": [
- "purls",
- "cyclonedx",
- "spdx"
- ],
- "type": "string"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "with_purl": {
- "description": "Of those, the ones carrying a purl.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "without_purl": {
- "description": "The ones without a purl: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "input",
- "components_in_document",
- "with_purl",
- "without_purl",
- "duplicates_removed",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "answered_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_sent_purls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
- },
- "results": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisories_considered": {
- "type": [
- "number",
- "null"
- ]
- },
- "assessed": {
- "description": "Whether the matcher produced a verdict for this component. false is never clean.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "code": {
- "type": [
- "string",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "error": {
- "type": [
- "string",
- "null"
- ]
- },
- "index": {
- "type": [
- "number",
- "null"
- ]
- },
- "input_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "matched_package": {
- "description": "The package name the advisories were looked up by (#2836): the purl's own name, or, for a deb or apk purl with an upstream qualifier, the source package it names, which is how Debian and Alpine file advisories.",
- "type": [
- "string",
- "null"
- ]
- },
- "matched_version_from": {
- "description": "Upstream rows: upstream when the qualifier named a version (upstream=name@version) and it was used, purl when the purl's own version was.",
- "type": [
- "string",
- "null"
- ]
- },
- "matched_via": {
- "description": "Which name matched_package is: purl_name (the purl's name), upstream (the purl's upstream qualifier) or coordinates (the component's package).",
- "type": [
- "string",
- "null"
- ]
- },
- "matches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "epss_score": {
- "description": "The CVE's EPSS score (FIRST), as EchelonGraph's record holds it; null when it has none.",
- "type": [
- "number",
- "null"
- ]
- },
- "fixed_in": {
- "description": "The fixed bound of the advisory interval that holds this component's version, always above it. null when that interval records no fix (it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which.",
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_in_reason": {
- "description": "Why fixed_in is null; absent when fixed_in is a version.",
- "type": [
- "string",
- "null"
- ]
- },
- "interval": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "fixed": {
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The advisory interval that holds this component's version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
- },
- "kev_listed": {
- "description": "Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, as EchelonGraph's record holds it.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "match_reason": {
- "description": "Why the advisory applies, with the advisory interval the version falls inside: \"[A, B)\" names the fixed version B, \"[A, B]\" the last affected version B. On an upstream row it ends by naming the source package and the purl name.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
- "type": [
- "string",
- "null"
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "purl": {
- "type": [
- "string",
- "null"
- ]
- },
- "purl_name": {
- "description": "Upstream rows: the purl's own (binary) package name, not looked up.",
- "type": [
- "string",
- "null"
- ]
- },
- "undetermined": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "verdict": {
- "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
- "type": [
- "string",
- "null"
- ]
- },
- "version": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "summary": {
- "additionalProperties": {},
- "properties": {
- "affected": {
- "type": [
- "number",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "corpus_cache_max_age_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "elapsed_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookups": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_affected": {
- "description": "Components with a decided, clean verdict.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed": {
- "description": "Components with no verdict: not clean.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_by_reason": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "advisory_lookup_failed": {
- "type": "number"
- },
- "candidate_window_truncated": {
- "type": "number"
- },
- "distro_release_unknown": {
- "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
- "type": "number"
- },
- "invalid_component": {
- "type": "number"
- },
- "no_decidable_advisory": {
- "type": "number"
- },
- "package_not_in_advisory_corpus": {
- "type": "number"
- },
- "purl_type_unsupported": {
- "type": "number"
- },
- "time_budget": {
- "description": "Components the batch's time budget ran out before: not clean; check them again.",
- "type": "number"
- },
- "version_missing": {
- "type": "number"
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The not_assessed components, counted by not_assessed_reason."
- },
- "partial": {
- "description": "true when the time budget ran out before every component was looked up.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "time_budget_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "undetermined": {
- "description": "Components whose advisories could not all be decided and none matched: not clean.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "components_in_document": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls that appeared more than once and were sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "input": {
- "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
- "enum": [
- "purls",
- "cyclonedx",
- "spdx"
- ],
- "type": "string"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "with_purl": {
- "description": "Of those, the ones carrying a purl.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "without_purl": {
- "description": "The ones without a purl: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "input",
- "components_in_document",
- "with_purl",
- "without_purl",
- "duplicates_removed",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "components_in_document": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls that appeared more than once and were sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "input": {
+ "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
+ "enum": [
+ "purls",
+ "cyclonedx",
+ "spdx"
+ ],
+ "type": "string"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "with_purl": {
+ "description": "Of those, the ones carrying a purl.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "without_purl": {
+ "description": "The ones without a purl: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "input",
+ "components_in_document",
+ "with_purl",
+ "without_purl",
+ "duplicates_removed",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "answered_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_sent_purls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
+ },
+ "results": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories_considered": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "assessed": {
+ "description": "Whether the matcher produced a verdict for this component. false is never clean.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "code": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "error": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "index": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "input_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_package": {
+ "description": "The package name the advisories were looked up by (#2836): the purl's own name, or, for a deb or apk purl with an upstream qualifier, the source package it names, which is how Debian and Alpine file advisories.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_version_from": {
+ "description": "Upstream rows: upstream when the qualifier named a version (upstream=name@version) and it was used, purl when the purl's own version was.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_via": {
+ "description": "Which name matched_package is: purl_name (the purl's name), upstream (the purl's upstream qualifier) or coordinates (the component's package).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The CVE's EPSS score (FIRST), as EchelonGraph's record holds it; null when it has none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "fixed_in": {
+ "description": "The lowest version above this component's that no affected interval of the CVE's record for the package holds, always above it: the fixed bound of the interval that holds the component's version, moved past any overlapping interval that still holds that bound (fixed_in_detail then names it). null when no such version is on record (an interval on the way records no fix: it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_detail": {
+ "description": "Set when fixed_in is not the fixed bound of the interval that holds the component's version: the overlapping intervals of the same record it moved past, which still hold that bound.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The advisory interval that holds this component's version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
+ },
+ "kev_listed": {
+ "description": "Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, as EchelonGraph's record holds it.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "match_reason": {
+ "description": "Why the advisory applies, with the advisory interval the version falls inside: \"[A, B)\" names that interval's fixed bound B (another interval of the advisory can still hold B; fixed_in is the version past them all), \"[A, B]\" the last affected version B. On an upstream row it ends by naming the source package and the purl name.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "matches_truncated": {
+ "additionalProperties": false,
+ "description": "Present only on a row whose matches the structured result's cut (DATA CUT) shortened or left out: total, the row's matches in the answer; returned, the ones data keeps (its first, highest effective_score first); and, while they fit, of all its matches, the CVE IDs KEV-listed (kev_listed_cve_ids) or used in ransomware (ransomware_cve_ids), and the distinct fixed_in versions (fixed_in_versions). The same call with full: true returns every match.",
+ "properties": {
+ "fixed_in_versions": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "kev_listed_cve_ids": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "ransomware_cve_ids": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl_name": {
+ "description": "Upstream rows: the purl's own (binary) package name, not looked up.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "verdict": {
+ "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "summary": {
+ "additionalProperties": {},
+ "properties": {
+ "affected": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "corpus_cache_max_age_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "elapsed_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookups": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_affected": {
+ "description": "Components with a decided, clean verdict.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed": {
+ "description": "Components with no verdict: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_by_reason": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_lookup_failed": {
+ "type": "number"
+ },
+ "candidate_window_truncated": {
+ "type": "number"
+ },
+ "distro_release_unknown": {
+ "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
+ "type": "number"
+ },
+ "invalid_component": {
+ "type": "number"
+ },
+ "no_decidable_advisory": {
+ "type": "number"
+ },
+ "package_not_in_advisory_corpus": {
+ "type": "number"
+ },
+ "purl_type_unsupported": {
+ "type": "number"
+ },
+ "time_budget": {
+ "description": "Components the batch's time budget ran out before: not clean; check them again.",
+ "type": "number"
+ },
+ "version_missing": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The not_assessed components, counted by not_assessed_reason."
+ },
+ "partial": {
+ "description": "true when the time budget ran out before every component was looked up.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "time_budget_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "description": "Components whose advisories could not all be decided and none matched: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "components_in_document": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls that appeared more than once and were sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "input": {
+ "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
+ "enum": [
+ "purls",
+ "cyclonedx",
+ "spdx"
+ ],
+ "type": "string"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "with_purl": {
+ "description": "Of those, the ones carrying a purl.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "without_purl": {
+ "description": "The ones without a purl: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "input",
+ "components_in_document",
+ "with_purl",
+ "without_purl",
+ "duplicates_removed",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_exposure2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "in_scope": {
- "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "in_scope"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "countries": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "exposed_hosts": {
- "type": [
- "number",
- "null"
- ]
- },
- "generated_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_catalog_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_seen_in_observations": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "last_seen": {
- "description": "When EchelonGraph last wrote or refreshed a service's row, not when the service was observed and not when its vulnerable version was last confirmed: it is set to the time of the write when a search matches the banner, and again when a re-check finds the port still listed by Shodan InternetDB, without re-reading the banner, so a patched service can stay counted while its port stays open. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
- "type": [
- "string",
- "null"
- ]
- },
- "method": {
- "type": [
- "string",
- "null"
- ]
- },
- "ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "top_countries": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "country": {
- "type": [
- "string",
- "null"
- ]
- },
- "hosts": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "top_products": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "hosts": {
- "type": [
- "number",
- "null"
- ]
- },
- "product": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "tracked": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "exposure_state": {
- "anyOf": [
- {
- "enum": [
- "exposed",
- "measured_zero",
- "not_assessed",
- "tracking_unknown"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer's count is, as the note's (exposure_state: …) tag says; not state, which says whether the answer is a dated measurement. exposed: data.exposed_hosts counts the services the radar holds on record for the CVE, above 0. measured_zero: the API marks the CVE as tracked with 0 services, a zero in the radar's sample. not_assessed: the CVE is outside the radar's tracked set, so its count, if any, is not a current measurement. tracking_unknown: the API does not say whether the radar tracks the CVE, so its 0 is not evidence either way. null: the answer carries no count."
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "exposure_state",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "in_scope": {
- "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "in_scope"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "countries": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "exposed_hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "generated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_catalog_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_seen_in_observations": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_seen": {
+ "description": "When EchelonGraph last wrote or refreshed a service's row, not when the service was observed and not when its vulnerable version was last confirmed: it is set to the time of the write when a search matches the banner, and again when a re-check finds the port still listed by Shodan InternetDB, without re-reading the banner, so a patched service can stay counted while its port stays open. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "top_countries": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "country": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "top_products": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "tracked": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "exposure_state": {
+ "anyOf": [
+ {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed",
+ "tracking_unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer's count is, as the note's (exposure_state: …) tag says; not state, which says whether the answer is a dated measurement. exposed: data.exposed_hosts counts the services the radar holds on record for the CVE, above 0. measured_zero: the API marks the CVE as tracked with 0 services, a zero in the radar's sample. not_assessed: the CVE is outside the radar's tracked set, so its count, if any, is not a current measurement. tracking_unknown: the API does not say whether the radar tracks the CVE, so its 0 is not evidence either way. null: the answer carries no count."
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "exposure_state",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_intel2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "dependents_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_branches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "description": "The OSV record that published the range (GHSA-…, PYSEC-…, CVE-…); null on a row loaded before it was stored.",
- "type": [
- "string",
- "null"
- ]
- },
- "fixed": {
- "description": "The range's fix: the first version past it. null where no fix is on record.",
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "description": "The range's lower bound, inclusive; \"0\" is the first version.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "description": "The range's last affected version, inclusive, where no fix is on record; never a fix.",
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "description": "The loader's label for that record (osv_bulk, osv); null on a row loaded before it was stored.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "fixed_branches lists each affected range of the package on record: introduced, and fixed (the range's fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader's label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem's version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced (\"0\" is the first version) and below fixed, or at or below last_affected; that range's fixed is the fix for it, and a version in no range is outside every range on record. fixed_branches is null where the package's ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range's fix, kept for compatibility (one per package: the range the loader kept, the advisory's last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0."
- },
- "fixed_version": {
- "description": "One range's fix, kept for compatibility; not the fix for every affected range: read fixed_branches.",
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "version_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "cve_id": {
- "type": "string"
- },
- "cwes": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cwe_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "first_seen_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kind": {
- "description": "metasploit, exploit_db, nuclei_template, github_poc or vendor_poc.",
- "type": [
- "string",
- "null"
- ]
- },
- "source_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source_url": {
- "type": [
- "string",
- "null"
- ]
- },
- "verified_status": {
- "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits_by_kind": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_by_status": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_capped": {
- "description": "true: exploits lists fewer references than exploits_total.",
- "type": "boolean"
- },
- "exploits_total": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
- },
- "fixed_versions": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "vulnerable_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "enriched_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "enrichment_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "fields_changed": {},
- "score_delta": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline_count_30d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_count_7d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_total": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "cve_id"
- ],
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "dependents_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_branches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "description": "The OSV record that published the range (GHSA-…, PYSEC-…, CVE-…); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed": {
+ "description": "The range's fix: the first version past it. null where no fix is on record.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "description": "The range's lower bound, inclusive; \"0\" is the first version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "description": "The range's last affected version, inclusive, where no fix is on record; never a fix.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "description": "The loader's label for that record (osv_bulk, osv); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "fixed_branches lists each affected range of the package on record: introduced, and fixed (the range's fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader's label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem's version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced (\"0\" is the first version) and below fixed, or at or below last_affected; its fix is that range's fixed, or, while another range still holds that, the other range's fixed (none past a range without one); a version in no range is outside every range on record. fixed_branches is null where the package's ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range's fix, kept for compatibility (one per package: the range the loader kept, the advisory's last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0."
+ },
+ "fixed_version": {
+ "description": "One range's fix, kept for compatibility; not the fix for every affected range: read fixed_branches.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cwes": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cwe_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "eg_first_seen_at": {
+ "description": "When EchelonGraph first recorded the reference, as a UTC timestamp: a date of EchelonGraph's, not the source's.",
+ "type": "string"
+ },
+ "first_seen_at": {
+ "description": "Deprecated: the same value as source_published_at, null when that is.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "description": "metasploit, exploit_db, nuclei_template, github_poc or vendor_poc.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_published_at": {
+ "description": "The source's own date for the reference (Exploit-DB's date_published, a GitHub proof-of-concept repository's created_at, or the first commit of a nuclei template or Metasploit module where EchelonGraph derived it from the source's git history); null where the source gives none, and EchelonGraph supplies no stand-in date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "verified_status": {
+ "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits_by_kind": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_by_status": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_capped": {
+ "description": "true: exploits lists fewer references than exploits_total.",
+ "type": "boolean"
+ },
+ "exploits_total": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
+ },
+ "fixed_versions": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vulnerable_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "enriched_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "enrichment_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fields_changed": {},
+ "score_delta": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline_count_30d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_count_7d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_total": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "cve_id"
+ ],
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_remediation5 fields changedInput schema / properties / ecosystemAdded value: +{
+ "description": "Installed version, with package and version: the package's ecosystem, such as npm, PyPI or Maven. Sent in a request header.",
+ "type": "string"
+}Input schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Input schema / properties / packageAdded value: +{
+ "description": "Installed version, with ecosystem and version: the package name in that ecosystem, such as org.apache.logging.log4j:log4j-core. Sent in a request header.",
+ "type": "string"
+}Input schema / properties / versionAdded value: +{
+ "description": "Installed version, with ecosystem and package: the version installed, such as 2.14.1. Sent in a request header.",
+ "type": "string"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "item_text_cap": {
- "type": [
- "number",
- "null"
- ]
- },
- "items_per_advisory_cap": {
- "type": [
- "number",
- "null"
- ]
- },
- "parsed_vendors": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors whose remediation EchelonGraph parses."
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
- },
- "sections_relayed": {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "vendor_advisory_limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "vendors_not_parsed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "parsed_vendors",
- "vendors_not_parsed",
- "vendor_advisory_limit",
- "item_text_cap",
- "items_per_advisory_cap"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "cisa": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "due_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "notes_urls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "required_action": {
- "description": "CISA's requiredAction, verbatim. CISA's required_action is directed at US federal civilian agencies (BOD 22-01) and is not EchelonGraph's advice.",
- "type": [
- "string",
- "null"
- ]
- },
- "short_description": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "coverage": {},
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "failed_sections": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "fix_references": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "tags": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "url": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "fixed_branches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_branches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed": {
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "description": "The range's last affected version, where no fix is on record; never a fix.",
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "fixed_version": {
- "description": "One range's fix, kept for compatibility; not the fix for every affected range.",
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_assessed_reason": {
- "type": [
- "string",
- "null"
- ]
- },
- "patches": {
- "anyOf": [
- {
- "items": {},
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "state": {
- "description": "assessed, or not_assessed for a CVE record rejected by its numbering authority.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_remediations": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "items": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "fixed_build": {
- "description": "MSRC's FixedBuild; null elsewhere.",
- "type": [
- "string",
- "null"
- ]
- },
- "kind": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendor's own category: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other."
- },
- "product_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "product_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendor's own product identifiers the item applies to, the first 16."
- },
- "source_category": {
- "description": "The vendor's own name for the category (CSAF vendor_fix, MSRC Vendor Fix, Palo Alto work_around).",
- "type": [
- "string",
- "null"
- ]
- },
- "source_subcategory": {
- "description": "MSRC's SubType, e.g. Security Update; null elsewhere.",
- "type": [
- "string",
- "null"
- ]
- },
- "text": {
- "description": "The vendor's text, verbatim but for HTML markup removed, cut at coverage.item_text_cap characters (text_truncated).",
- "type": [
- "string",
- "null"
- ]
- },
- "text_chars": {
- "description": "The length of the vendor's text in characters.",
- "type": [
- "number",
- "null"
- ]
- },
- "text_truncated": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "url": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "items_total": {
- "type": [
- "number",
- "null"
- ]
- },
- "remediation_kinds": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "remediation_state": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "parsed",
- "none_in_source",
- "not_parsed",
- "withdrawn"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "parsed; none_in_source (parsed, and the advisory lists no remediation for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory); withdrawn (the vendor rescinded it)."
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "item_text_cap": {
- "type": [
- "number",
- "null"
- ]
- },
- "items_per_advisory_cap": {
- "type": [
- "number",
- "null"
- ]
- },
- "parsed_vendors": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors whose remediation EchelonGraph parses."
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
- },
- "sections_relayed": {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "vendor_advisory_limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "vendors_not_parsed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "parsed_vendors",
- "vendors_not_parsed",
- "vendor_advisory_limit",
- "item_text_cap",
- "items_per_advisory_cap"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "installed_asked": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "ecosystem": {
+ "type": "string"
+ },
+ "package": {
+ "type": "string"
+ },
+ "version": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "ecosystem",
+ "package",
+ "version"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The installed version this call sent (in request headers), as given; null when none."
+ },
+ "item_text_cap": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "items_per_advisory_cap": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "parsed_vendors": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors whose remediation EchelonGraph parses."
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
+ },
+ "sections_relayed": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "vendor_advisory_limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendors_not_parsed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "parsed_vendors",
+ "vendors_not_parsed",
+ "vendor_advisory_limit",
+ "item_text_cap",
+ "items_per_advisory_cap",
+ "installed_asked"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cisa": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "due_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "notes_urls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "required_action": {
+ "description": "CISA's requiredAction, verbatim. CISA's required_action is directed at US federal civilian agencies (under BOD 26-04, which replaced BOD 22-01 on 10 June 2026) and is not EchelonGraph's advice.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "short_description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "coverage": {},
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "failed_sections": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "fix_references": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "tags": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "fix_status": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "basis": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "described_by": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "listed_in_patch_table": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "solution_by": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cna": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "section": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "available",
+ "fix_referenced",
+ "fix_merged",
+ "none_confirmed",
+ "unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "stated_in_record": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "unread_inputs": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "vendor_released": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The API's fix-status rule for the CVE, the one CVE Pulse pages show: state is available (a fix is on record), fix_referenced (a reference tagged Patch, often a source commit, and no release confirmed), fix_merged (an upstream fix merged, not yet in a tagged release), none_confirmed (no fix evidence on record, which is not a finding that no fix exists) or unknown (an input could not be read). basis is the step of the rule that decided it; described_by is the CVE description's sentence naming the fix, solution_by the CVE record's solution sentence naming it (statement) and the CNA that wrote it (cna), stated_in_record that patch_evidence counts a fix the CVE record states with no sentence to quote, listed_in_patch_table that a fixed version or patch row is on record; unread_inputs names any input the API could not read. vendor_released (basis vendor_fix_released) is the vendor's own statement that a fix is released where the CVE record names no fixed version: its sentence, verbatim (statement, or null), never a version, so the fixed release is the vendor advisory's to name. solution_by's section is workarounds when the fix sentence is the record's workaround, not its solution."
+ },
+ "fixed_branches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_branches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "description": "The range's last affected version, where no fix is on record; never a fix.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "fixed_branches_truncated": {
+ "additionalProperties": false,
+ "description": "Present only where the structured result's cut (DATA CUT) kept this package's first ranges, not all: total, its ranges in the answer; returned, the ones data keeps. The same call with full: true returns every range.",
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "fixed_version": {
+ "description": "One range's fix, kept for compatibility; not the fix for every affected range.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "fixed_in": {
+ "description": "With an installed version: the first version above it that no affected range on record holds, always above it, as the advisory states it: the fixed bound of the range holding it, moved past any overlapping range that still holds that bound (fixed_in_detail then names it). null when no range on record holds it, no fix is on record past the ranges holding it, or the version was not assessed, with fixed_in_reason saying which. Absent when no installed version was asked.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_detail": {
+ "description": "Set when fixed_in is not the fixed bound of the range holding the installed version: the overlapping ranges of the same record it moved past, which still hold that bound.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "installed": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "ecosystem": {
+ "description": "The ecosystem asked for, in its canonical OSV spelling.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ecosystem_recognised": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The affected range holding the version (fixed is exclusive, last_affected inclusive); absent when none holds it."
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "verdict": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "affected",
+ "not_affected",
+ "undetermined",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "affected (a range on record holds the version), not_affected (no range on record holds it), undetermined (a range could not be decided at it) or not_assessed (the record names no such package for this CVE, or the lookup did not run)."
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version_evidence": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The installed version asked for, as the API read it from the request headers, and its verdict against this CVE; absent when none was asked."
+ },
+ "not_assessed_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "patches": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "state": {
+ "description": "assessed, or not_assessed for a CVE record rejected by its numbering authority.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_remediations": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "items": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "fixed_build": {
+ "description": "MSRC's FixedBuild; null elsewhere.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendor's own category: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other."
+ },
+ "product_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendor's own product identifiers the item applies to, the first 16."
+ },
+ "source_category": {
+ "description": "The vendor's own name for the category (CSAF vendor_fix, MSRC Vendor Fix, Palo Alto work_around).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_subcategory": {
+ "description": "MSRC's SubType, e.g. Security Update; null elsewhere.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text": {
+ "description": "The vendor's text, verbatim but for HTML markup removed, cut at coverage.item_text_cap characters (text_truncated).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text_chars": {
+ "description": "The length of the vendor's text in characters.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "text_truncated": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "items_total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (parsed, and the advisory lists no remediation for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory); withdrawn (the vendor rescinded it)."
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "installed_asked": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "ecosystem": {
+ "type": "string"
+ },
+ "package": {
+ "type": "string"
+ },
+ "version": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "ecosystem",
+ "package",
+ "version"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The installed version this call sent (in request headers), as given; null when none."
+ },
+ "item_text_cap": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "items_per_advisory_cap": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "parsed_vendors": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors whose remediation EchelonGraph parses."
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
+ },
+ "sections_relayed": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "vendor_advisory_limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendors_not_parsed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "parsed_vendors",
+ "vendors_not_parsed",
+ "vendor_advisory_limit",
+ "item_text_cap",
+ "items_per_advisory_cap",
+ "installed_asked"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_summary3 fields changedInput schema / $schemaAdded value: +"https://json-schema.org/draft/2020-12/schema"Input schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "description": "What the answer covers; null where the answer says nothing about it.",
- "type": "null"
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "poller": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "cves_ingested": {
- "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
- "type": [
- "number",
- "null"
- ]
- },
- "cves_skipped": {
- "description": "CVE records this instance's NVD poller skipped since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "http_retries": {
- "description": "HTTP retries this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "interval": {
- "description": "How often this instance's NVD poller polls.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_at": {
- "description": "When this instance's NVD poller last polled: never the feed's freshness.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_dur_ms": {
- "description": "How long that poll took, in milliseconds.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_count": {
- "description": "Polls this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_errors": {
- "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. A poller field the answer sends in a JSON type other than the one described here is left out of data and named in the note, and a poller that is neither a JSON object nor null is left out whole: summary is relayed either way."
- },
- "summary": {
- "additionalProperties": {},
- "description": "summary.nvd_critical, summary.nvd_high, summary.nvd_medium, summary.nvd_low and summary.nvd_none count the same active CVEs as summary.total by NVD's CVSS severity label (v3.x, else v4.0; before NVD's record arrives, or where it gives none, a pre-NVD label from the CVE.org record or a GitHub advisory can stand in): provenance, never EchelonGraph's severity band. summary.nvd_none counts the active CVEs with no Critical, High, Medium or Low label there, CVEs NVD never labelled under CVSS v3 among them, and many of those carry an NVD CVSS v2 score instead: it is neither a count of CVEs rated None nor the count of CVEs with no severity, which is summary.none. Whenever summary.nvd_none is above zero the note says what it counts, with its count.",
- "properties": {
- "critical": {
- "type": [
- "number",
- "null"
- ]
- },
- "high": {
- "type": [
- "number",
- "null"
- ]
- },
- "last_updated": {
- "type": [
- "string",
- "null"
- ]
- },
- "low": {
- "type": [
- "number",
- "null"
- ]
- },
- "medium": {
- "type": [
- "number",
- "null"
- ]
- },
- "none": {
- "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_critical": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_high": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_low": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_medium": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_none": {
- "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
- "type": [
- "number",
- "null"
- ]
- },
- "rejected": {
- "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "unscored": {
- "description": "The same count as none, under its own name.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "type": "null"
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "poller": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cves_ingested": {
+ "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cves_skipped": {
+ "description": "CVE records this instance's NVD poller skipped since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "http_retries": {
+ "description": "HTTP retries this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "interval": {
+ "description": "How often this instance's NVD poller polls.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_at": {
+ "description": "When this instance's NVD poller last polled: never the feed's freshness.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_dur_ms": {
+ "description": "How long that poll took, in milliseconds.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_count": {
+ "description": "Polls this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_errors": {
+ "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. A poller field the answer sends in a JSON type other than the one described here is left out of data and named in the note, and a poller that is neither a JSON object nor null is left out whole: summary is relayed either way."
+ },
+ "summary": {
+ "additionalProperties": {},
+ "description": "summary.nvd_critical, summary.nvd_high, summary.nvd_medium, summary.nvd_low and summary.nvd_none count the same active CVEs as summary.total by NVD's CVSS severity label (v3.x, else v4.0; before NVD's record arrives, or where it gives none, a pre-NVD label from the CVE.org record or a GitHub advisory can stand in): provenance, never EchelonGraph's severity band. summary.nvd_none counts the active CVEs with no Critical, High, Medium or Low label there, CVEs NVD never labelled under CVSS v3 among them, and many of those carry an NVD CVSS v2 score instead: it is neither a count of CVEs rated None nor the count of CVEs with no severity, which is summary.none. Whenever summary.nvd_none is above zero the note says what it counts, with its count.",
+ "properties": {
+ "critical": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "high": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "last_updated": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "low": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "medium": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "none": {
+ "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_critical": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_high": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_low": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_medium": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_none": {
+ "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "rejected": {
+ "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "unscored": {
+ "description": "The same count as none, under its own name.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]epss_history2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "complete_since": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
- },
- "days_held": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Score dates from first_day to last_day the record holds; null when none are listed."
- },
- "days_missing": {
- "description": "Score dates from first_day to last_day the record does not hold.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "days_partial": {
- "description": "Score dates held for some CVEs only.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "first_day": {
- "description": "The earliest FIRST score date the run log lists; null when it lists none.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_day": {
- "type": [
- "string",
- "null"
- ]
- },
- "points": {
- "description": "How many points the series holds.",
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "points_before_complete_since": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "How many of them fall where changes are missing; null when the API did not say."
- },
- "points_truncated": {
- "type": "boolean"
- },
- "series_complete": {
- "description": "True only when the API says nothing in the record predates complete_since.",
- "type": "boolean"
- },
- "series_kind": {
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "series_kind",
- "series_starts_at",
- "complete_since",
- "series_complete",
- "points",
- "points_before_complete_since",
- "points_truncated",
- "first_day",
- "last_day",
- "days_held",
- "days_partial",
- "days_missing"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "complete_since": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "From when the record holds every change a refresh applied. Between series_starts_at and complete_since changes are missing, so a missing point there does not mean unchanged. Absent from an API older than #2867."
- },
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "complete_since": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "From here on every change a refresh applied is a point; before it changes are missing."
- },
- "days_held": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Score dates from first_day to last_day that a refresh applied completely."
- },
- "days_missing": {
- "anyOf": [
- {
- "items": {
- "description": "A FIRST score date, YYYY-MM-DD.",
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Score dates from first_day to last_day that no refresh applied."
- },
- "days_partial": {
- "anyOf": [
- {
- "items": {
- "description": "A FIRST score date, YYYY-MM-DD.",
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Score dates whose refreshes all failed part-way: some CVEs hold that day, some do not."
- },
- "first_day": {
- "anyOf": [
- {
- "description": "A FIRST score date, YYYY-MM-DD.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The earliest score date in the run log."
- },
- "last_day": {
- "anyOf": [
- {
- "description": "A FIRST score date, YYYY-MM-DD.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The latest score date in the run log."
- },
- "points_before_complete_since": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "This CVE's points in the part of the record that misses changes."
- },
- "recorded_from": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "series_starts_at: when recording began."
- },
- "refresh_runs_truncated": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "run_log_since": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The first logged refresh: score dates before it are not listed, held or missing."
- },
- "runs_undated": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- },
- "series_complete": {
- "description": "True only when nothing in the record predates complete_since.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "Which part of the record is complete and which FIRST score dates it holds."
- },
- "current": {
- "additionalProperties": {},
- "properties": {
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "description": "The record's EPSS probability now; null when it holds none.",
- "type": [
- "number",
- "null"
- ]
- },
- "epss_updated_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When EchelonGraph last wrote a changed EPSS value for this CVE."
- }
- },
- "type": "object"
- },
- "cve_id": {
- "type": "string"
- },
- "history_rows": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Raw history rows read, before repeated records of one change were collapsed."
- },
- "latest_point_matches_current": {
- "description": "Whether the newest point equals current; false means a change is missing from the series; null when there is no point or no current value.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "points": {
- "description": "Recorded changes, oldest first. Never a daily series.",
- "items": {
- "additionalProperties": {},
- "properties": {
- "at": {
- "description": "When EchelonGraph recorded this change.",
- "type": "string"
- },
- "epss_percentile": {
- "description": "Its percentile (0 to 1), null where the record held none.",
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "description": "The EPSS probability (0 to 1) from that change on.",
- "type": "number"
- },
- "score_date": {
- "description": "FIRST's score date (YYYY-MM-DD) of the logged refresh that wrote this point; null where no logged refresh covers it.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "at",
- "epss_score"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "points_truncated": {
- "description": "True when only the newest rows were read, so the earliest points are missing.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "series_kind": {
- "description": "Always change_only: one point per recorded change, none for a day without one.",
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The earliest EPSS change EchelonGraph recorded for any CVE: when recording began. Null when nothing has been recorded."
- }
- },
- "required": [
- "cve_id",
- "series_kind",
- "series_starts_at",
- "current",
- "points"
- ],
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "complete_since": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
- },
- "days_held": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Score dates from first_day to last_day the record holds; null when none are listed."
- },
- "days_missing": {
- "description": "Score dates from first_day to last_day the record does not hold.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "days_partial": {
- "description": "Score dates held for some CVEs only.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "first_day": {
- "description": "The earliest FIRST score date the run log lists; null when it lists none.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_day": {
- "type": [
- "string",
- "null"
- ]
- },
- "points": {
- "description": "How many points the series holds.",
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "points_before_complete_since": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "How many of them fall where changes are missing; null when the API did not say."
- },
- "points_truncated": {
- "type": "boolean"
- },
- "series_complete": {
- "description": "True only when the API says nothing in the record predates complete_since.",
- "type": "boolean"
- },
- "series_kind": {
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "series_kind",
- "series_starts_at",
- "complete_since",
- "series_complete",
- "points",
- "points_before_complete_since",
- "points_truncated",
- "first_day",
- "last_day",
- "days_held",
- "days_partial",
- "days_missing"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day the record holds; null when none are listed."
+ },
+ "days_missing": {
+ "description": "Score dates from first_day to last_day the record does not hold.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "days_partial": {
+ "description": "Score dates held for some CVEs only.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "first_day": {
+ "description": "The earliest FIRST score date the run log lists; null when it lists none.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_day": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "How many points the series holds.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "How many of them fall where changes are missing; null when the API did not say."
+ },
+ "points_truncated": {
+ "type": "boolean"
+ },
+ "series_complete": {
+ "description": "True only when the API says nothing in the record predates complete_since.",
+ "type": "boolean"
+ },
+ "series_kind": {
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "series_kind",
+ "series_starts_at",
+ "complete_since",
+ "series_complete",
+ "points",
+ "points_before_complete_since",
+ "points_truncated",
+ "first_day",
+ "last_day",
+ "days_held",
+ "days_partial",
+ "days_missing"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when the record holds every change a refresh applied. Between series_starts_at and complete_since changes are missing, so a missing point there does not mean unchanged. Absent from an API older than #2867."
+ },
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From here on every change a refresh applied is a point; before it changes are missing."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day that a refresh applied completely."
+ },
+ "days_missing": {
+ "anyOf": [
+ {
+ "items": {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day that no refresh applied."
+ },
+ "days_partial": {
+ "anyOf": [
+ {
+ "items": {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates whose refreshes all failed part-way: some CVEs hold that day, some do not."
+ },
+ "first_day": {
+ "anyOf": [
+ {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The earliest score date in the run log."
+ },
+ "last_day": {
+ "anyOf": [
+ {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The latest score date in the run log."
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This CVE's points in the part of the record that misses changes."
+ },
+ "recorded_from": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "series_starts_at: when recording began."
+ },
+ "refresh_runs_truncated": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "run_log_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The first logged refresh: score dates before it are not listed, held or missing."
+ },
+ "runs_undated": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "series_complete": {
+ "description": "True only when nothing in the record predates complete_since.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Which part of the record is complete and which FIRST score dates it holds."
+ },
+ "current": {
+ "additionalProperties": {},
+ "properties": {
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The record's EPSS probability now; null when it holds none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_updated_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When EchelonGraph last wrote a changed EPSS value for this CVE."
+ }
+ },
+ "type": "object"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "history_rows": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Raw history rows read, before repeated records of one change were collapsed."
+ },
+ "latest_point_matches_current": {
+ "description": "Whether the newest point equals current; false means a change is missing from the series; null when there is no point or no current value.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "Recorded changes, oldest first. Never a daily series.",
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "at": {
+ "description": "When EchelonGraph recorded this change.",
+ "type": "string"
+ },
+ "epss_percentile": {
+ "description": "Its percentile (0 to 1), null where the record held none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The EPSS probability (0 to 1) from that change on.",
+ "type": "number"
+ },
+ "score_date": {
+ "description": "FIRST's score date (YYYY-MM-DD) of the logged refresh that wrote this point; null where no logged refresh covers it.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "at",
+ "epss_score"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "points_truncated": {
+ "description": "True when only the newest rows were read, so the earliest points are missing.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "series_kind": {
+ "description": "Always change_only: one point per recorded change, none for a day without one.",
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The earliest EPSS change EchelonGraph recorded for any CVE: when recording began. Null when nothing has been recorded."
+ }
+ },
+ "required": [
+ "cve_id",
+ "series_kind",
+ "series_starts_at",
+ "current",
+ "points"
+ ],
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day the record holds; null when none are listed."
+ },
+ "days_missing": {
+ "description": "Score dates from first_day to last_day the record does not hold.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "days_partial": {
+ "description": "Score dates held for some CVEs only.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "first_day": {
+ "description": "The earliest FIRST score date the run log lists; null when it lists none.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_day": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "How many points the series holds.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "How many of them fall where changes are missing; null when the API did not say."
+ },
+ "points_truncated": {
+ "type": "boolean"
+ },
+ "series_complete": {
+ "description": "True only when the API says nothing in the record predates complete_since.",
+ "type": "boolean"
+ },
+ "series_kind": {
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "series_kind",
+ "series_starts_at",
+ "complete_since",
+ "series_complete",
+ "points",
+ "points_before_complete_since",
+ "points_truncated",
+ "first_day",
+ "last_day",
+ "days_held",
+ "days_partial",
+ "days_missing"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]exposure_radar3 fields changedInput schema / $schemaAdded value: +"https://json-schema.org/draft/2020-12/schema"Input schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "description": "A field this version cannot label is left out of data and named in the note. Each of the kev_exposure, exposed_databases and leaked_credentials radars also carries generated_at, when the API computed its totals, and, when the API can tell, last_run_at. kev_exposure.last_run_at, exposed_databases.last_run_at and leaked_credentials.last_run_at are timestamps, not counts: each is when that radar last completed a check, a cycle whose reads succeeded, among them a Shodan search (for exposed_databases, or its LeakIX fallback) that answered at least one query, or for leaked_credentials a read of the public GitHub event stream. A cycle that read nothing does not move it, and it is not the time of every record a radar's numbers count, which cover everything still on record, not only what the last check found. A radar whose answer carries no last_run_at has none in the result, and the note says nothing about it. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "description": "exposed_databases: exposed_databases.distinct_hosts counts distinct ip:port services the check confirmed answering without authentication, and exposed_databases.engines the distinct engine types among them; exposed_databases.top_engines and exposed_databases.top_countries rank up to 15 engines and 10 countries by those services. exposed_databases.pii_likely and exposed_databases.pci_likely count services whose schema names (never record values) pass a high-confidence, precision-first gate for personal or payment-card data, so a service outside them is not shown to hold no such data. exposed_databases.window.from and exposed_databases.window.to are timestamps, not counts: when EchelonGraph's check last confirmed the oldest and the newest of the services counted, a span of checks made at different times; with a counted service that has no such time on record there is no window.",
- "properties": {
- "distinct_hosts": {
- "type": "number"
- },
- "engines": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "pci_likely": {
- "type": "number"
- },
- "pii_likely": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_engines": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "engine": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "engine",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "description": "kev_exposure: kev_exposure.distinct_hosts counts distinct ip:port services, not machines (a machine answering on two ports counts twice), with at least one CISA-KEV-listed CVE on record, and kev_exposure.ransomware_hosts those with a ransomware-linked one; kev_exposure.kev_cves_exposed and kev_exposure.ransomware_cves count distinct CVEs with at least one such service; kev_exposure.correlations counts service×CVE pairs, not services, so a service with three KEV CVEs counts three times. kev_exposure.top_products, kev_exposure.top_countries and kev_exposure.top_cves rank up to 12 products, 10 countries and 12 CVEs by those services; kev_exposure.top_cves[].cvss_v3_score and kev_exposure.top_cves[].epss_score are the highest CVSS v3 base score and EPSS probability recorded on that CVE's observations. kev_exposure.trend counts service×CVE pairs still on record by the week in which each was first recorded, over 12 weeks, so earlier weeks read low. kev_exposure.newest_kev lists the 15 CVEs that EchelonGraph's CVE records most recently mark as CISA-KEV-listed, each with an exposure_state: exposed, where kev_exposure.newest_kev[].exposed_hosts counts distinct ip:port services on record with it; or not_assessed, where the API's answer holds no measurement for that CVE (its 0 is not one) and no count is relayed, and this answer does not say whether the radar tracks that CVE: tracking is answered per CVE. kev_exposure.newest_kev[].cvss_v3_score and kev_exposure.newest_kev[].epss_score are the CVE record's CVSS v3 base score and EPSS probability. kev_exposure.window.from and kev_exposure.window.to are timestamps, not counts: when Shodan collected the banners of the oldest and the newest of the service×CVE pairs counted, a span of observations made at different times; with a counted pair that has no such time on record there is no window. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
- "properties": {
- "correlations": {
- "type": "number"
- },
- "distinct_hosts": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "kev_cves_exposed": {
- "type": "number"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "newest_kev": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "added_date": {
- "type": "string"
- },
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "exposed_hosts": {
- "type": "number"
- },
- "exposure_state": {
- "enum": [
- "exposed",
- "measured_zero",
- "not_assessed"
- ],
- "type": "string"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- },
- "vuln_name": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "exposure_state"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "ransomware_cves": {
- "type": "number"
- },
- "ransomware_hosts": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_cves": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "hosts": {
- "type": "number"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "hosts": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "trend": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "new_exposures": {
- "type": "number"
- },
- "week": {
- "type": "string"
- }
- },
- "required": [
- "week",
- "new_exposures"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "description": "leaked_credentials: leaked_credentials.total counts (repository, secret) pairs, not distinct secrets, so one secret in three repositories counts three times; leaked_credentials.distinct_secrets counts each secret once and leaked_credentials.distinct_repos counts repositories; leaked_credentials.top_providers and leaked_credentials.top_types rank up to 15 providers and secret types by those pairs. None is validated: each is a credential-shaped string that passed EchelonGraph's filters, at most structurally checked and never tested against its provider. leaked_credentials.window.from and leaked_credentials.window.to are timestamps, not counts: when EchelonGraph's detector last found the oldest and the newest of the pairs counted.",
- "properties": {
- "distinct_repos": {
- "type": "number"
- },
- "distinct_secrets": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_providers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "provider": {
- "type": "string"
- }
- },
- "required": [
- "provider",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_types": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "secret_type": {
- "type": "string"
- }
- },
- "required": [
- "secret_type",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "description": "mcp_servers: counts and timestamps only, no hostname. mcp_servers.total counts hostnames the AI-exposure radar has checked for an MCP server, each once by its latest verdict on record, and not every one is an MCP server; EchelonGraph's own control servers are left out, and mcp_servers.own_controls_excluded counts them; hostnames whose owner opted out of scanning are not checked again while the opt-out stands, so their last verdict is left out too, and mcp_servers.withheld_opted_out counts them. mcp_servers.total is mcp_servers.protected plus mcp_servers.pending_readjudication plus mcp_servers.not_assessed. mcp_servers.protected counts hostnames whose /mcp endpoint asked for credentials and whose OAuth protected-resource metadata validated under RFC 9728; mcp_servers.prm_via divides them by where that document was found: mcp_servers.prm_via.header, mcp_servers.prm_via.wellknown_path and mcp_servers.prm_via.wellknown_root. mcp_servers.pending_readjudication counts verdicts of a rule since replaced, not yet re-checked. mcp_servers.not_assessed counts the rest, whose protection the radar could not assess (not assessed does not mean unprotected), and mcp_servers.not_assessed_by_reason puts each in one bucket. mcp_servers.not_assessed_by_reason.identified_no_challenge holds servers that identified themselves as MCP servers and did not ask for credentials at the handshake. That is normal in MCP: authorization is optional in the spec, and a server can enforce it at tools/call instead, which EchelonGraph never sends, so this bucket is not a finding of exposure. mcp_servers.not_assessed_by_reason.resource_mismatch, mcp_servers.not_assessed_by_reason.cross_origin_pointer, mcp_servers.not_assessed_by_reason.bare_challenge_no_prm, mcp_servers.not_assessed_by_reason.pointer_unreachable, mcp_servers.not_assessed_by_reason.pointer_invalid, mcp_servers.not_assessed_by_reason.no_authorization_servers, mcp_servers.not_assessed_by_reason.wellknown_unreachable and mcp_servers.not_assessed_by_reason.metadata_invalid hold endpoints that asked for credentials but whose RFC 9728 metadata did not validate, by why, so none of them is shown to lack protection; mcp_servers.not_assessed_by_reason.challenge_unadjudicated holds endpoints that asked for credentials before that check existed, not yet re-checked. mcp_servers.not_assessed_by_reason.no_http_answer holds hostnames that gave no HTTP answer, and mcp_servers.not_assessed_by_reason.not_identified_as_mcp hostnames whose HTTP answer identified no MCP server. mcp_servers.era divides every counted hostname by protocol era: mcp_servers.era.legacy; mcp_servers.era.dual, a lower bound; mcp_servers.era.modern, not proven modern-only; mcp_servers.era.unknown; and mcp_servers.era.not_measured, recorded before the era probe and not re-checked since. mcp_servers.transport divides them by transport: mcp_servers.transport.streamable_http, mcp_servers.transport.legacy_sse, mcp_servers.transport.unknown and mcp_servers.transport.not_measured. mcp_servers.window.from and mcp_servers.window.to are when the oldest and the newest of the verdicts counted were last checked. mcp_servers.last_run_at is a timestamp, not a count: when the AI-exposure radar, which checks other AI services too, last completed a check; mcp_servers.enabled is whether one completed within 45 minutes of the answer, and mcp_servers.counted_at is when the API read the counts. A partition whose buckets do not add up to the count it divides is left out and named; an answer that does not say it is the MCP-server counts, or whose mcp_servers.total, mcp_servers.protected, mcp_servers.pending_readjudication and mcp_servers.not_assessed are missing or contradict each other, is a failure.",
- "properties": {
- "counted_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "enabled": {
- "type": "boolean"
- },
- "era": {
- "additionalProperties": false,
- "properties": {
- "dual": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "legacy": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "modern": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "legacy",
- "dual",
- "modern",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "not_assessed": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_assessed_by_reason": {
- "additionalProperties": false,
- "properties": {
- "bare_challenge_no_prm": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "challenge_unadjudicated": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "cross_origin_pointer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "identified_no_challenge": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "metadata_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_authorization_servers": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_http_answer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_identified_as_mcp": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "resource_mismatch": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "identified_no_challenge",
- "resource_mismatch",
- "cross_origin_pointer",
- "bare_challenge_no_prm",
- "pointer_unreachable",
- "pointer_invalid",
- "no_authorization_servers",
- "wellknown_unreachable",
- "metadata_invalid",
- "challenge_unadjudicated",
- "no_http_answer",
- "not_identified_as_mcp"
- ],
- "type": "object"
- },
- "own_controls_excluded": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pending_readjudication": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "prm_via": {
- "additionalProperties": false,
- "properties": {
- "header": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_path": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_root": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "header",
- "wellknown_path",
- "wellknown_root"
- ],
- "type": "object"
- },
- "protected": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "total": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "transport": {
- "additionalProperties": false,
- "properties": {
- "legacy_sse": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "streamable_http": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "streamable_http",
- "legacy_sse",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- },
- "withheld_opted_out": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "total",
- "protected",
- "pending_readjudication",
- "not_assessed"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "description": "shadow_ai: the result is regrouped by what each number counts. shadow_ai.confirmed_exposed counts services EchelonGraph's probes found answering without an authentication gate (liveness active, or rechecking during a re-check): confirmed_exposed.total is the sum of confirmed_exposed.by_category, and confirmed_exposed.last_24h counts those first recorded in the last 24 h. Of the shadow_ai numbers, only confirmed_exposed counts exposed services. confirmed_exposed.window.from and confirmed_exposed.window.to are timestamps, not counts: when EchelonGraph's verifier ran the probe that last decided the oldest and the newest of those services, a span of probes made at different times. shadow_ai.observed counts every Certificate Transparency or Shodan observation on record, whatever its verification state: its numbers are observed, not exposed. They are observed.total; observed.by_category (the same observations by category); observed.last_24h (those first recorded in the last 24 h); observed.trend_30d (observations per UTC day over the last 30 days); and observed.top_products, observed.top_countries and observed.top_issuers (up to ten products, countries and issuers ranked by observations, where an issuer is the certificate's CA for a Certificate Transparency observation and the hosting operator Shodan reports for a Shodan one). shadow_ai.authentication counts observations by probe outcome: authentication.observed where a probe observed an authentication gate (a 401/403, a login page or an auth marker), and authentication.not_determined where the service answered but no probe could tell. Neither authentication count is part of confirmed_exposed, and observed.total minus confirmed_exposed.total is not a count of secured services. The shadow-AI poller block carries only running and last_run_at: last_run_at is when the radar's leader last completed a Certificate Transparency (crt.sh) cycle, and its running is true only when that was within 30 minutes of the answer. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
- "properties": {
- "authentication": {
- "additionalProperties": false,
- "properties": {
- "not_determined": {
- "type": "number"
- },
- "observed": {
- "type": "number"
- }
- },
- "type": "object"
- },
- "confirmed_exposed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "observed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "last_observation": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "country": {
- "type": "string"
- }
- },
- "required": [
- "country",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_issuers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "issuer": {
- "type": "string"
- }
- },
- "required": [
- "issuer",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "trend_30d": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "date": {
- "type": "string"
- }
- },
- "required": [
- "date",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "poller": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "running": {
- "type": "boolean"
- }
- },
- "required": [
- "running",
- "last_run_at"
- ],
- "type": "object"
- }
- },
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- "freshness": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "properties": {
- "enabled": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at",
- "enabled"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- },
- "running": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "last_run_at",
- "running"
- ],
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The producing radar's last completed check (last_run_at), where the API serves one."
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "radars": {
- "description": "Each radar that could not be read, and why.",
- "items": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "unexpected_shape"
- ],
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "path": {
- "type": "string"
- },
- "radar": {
- "type": "string"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "radar",
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "description": "A field this version cannot label is left out of data and named in the note. Each of the kev_exposure, exposed_databases and leaked_credentials radars also carries generated_at, when the API computed its totals, and, when the API can tell, last_run_at. kev_exposure.last_run_at, exposed_databases.last_run_at and leaked_credentials.last_run_at are timestamps, not counts: each is when that radar last completed a check, a cycle whose reads succeeded, among them a Shodan search (for exposed_databases, or its LeakIX fallback) that answered at least one query, or for leaked_credentials a read of the public GitHub event stream. A cycle that read nothing does not move it, and it is not the time of every record a radar's numbers count, which cover everything still on record, not only what the last check found. A radar whose answer carries no last_run_at has none in the result, and the note says nothing about it. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "description": "exposed_databases: exposed_databases.distinct_hosts counts distinct ip:port services the check confirmed answering without authentication, and exposed_databases.engines the distinct engine types among them; exposed_databases.top_engines and exposed_databases.top_countries rank up to 15 engines and 10 countries by those services. exposed_databases.pii_likely and exposed_databases.pci_likely count services whose schema names (never record values) pass a high-confidence, precision-first gate for personal or payment-card data, so a service outside them is not shown to hold no such data. exposed_databases.window.from and exposed_databases.window.to are timestamps, not counts: when EchelonGraph's check last confirmed the oldest and the newest of the services counted, a span of checks made at different times; with a counted service that has no such time on record there is no window.",
+ "properties": {
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "engines": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "pci_likely": {
+ "type": "number"
+ },
+ "pii_likely": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_engines": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "engine": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "engine",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "description": "kev_exposure: kev_exposure.distinct_hosts counts distinct ip:port services, not machines (a machine answering on two ports counts twice), with at least one CISA-KEV-listed CVE on record, and kev_exposure.ransomware_hosts those with a ransomware-linked one; kev_exposure.kev_cves_exposed and kev_exposure.ransomware_cves count distinct CVEs with at least one such service; kev_exposure.correlations counts service×CVE pairs, not services, so a service with three KEV CVEs counts three times. kev_exposure.top_products, kev_exposure.top_countries and kev_exposure.top_cves rank up to 12 products, 10 countries and 12 CVEs by those services; kev_exposure.top_cves[].cvss_v3_score and kev_exposure.top_cves[].epss_score are the highest CVSS v3 base score and EPSS probability recorded on that CVE's observations. kev_exposure.trend counts service×CVE pairs still on record by the week in which each was first recorded, over 12 weeks, so earlier weeks read low. kev_exposure.newest_kev lists the 15 CVEs that EchelonGraph's CVE records most recently mark as CISA-KEV-listed, each with an exposure_state: exposed, where kev_exposure.newest_kev[].exposed_hosts counts distinct ip:port services on record with it; or not_assessed, where the API's answer holds no measurement for that CVE (its 0 is not one) and no count is relayed, and this answer does not say whether the radar tracks that CVE: tracking is answered per CVE. kev_exposure.newest_kev[].cvss_v3_score and kev_exposure.newest_kev[].epss_score are the CVE record's CVSS v3 base score and EPSS probability. kev_exposure.window.from and kev_exposure.window.to are timestamps, not counts: when Shodan collected the banners of the oldest and the newest of the service×CVE pairs counted, a span of observations made at different times; with a counted pair that has no such time on record there is no window. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "correlations": {
+ "type": "number"
+ },
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "kev_cves_exposed": {
+ "type": "number"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "newest_kev": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "added_date": {
+ "type": "string"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "exposed_hosts": {
+ "type": "number"
+ },
+ "exposure_state": {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ },
+ "vuln_name": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "exposure_state"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "ransomware_cves": {
+ "type": "number"
+ },
+ "ransomware_hosts": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_cves": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "hosts": {
+ "type": "number"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "hosts": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "trend": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "new_exposures": {
+ "type": "number"
+ },
+ "week": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "week",
+ "new_exposures"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "description": "leaked_credentials: leaked_credentials.total counts (repository, secret) pairs, not distinct secrets, so one secret in three repositories counts three times; leaked_credentials.distinct_secrets counts each secret once and leaked_credentials.distinct_repos counts repositories; leaked_credentials.top_providers and leaked_credentials.top_types rank up to 15 providers and secret types by those pairs. None is validated: each is a credential-shaped string that passed EchelonGraph's filters, at most structurally checked and never tested against its provider. leaked_credentials.window.from and leaked_credentials.window.to are timestamps, not counts: when EchelonGraph's detector last found the oldest and the newest of the pairs counted.",
+ "properties": {
+ "distinct_repos": {
+ "type": "number"
+ },
+ "distinct_secrets": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_providers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "provider": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "provider",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_types": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "secret_type": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "secret_type",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "description": "mcp_servers: counts and timestamps only, no hostname. mcp_servers.total counts hostnames the AI-exposure radar has checked for an MCP server, each once by its latest verdict on record, and not every one is an MCP server; EchelonGraph's own control servers are left out, and mcp_servers.own_controls_excluded counts them; hostnames whose owner opted out of scanning are not checked again while the opt-out stands, so their last verdict is left out too, and mcp_servers.withheld_opted_out counts them. mcp_servers.total is mcp_servers.protected plus mcp_servers.pending_readjudication plus mcp_servers.not_assessed. mcp_servers.protected counts hostnames whose /mcp endpoint asked for credentials and whose OAuth protected-resource metadata validated under RFC 9728; mcp_servers.prm_via divides them by where that document was found: mcp_servers.prm_via.header, mcp_servers.prm_via.wellknown_path and mcp_servers.prm_via.wellknown_root. mcp_servers.pending_readjudication counts verdicts of a rule since replaced, not yet re-checked. mcp_servers.not_assessed counts the rest, whose protection the radar could not assess (not assessed does not mean unprotected), and mcp_servers.not_assessed_by_reason puts each in one bucket. mcp_servers.not_assessed_by_reason.identified_no_challenge holds servers that identified themselves as MCP servers and did not ask for credentials at the handshake. That is normal in MCP: authorization is optional in the spec, and a server can enforce it at tools/call instead, which EchelonGraph never sends, so this bucket is not a finding of exposure. mcp_servers.not_assessed_by_reason.resource_mismatch, mcp_servers.not_assessed_by_reason.cross_origin_pointer, mcp_servers.not_assessed_by_reason.bare_challenge_no_prm, mcp_servers.not_assessed_by_reason.pointer_unreachable, mcp_servers.not_assessed_by_reason.pointer_invalid, mcp_servers.not_assessed_by_reason.no_authorization_servers, mcp_servers.not_assessed_by_reason.wellknown_unreachable and mcp_servers.not_assessed_by_reason.metadata_invalid hold endpoints that asked for credentials but whose RFC 9728 metadata did not validate, by why, so none of them is shown to lack protection; mcp_servers.not_assessed_by_reason.challenge_unadjudicated holds endpoints that asked for credentials before that check existed, not yet re-checked. mcp_servers.not_assessed_by_reason.no_http_answer holds hostnames that gave no HTTP answer, and mcp_servers.not_assessed_by_reason.not_identified_as_mcp hostnames whose HTTP answer identified no MCP server. mcp_servers.era divides every counted hostname by protocol era: mcp_servers.era.legacy; mcp_servers.era.dual, a lower bound; mcp_servers.era.modern, not proven modern-only; mcp_servers.era.unknown; and mcp_servers.era.not_measured, recorded before the era probe and not re-checked since. mcp_servers.transport divides them by transport: mcp_servers.transport.streamable_http, mcp_servers.transport.legacy_sse, mcp_servers.transport.unknown and mcp_servers.transport.not_measured. mcp_servers.window.from and mcp_servers.window.to are when the oldest and the newest of the verdicts counted were last checked. mcp_servers.last_run_at is a timestamp, not a count: when the AI-exposure radar, which checks other AI services too, last completed a check; mcp_servers.enabled is whether one completed within 45 minutes of the answer, and mcp_servers.counted_at is when the API read the counts. A partition whose buckets do not add up to the count it divides is left out and named; an answer that does not say it is the MCP-server counts, or whose mcp_servers.total, mcp_servers.protected, mcp_servers.pending_readjudication and mcp_servers.not_assessed are missing or contradict each other, is a failure.",
+ "properties": {
+ "counted_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "era": {
+ "additionalProperties": false,
+ "properties": {
+ "dual": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "legacy": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "modern": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "legacy",
+ "dual",
+ "modern",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "not_assessed": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_assessed_by_reason": {
+ "additionalProperties": false,
+ "properties": {
+ "bare_challenge_no_prm": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "challenge_unadjudicated": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "cross_origin_pointer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "identified_no_challenge": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "metadata_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_authorization_servers": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_http_answer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_identified_as_mcp": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "resource_mismatch": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "identified_no_challenge",
+ "resource_mismatch",
+ "cross_origin_pointer",
+ "bare_challenge_no_prm",
+ "pointer_unreachable",
+ "pointer_invalid",
+ "no_authorization_servers",
+ "wellknown_unreachable",
+ "metadata_invalid",
+ "challenge_unadjudicated",
+ "no_http_answer",
+ "not_identified_as_mcp"
+ ],
+ "type": "object"
+ },
+ "own_controls_excluded": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pending_readjudication": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "prm_via": {
+ "additionalProperties": false,
+ "properties": {
+ "header": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_path": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_root": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "header",
+ "wellknown_path",
+ "wellknown_root"
+ ],
+ "type": "object"
+ },
+ "protected": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "transport": {
+ "additionalProperties": false,
+ "properties": {
+ "legacy_sse": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "streamable_http": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "streamable_http",
+ "legacy_sse",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ },
+ "withheld_opted_out": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "protected",
+ "pending_readjudication",
+ "not_assessed"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "description": "shadow_ai: the result is regrouped by what each number counts. shadow_ai.confirmed_exposed counts services EchelonGraph's probes found answering without an authentication gate (liveness active, or rechecking during a re-check): confirmed_exposed.total is the sum of confirmed_exposed.by_category, and confirmed_exposed.last_24h counts those first recorded in the last 24 h. Of the shadow_ai numbers, only confirmed_exposed counts exposed services. confirmed_exposed.window.from and confirmed_exposed.window.to are timestamps, not counts: when EchelonGraph's verifier ran the probe that last decided the oldest and the newest of those services, a span of probes made at different times. shadow_ai.observed counts every Certificate Transparency or Shodan observation on record, whatever its verification state: its numbers are observed, not exposed. They are observed.total; observed.by_category (the same observations by category); observed.last_24h (those first recorded in the last 24 h); observed.trend_30d (observations per UTC day over the last 30 days); and observed.top_products, observed.top_countries and observed.top_issuers (up to ten products, countries and issuers ranked by observations, where an issuer is the certificate's CA for a Certificate Transparency observation and the hosting operator Shodan reports for a Shodan one). shadow_ai.authentication counts observations by probe outcome: authentication.observed where a probe observed an authentication gate (a 401/403, a login page or an auth marker), and authentication.not_determined where the service answered but no probe could tell. Neither authentication count is part of confirmed_exposed, and observed.total minus confirmed_exposed.total is not a count of secured services. The shadow-AI poller block carries only running and last_run_at: last_run_at is when the radar's leader last completed a Certificate Transparency (crt.sh) cycle, and its running is true only when that was within 30 minutes of the answer. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "authentication": {
+ "additionalProperties": false,
+ "properties": {
+ "not_determined": {
+ "type": "number"
+ },
+ "observed": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ "confirmed_exposed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "observed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "last_observation": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "country": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "country",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_issuers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "issuer": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "issuer",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "trend_30d": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "date": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "date",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "poller": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "running": {
+ "type": "boolean"
+ }
+ },
+ "required": [
+ "running",
+ "last_run_at"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "enabled"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "running": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "running"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "radars": {
+ "description": "Each radar that could not be read, and why.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "unexpected_shape"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "type": "string"
+ },
+ "path": {
+ "type": "string"
+ },
+ "radar": {
+ "type": "string"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "radar",
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_cve2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "description": "What the answer covers; null where the answer says nothing about it.",
- "type": "null"
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "cpe_configurations": {
- "anyOf": [
- {
- "items": {},
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
- },
- "cpe_match": {
- "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_risk": {
- "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "ghsa_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_due_date": {
- "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_notes_urls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_required_action": {
- "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 22-01, by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
- "type": [
- "string",
- "null"
- ]
- },
- "kev_short_description": {
- "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
- "type": [
- "string",
- "null"
- ]
- },
- "modified": {
- "type": [
- "string",
- "null"
- ]
- },
- "patch_available": {
- "description": "true: EchelonGraph holds evidence of a fix for the CVE, its sources named in patch_evidence. false: no fix evidence is on record, which is not a finding that no fix exists. Once true it is never set back to false. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "patch_evidence": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_patch",
- "fixed_version",
- "release_reference",
- "nvd_patch_reference",
- "cna_patch_reference"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), nvd_patch_reference (an NVD reference tagged Patch) and cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
- },
- "published": {
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "remediation": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {},
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
- },
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_confidence": {
- "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
- "type": [
- "string",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "updated_at": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "type": "null"
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cna": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "short_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CNA that wrote the CVE record: short_name as the record gives it, and name, the CVE Program's name for that CNA (the short name where its list does not hold it). Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field."
+ },
+ "cna_solution": {
+ "description": "The sentence of the CVE record's solutions or workarounds, written by its CNA, that names a released fix, verbatim: what makes cna_solution patch evidence. It is the CNA's text, not EchelonGraph's advice. cna_solution_section says which of the two sections it is. Absent where the record's solutions name no fixed version, as well as where the field itself is: Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cna_solution_section": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "solution",
+ "workaround"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Which section of the CVE record cna_solution was read from: solution (the record's solutions) or workaround (its workarounds, read only where its solutions name no fix: a temporary measure the CNA lists beside its fix). A workaround's sentence is the record's workaround, never its solution. Present whenever cna_solution is; absent from an API older than the field."
+ },
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_public": {
+ "description": "When the vulnerability was made public, as the CVE record's CNA states it (the record's datePublic: \"if known, the date/time the vulnerability was disclosed publicly\"). It is the CNA's date, not the record's own publication date, which is published. Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_public_source": {
+ "description": "Whose date date_public is: cna, the CVE record's CNA. Absent whenever date_public is.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_ssvc_decision": {
+ "description": "The SSVC decision (Act, Attend, Track* or Track) EchelonGraph computes with CISA's decision table at medium mission impact. CISA publishes the table and, for some CVEs, its inputs, not a decision for a CVE. score_factors.ssvc gives the decision at low, medium and high mission impact, with each input and its source.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_notes_urls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_required_action": {
+ "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 26-04 (which replaced BOD 22-01 on 10 June 2026), by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_short_description": {
+ "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "patch_available": {
+ "description": "true: EchelonGraph holds, or once held, evidence of a fix for the CVE; patch_evidence names the sources it holds now. true beside an empty patch_evidence means evidence of a fix once held has since been withdrawn (patch_available is never set back to false), and fix_status (remediation.fix_status in the CVE's record) is the current reading, not patch_available. false: no fix evidence is on record, which is not a finding that no fix exists. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "patch_evidence": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_patch",
+ "fixed_version",
+ "release_reference",
+ "vendor_advisory_fix",
+ "nvd_patch_reference",
+ "cna_patch_reference",
+ "cna_solution",
+ "description_fix",
+ "vendor_fix_released"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), vendor_advisory_fix (a vendor advisory that lists a fix for the CVE under the vendor's own structured category: Red Hat's CSAF vendor_fix, Microsoft's Vendor Fix), nvd_patch_reference (an NVD reference tagged Patch), cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record), cna_solution (a sentence of the CVE record's solutions or workarounds, written by its CNA, that names a fixed version; relayed as cna_solution), description_fix (a sentence of the CVE description that names a fixed version) and vendor_fix_released (the vendor states, in the CVE record, that a fix is released and the record names no fixed version; check the vendor's advisory). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "remediation": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fix_status": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "basis": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "described_by": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "listed_in_patch_table": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "solution_by": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cna": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "section": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "available",
+ "fix_referenced",
+ "fix_merged",
+ "none_confirmed",
+ "unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "stated_in_record": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "unread_inputs": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "vendor_released": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The API's fix-status rule for the CVE, the one CVE Pulse pages show: state is available (a fix is on record), fix_referenced (a reference tagged Patch, often a source commit, and no release confirmed), fix_merged (an upstream fix merged, not yet in a tagged release), none_confirmed (no fix evidence on record, which is not a finding that no fix exists) or unknown (an input could not be read). basis is the step of the rule that decided it; described_by is the CVE description's sentence naming the fix, solution_by the CVE record's solution sentence naming it (statement) and the CNA that wrote it (cna), stated_in_record that patch_evidence counts a fix the CVE record states with no sentence to quote, listed_in_patch_table that a fixed version or patch row is on record; unread_inputs names any input the API could not read. vendor_released (basis vendor_fix_released) is the vendor's own statement that a fix is released where the CVE record names no fixed version: its sentence, verbatim (statement, or null), never a version, so the fixed release is the vendor advisory's to name. solution_by's section is workarounds when the fix sentence is the record's workaround, not its solution."
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: fix_status first (the API's fix-status rule: state, basis, described_by, solution_by, stated_in_record, listed_in_patch_table and unread_inputs), vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation by NVD, or patch or mitigation by the CNA), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_factors": {
+ "description": "EchelonGraph's evidence for its score. ssvc: the SSVC decision at every mission impact level, each input with its source. bod_26_04 (scorer v3.4 and later): CISA BOD 26-04's remediation timeline, if_publicly_exposed and if_not_publicly_exposed, each a list of CERT/CC's keys (3DF, 3D, 14D, 60D, FSU) named in timelines, with kev, automatable and technical_impact, each with its source; source cisa_bod_26_04_default is CISA's own default for a CVE not in KEV that nobody has assessed."
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_cwe2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "max_page": {
- "type": [
- "number",
- "null"
- ]
- },
- "page": {
- "description": "The page served.",
- "type": [
- "number",
- "null"
- ]
- },
- "page_requested": {
- "description": "The page asked for.",
- "type": "number"
- },
- "page_size": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "returned",
- "page",
- "page_requested",
- "page_size",
- "max_page"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "catalog_version": {
- "description": "The version of the MITRE CWE catalog name and description come from.",
- "type": [
- "string",
- "null"
- ]
- },
- "cves": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v2_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v2_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score: a score only when score_assessed is true.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "published": {
- "type": [
- "string",
- "null"
- ]
- },
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE; false: NOT YET SCORED, not scored 0.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "cwe_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "max_page": {
- "description": "The last page the API serves; a later page is answered as this one.",
- "type": [
- "number",
- "null"
- ]
- },
- "name": {
- "type": [
- "string",
- "null"
- ]
- },
- "order": {
- "description": "How cves is sorted, as the API states it; absent from an API older than the field, which sorted by CVE id.",
- "type": [
- "string",
- "null"
- ]
- },
- "page": {
- "type": [
- "number",
- "null"
- ]
- },
- "page_size": {
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "description": "The active CVEs classified under the CWE, rejected and reserved records left out.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "max_page": {
- "type": [
- "number",
- "null"
- ]
- },
- "page": {
- "description": "The page served.",
- "type": [
- "number",
- "null"
- ]
- },
- "page_requested": {
- "description": "The page asked for.",
- "type": "number"
- },
- "page_size": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "returned",
- "page",
- "page_requested",
- "page_size",
- "max_page"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "max_page": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "page": {
+ "description": "The page served.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "page_requested": {
+ "description": "The page asked for.",
+ "type": "number"
+ },
+ "page_size": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "returned",
+ "page",
+ "page_requested",
+ "page_size",
+ "max_page"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "catalog_version": {
+ "description": "The version of the MITRE CWE catalog name and description come from.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cves": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v2_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v2_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score: a score only when score_assessed is true.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE; false: NOT YET SCORED, not scored 0.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "cwe_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "max_page": {
+ "description": "The last page the API serves; a later page is answered as this one.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "order": {
+ "description": "How cves is sorted, as the API states it; absent from an API older than the field, which sorted by CVE id.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "page": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "page_size": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "The active CVEs classified under the CWE, rejected and reserved records left out.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "max_page": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "page": {
+ "description": "The page served.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "page_requested": {
+ "description": "The page asked for.",
+ "type": "number"
+ },
+ "page_size": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "returned",
+ "page",
+ "page_requested",
+ "page_size",
+ "max_page"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_vendor_advisory2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "known_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "rejected_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
- },
- "remediation": {
- "description": "The vendor's remediation as one text (the legacy field), beside remediations.",
- "type": [
- "string",
- "null"
- ]
- },
- "remediation_items_not_stored": {
- "description": "Items past the 64 stored per advisory.",
- "type": [
- "number",
- "null"
- ]
- },
- "remediation_kinds": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
- },
- "remediation_state": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "parsed",
- "none_in_source",
- "not_parsed",
- "withdrawn"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
- },
- "remediations": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVEs the item covers; [] for the whole advisory."
- },
- "fixed_build": {
- "type": [
- "string",
- "null"
- ]
- },
- "kind": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ]
- },
- "product_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "product_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "source_category": {
- "description": "The vendor's own name for the category.",
- "type": [
- "string",
- "null"
- ]
- },
- "source_subcategory": {
- "type": [
- "string",
- "null"
- ]
- },
- "text": {
- "description": "The vendor's text, verbatim but for HTML markup removed, untested by EchelonGraph; at most 2,000 characters (text_truncated, text_chars).",
- "type": [
- "string",
- "null"
- ]
- },
- "text_chars": {
- "type": [
- "number",
- "null"
- ]
- },
- "text_truncated": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "url": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each remediation the vendor lists, with its kind, the vendor's own category."
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_modified_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "withdrawn_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn_reason": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "known_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation": {
+ "description": "The vendor's remediation as one text (the legacy field), beside remediations.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "remediation_items_not_stored": {
+ "description": "Items past the 64 stored per advisory.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "remediations": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVEs the item covers; [] for the whole advisory."
+ },
+ "fixed_build": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "product_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "source_category": {
+ "description": "The vendor's own name for the category.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_subcategory": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text": {
+ "description": "The vendor's text, verbatim but for HTML markup removed, untested by EchelonGraph; at most 2,000 characters (text_truncated, text_chars).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text_chars": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "text_truncated": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each remediation the vendor lists, with its kind, the vendor's own category."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_modified_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "withdrawn_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]kev_recent2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog": {
- "const": "CISA KEV catalog",
- "type": "string"
- },
- "catalog_count": {
- "description": "CISA's own count, in the catalog last fetched.",
- "type": [
- "number",
- "null"
- ]
- },
- "has_more": {
- "description": "Whether next_cursor names a further page.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed_total": {
- "description": "Every CVE EchelonGraph holds as KEV-listed.",
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "Rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "description": "CVEs matching the filters.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "catalog",
- "total",
- "returned",
- "kev_listed_total",
- "catalog_count",
- "limit",
- "has_more"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "catalog": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "catalog_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "catalog_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "date_released": {
- "type": [
- "string",
- "null"
- ]
- },
- "feed_url": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_successful_fetch_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "filters": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {},
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "generated_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev": {
- "description": "Newest kev_added_date first; rows within one date are ordered by cve_id.",
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "eg_kev_tier": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_due_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_product": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_vuln_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "our_first_seen_kev": {
- "description": "When EchelonGraph's poller first recorded the CVE entering the catalog; null where no such record exists.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "kev_listed_total": {
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "method": {
- "type": [
- "string",
- "null"
- ]
- },
- "next_cursor": {
- "type": [
- "string",
- "null"
- ]
- },
- "notes": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "order": {
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "date_released": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_successful_fetch_at": {
- "description": "When CISA last answered our poll of its feed: a 200 we applied, or a 304 Not Modified.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "last_successful_fetch_at",
- "catalog_version",
- "date_released"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The producing radar's last completed check (last_run_at), where the API serves one."
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog": {
- "const": "CISA KEV catalog",
- "type": "string"
- },
- "catalog_count": {
- "description": "CISA's own count, in the catalog last fetched.",
- "type": [
- "number",
- "null"
- ]
- },
- "has_more": {
- "description": "Whether next_cursor names a further page.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed_total": {
- "description": "Every CVE EchelonGraph holds as KEV-listed.",
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "Rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "description": "CVEs matching the filters.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "catalog",
- "total",
- "returned",
- "kev_listed_total",
- "catalog_count",
- "limit",
- "has_more"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog": {
+ "const": "CISA KEV catalog",
+ "type": "string"
+ },
+ "catalog_count": {
+ "description": "CISA's own count, in the catalog last fetched.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "has_more": {
+ "description": "Whether next_cursor names a further page.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed_total": {
+ "description": "Every CVE EchelonGraph holds as KEV-listed.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "Rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "CVEs matching the filters.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "catalog",
+ "total",
+ "returned",
+ "kev_listed_total",
+ "catalog_count",
+ "limit",
+ "has_more"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "catalog": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "catalog_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "catalog_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_released": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "feed_url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_successful_fetch_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "filters": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {},
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "generated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev": {
+ "description": "Newest kev_added_date first; rows within one date are ordered by cve_id.",
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "eg_kev_tier": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_vuln_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "our_first_seen_kev": {
+ "description": "When EchelonGraph's poller first recorded the CVE entering the catalog; null where no such record exists.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "kev_listed_total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "next_cursor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "notes": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "order": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_released": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_successful_fetch_at": {
+ "description": "When CISA last answered our poll of its feed: a 200 we applied, or a 304 Not Modified.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_successful_fetch_at",
+ "catalog_version",
+ "date_released"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog": {
+ "const": "CISA KEV catalog",
+ "type": "string"
+ },
+ "catalog_count": {
+ "description": "CISA's own count, in the catalog last fetched.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "has_more": {
+ "description": "Whether next_cursor names a further page.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed_total": {
+ "description": "Every CVE EchelonGraph holds as KEV-listed.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "Rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "CVEs matching the filters.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "catalog",
+ "total",
+ "returned",
+ "kev_listed_total",
+ "catalog_count",
+ "limit",
+ "has_more"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]scan_manifest2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls read more than once (the same package and version in two places) and sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "entries_pinned": {
- "description": "Entries pinned to one version across the files, duplicates included.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files": {
- "description": "Files passed.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files_not_read": {
- "description": "The ones refused or unreadable: nothing in them is checked, and none is clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files_read": {
- "description": "Of those, the ones read.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_checked": {
- "description": "Entries not sent (data.not_checked): not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_checked_by_reason": {
- "additionalProperties": false,
- "description": "not_checked, counted by reason.",
- "properties": {
- "local_path": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "unsupported_line": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "vcs_source": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "version_unpinned": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "version_unresolved": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "version_unpinned",
- "version_unresolved",
- "local_path",
- "vcs_source",
- "unsupported_line"
- ],
- "type": "object"
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "files",
- "files_read",
- "files_not_read",
- "entries_pinned",
- "duplicates_removed",
- "not_checked",
- "not_checked_by_reason",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "answered_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "manifest": {
- "additionalProperties": false,
- "description": "Each file passed, in order, and how it was read. Filenames and contents are not sent to the API.",
- "properties": {
- "files": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "ecosystem": {
- "description": "The OSV ecosystem of the purls read from it.",
- "type": [
- "string",
- "null"
- ]
- },
- "filename": {
- "type": "string"
- },
- "format": {
- "anyOf": [
- {
- "enum": [
- "requirements.txt",
- "go.mod",
- "package-lock.json",
- "Cargo.lock",
- "Gemfile.lock",
- "composer.lock",
- "poetry.lock",
- "gradle.lockfile"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The format the file was read as: set by format, or read from the filename; null when it was not read."
- },
- "not_checked": {
- "description": "Entries not sent, listed in data.not_checked: not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "notes": {
- "description": "How this file was read where that limits what its verdicts cover (a go.mod below go 1.17).",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "purls": {
- "description": "Entries pinned to one version, read as purls (duplicates included).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "read": {
- "description": "false: the file was refused or could not be read, and nothing in it is checked (not clean).",
- "type": "boolean"
- },
- "refused": {
- "description": "Why the file was not read, and the file to pass instead where there is one; null when it was read.",
- "type": [
- "string",
- "null"
- ]
- },
- "replaced": {
- "description": "go.mod replace directives applied: the module required, and the module and version checked instead.",
- "items": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "type": "string"
- },
- "to": {
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "skipped": {
- "description": "Entries that are not dependencies (a package-lock's root entry, the project itself).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "filename",
- "format",
- "ecosystem",
- "read",
- "refused",
- "purls",
- "not_checked",
- "skipped",
- "notes",
- "replaced"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "required": [
- "files"
- ],
- "type": "object"
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_checked": {
- "description": "Each entry not sent to the API, with its file, line and reason: not checked, and not clean.",
- "items": {
- "additionalProperties": false,
- "properties": {
- "detail": {
- "type": "string"
- },
- "file": {
- "type": "string"
- },
- "line": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "1-based line; null in a JSON lockfile, whose entries spec names by key."
- },
- "name": {
- "type": [
- "string",
- "null"
- ]
- },
- "reason": {
- "description": "version_unpinned: a range or wildcard, not one version; version_unresolved: no single registry version (none given, a branch, or an excluded go.mod version); local_path: a directory, file or workspace member; vcs_source: a VCS checkout; unsupported_line: a line or entry this tool does not read (another file named by -r or -c, a direct URL, another registry).",
- "enum": [
- "version_unpinned",
- "version_unresolved",
- "local_path",
- "vcs_source",
- "unsupported_line"
- ],
- "type": "string"
- },
- "spec": {
- "description": "What the file says for the entry: its line, or its lockfile key and version (at most 200 characters).",
- "type": "string"
- }
- },
- "required": [
- "file",
- "name",
- "spec",
- "reason",
- "line",
- "detail"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "not_sent_purls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
- },
- "results": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisories_considered": {
- "type": [
- "number",
- "null"
- ]
- },
- "assessed": {
- "description": "Whether the matcher produced a verdict for this component. false is never clean.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "code": {
- "type": [
- "string",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "error": {
- "type": [
- "string",
- "null"
- ]
- },
- "index": {
- "type": [
- "number",
- "null"
- ]
- },
- "input_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "matched_package": {
- "description": "The package name the advisories were looked up by (#2836): the purl's own name, or, for a deb or apk purl with an upstream qualifier, the source package it names, which is how Debian and Alpine file advisories.",
- "type": [
- "string",
- "null"
- ]
- },
- "matched_version_from": {
- "description": "Upstream rows: upstream when the qualifier named a version (upstream=name@version) and it was used, purl when the purl's own version was.",
- "type": [
- "string",
- "null"
- ]
- },
- "matched_via": {
- "description": "Which name matched_package is: purl_name (the purl's name), upstream (the purl's upstream qualifier) or coordinates (the component's package).",
- "type": [
- "string",
- "null"
- ]
- },
- "matches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "epss_score": {
- "description": "The CVE's EPSS score (FIRST), as EchelonGraph's record holds it; null when it has none.",
- "type": [
- "number",
- "null"
- ]
- },
- "fixed_in": {
- "description": "The fixed bound of the advisory interval that holds this component's version, always above it. null when that interval records no fix (it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which.",
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_in_reason": {
- "description": "Why fixed_in is null; absent when fixed_in is a version.",
- "type": [
- "string",
- "null"
- ]
- },
- "interval": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "fixed": {
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The advisory interval that holds this component's version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
- },
- "kev_listed": {
- "description": "Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, as EchelonGraph's record holds it.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "match_reason": {
- "description": "Why the advisory applies, with the advisory interval the version falls inside: \"[A, B)\" names the fixed version B, \"[A, B]\" the last affected version B. On an upstream row it ends by naming the source package and the purl name.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
- "type": [
- "string",
- "null"
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "purl": {
- "type": [
- "string",
- "null"
- ]
- },
- "purl_name": {
- "description": "Upstream rows: the purl's own (binary) package name, not looked up.",
- "type": [
- "string",
- "null"
- ]
- },
- "undetermined": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "verdict": {
- "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
- "type": [
- "string",
- "null"
- ]
- },
- "version": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "summary": {
- "additionalProperties": {},
- "properties": {
- "affected": {
- "type": [
- "number",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "corpus_cache_max_age_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "elapsed_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookups": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_affected": {
- "description": "Components with a decided, clean verdict.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed": {
- "description": "Components with no verdict: not clean.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_by_reason": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "advisory_lookup_failed": {
- "type": "number"
- },
- "candidate_window_truncated": {
- "type": "number"
- },
- "distro_release_unknown": {
- "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
- "type": "number"
- },
- "invalid_component": {
- "type": "number"
- },
- "no_decidable_advisory": {
- "type": "number"
- },
- "package_not_in_advisory_corpus": {
- "type": "number"
- },
- "purl_type_unsupported": {
- "type": "number"
- },
- "time_budget": {
- "description": "Components the batch's time budget ran out before: not clean; check them again.",
- "type": "number"
- },
- "version_missing": {
- "type": "number"
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The not_assessed components, counted by not_assessed_reason."
- },
- "partial": {
- "description": "true when the time budget ran out before every component was looked up.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "time_budget_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "undetermined": {
- "description": "Components whose advisories could not all be decided and none matched: not clean.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "required": [
- "manifest",
- "not_checked"
- ],
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls read more than once (the same package and version in two places) and sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "entries_pinned": {
- "description": "Entries pinned to one version across the files, duplicates included.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files": {
- "description": "Files passed.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files_not_read": {
- "description": "The ones refused or unreadable: nothing in them is checked, and none is clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "files_read": {
- "description": "Of those, the ones read.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_checked": {
- "description": "Entries not sent (data.not_checked): not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_checked_by_reason": {
- "additionalProperties": false,
- "description": "not_checked, counted by reason.",
- "properties": {
- "local_path": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "unsupported_line": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "vcs_source": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "version_unpinned": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "version_unresolved": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "version_unpinned",
- "version_unresolved",
- "local_path",
- "vcs_source",
- "unsupported_line"
- ],
- "type": "object"
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "files",
- "files_read",
- "files_not_read",
- "entries_pinned",
- "duplicates_removed",
- "not_checked",
- "not_checked_by_reason",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls read more than once (the same package and version in two places) and sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "entries_pinned": {
+ "description": "Entries pinned to one version across the files, duplicates included.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files": {
+ "description": "Files passed.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files_not_read": {
+ "description": "The ones refused or unreadable: nothing in them is checked, and none is clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files_read": {
+ "description": "Of those, the ones read.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_checked": {
+ "description": "Entries not sent (data.not_checked): not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_checked_by_reason": {
+ "additionalProperties": false,
+ "description": "not_checked, counted by reason.",
+ "properties": {
+ "local_path": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "unsupported_line": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "vcs_source": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "version_unpinned": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "version_unresolved": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "version_unpinned",
+ "version_unresolved",
+ "local_path",
+ "vcs_source",
+ "unsupported_line"
+ ],
+ "type": "object"
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "files",
+ "files_read",
+ "files_not_read",
+ "entries_pinned",
+ "duplicates_removed",
+ "not_checked",
+ "not_checked_by_reason",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "answered_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "manifest": {
+ "additionalProperties": false,
+ "description": "Each file passed, in order, and how it was read. Filenames and contents are not sent to the API.",
+ "properties": {
+ "files": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "ecosystem": {
+ "description": "The OSV ecosystem of the purls read from it.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "filename": {
+ "type": "string"
+ },
+ "format": {
+ "anyOf": [
+ {
+ "enum": [
+ "requirements.txt",
+ "go.mod",
+ "package-lock.json",
+ "Cargo.lock",
+ "Gemfile.lock",
+ "composer.lock",
+ "poetry.lock",
+ "gradle.lockfile"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The format the file was read as: set by format, or read from the filename; null when it was not read."
+ },
+ "not_checked": {
+ "description": "Entries not sent, listed in data.not_checked: not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "notes": {
+ "description": "How this file was read where that limits what its verdicts cover (a go.mod below go 1.17).",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "purls": {
+ "description": "Entries pinned to one version, read as purls (duplicates included).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "read": {
+ "description": "false: the file was refused or could not be read, and nothing in it is checked (not clean).",
+ "type": "boolean"
+ },
+ "refused": {
+ "description": "Why the file was not read, and the file to pass instead where there is one; null when it was read.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "replaced": {
+ "description": "go.mod replace directives applied: the module required, and the module and version checked instead.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "type": "string"
+ },
+ "to": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "skipped": {
+ "description": "Entries that are not dependencies (a package-lock's root entry, the project itself).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "filename",
+ "format",
+ "ecosystem",
+ "read",
+ "refused",
+ "purls",
+ "not_checked",
+ "skipped",
+ "notes",
+ "replaced"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "files"
+ ],
+ "type": "object"
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_checked": {
+ "description": "Each entry not sent to the API, with its file, line and reason: not checked, and not clean.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "detail": {
+ "type": "string"
+ },
+ "file": {
+ "type": "string"
+ },
+ "line": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "1-based line; null in a JSON lockfile, whose entries spec names by key."
+ },
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "reason": {
+ "description": "version_unpinned: a range or wildcard, not one version; version_unresolved: no single registry version (none given, a branch, or an excluded go.mod version); local_path: a directory, file or workspace member; vcs_source: a VCS checkout; unsupported_line: a line or entry this tool does not read (another file named by -r or -c, a direct URL, another registry).",
+ "enum": [
+ "version_unpinned",
+ "version_unresolved",
+ "local_path",
+ "vcs_source",
+ "unsupported_line"
+ ],
+ "type": "string"
+ },
+ "spec": {
+ "description": "What the file says for the entry: its line, or its lockfile key and version (at most 200 characters).",
+ "type": "string"
+ }
+ },
+ "required": [
+ "file",
+ "name",
+ "spec",
+ "reason",
+ "line",
+ "detail"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "not_sent_purls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
+ },
+ "results": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories_considered": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "assessed": {
+ "description": "Whether the matcher produced a verdict for this component. false is never clean.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "code": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "error": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "index": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "input_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_package": {
+ "description": "The package name the advisories were looked up by (#2836): the purl's own name, or, for a deb or apk purl with an upstream qualifier, the source package it names, which is how Debian and Alpine file advisories.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_version_from": {
+ "description": "Upstream rows: upstream when the qualifier named a version (upstream=name@version) and it was used, purl when the purl's own version was.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_via": {
+ "description": "Which name matched_package is: purl_name (the purl's name), upstream (the purl's upstream qualifier) or coordinates (the component's package).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The CVE's EPSS score (FIRST), as EchelonGraph's record holds it; null when it has none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "fixed_in": {
+ "description": "The lowest version above this component's that no affected interval of the CVE's record for the package holds, always above it: the fixed bound of the interval that holds the component's version, moved past any overlapping interval that still holds that bound (fixed_in_detail then names it). null when no such version is on record (an interval on the way records no fix: it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_detail": {
+ "description": "Set when fixed_in is not the fixed bound of the interval that holds the component's version: the overlapping intervals of the same record it moved past, which still hold that bound.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The advisory interval that holds this component's version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
+ },
+ "kev_listed": {
+ "description": "Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, as EchelonGraph's record holds it.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "match_reason": {
+ "description": "Why the advisory applies, with the advisory interval the version falls inside: \"[A, B)\" names that interval's fixed bound B (another interval of the advisory can still hold B; fixed_in is the version past them all), \"[A, B]\" the last affected version B. On an upstream row it ends by naming the source package and the purl name.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "matches_truncated": {
+ "additionalProperties": false,
+ "description": "Present only on a row whose matches the structured result's cut (DATA CUT) shortened or left out: total, the row's matches in the answer; returned, the ones data keeps (its first, highest effective_score first); and, while they fit, of all its matches, the CVE IDs KEV-listed (kev_listed_cve_ids) or used in ransomware (ransomware_cve_ids), and the distinct fixed_in versions (fixed_in_versions). The same call with full: true returns every match.",
+ "properties": {
+ "fixed_in_versions": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "kev_listed_cve_ids": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "ransomware_cve_ids": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl_name": {
+ "description": "Upstream rows: the purl's own (binary) package name, not looked up.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "verdict": {
+ "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "summary": {
+ "additionalProperties": {},
+ "properties": {
+ "affected": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "corpus_cache_max_age_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "elapsed_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookups": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_affected": {
+ "description": "Components with a decided, clean verdict.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed": {
+ "description": "Components with no verdict: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_by_reason": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_lookup_failed": {
+ "type": "number"
+ },
+ "candidate_window_truncated": {
+ "type": "number"
+ },
+ "distro_release_unknown": {
+ "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
+ "type": "number"
+ },
+ "invalid_component": {
+ "type": "number"
+ },
+ "no_decidable_advisory": {
+ "type": "number"
+ },
+ "package_not_in_advisory_corpus": {
+ "type": "number"
+ },
+ "purl_type_unsupported": {
+ "type": "number"
+ },
+ "time_budget": {
+ "description": "Components the batch's time budget ran out before: not clean; check them again.",
+ "type": "number"
+ },
+ "version_missing": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The not_assessed components, counted by not_assessed_reason."
+ },
+ "partial": {
+ "description": "true when the time budget ran out before every component was looked up.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "time_budget_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "description": "Components whose advisories could not all be decided and none matched: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "manifest",
+ "not_checked"
+ ],
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls read more than once (the same package and version in two places) and sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "entries_pinned": {
+ "description": "Entries pinned to one version across the files, duplicates included.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files": {
+ "description": "Files passed.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files_not_read": {
+ "description": "The ones refused or unreadable: nothing in them is checked, and none is clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "files_read": {
+ "description": "Of those, the ones read.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_checked": {
+ "description": "Entries not sent (data.not_checked): not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_checked_by_reason": {
+ "additionalProperties": false,
+ "description": "not_checked, counted by reason.",
+ "properties": {
+ "local_path": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "unsupported_line": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "vcs_source": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "version_unpinned": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "version_unresolved": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "version_unpinned",
+ "version_unresolved",
+ "local_path",
+ "vcs_source",
+ "unsupported_line"
+ ],
+ "type": "object"
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "files",
+ "files_read",
+ "files_not_read",
+ "entries_pinned",
+ "duplicates_removed",
+ "not_checked",
+ "not_checked_by_reason",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]search_cves2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "The rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "total_counted",
- "total_is_lower_bound",
- "search_relaxed",
- "returned",
- "limit",
- "offset"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "cves": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cpe_configurations": {
- "anyOf": [
- {
- "items": {},
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
- },
- "cpe_match": {
- "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_risk": {
- "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "ghsa_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_due_date": {
- "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_notes_urls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_required_action": {
- "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 22-01, by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
- "type": [
- "string",
- "null"
- ]
- },
- "kev_short_description": {
- "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
- "type": [
- "string",
- "null"
- ]
- },
- "modified": {
- "type": [
- "string",
- "null"
- ]
- },
- "patch_available": {
- "description": "true: EchelonGraph holds evidence of a fix for the CVE, its sources named in patch_evidence. false: no fix evidence is on record, which is not a finding that no fix exists. Once true it is never set back to false. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "patch_evidence": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_patch",
- "fixed_version",
- "release_reference",
- "nvd_patch_reference",
- "cna_patch_reference"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), nvd_patch_reference (an NVD reference tagged Patch) and cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
- },
- "published": {
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "remediation": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {},
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
- },
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_confidence": {
- "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
- "type": [
- "string",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "updated_at": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "description": "true: a search phrase was relaxed to all of its words.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "description": "false: the matches were not counted, so total is not a count.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "description": "true: there are at least total matches.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "The rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "total_counted",
- "total_is_lower_bound",
- "search_relaxed",
- "returned",
- "limit",
- "offset"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "The rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cves": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cna": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "short_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CNA that wrote the CVE record: short_name as the record gives it, and name, the CVE Program's name for that CNA (the short name where its list does not hold it). Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field."
+ },
+ "cna_solution": {
+ "description": "The sentence of the CVE record's solutions or workarounds, written by its CNA, that names a released fix, verbatim: what makes cna_solution patch evidence. It is the CNA's text, not EchelonGraph's advice. cna_solution_section says which of the two sections it is. Absent where the record's solutions name no fixed version, as well as where the field itself is: Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cna_solution_section": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "solution",
+ "workaround"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Which section of the CVE record cna_solution was read from: solution (the record's solutions) or workaround (its workarounds, read only where its solutions name no fix: a temporary measure the CNA lists beside its fix). A workaround's sentence is the record's workaround, never its solution. Present whenever cna_solution is; absent from an API older than the field."
+ },
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_public": {
+ "description": "When the vulnerability was made public, as the CVE record's CNA states it (the record's datePublic: \"if known, the date/time the vulnerability was disclosed publicly\"). It is the CNA's date, not the record's own publication date, which is published. Absent where EchelonGraph has not read the CVE record's CNA container yet, where the record has none, for a REJECTED CVE, and from an API older than the field.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_public_source": {
+ "description": "Whose date date_public is: cna, the CVE record's CNA. Absent whenever date_public is.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_ssvc_decision": {
+ "description": "The SSVC decision (Act, Attend, Track* or Track) EchelonGraph computes with CISA's decision table at medium mission impact. CISA publishes the table and, for some CVEs, its inputs, not a decision for a CVE. score_factors.ssvc gives the decision at low, medium and high mission impact, with each input and its source.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_notes_urls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_required_action": {
+ "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 26-04 (which replaced BOD 22-01 on 10 June 2026), by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_short_description": {
+ "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "patch_available": {
+ "description": "true: EchelonGraph holds, or once held, evidence of a fix for the CVE; patch_evidence names the sources it holds now. true beside an empty patch_evidence means evidence of a fix once held has since been withdrawn (patch_available is never set back to false), and fix_status (remediation.fix_status in the CVE's record) is the current reading, not patch_available. false: no fix evidence is on record, which is not a finding that no fix exists. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "patch_evidence": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_patch",
+ "fixed_version",
+ "release_reference",
+ "vendor_advisory_fix",
+ "nvd_patch_reference",
+ "cna_patch_reference",
+ "cna_solution",
+ "description_fix",
+ "vendor_fix_released"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), vendor_advisory_fix (a vendor advisory that lists a fix for the CVE under the vendor's own structured category: Red Hat's CSAF vendor_fix, Microsoft's Vendor Fix), nvd_patch_reference (an NVD reference tagged Patch), cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record), cna_solution (a sentence of the CVE record's solutions or workarounds, written by its CNA, that names a fixed version; relayed as cna_solution), description_fix (a sentence of the CVE description that names a fixed version) and vendor_fix_released (the vendor states, in the CVE record, that a fix is released and the record names no fixed version; check the vendor's advisory). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "remediation": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fix_status": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "basis": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "described_by": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "listed_in_patch_table": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "solution_by": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cna": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "section": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "available",
+ "fix_referenced",
+ "fix_merged",
+ "none_confirmed",
+ "unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "stated_in_record": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "unread_inputs": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "vendor_released": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "statement": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The API's fix-status rule for the CVE, the one CVE Pulse pages show: state is available (a fix is on record), fix_referenced (a reference tagged Patch, often a source commit, and no release confirmed), fix_merged (an upstream fix merged, not yet in a tagged release), none_confirmed (no fix evidence on record, which is not a finding that no fix exists) or unknown (an input could not be read). basis is the step of the rule that decided it; described_by is the CVE description's sentence naming the fix, solution_by the CVE record's solution sentence naming it (statement) and the CNA that wrote it (cna), stated_in_record that patch_evidence counts a fix the CVE record states with no sentence to quote, listed_in_patch_table that a fixed version or patch row is on record; unread_inputs names any input the API could not read. vendor_released (basis vendor_fix_released) is the vendor's own statement that a fix is released where the CVE record names no fixed version: its sentence, verbatim (statement, or null), never a version, so the fixed release is the vendor advisory's to name. solution_by's section is workarounds when the fix sentence is the record's workaround, not its solution."
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: fix_status first (the API's fix-status rule: state, basis, described_by, solution_by, stated_in_record, listed_in_patch_table and unread_inputs), vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation by NVD, or patch or mitigation by the CNA), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_factors": {
+ "description": "EchelonGraph's evidence for its score. ssvc: the SSVC decision at every mission impact level, each input with its source. bod_26_04 (scorer v3.4 and later): CISA BOD 26-04's remediation timeline, if_publicly_exposed and if_not_publicly_exposed, each a list of CERT/CC's keys (3DF, 3D, 14D, 60D, FSU) named in timelines, with kev, automatable and technical_impact, each with its source; source cisa_bod_26_04_default is CISA's own default for a CVE not in KEV that nobody has assessed."
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "description": "true: a search phrase was relaxed to all of its words.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "description": "false: the matches were not counted, so total is not a count.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "description": "true: there are at least total matches.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "The rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]search_vendor_advisories2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "rejected_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
- },
- "remediation_kinds": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
- },
- "remediation_state": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "parsed",
- "none_in_source",
- "not_parsed",
- "withdrawn"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "description": "Whether a free-text search filtered this answer.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, vendor_advisory_id, affected_products and cve_ids (search_match substring). A query of 1 or 2 characters matches whole words only (search_match word): it must equal, ignoring case, a whole word (a run of letters and digits) of one of those, so xz finds xz-utils but not xzibit, and a 1- or 2-character query with any other character, such as c#, matches nothing.",
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count. A search counts at most 1,000 matches: past that, total is 1000 and total_capped is true, which means 1,000 or more (the note writes 1,000+), never exactly 1,000; paging past it still works. Without a query, total is the exact count and total_capped is false.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "description": "Whether a free-text search filtered this answer.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, vendor_advisory_id, affected_products and cve_ids (search_match substring). A query of 1 or 2 characters matches whole words only (search_match word): it must equal, ignoring case, a whole word (a run of letters and digits) of one of those, so xz finds xz-utils but not xzibit, and a 1- or 2-character query with any other character, such as c#, matches nothing.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count. A search counts at most 1,000 matches: past that, total is 1000 and total_capped is true, which means 1,000 or more (the note writes 1,000+), never exactly 1,000; paging past it still works. Without a query, total is the exact count and total_capped is false.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]vendor_advisories_for_cve2 fields changedInput schema / properties / fullAdded value: +{
+ "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+ "type": "boolean"
+}Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "rejected_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
- },
- "remediation_kinds": {
- "anyOf": [
- {
- "items": {
- "anyOf": [
- {
- "enum": [
- "vendor_fix",
- "workaround",
- "mitigation",
- "no_fix_planned",
- "none_available",
- "other"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
- },
- "remediation_state": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "parsed",
- "none_in_source",
- "not_parsed",
- "withdrawn"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cve_rejected": {
- "description": "true: the CVE record of cve_id was rejected (withdrawn) by its numbering authority, so these advisories name a rejected record, not an active vulnerability; null when that could not be checked.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cve_rejected": {
+ "description": "true: the CVE record of cve_id was rejected (withdrawn) by its numbering authority, so these advisories name a rejected record, not an active vulnerability; null when that could not be checked.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": false,
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]v2.7.0check_affected1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "assessed": {
- "description": "The answer's assessed, first: null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "degraded": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookup": {
- "description": "Which lookup path this call asked for.",
- "enum": [
- "cpe",
- "registry"
- ],
- "type": "string"
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "assessed",
- "not_assessed_reason",
- "lookup",
- "match_layer",
- "count",
- "capped",
- "candidates_capped",
- "excluded_count",
- "undetermined_count",
- "not_affected_count",
- "degraded"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories_considered": {
- "type": [
- "number",
- "null"
- ]
- },
- "assessed": {
- "description": "Read first. true: the lookup evaluated this component. false: it did not, and count 0 says nothing about whether this version is affected.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidate_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "degraded": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "ecosystem_recognised": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded": {},
- "excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "matches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cpe_vendor": {
- "description": "The vendor NVD's CPE asserts for this match.",
- "type": [
- "string",
- "null"
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v2_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score: present only when score_assessed is true.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "effective_score": {
- "description": "The best real score held for the CVE (EchelonGraph's, else CVSS), the number the matches are ranked by.",
- "type": [
- "number",
- "null"
- ]
- },
- "effective_severity": {
- "description": "The band of effective_score; absent or empty when the CVE has no band at all (unrated, not harmless).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_score": {
- "description": "EPSS exploitation probability, 0 to 1.",
- "type": [
- "number",
- "null"
- ]
- },
- "kev_listed": {
- "description": "Listed in CISA-KEV: known to be exploited.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "match_confidence": {
- "type": [
- "number",
- "null"
- ]
- },
- "match_method": {
- "type": [
- "string",
- "null"
- ]
- },
- "match_reason": {
- "type": [
- "string",
- "null"
- ]
- },
- "matched_criteria": {
- "type": [
- "string",
- "null"
- ]
- },
- "ransomware": {
- "description": "CISA-KEV records known use in ransomware campaigns.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. false: NOT YET SCORED, and echelongraph_score is withheld.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "description": "NVD's own CVSS v3 band, as provenance: it can be NONE for a CVE NVD rated only under CVSS v2. Rank and display on effective_severity.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_unknown": {
- "description": "true: the vendor was not verified, so the match is real but its attribution to your vendor is not.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "version_evidence": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "product": {
- "type": [
- "string",
- "null"
- ]
- },
- "product_named_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undecidable_excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undecided_candidate_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "undetermined": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "detail": {
- "type": [
- "string",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "reason": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "version": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "assessed": {
- "description": "The answer's assessed, first: null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "degraded": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "excluded_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookup": {
- "description": "Which lookup path this call asked for.",
- "enum": [
- "cpe",
- "registry"
- ],
- "type": "string"
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "product_not_in_cpe_corpus",
- "package_not_cpe_nameable",
- "candidate_load_pending",
- "candidate_window_truncated",
- "package_not_in_advisory_corpus",
- "no_decidable_advisory",
- "advisory_lookup_failed"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ],
- "description": "Why assessed is false; empty or absent when it is true."
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "assessed",
- "not_assessed_reason",
- "lookup",
- "match_layer",
- "count",
- "capped",
- "candidates_capped",
- "excluded_count",
- "undetermined_count",
- "not_affected_count",
- "degraded"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "assessed": {
+ "description": "The answer's assessed, first: null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "degraded": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookup": {
+ "description": "Which lookup path this call asked for.",
+ "enum": [
+ "cpe",
+ "registry"
+ ],
+ "type": "string"
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "assessed",
+ "not_assessed_reason",
+ "lookup",
+ "match_layer",
+ "count",
+ "capped",
+ "candidates_capped",
+ "excluded_count",
+ "undetermined_count",
+ "not_affected_count",
+ "degraded"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories_considered": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "assessed": {
+ "description": "count depends on it. true: the lookup evaluated this component. false: it did not, and count 0 says nothing about whether this version is affected.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidate_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "description": "true: not every candidate CVE was loaded.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "description": "true: the match list stopped at its cap.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "degraded": {
+ "description": "true: the lookup ran out of time.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ecosystem_recognised": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded": {},
+ "excluded_count": {
+ "description": "CPE candidates suppressed by the vendor or platform gate.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_layer": {
+ "description": "Which lookup path answered.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_vendor": {
+ "description": "The vendor NVD's CPE asserts for this match.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v2_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score: present only when score_assessed is true.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "effective_score": {
+ "description": "The best real score held for the CVE (EchelonGraph's, else CVSS), the number the matches are ranked by.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "effective_severity": {
+ "description": "The band of effective_score; absent or empty when the CVE has no band at all (unrated, not harmless).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "EPSS exploitation probability, 0 to 1.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "fixed_in": {
+ "description": "Registry match: the fixed bound of the advisory interval that holds this version, always above it. null when that interval records no fix (it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which. Absent on a CPE match.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Registry match: the advisory interval that holds this version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
+ },
+ "kev_listed": {
+ "description": "Listed in CISA-KEV: known to be exploited.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "match_confidence": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "match_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_criteria": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ransomware": {
+ "description": "CISA-KEV records known use in ransomware campaigns.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. false: NOT YET SCORED, and echelongraph_score is withheld.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "description": "NVD's own CVSS v3 band, as provenance: it can be NONE for a CVE NVD rated only under CVSS v2. Rank and display on effective_severity.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_unknown": {
+ "description": "true: the vendor was not verified, so the match is real but its attribution to your vendor is not.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "version_evidence": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "not_affected_count": {
+ "description": "Advisories decided as not affecting this version.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "product_named_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undecidable_excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undecided_candidate_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "detail": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "assessed": {
+ "description": "The answer's assessed, first: null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "degraded": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "excluded_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookup": {
+ "description": "Which lookup path this call asked for.",
+ "enum": [
+ "cpe",
+ "registry"
+ ],
+ "type": "string"
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "product_not_in_cpe_corpus",
+ "package_not_cpe_nameable",
+ "candidate_load_pending",
+ "candidate_window_truncated",
+ "package_not_in_advisory_corpus",
+ "no_decidable_advisory",
+ "advisory_lookup_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ],
+ "description": "Why assessed is false; empty or absent when it is true."
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "assessed",
+ "not_assessed_reason",
+ "lookup",
+ "match_layer",
+ "count",
+ "capped",
+ "candidates_capped",
+ "excluded_count",
+ "undetermined_count",
+ "not_affected_count",
+ "degraded"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]check_sbom1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "components_in_document": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls that appeared more than once and were sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "input": {
- "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
- "enum": [
- "purls",
- "cyclonedx",
- "spdx"
- ],
- "type": "string"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "with_purl": {
- "description": "Of those, the ones carrying a purl.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "without_purl": {
- "description": "The ones without a purl: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "input",
- "components_in_document",
- "with_purl",
- "without_purl",
- "duplicates_removed",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "answered_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "match_layer": {
- "type": [
- "string",
- "null"
- ]
- },
- "not_sent_purls": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
- },
- "results": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisories_considered": {
- "type": [
- "number",
- "null"
- ]
- },
- "assessed": {
- "description": "Whether the matcher produced a verdict for this component. false is never clean.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "candidates_capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "capped": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "code": {
- "type": [
- "string",
- "null"
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "error": {
- "type": [
- "string",
- "null"
- ]
- },
- "index": {
- "type": [
- "number",
- "null"
- ]
- },
- "input_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "matches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "not_affected_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_reason": {
- "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
- "type": [
- "string",
- "null"
- ]
- },
- "package": {
- "type": [
- "string",
- "null"
- ]
- },
- "purl": {
- "type": [
- "string",
- "null"
- ]
- },
- "undetermined": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "undetermined_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "verdict": {
- "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
- "type": [
- "string",
- "null"
- ]
- },
- "version": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "summary": {
- "additionalProperties": {},
- "properties": {
- "affected": {
- "type": [
- "number",
- "null"
- ]
- },
- "components": {
- "type": [
- "number",
- "null"
- ]
- },
- "corpus_cache_max_age_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "elapsed_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "lookups": {
- "type": [
- "number",
- "null"
- ]
- },
- "not_affected": {
- "description": "Components with a decided, clean verdict.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed": {
- "description": "Components with no verdict: not clean.",
- "type": [
- "number",
- "null"
- ]
- },
- "not_assessed_by_reason": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "advisory_lookup_failed": {
- "type": "number"
- },
- "candidate_window_truncated": {
- "type": "number"
- },
- "distro_release_unknown": {
- "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
- "type": "number"
- },
- "invalid_component": {
- "type": "number"
- },
- "no_decidable_advisory": {
- "type": "number"
- },
- "package_not_in_advisory_corpus": {
- "type": "number"
- },
- "purl_type_unsupported": {
- "type": "number"
- },
- "time_budget": {
- "description": "Components the batch's time budget ran out before: not clean; check them again.",
- "type": "number"
- },
- "version_missing": {
- "type": "number"
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The not_assessed components, counted by not_assessed_reason."
- },
- "partial": {
- "description": "true when the time budget ran out before every component was looked up.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "time_budget_ms": {
- "type": [
- "number",
- "null"
- ]
- },
- "undetermined": {
- "description": "Components whose advisories could not all be decided and none matched: not clean.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "batch_size": {
- "description": "The most purls one request carries (the API's cap per request).",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches": {
- "description": "Requests the distinct purls make, at batch_size each.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "batches_sent": {
- "description": "Of those, the ones the API answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "components_in_document": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
- },
- "distinct_purls": {
- "description": "Distinct purls to check: sent plus not_sent.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "duplicates_removed": {
- "description": "Purls that appeared more than once and were sent once.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "input": {
- "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
- "enum": [
- "purls",
- "cyclonedx",
- "spdx"
- ],
- "type": "string"
- },
- "not_assessed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Of those sent, the components with no verdict, as the answer counts them."
- },
- "not_sent": {
- "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "not_sent_reason": {
- "anyOf": [
- {
- "enum": [
- "time_budget",
- "rate_limited",
- "request_failed"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
- },
- "partial": {
- "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "rate_limit_waits": {
- "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "sent": {
- "description": "Distinct purls sent and answered.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "waited_ms": {
- "description": "Milliseconds spent in those waits.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "with_purl": {
- "description": "Of those, the ones carrying a purl.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "without_purl": {
- "description": "The ones without a purl: not checked, and not clean.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "input",
- "components_in_document",
- "with_purl",
- "without_purl",
- "duplicates_removed",
- "distinct_purls",
- "batch_size",
- "batches",
- "batches_sent",
- "sent",
- "not_sent",
- "not_sent_reason",
- "rate_limit_waits",
- "waited_ms",
- "not_assessed",
- "partial"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "components_in_document": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls that appeared more than once and were sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "input": {
+ "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
+ "enum": [
+ "purls",
+ "cyclonedx",
+ "spdx"
+ ],
+ "type": "string"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "with_purl": {
+ "description": "Of those, the ones carrying a purl.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "without_purl": {
+ "description": "The ones without a purl: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "input",
+ "components_in_document",
+ "with_purl",
+ "without_purl",
+ "duplicates_removed",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "answered_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "match_layer": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "not_sent_purls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The distinct purls not sent (coverage.not_sent_reason says why): not checked, and not clean. Present only when some were not sent."
+ },
+ "results": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories_considered": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "assessed": {
+ "description": "Whether the matcher produced a verdict for this component. false is never clean.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "candidates_capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "capped": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "code": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "error": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "index": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "input_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_package": {
+ "description": "The package name the advisories were looked up by (#2836): the purl's own name, or, for a deb or apk purl with an upstream qualifier, the source package it names, which is how Debian and Alpine file advisories.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_version_from": {
+ "description": "Upstream rows: upstream when the qualifier named a version (upstream=name@version) and it was used, purl when the purl's own version was.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matched_via": {
+ "description": "Which name matched_package is: purl_name (the purl's name), upstream (the purl's upstream qualifier) or coordinates (the component's package).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "matches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The CVE's EPSS score (FIRST), as EchelonGraph's record holds it; null when it has none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "fixed_in": {
+ "description": "The fixed bound of the advisory interval that holds this component's version, always above it. null when that interval records no fix (it ends at last_affected, or has no end) or no interval holds the version, with fixed_in_reason saying which.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_in_reason": {
+ "description": "Why fixed_in is null; absent when fixed_in is a version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "interval": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "fixed": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The advisory interval that holds this component's version (fixed is exclusive, last_affected inclusive); absent when no interval holds it."
+ },
+ "kev_listed": {
+ "description": "Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, as EchelonGraph's record holds it.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "match_reason": {
+ "description": "Why the advisory applies, with the advisory interval the version falls inside: \"[A, B)\" names the fixed version B, \"[A, B]\" the last affected version B. On an upstream row it ends by naming the source package and the purl name.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "not_affected_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_reason": {
+ "description": "Why assessed is false: package_not_in_advisory_corpus, no_decidable_advisory, advisory_lookup_failed, candidate_window_truncated, time_budget, distro_release_unknown, purl_type_unsupported, version_missing or invalid_component.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "purl_name": {
+ "description": "Upstream rows: the purl's own (binary) package name, not looked up.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "undetermined_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "verdict": {
+ "description": "affected (count > 0); not_affected (assessed, no match, nothing undetermined: the only clean verdict); undetermined (advisories name the package, at least one could not be decided, none matched: not clean); not_assessed (no verdict: not clean).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "summary": {
+ "additionalProperties": {},
+ "properties": {
+ "affected": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "components": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "corpus_cache_max_age_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "elapsed_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "lookups": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_affected": {
+ "description": "Components with a decided, clean verdict.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed": {
+ "description": "Components with no verdict: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "not_assessed_by_reason": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_lookup_failed": {
+ "type": "number"
+ },
+ "candidate_window_truncated": {
+ "type": "number"
+ },
+ "distro_release_unknown": {
+ "description": "deb, apk or rpm purls without a distro qualifier naming the release, which EchelonGraph does not guess.",
+ "type": "number"
+ },
+ "invalid_component": {
+ "type": "number"
+ },
+ "no_decidable_advisory": {
+ "type": "number"
+ },
+ "package_not_in_advisory_corpus": {
+ "type": "number"
+ },
+ "purl_type_unsupported": {
+ "type": "number"
+ },
+ "time_budget": {
+ "description": "Components the batch's time budget ran out before: not clean; check them again.",
+ "type": "number"
+ },
+ "version_missing": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The not_assessed components, counted by not_assessed_reason."
+ },
+ "partial": {
+ "description": "true when the time budget ran out before every component was looked up.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "time_budget_ms": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "undetermined": {
+ "description": "Components whose advisories could not all be decided and none matched: not clean.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "batch_size": {
+ "description": "The most purls one request carries (the API's cap per request).",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches": {
+ "description": "Requests the distinct purls make, at batch_size each.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "batches_sent": {
+ "description": "Of those, the ones the API answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "components_in_document": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Components (CycloneDX) or packages (SPDX) in the document; null for a purl list."
+ },
+ "distinct_purls": {
+ "description": "Distinct purls to check: sent plus not_sent.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "duplicates_removed": {
+ "description": "Purls that appeared more than once and were sent once.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "input": {
+ "description": "What was passed: a purl list, a CycloneDX JSON document or an SPDX JSON document.",
+ "enum": [
+ "purls",
+ "cyclonedx",
+ "spdx"
+ ],
+ "type": "string"
+ },
+ "not_assessed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Of those sent, the components with no verdict, as the answer counts them."
+ },
+ "not_sent": {
+ "description": "Distinct purls not sent, listed in data.not_sent_purls: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "not_sent_reason": {
+ "anyOf": [
+ {
+ "enum": [
+ "time_budget",
+ "rate_limited",
+ "request_failed"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Why not_sent is above 0: time_budget (the call's 50 s budget ran out, before a batch or while one was unanswered, which is then cut off; or waiting out the API's Retry-After would pass it), rate_limited (a 429 without Retry-After, or a 429 after 10 waits), request_failed (a batch after the first failed; the note quotes how). null when every purl was sent."
+ },
+ "partial": {
+ "description": "true when not every purl was sent (not_sent above 0) or any batch's summary.partial was true (its time budget ran out first); otherwise the answer's summary.partial.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "rate_limit_waits": {
+ "description": "How many times the API answered 429 and the tool waited its Retry-After before sending the batch again.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "sent": {
+ "description": "Distinct purls sent and answered.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "waited_ms": {
+ "description": "Milliseconds spent in those waits.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "with_purl": {
+ "description": "Of those, the ones carrying a purl.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "without_purl": {
+ "description": "The ones without a purl: not checked, and not clean.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "input",
+ "components_in_document",
+ "with_purl",
+ "without_purl",
+ "duplicates_removed",
+ "distinct_purls",
+ "batch_size",
+ "batches",
+ "batches_sent",
+ "sent",
+ "not_sent",
+ "not_sent_reason",
+ "rate_limit_waits",
+ "waited_ms",
+ "not_assessed",
+ "partial"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_exposure1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "in_scope": {
- "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "in_scope"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "countries": {
- "type": [
- "number",
- "null"
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "exposed_hosts": {
- "type": [
- "number",
- "null"
- ]
- },
- "generated_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_catalog_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_seen_in_observations": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "last_seen": {
- "type": [
- "string",
- "null"
- ]
- },
- "method": {
- "type": [
- "string",
- "null"
- ]
- },
- "ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "top_countries": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "country": {
- "type": [
- "string",
- "null"
- ]
- },
- "hosts": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "top_products": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "hosts": {
- "type": [
- "number",
- "null"
- ]
- },
- "product": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "tracked": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "exposure_state": {
- "anyOf": [
- {
- "enum": [
- "exposed",
- "measured_zero",
- "not_assessed",
- "tracking_unknown"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer's count is, as the note's (exposure_state: …) tag says; not state, which says whether the answer is a dated measurement. exposed: data.exposed_hosts counts the services the radar holds on record for the CVE, above 0. measured_zero: the API marks the CVE as tracked with 0 services, a zero in the radar's sample. not_assessed: the CVE is outside the radar's tracked set, so its count, if any, is not a current measurement. tracking_unknown: the API does not say whether the radar tracks the CVE, so its 0 is not evidence either way. null: the answer carries no count."
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "exposure_state",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "in_scope": {
- "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "in_scope"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "countries": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "exposed_hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "generated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_catalog_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_seen_in_observations": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_seen": {
+ "description": "When EchelonGraph last wrote or refreshed a service's row, not when the service was observed and not when its vulnerable version was last confirmed: it is set to the time of the write when a search matches the banner, and again when a re-check finds the port still listed by Shodan InternetDB, without re-reading the banner, so a patched service can stay counted while its port stays open. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "top_countries": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "country": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "top_products": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "tracked": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "exposure_state": {
+ "anyOf": [
+ {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed",
+ "tracking_unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer's count is, as the note's (exposure_state: …) tag says; not state, which says whether the answer is a dated measurement. exposed: data.exposed_hosts counts the services the radar holds on record for the CVE, above 0. measured_zero: the API marks the CVE as tracked with 0 services, a zero in the radar's sample. not_assessed: the CVE is outside the radar's tracked set, so its count, if any, is not a current measurement. tracking_unknown: the API does not say whether the radar tracks the CVE, so its 0 is not evidence either way. null: the answer carries no count."
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "exposure_state",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]cve_remediationcve_summary1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "description": "What the answer covers; null where the answer says nothing about it.",
- "type": "null"
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "poller": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "cves_ingested": {
- "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
- "type": [
- "number",
- "null"
- ]
- },
- "cves_skipped": {
- "description": "CVE records this instance's NVD poller skipped since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "http_retries": {
- "description": "HTTP retries this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "interval": {
- "description": "How often this instance's NVD poller polls.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_at": {
- "description": "When this instance's NVD poller last polled: never the feed's freshness.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_dur_ms": {
- "description": "How long that poll took, in milliseconds.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_count": {
- "description": "Polls this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_errors": {
- "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. A poller field the answer sends in a JSON type other than the one described here is left out of data and named in the note, and a poller that is neither a JSON object nor null is left out whole: summary is relayed either way."
- },
- "summary": {
- "additionalProperties": {},
- "properties": {
- "critical": {
- "type": [
- "number",
- "null"
- ]
- },
- "high": {
- "type": [
- "number",
- "null"
- ]
- },
- "last_updated": {
- "type": [
- "string",
- "null"
- ]
- },
- "low": {
- "type": [
- "number",
- "null"
- ]
- },
- "medium": {
- "type": [
- "number",
- "null"
- ]
- },
- "none": {
- "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_critical": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_high": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_low": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_medium": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_none": {
- "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
- "type": [
- "number",
- "null"
- ]
- },
- "rejected": {
- "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "unscored": {
- "description": "The same count as none, under its own name.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "type": "null"
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "poller": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cves_ingested": {
+ "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cves_skipped": {
+ "description": "CVE records this instance's NVD poller skipped since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "http_retries": {
+ "description": "HTTP retries this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "interval": {
+ "description": "How often this instance's NVD poller polls.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_at": {
+ "description": "When this instance's NVD poller last polled: never the feed's freshness.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_dur_ms": {
+ "description": "How long that poll took, in milliseconds.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_count": {
+ "description": "Polls this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_errors": {
+ "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. A poller field the answer sends in a JSON type other than the one described here is left out of data and named in the note, and a poller that is neither a JSON object nor null is left out whole: summary is relayed either way."
+ },
+ "summary": {
+ "additionalProperties": {},
+ "description": "summary.nvd_critical, summary.nvd_high, summary.nvd_medium, summary.nvd_low and summary.nvd_none count the same active CVEs as summary.total by NVD's CVSS severity label (v3.x, else v4.0; before NVD's record arrives, or where it gives none, a pre-NVD label from the CVE.org record or a GitHub advisory can stand in): provenance, never EchelonGraph's severity band. summary.nvd_none counts the active CVEs with no Critical, High, Medium or Low label there, CVEs NVD never labelled under CVSS v3 among them, and many of those carry an NVD CVSS v2 score instead: it is neither a count of CVEs rated None nor the count of CVEs with no severity, which is summary.none. Whenever summary.nvd_none is above zero the note says what it counts, with its count.",
+ "properties": {
+ "critical": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "high": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "last_updated": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "low": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "medium": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "none": {
+ "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_critical": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_high": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_low": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_medium": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_none": {
+ "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "rejected": {
+ "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "unscored": {
+ "description": "The same count as none, under its own name.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]epss_history1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "points": {
- "description": "How many points the series holds.",
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "points_truncated": {
- "type": "boolean"
- },
- "series_kind": {
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "series_kind",
- "series_starts_at",
- "points",
- "points_truncated"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "current": {
- "additionalProperties": {},
- "properties": {
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "description": "The record's EPSS probability now; null when it holds none.",
- "type": [
- "number",
- "null"
- ]
- },
- "epss_updated_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When EchelonGraph last wrote a changed EPSS value for this CVE."
- }
- },
- "type": "object"
- },
- "cve_id": {
- "type": "string"
- },
- "history_rows": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Raw history rows read, before repeated records of one change were collapsed."
- },
- "latest_point_matches_current": {
- "description": "Whether the newest point equals current; false means a change is missing from the series; null when there is no point or no current value.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "points": {
- "description": "Recorded changes, oldest first. Never a daily series.",
- "items": {
- "additionalProperties": {},
- "properties": {
- "at": {
- "description": "When EchelonGraph recorded this change.",
- "type": "string"
- },
- "epss_percentile": {
- "description": "Its percentile (0 to 1), null where the record held none.",
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "description": "The EPSS probability (0 to 1) from that change on.",
- "type": "number"
- }
- },
- "required": [
- "at",
- "epss_score"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "points_truncated": {
- "description": "True when only the newest rows were read, so the earliest points are missing.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "series_kind": {
- "description": "Always change_only: one point per recorded change, none for a day without one.",
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "The earliest EPSS change EchelonGraph recorded for any CVE: when recording began. Null when nothing has been recorded."
- }
- },
- "required": [
- "cve_id",
- "series_kind",
- "series_starts_at",
- "current",
- "points"
- ],
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "points": {
- "description": "How many points the series holds.",
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "points_truncated": {
- "type": "boolean"
- },
- "series_kind": {
- "enum": [
- "change_only"
- ],
- "type": "string"
- },
- "series_starts_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "series_kind",
- "series_starts_at",
- "points",
- "points_truncated"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day the record holds; null when none are listed."
+ },
+ "days_missing": {
+ "description": "Score dates from first_day to last_day the record does not hold.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "days_partial": {
+ "description": "Score dates held for some CVEs only.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "first_day": {
+ "description": "The earliest FIRST score date the run log lists; null when it lists none.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_day": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "How many points the series holds.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "How many of them fall where changes are missing; null when the API did not say."
+ },
+ "points_truncated": {
+ "type": "boolean"
+ },
+ "series_complete": {
+ "description": "True only when the API says nothing in the record predates complete_since.",
+ "type": "boolean"
+ },
+ "series_kind": {
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "series_kind",
+ "series_starts_at",
+ "complete_since",
+ "series_complete",
+ "points",
+ "points_before_complete_since",
+ "points_truncated",
+ "first_day",
+ "last_day",
+ "days_held",
+ "days_partial",
+ "days_missing"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when the record holds every change a refresh applied. Between series_starts_at and complete_since changes are missing, so a missing point there does not mean unchanged. Absent from an API older than #2867."
+ },
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From here on every change a refresh applied is a point; before it changes are missing."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day that a refresh applied completely."
+ },
+ "days_missing": {
+ "anyOf": [
+ {
+ "items": {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day that no refresh applied."
+ },
+ "days_partial": {
+ "anyOf": [
+ {
+ "items": {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates whose refreshes all failed part-way: some CVEs hold that day, some do not."
+ },
+ "first_day": {
+ "anyOf": [
+ {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The earliest score date in the run log."
+ },
+ "last_day": {
+ "anyOf": [
+ {
+ "description": "A FIRST score date, YYYY-MM-DD.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The latest score date in the run log."
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This CVE's points in the part of the record that misses changes."
+ },
+ "recorded_from": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "series_starts_at: when recording began."
+ },
+ "refresh_runs_truncated": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "run_log_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The first logged refresh: score dates before it are not listed, held or missing."
+ },
+ "runs_undated": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "series_complete": {
+ "description": "True only when nothing in the record predates complete_since.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Which part of the record is complete and which FIRST score dates it holds."
+ },
+ "current": {
+ "additionalProperties": {},
+ "properties": {
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The record's EPSS probability now; null when it holds none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_updated_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When EchelonGraph last wrote a changed EPSS value for this CVE."
+ }
+ },
+ "type": "object"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "history_rows": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Raw history rows read, before repeated records of one change were collapsed."
+ },
+ "latest_point_matches_current": {
+ "description": "Whether the newest point equals current; false means a change is missing from the series; null when there is no point or no current value.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "Recorded changes, oldest first. Never a daily series.",
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "at": {
+ "description": "When EchelonGraph recorded this change.",
+ "type": "string"
+ },
+ "epss_percentile": {
+ "description": "Its percentile (0 to 1), null where the record held none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "description": "The EPSS probability (0 to 1) from that change on.",
+ "type": "number"
+ },
+ "score_date": {
+ "description": "FIRST's score date (YYYY-MM-DD) of the logged refresh that wrote this point; null where no logged refresh covers it.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "at",
+ "epss_score"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "points_truncated": {
+ "description": "True when only the newest rows were read, so the earliest points are missing.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "series_kind": {
+ "description": "Always change_only: one point per recorded change, none for a day without one.",
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The earliest EPSS change EchelonGraph recorded for any CVE: when recording began. Null when nothing has been recorded."
+ }
+ },
+ "required": [
+ "cve_id",
+ "series_kind",
+ "series_starts_at",
+ "current",
+ "points"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "complete_since": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "From when every change is a point; null when the API did not say, and then no part of the series is known complete."
+ },
+ "days_held": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Score dates from first_day to last_day the record holds; null when none are listed."
+ },
+ "days_missing": {
+ "description": "Score dates from first_day to last_day the record does not hold.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "days_partial": {
+ "description": "Score dates held for some CVEs only.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "first_day": {
+ "description": "The earliest FIRST score date the run log lists; null when it lists none.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_day": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "points": {
+ "description": "How many points the series holds.",
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "points_before_complete_since": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "How many of them fall where changes are missing; null when the API did not say."
+ },
+ "points_truncated": {
+ "type": "boolean"
+ },
+ "series_complete": {
+ "description": "True only when the API says nothing in the record predates complete_since.",
+ "type": "boolean"
+ },
+ "series_kind": {
+ "enum": [
+ "change_only"
+ ],
+ "type": "string"
+ },
+ "series_starts_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "series_kind",
+ "series_starts_at",
+ "complete_since",
+ "series_complete",
+ "points",
+ "points_before_complete_since",
+ "points_truncated",
+ "first_day",
+ "last_day",
+ "days_held",
+ "days_partial",
+ "days_missing"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]exposure_radar1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "properties": {
- "distinct_hosts": {
- "type": "number"
- },
- "engines": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "pci_likely": {
- "type": "number"
- },
- "pii_likely": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_engines": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "engine": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "engine",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "properties": {
- "correlations": {
- "type": "number"
- },
- "distinct_hosts": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "kev_cves_exposed": {
- "type": "number"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "newest_kev": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "added_date": {
- "type": "string"
- },
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "exposed_hosts": {
- "type": "number"
- },
- "exposure_state": {
- "enum": [
- "exposed",
- "measured_zero",
- "not_assessed"
- ],
- "type": "string"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- },
- "vuln_name": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "exposure_state"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "ransomware_cves": {
- "type": "number"
- },
- "ransomware_hosts": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_cves": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "hosts": {
- "type": "number"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "hosts": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "trend": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "new_exposures": {
- "type": "number"
- },
- "week": {
- "type": "string"
- }
- },
- "required": [
- "week",
- "new_exposures"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "properties": {
- "distinct_repos": {
- "type": "number"
- },
- "distinct_secrets": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_providers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "provider": {
- "type": "string"
- }
- },
- "required": [
- "provider",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_types": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "secret_type": {
- "type": "string"
- }
- },
- "required": [
- "secret_type",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "properties": {
- "counted_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "enabled": {
- "type": "boolean"
- },
- "era": {
- "additionalProperties": false,
- "properties": {
- "dual": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "legacy": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "modern": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "legacy",
- "dual",
- "modern",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "not_assessed": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_assessed_by_reason": {
- "additionalProperties": false,
- "properties": {
- "bare_challenge_no_prm": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "challenge_unadjudicated": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "cross_origin_pointer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "identified_no_challenge": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "metadata_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_authorization_servers": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_http_answer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_identified_as_mcp": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "resource_mismatch": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "identified_no_challenge",
- "resource_mismatch",
- "cross_origin_pointer",
- "bare_challenge_no_prm",
- "pointer_unreachable",
- "pointer_invalid",
- "no_authorization_servers",
- "wellknown_unreachable",
- "metadata_invalid",
- "challenge_unadjudicated",
- "no_http_answer",
- "not_identified_as_mcp"
- ],
- "type": "object"
- },
- "own_controls_excluded": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pending_readjudication": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "prm_via": {
- "additionalProperties": false,
- "properties": {
- "header": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_path": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_root": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "header",
- "wellknown_path",
- "wellknown_root"
- ],
- "type": "object"
- },
- "protected": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "total": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "transport": {
- "additionalProperties": false,
- "properties": {
- "legacy_sse": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "streamable_http": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "streamable_http",
- "legacy_sse",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- },
- "withheld_opted_out": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "total",
- "protected",
- "pending_readjudication",
- "not_assessed"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "properties": {
- "authentication": {
- "additionalProperties": false,
- "properties": {
- "not_determined": {
- "type": "number"
- },
- "observed": {
- "type": "number"
- }
- },
- "type": "object"
- },
- "confirmed_exposed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "observed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "last_observation": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "country": {
- "type": "string"
- }
- },
- "required": [
- "country",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_issuers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "issuer": {
- "type": "string"
- }
- },
- "required": [
- "issuer",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "trend_30d": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "date": {
- "type": "string"
- }
- },
- "required": [
- "date",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "poller": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "running": {
- "type": "boolean"
- }
- },
- "required": [
- "running",
- "last_run_at"
- ],
- "type": "object"
- }
- },
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- "freshness": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "properties": {
- "enabled": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at",
- "enabled"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- },
- "running": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "last_run_at",
- "running"
- ],
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The producing radar's last completed check (last_run_at), where the API serves one."
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "radars": {
- "description": "Each radar that could not be read, and why.",
- "items": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "unexpected_shape"
- ],
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "path": {
- "type": "string"
- },
- "radar": {
- "type": "string"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "radar",
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "description": "A field this version cannot label is left out of data and named in the note. Each of the kev_exposure, exposed_databases and leaked_credentials radars also carries generated_at, when the API computed its totals, and, when the API can tell, last_run_at. kev_exposure.last_run_at, exposed_databases.last_run_at and leaked_credentials.last_run_at are timestamps, not counts: each is when that radar last completed a check, a cycle whose reads succeeded, among them a Shodan search (for exposed_databases, or its LeakIX fallback) that answered at least one query, or for leaked_credentials a read of the public GitHub event stream. A cycle that read nothing does not move it, and it is not the time of every record a radar's numbers count, which cover everything still on record, not only what the last check found. A radar whose answer carries no last_run_at has none in the result, and the note says nothing about it. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "description": "exposed_databases: exposed_databases.distinct_hosts counts distinct ip:port services the check confirmed answering without authentication, and exposed_databases.engines the distinct engine types among them; exposed_databases.top_engines and exposed_databases.top_countries rank up to 15 engines and 10 countries by those services. exposed_databases.pii_likely and exposed_databases.pci_likely count services whose schema names (never record values) pass a high-confidence, precision-first gate for personal or payment-card data, so a service outside them is not shown to hold no such data. exposed_databases.window.from and exposed_databases.window.to are timestamps, not counts: when EchelonGraph's check last confirmed the oldest and the newest of the services counted, a span of checks made at different times; with a counted service that has no such time on record there is no window.",
+ "properties": {
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "engines": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "pci_likely": {
+ "type": "number"
+ },
+ "pii_likely": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_engines": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "engine": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "engine",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "description": "kev_exposure: kev_exposure.distinct_hosts counts distinct ip:port services, not machines (a machine answering on two ports counts twice), with at least one CISA-KEV-listed CVE on record, and kev_exposure.ransomware_hosts those with a ransomware-linked one; kev_exposure.kev_cves_exposed and kev_exposure.ransomware_cves count distinct CVEs with at least one such service; kev_exposure.correlations counts service×CVE pairs, not services, so a service with three KEV CVEs counts three times. kev_exposure.top_products, kev_exposure.top_countries and kev_exposure.top_cves rank up to 12 products, 10 countries and 12 CVEs by those services; kev_exposure.top_cves[].cvss_v3_score and kev_exposure.top_cves[].epss_score are the highest CVSS v3 base score and EPSS probability recorded on that CVE's observations. kev_exposure.trend counts service×CVE pairs still on record by the week in which each was first recorded, over 12 weeks, so earlier weeks read low. kev_exposure.newest_kev lists the 15 CVEs that EchelonGraph's CVE records most recently mark as CISA-KEV-listed, each with an exposure_state: exposed, where kev_exposure.newest_kev[].exposed_hosts counts distinct ip:port services on record with it; or not_assessed, where the API's answer holds no measurement for that CVE (its 0 is not one) and no count is relayed, and this answer does not say whether the radar tracks that CVE: tracking is answered per CVE. kev_exposure.newest_kev[].cvss_v3_score and kev_exposure.newest_kev[].epss_score are the CVE record's CVSS v3 base score and EPSS probability. kev_exposure.window.from and kev_exposure.window.to are timestamps, not counts: when Shodan collected the banners of the oldest and the newest of the service×CVE pairs counted, a span of observations made at different times; with a counted pair that has no such time on record there is no window. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "correlations": {
+ "type": "number"
+ },
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "kev_cves_exposed": {
+ "type": "number"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "newest_kev": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "added_date": {
+ "type": "string"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "exposed_hosts": {
+ "type": "number"
+ },
+ "exposure_state": {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ },
+ "vuln_name": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "exposure_state"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "ransomware_cves": {
+ "type": "number"
+ },
+ "ransomware_hosts": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_cves": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "hosts": {
+ "type": "number"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "hosts": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "trend": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "new_exposures": {
+ "type": "number"
+ },
+ "week": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "week",
+ "new_exposures"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "description": "leaked_credentials: leaked_credentials.total counts (repository, secret) pairs, not distinct secrets, so one secret in three repositories counts three times; leaked_credentials.distinct_secrets counts each secret once and leaked_credentials.distinct_repos counts repositories; leaked_credentials.top_providers and leaked_credentials.top_types rank up to 15 providers and secret types by those pairs. None is validated: each is a credential-shaped string that passed EchelonGraph's filters, at most structurally checked and never tested against its provider. leaked_credentials.window.from and leaked_credentials.window.to are timestamps, not counts: when EchelonGraph's detector last found the oldest and the newest of the pairs counted.",
+ "properties": {
+ "distinct_repos": {
+ "type": "number"
+ },
+ "distinct_secrets": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_providers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "provider": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "provider",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_types": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "secret_type": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "secret_type",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "description": "mcp_servers: counts and timestamps only, no hostname. mcp_servers.total counts hostnames the AI-exposure radar has checked for an MCP server, each once by its latest verdict on record, and not every one is an MCP server; EchelonGraph's own control servers are left out, and mcp_servers.own_controls_excluded counts them; hostnames whose owner opted out of scanning are not checked again while the opt-out stands, so their last verdict is left out too, and mcp_servers.withheld_opted_out counts them. mcp_servers.total is mcp_servers.protected plus mcp_servers.pending_readjudication plus mcp_servers.not_assessed. mcp_servers.protected counts hostnames whose /mcp endpoint asked for credentials and whose OAuth protected-resource metadata validated under RFC 9728; mcp_servers.prm_via divides them by where that document was found: mcp_servers.prm_via.header, mcp_servers.prm_via.wellknown_path and mcp_servers.prm_via.wellknown_root. mcp_servers.pending_readjudication counts verdicts of a rule since replaced, not yet re-checked. mcp_servers.not_assessed counts the rest, whose protection the radar could not assess (not assessed does not mean unprotected), and mcp_servers.not_assessed_by_reason puts each in one bucket. mcp_servers.not_assessed_by_reason.identified_no_challenge holds servers that identified themselves as MCP servers and did not ask for credentials at the handshake. That is normal in MCP: authorization is optional in the spec, and a server can enforce it at tools/call instead, which EchelonGraph never sends, so this bucket is not a finding of exposure. mcp_servers.not_assessed_by_reason.resource_mismatch, mcp_servers.not_assessed_by_reason.cross_origin_pointer, mcp_servers.not_assessed_by_reason.bare_challenge_no_prm, mcp_servers.not_assessed_by_reason.pointer_unreachable, mcp_servers.not_assessed_by_reason.pointer_invalid, mcp_servers.not_assessed_by_reason.no_authorization_servers, mcp_servers.not_assessed_by_reason.wellknown_unreachable and mcp_servers.not_assessed_by_reason.metadata_invalid hold endpoints that asked for credentials but whose RFC 9728 metadata did not validate, by why, so none of them is shown to lack protection; mcp_servers.not_assessed_by_reason.challenge_unadjudicated holds endpoints that asked for credentials before that check existed, not yet re-checked. mcp_servers.not_assessed_by_reason.no_http_answer holds hostnames that gave no HTTP answer, and mcp_servers.not_assessed_by_reason.not_identified_as_mcp hostnames whose HTTP answer identified no MCP server. mcp_servers.era divides every counted hostname by protocol era: mcp_servers.era.legacy; mcp_servers.era.dual, a lower bound; mcp_servers.era.modern, not proven modern-only; mcp_servers.era.unknown; and mcp_servers.era.not_measured, recorded before the era probe and not re-checked since. mcp_servers.transport divides them by transport: mcp_servers.transport.streamable_http, mcp_servers.transport.legacy_sse, mcp_servers.transport.unknown and mcp_servers.transport.not_measured. mcp_servers.window.from and mcp_servers.window.to are when the oldest and the newest of the verdicts counted were last checked. mcp_servers.last_run_at is a timestamp, not a count: when the AI-exposure radar, which checks other AI services too, last completed a check; mcp_servers.enabled is whether one completed within 45 minutes of the answer, and mcp_servers.counted_at is when the API read the counts. A partition whose buckets do not add up to the count it divides is left out and named; an answer that does not say it is the MCP-server counts, or whose mcp_servers.total, mcp_servers.protected, mcp_servers.pending_readjudication and mcp_servers.not_assessed are missing or contradict each other, is a failure.",
+ "properties": {
+ "counted_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "era": {
+ "additionalProperties": false,
+ "properties": {
+ "dual": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "legacy": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "modern": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "legacy",
+ "dual",
+ "modern",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "not_assessed": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_assessed_by_reason": {
+ "additionalProperties": false,
+ "properties": {
+ "bare_challenge_no_prm": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "challenge_unadjudicated": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "cross_origin_pointer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "identified_no_challenge": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "metadata_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_authorization_servers": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_http_answer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_identified_as_mcp": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "resource_mismatch": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "identified_no_challenge",
+ "resource_mismatch",
+ "cross_origin_pointer",
+ "bare_challenge_no_prm",
+ "pointer_unreachable",
+ "pointer_invalid",
+ "no_authorization_servers",
+ "wellknown_unreachable",
+ "metadata_invalid",
+ "challenge_unadjudicated",
+ "no_http_answer",
+ "not_identified_as_mcp"
+ ],
+ "type": "object"
+ },
+ "own_controls_excluded": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pending_readjudication": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "prm_via": {
+ "additionalProperties": false,
+ "properties": {
+ "header": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_path": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_root": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "header",
+ "wellknown_path",
+ "wellknown_root"
+ ],
+ "type": "object"
+ },
+ "protected": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "transport": {
+ "additionalProperties": false,
+ "properties": {
+ "legacy_sse": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "streamable_http": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "streamable_http",
+ "legacy_sse",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ },
+ "withheld_opted_out": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "protected",
+ "pending_readjudication",
+ "not_assessed"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "description": "shadow_ai: the result is regrouped by what each number counts. shadow_ai.confirmed_exposed counts services EchelonGraph's probes found answering without an authentication gate (liveness active, or rechecking during a re-check): confirmed_exposed.total is the sum of confirmed_exposed.by_category, and confirmed_exposed.last_24h counts those first recorded in the last 24 h. Of the shadow_ai numbers, only confirmed_exposed counts exposed services. confirmed_exposed.window.from and confirmed_exposed.window.to are timestamps, not counts: when EchelonGraph's verifier ran the probe that last decided the oldest and the newest of those services, a span of probes made at different times. shadow_ai.observed counts every Certificate Transparency or Shodan observation on record, whatever its verification state: its numbers are observed, not exposed. They are observed.total; observed.by_category (the same observations by category); observed.last_24h (those first recorded in the last 24 h); observed.trend_30d (observations per UTC day over the last 30 days); and observed.top_products, observed.top_countries and observed.top_issuers (up to ten products, countries and issuers ranked by observations, where an issuer is the certificate's CA for a Certificate Transparency observation and the hosting operator Shodan reports for a Shodan one). shadow_ai.authentication counts observations by probe outcome: authentication.observed where a probe observed an authentication gate (a 401/403, a login page or an auth marker), and authentication.not_determined where the service answered but no probe could tell. Neither authentication count is part of confirmed_exposed, and observed.total minus confirmed_exposed.total is not a count of secured services. The shadow-AI poller block carries only running and last_run_at: last_run_at is when the radar's leader last completed a Certificate Transparency (crt.sh) cycle, and its running is true only when that was within 30 minutes of the answer. Shodan data is owned by Shodan, which holds its copyright (© Shodan).",
+ "properties": {
+ "authentication": {
+ "additionalProperties": false,
+ "properties": {
+ "not_determined": {
+ "type": "number"
+ },
+ "observed": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ "confirmed_exposed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "observed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "last_observation": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "country": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "country",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_issuers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "issuer": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "issuer",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "trend_30d": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "date": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "date",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "poller": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "running": {
+ "type": "boolean"
+ }
+ },
+ "required": [
+ "running",
+ "last_run_at"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "enabled"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "running": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "running"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "radars": {
+ "description": "Each radar that could not be read, and why.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "unexpected_shape"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "type": "string"
+ },
+ "path": {
+ "type": "string"
+ },
+ "radar": {
+ "type": "string"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "radar",
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_cve1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "description": "What the answer covers; null where the answer says nothing about it.",
- "type": "null"
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "cpe_configurations": {
- "anyOf": [
- {
- "items": {},
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
- },
- "cpe_match": {
- "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_risk": {
- "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "ghsa_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "modified": {
- "type": [
- "string",
- "null"
- ]
- },
- "published": {
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_confidence": {
- "type": [
- "string",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "updated_at": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "type": "null"
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_notes_urls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_required_action": {
+ "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 22-01, by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_short_description": {
+ "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "patch_available": {
+ "description": "true: EchelonGraph holds evidence of a fix for the CVE, its sources named in patch_evidence. false: no fix evidence is on record, which is not a finding that no fix exists. Once true it is never set back to false. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "patch_evidence": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_patch",
+ "fixed_version",
+ "release_reference",
+ "nvd_patch_reference",
+ "cna_patch_reference"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), nvd_patch_reference (an NVD reference tagged Patch) and cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "remediation": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {},
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_vendor_advisory1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "known_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "remediation": {
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_modified_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "withdrawn_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn_reason": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "known_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation": {
+ "description": "The vendor's remediation as one text (the legacy field), beside remediations.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "remediation_items_not_stored": {
+ "description": "Items past the 64 stored per advisory.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "remediations": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVEs the item covers; [] for the whole advisory."
+ },
+ "fixed_build": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "product_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "source_category": {
+ "description": "The vendor's own name for the category.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_subcategory": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text": {
+ "description": "The vendor's text, verbatim but for HTML markup removed, untested by EchelonGraph; at most 2,000 characters (text_truncated, text_chars).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "text_chars": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "text_truncated": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each remediation the vendor lists, with its kind, the vendor's own category."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_modified_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "withdrawn_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]kev_recent3 fields changedInput schema / properties / since / descriptionPrevious value: -"earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it)"New value: +"earliest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it, with the time and offset dropped; anything else is refused)"Input schema / properties / until / descriptionPrevious value: -"latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it)"New value: +"latest kev_added_date to include, YYYY-MM-DD (an RFC 3339 timestamp is read as the date written in it, with the time and offset dropped; anything else is refused)"Output schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog": {
- "const": "CISA KEV catalog",
- "type": "string"
- },
- "catalog_count": {
- "description": "CISA's own count, in the catalog last fetched.",
- "type": [
- "number",
- "null"
- ]
- },
- "has_more": {
- "description": "Whether next_cursor names a further page.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed_total": {
- "description": "Every CVE EchelonGraph holds as KEV-listed.",
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "Rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "description": "CVEs matching the filters.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "catalog",
- "total",
- "returned",
- "kev_listed_total",
- "catalog_count",
- "limit",
- "has_more"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "catalog": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "catalog_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "catalog_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "date_released": {
- "type": [
- "string",
- "null"
- ]
- },
- "feed_url": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_successful_fetch_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "count": {
- "type": [
- "number",
- "null"
- ]
- },
- "filters": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {},
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "generated_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "eg_kev_tier": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_due_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_product": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_vuln_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "our_first_seen_kev": {
- "description": "When EchelonGraph's poller first recorded the CVE entering the catalog; null where no such record exists.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "kev_listed_total": {
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "method": {
- "type": [
- "string",
- "null"
- ]
- },
- "next_cursor": {
- "type": [
- "string",
- "null"
- ]
- },
- "notes": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "order": {
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "date_released": {
- "type": [
- "string",
- "null"
- ]
- },
- "last_successful_fetch_at": {
- "description": "When CISA last answered our poll of its feed: a 200 we applied, or a 304 Not Modified.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "last_successful_fetch_at",
- "catalog_version",
- "date_released"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The producing radar's last completed check (last_run_at), where the API serves one."
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "catalog": {
- "const": "CISA KEV catalog",
- "type": "string"
- },
- "catalog_count": {
- "description": "CISA's own count, in the catalog last fetched.",
- "type": [
- "number",
- "null"
- ]
- },
- "has_more": {
- "description": "Whether next_cursor names a further page.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_listed_total": {
- "description": "Every CVE EchelonGraph holds as KEV-listed.",
- "type": [
- "number",
- "null"
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "description": "Rows in this page.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "description": "CVEs matching the filters.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "required": [
- "catalog",
- "total",
- "returned",
- "kev_listed_total",
- "catalog_count",
- "limit",
- "has_more"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog": {
+ "const": "CISA KEV catalog",
+ "type": "string"
+ },
+ "catalog_count": {
+ "description": "CISA's own count, in the catalog last fetched.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "has_more": {
+ "description": "Whether next_cursor names a further page.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed_total": {
+ "description": "Every CVE EchelonGraph holds as KEV-listed.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "Rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "CVEs matching the filters.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "catalog",
+ "total",
+ "returned",
+ "kev_listed_total",
+ "catalog_count",
+ "limit",
+ "has_more"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "catalog": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "catalog_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "catalog_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_released": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "feed_url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_successful_fetch_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "filters": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {},
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "generated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev": {
+ "description": "Newest kev_added_date first; rows within one date are ordered by cve_id.",
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "eg_kev_tier": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_vuln_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "our_first_seen_kev": {
+ "description": "When EchelonGraph's poller first recorded the CVE entering the catalog; null where no such record exists.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "kev_listed_total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "next_cursor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "notes": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "order": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "date_released": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_successful_fetch_at": {
+ "description": "When CISA last answered our poll of its feed: a 200 we applied, or a 304 Not Modified.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_successful_fetch_at",
+ "catalog_version",
+ "date_released"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "catalog": {
+ "const": "CISA KEV catalog",
+ "type": "string"
+ },
+ "catalog_count": {
+ "description": "CISA's own count, in the catalog last fetched.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "has_more": {
+ "description": "Whether next_cursor names a further page.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed_total": {
+ "description": "Every CVE EchelonGraph holds as KEV-listed.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "Rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "CVEs matching the filters.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "catalog",
+ "total",
+ "returned",
+ "kev_listed_total",
+ "catalog_count",
+ "limit",
+ "has_more"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]scan_manifestsearch_cves1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "total_counted",
- "total_is_lower_bound",
- "search_relaxed",
- "returned",
- "limit",
- "offset"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "cves": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cpe_configurations": {
- "anyOf": [
- {
- "items": {},
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
- },
- "cpe_match": {
- "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "cvss_v4_severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "echelongraph_risk": {
- "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_score": {
- "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
- "type": [
- "number",
- "null"
- ]
- },
- "echelongraph_severity": {
- "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
- "type": [
- "string",
- "null"
- ]
- },
- "epss_percentile": {
- "type": [
- "number",
- "null"
- ]
- },
- "epss_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "ghsa_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_added_date": {
- "type": [
- "string",
- "null"
- ]
- },
- "kev_listed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "kev_ransomware": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "modified": {
- "type": [
- "string",
- "null"
- ]
- },
- "published": {
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "score_assessed": {
- "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "score_confidence": {
- "type": [
- "string",
- "null"
- ]
- },
- "score_unassessed_reason": {
- "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "updated_at": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_relaxed": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "total_counted": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "total_is_lower_bound": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "total",
- "total_counted",
- "total_is_lower_bound",
- "search_relaxed",
- "returned",
- "limit",
- "offset"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "The rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cves": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_due_date": {
+ "description": "CISA's dueDate: when US federal civilian agencies must have applied kev_required_action. Absent where the CVE is not CISA-KEV-listed.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_notes_urls": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The https links in CISA's notes for the CVE, in CISA's order, de-duplicated, at most 10: the references CISA's catalog entry gives, such as the vendor's advisory or instructions and NVD's page. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none)."
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_required_action": {
+ "description": "CISA's requiredAction for the CVE, verbatim from its Known Exploited Vulnerabilities catalog: the action CISA requires of US federal civilian agencies under Binding Operational Directive 22-01, by kev_due_date. It is CISA's text, not EchelonGraph's advice. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_short_description": {
+ "description": "CISA's shortDescription of the vulnerability, verbatim from its Known Exploited Vulnerabilities catalog. Absent where the CVE is not CISA-KEV-listed, where CISA's entry has none, or where EchelonGraph has not stored it yet (an API older than the field serves none).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "patch_available": {
+ "description": "true: EchelonGraph holds evidence of a fix for the CVE, its sources named in patch_evidence. false: no fix evidence is on record, which is not a finding that no fix exists. Once true it is never set back to false. An answer with no patch_evidence (an API older than that field) does not name the evidence, and a false there is not a finding that no fix exists either.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "patch_evidence": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_patch",
+ "fixed_version",
+ "release_reference",
+ "nvd_patch_reference",
+ "cna_patch_reference"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sources of the fix evidence EchelonGraph holds for the CVE, strongest first: vendor_patch (a vendor patch on record, from Ubuntu or Red Hat), fixed_version (a fixed version recorded for an affected package, or the fixed bound of an affected version range), release_reference (a reference that EchelonGraph confirmed through the GitHub API is a published release containing the fix, or a pull request or commit that a published release contains), nvd_patch_reference (an NVD reference tagged Patch) and cna_patch_reference (a reference the CVE's CNA tagged patch in its CVE record). Empty where none was found when EchelonGraph last computed it. Absent (an API older than the field): the answer does not name the evidence."
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "remediation": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {},
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "A capped summary (at most 1,500 characters of JSON) of how the CVE is fixed, as its sources state it: vendor_remediation_kinds (per kind, the vendor advisories listing one for this CVE, by the vendor's own category), vendor_advisories, vendors_not_parsed, kev_required_action (CISA's, verbatim), fixed_branches_count, fixed_versions (per package, fixed versions on record), fix_references (URLs tagged Patch or Mitigation), failed_sections, truncated, and see, the name of the tool that returns the whole, with each text. A kind missing from vendor_remediation_kinds is not a finding that no such remediation exists. Absent for a REJECTED CVE and from an API older than the field."
+ },
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "description": "How confident EchelonGraph is in its score: NONE when score_assessed is false.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "description": "true: a search phrase was relaxed to all of its words.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "description": "false: the matches were not counted, so total is not a count.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "description": "true: there are at least total matches.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "description": "The rows in this page.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]search_vendor_advisories1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "description": "Whether a free-text search filtered this answer.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query.",
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "description": "Whether a free-text search filtered this answer.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query. A query of 3 or more characters is matched case-insensitively as a substring of each advisory's title, description, vendor name, vendor_advisory_id, affected_products and cve_ids (search_match substring). A query of 1 or 2 characters matches whole words only (search_match word): it must equal, ignoring case, a whole word (a run of letters and digits) of one of those, so xz finds xz-utils but not xzibit, and a 1- or 2-character query with any other character, such as c#, matches nothing.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count. A search counts at most 1,000 matches: past that, total is 1000 and total_capped is true, which means 1,000 or more (the note writes 1,000+), never exactly 1,000; paging past it still works. Without a query, total is the exact count and total_capped is false.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds, only that vendor's when vendor is given; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]vendor_advisories_for_cve1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
- "type": [
- "string",
- "null"
- ]
- },
- "held_since": {
- "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "held_since",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "rejected_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs this advisory names whose CVE record was rejected (withdrawn) by its numbering authority: each is a rejected record, not an active vulnerability, whatever the advisory's text says. The vendor's withdrawn is separate and unchanged by it. [] when none is; null when that could not be checked."
+ },
+ "remediation_kinds": {
+ "anyOf": [
+ {
+ "items": {
+ "anyOf": [
+ {
+ "enum": [
+ "vendor_fix",
+ "workaround",
+ "mitigation",
+ "no_fix_planned",
+ "none_available",
+ "other"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The kinds of remediation the advisory lists (for the CVE asked about, on a by-cve row), each the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. [] with remediation_state not_parsed is not a finding that it lists none."
+ },
+ "remediation_state": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "parsed",
+ "none_in_source",
+ "not_parsed",
+ "withdrawn"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "parsed; none_in_source (EchelonGraph read the vendor's remediation, and it lists none for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory: not a finding of none); withdrawn (the vendor rescinded the advisory)."
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory, so it is a withdrawn advisory, not a current one.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cve_rejected": {
+ "description": "true: the CVE record of cve_id was rejected (withdrawn) by its numbering authority, so these advisories name a rejected record, not an active vulnerability; null when that could not be checked.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "description": "A vendor's window in what EchelonGraph holds: vendor, advisories (how many EchelonGraph holds from that vendor), earliest_vendor_published_at and latest_vendor_published_at (the earliest and latest vendor_published_at among them, null when none is held), held_since (the start of the window EchelonGraph has read that vendor's advisories from, before which an advisory may not be held; null when none is held or the API does not say; for a vendor with no history read it is when its feed was first read from, and can be years after earliest_vendor_published_at, since an older advisory is held when the vendor revised it later, not the ones published beside it) and history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried).",
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]v2.6.6cve_intel1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "dependents_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "version_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "cve_id": {
- "type": "string"
- },
- "cwes": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cwe_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "first_seen_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "kind": {
- "description": "metasploit, exploit_db, nuclei_template, github_poc or vendor_poc.",
- "type": [
- "string",
- "null"
- ]
- },
- "source_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source_url": {
- "type": [
- "string",
- "null"
- ]
- },
- "verified_status": {
- "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits_by_kind": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_by_status": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_capped": {
- "description": "true: exploits lists fewer references than exploits_total.",
- "type": "boolean"
- },
- "exploits_total": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
- },
- "fixed_versions": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "vulnerable_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "enriched_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "enrichment_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "fields_changed": {},
- "score_delta": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline_count_30d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_count_7d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_total": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "cve_id"
- ],
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "dependents_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_branches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "description": "The OSV record that published the range (GHSA-…, PYSEC-…, CVE-…); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed": {
+ "description": "The range's fix: the first version past it. null where no fix is on record.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "description": "The range's lower bound, inclusive; \"0\" is the first version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "description": "The range's last affected version, inclusive, where no fix is on record; never a fix.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "description": "The loader's label for that record (osv_bulk, osv); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "fixed_branches lists each affected range of the package on record: introduced, and fixed (the range's fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader's label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem's version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced (\"0\" is the first version) and below fixed, or at or below last_affected; that range's fixed is the fix for it, and a version in no range is outside every range on record. fixed_branches is null where the package's ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range's fix, kept for compatibility (one per package: the range the loader kept, the advisory's last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0."
+ },
+ "fixed_version": {
+ "description": "One range's fix, kept for compatibility; not the fix for every affected range: read fixed_branches.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cwes": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cwe_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "first_seen_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "description": "metasploit, exploit_db, nuclei_template, github_poc or vendor_poc.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "verified_status": {
+ "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits_by_kind": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_by_status": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_capped": {
+ "description": "true: exploits lists fewer references than exploits_total.",
+ "type": "boolean"
+ },
+ "exploits_total": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
+ },
+ "fixed_versions": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vulnerable_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "enriched_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "enrichment_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fields_changed": {},
+ "score_delta": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline_count_30d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_count_7d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_total": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "cve_id"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]exposure_radar1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "properties": {
- "distinct_hosts": {
- "type": "number"
- },
- "engines": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "pci_likely": {
- "type": "number"
- },
- "pii_likely": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_engines": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "engine": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "engine",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "properties": {
- "correlations": {
- "type": "number"
- },
- "distinct_hosts": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "kev_cves_exposed": {
- "type": "number"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "newest_kev": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "added_date": {
- "type": "string"
- },
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "exposed_hosts": {
- "type": "number"
- },
- "exposure_state": {
- "enum": [
- "exposed",
- "measured_zero",
- "not_assessed"
- ],
- "type": "string"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- },
- "vuln_name": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "exposure_state"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "ransomware_cves": {
- "type": "number"
- },
- "ransomware_hosts": {
- "type": "number"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "country": {
- "type": "string"
- },
- "hosts": {
- "type": "number"
- }
- },
- "required": [
- "country",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_cves": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "cve_id": {
- "type": "string"
- },
- "cvss_v3_score": {
- "type": "number"
- },
- "epss_score": {
- "type": "number"
- },
- "hosts": {
- "type": "number"
- },
- "ransomware": {
- "type": "boolean"
- },
- "severity": {
- "type": "string"
- }
- },
- "required": [
- "cve_id",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "hosts": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "hosts"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "trend": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "new_exposures": {
- "type": "number"
- },
- "week": {
- "type": "string"
- }
- },
- "required": [
- "week",
- "new_exposures"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "properties": {
- "distinct_repos": {
- "type": "number"
- },
- "distinct_secrets": {
- "type": "number"
- },
- "generated_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_providers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "provider": {
- "type": "string"
- }
- },
- "required": [
- "provider",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_types": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "secret_type": {
- "type": "string"
- }
- },
- "required": [
- "secret_type",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "properties": {
- "counted_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "enabled": {
- "type": "boolean"
- },
- "era": {
- "additionalProperties": false,
- "properties": {
- "dual": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "legacy": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "modern": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "legacy",
- "dual",
- "modern",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "not_assessed": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_assessed_by_reason": {
- "additionalProperties": false,
- "properties": {
- "bare_challenge_no_prm": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "challenge_unadjudicated": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "cross_origin_pointer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "identified_no_challenge": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "metadata_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_authorization_servers": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "no_http_answer": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_identified_as_mcp": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_invalid": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pointer_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "resource_mismatch": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_unreachable": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "identified_no_challenge",
- "resource_mismatch",
- "cross_origin_pointer",
- "bare_challenge_no_prm",
- "pointer_unreachable",
- "pointer_invalid",
- "no_authorization_servers",
- "wellknown_unreachable",
- "metadata_invalid",
- "challenge_unadjudicated",
- "no_http_answer",
- "not_identified_as_mcp"
- ],
- "type": "object"
- },
- "own_controls_excluded": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "pending_readjudication": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "prm_via": {
- "additionalProperties": false,
- "properties": {
- "header": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_path": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "wellknown_root": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "header",
- "wellknown_path",
- "wellknown_root"
- ],
- "type": "object"
- },
- "protected": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "total": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "transport": {
- "additionalProperties": false,
- "properties": {
- "legacy_sse": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "not_measured": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "streamable_http": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "unknown": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "streamable_http",
- "legacy_sse",
- "unknown",
- "not_measured"
- ],
- "type": "object"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "required": [
- "total",
- "protected",
- "pending_readjudication",
- "not_assessed"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "properties": {
- "authentication": {
- "additionalProperties": false,
- "properties": {
- "not_determined": {
- "type": "number"
- },
- "observed": {
- "type": "number"
- }
- },
- "type": "object"
- },
- "confirmed_exposed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "total": {
- "type": "number"
- },
- "window": {
- "additionalProperties": false,
- "properties": {
- "from": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "to": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- }
- },
- "required": [
- "from",
- "to"
- ],
- "type": "object"
- }
- },
- "type": "object"
- },
- "observed": {
- "additionalProperties": false,
- "properties": {
- "by_category": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "last_24h": {
- "type": "number"
- },
- "last_observation": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "top_countries": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "country": {
- "type": "string"
- }
- },
- "required": [
- "country",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_issuers": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "issuer": {
- "type": "string"
- }
- },
- "required": [
- "issuer",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "top_products": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "product": {
- "type": "string"
- }
- },
- "required": [
- "product",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "total": {
- "type": "number"
- },
- "trend_30d": {
- "items": {
- "additionalProperties": false,
- "properties": {
- "count": {
- "type": "number"
- },
- "date": {
- "type": "string"
- }
- },
- "required": [
- "date",
- "count"
- ],
- "type": "object"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "poller": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- "running": {
- "type": "boolean"
- }
- },
- "required": [
- "running",
- "last_run_at"
- ],
- "type": "object"
- }
- },
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- "freshness": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "exposed_databases": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "kev_exposure": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "leaked_credentials": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at"
- ],
- "type": "object"
- },
- "mcp_servers": {
- "additionalProperties": false,
- "properties": {
- "enabled": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "last_run_at",
- "enabled"
- ],
- "type": "object"
- },
- "shadow_ai": {
- "additionalProperties": false,
- "properties": {
- "last_run_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ]
- },
- "running": {
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "required": [
- "last_run_at",
- "running"
- ],
- "type": "object"
- }
- },
- "required": [
- "kev_exposure",
- "exposed_databases",
- "leaked_credentials",
- "shadow_ai",
- "mcp_servers"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "The producing radar's last completed check (last_run_at), where the API serves one."
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "answered": {
- "description": "The radars that answered. On a failure their answers are withheld.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "failed": {
- "description": "The radars that could not be read.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "radars": {
- "description": "The radars this tool reads.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "required": [
- "radars",
- "answered",
- "failed"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "radars": {
- "description": "Each radar that could not be read, and why.",
- "items": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "unexpected_shape"
- ],
- "type": "string"
- },
- "message": {
- "type": "string"
- },
- "path": {
- "type": "string"
- },
- "radar": {
- "type": "string"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "radar",
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "type": "array"
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "engines": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "pci_likely": {
+ "type": "number"
+ },
+ "pii_likely": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_engines": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "engine": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "engine",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "correlations": {
+ "type": "number"
+ },
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "kev_cves_exposed": {
+ "type": "number"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "newest_kev": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "added_date": {
+ "type": "string"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "exposed_hosts": {
+ "type": "number"
+ },
+ "exposure_state": {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ },
+ "vuln_name": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "exposure_state"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "ransomware_cves": {
+ "type": "number"
+ },
+ "ransomware_hosts": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_cves": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "hosts": {
+ "type": "number"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "hosts": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "trend": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "new_exposures": {
+ "type": "number"
+ },
+ "week": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "week",
+ "new_exposures"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "distinct_repos": {
+ "type": "number"
+ },
+ "distinct_secrets": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_providers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "provider": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "provider",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_types": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "secret_type": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "secret_type",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "counted_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "era": {
+ "additionalProperties": false,
+ "properties": {
+ "dual": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "legacy": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "modern": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "legacy",
+ "dual",
+ "modern",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "not_assessed": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_assessed_by_reason": {
+ "additionalProperties": false,
+ "properties": {
+ "bare_challenge_no_prm": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "challenge_unadjudicated": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "cross_origin_pointer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "identified_no_challenge": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "metadata_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_authorization_servers": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_http_answer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_identified_as_mcp": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "resource_mismatch": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "identified_no_challenge",
+ "resource_mismatch",
+ "cross_origin_pointer",
+ "bare_challenge_no_prm",
+ "pointer_unreachable",
+ "pointer_invalid",
+ "no_authorization_servers",
+ "wellknown_unreachable",
+ "metadata_invalid",
+ "challenge_unadjudicated",
+ "no_http_answer",
+ "not_identified_as_mcp"
+ ],
+ "type": "object"
+ },
+ "own_controls_excluded": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pending_readjudication": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "prm_via": {
+ "additionalProperties": false,
+ "properties": {
+ "header": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_path": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_root": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "header",
+ "wellknown_path",
+ "wellknown_root"
+ ],
+ "type": "object"
+ },
+ "protected": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "transport": {
+ "additionalProperties": false,
+ "properties": {
+ "legacy_sse": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "streamable_http": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "streamable_http",
+ "legacy_sse",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ },
+ "withheld_opted_out": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "protected",
+ "pending_readjudication",
+ "not_assessed"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "authentication": {
+ "additionalProperties": false,
+ "properties": {
+ "not_determined": {
+ "type": "number"
+ },
+ "observed": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ "confirmed_exposed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "observed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "last_observation": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "country": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "country",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_issuers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "issuer": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "issuer",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "trend_30d": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "date": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "date",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "poller": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "running": {
+ "type": "boolean"
+ }
+ },
+ "required": [
+ "running",
+ "last_run_at"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "enabled"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "running": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "running"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "radars": {
+ "description": "Each radar that could not be read, and why.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "unexpected_shape"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "type": "string"
+ },
+ "path": {
+ "type": "string"
+ },
+ "radar": {
+ "type": "string"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "radar",
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]get_vendor_advisory1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "known_cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "references": {},
- "remediation": {
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_modified_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "withdrawn_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn_reason": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "vendor_window": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
- }
- },
- "required": [
- "vendor_window"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "known_cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The CVE IDs of cve_ids that have a record in EchelonGraph's CVE feed."
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "remediation": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_modified_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "withdrawn_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn_reason": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "vendor_window": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "This advisory's vendor's window in what EchelonGraph holds; null when the windows could not be read or carry none for this vendor."
+ }
+ },
+ "required": [
+ "vendor_window"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]search_vendor_advisories1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "description": "Whether a free-text search filtered this answer.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query.",
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "limit": {
- "type": [
- "number",
- "null"
- ]
- },
- "offset": {
- "type": [
- "number",
- "null"
- ]
- },
- "returned": {
- "type": [
- "number",
- "null"
- ]
- },
- "search_applied": {
- "type": [
- "boolean",
- "null"
- ]
- },
- "search_match": {
- "anyOf": [
- {
- "enum": [
- "word",
- "substring"
- ],
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
- },
- "total": {
- "description": "The API's total; when total_capped is true, a lower bound, not the count.",
- "type": [
- "number",
- "null"
- ]
- },
- "total_capped": {
- "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
- }
- },
- "required": [
- "total",
- "total_capped",
- "returned",
- "limit",
- "offset",
- "search_applied",
- "search_match",
- "vendor_windows"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "description": "Whether a free-text search filtered this answer.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "description": "How the query was matched: word (a query of 1 or 2 characters, whole words only) or substring; null without a query.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "description": "The matches; when total_capped is true, a lower bound: 1,000 or more.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: the search stopped counting at total, so total is a lower bound (1,000+), not the count.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_applied": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "search_match": {
+ "anyOf": [
+ {
+ "enum": [
+ "word",
+ "substring"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "word: a query of 1 or 2 characters, matched as a whole word only; substring: a longer query; null without a query."
+ },
+ "total": {
+ "description": "The API's total; when total_capped is true, a lower bound, not the count.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_capped": {
+ "description": "true: total is the API's cap on a search's count, so 1,000 or more match.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ }
+ },
+ "required": [
+ "total",
+ "total_capped",
+ "returned",
+ "limit",
+ "offset",
+ "search_applied",
+ "search_match",
+ "vendor_windows"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]vendor_advisories_for_cve1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, the earliest held dated after 1 January of cve_year, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "advisories": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "affected_products": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_ids": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cvss_v3_score": {
- "type": [
- "number",
- "null"
- ]
- },
- "our_first_seen_at": {
- "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
- "type": [
- "string",
- "null"
- ]
- },
- "severity": {
- "type": [
- "string",
- "null"
- ]
- },
- "summary": {
- "type": [
- "string",
- "null"
- ]
- },
- "title": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_advisory_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "vendor_published_at": {
- "description": "The date the vendor gives for the advisory.",
- "type": [
- "string",
- "null"
- ]
- },
- "withdrawn": {
- "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
- "type": [
- "boolean",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ]
- },
- "cve_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "at_cap": {
- "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
- "type": [
- "boolean",
- "null"
- ]
- },
- "cap": {
- "description": "The most the API returns for one CVE, newest first.",
- "type": "number"
- },
- "cve_year": {
- "description": "The year in the CVE ID.",
- "type": "number"
- },
- "returned": {
- "description": "The advisories in this answer.",
- "type": [
- "number",
- "null"
- ]
- },
- "vendor_windows": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": false,
- "properties": {
- "advisories": {
- "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
- "type": [
- "number",
- "null"
- ]
- },
- "earliest_vendor_published_at": {
- "description": "The earliest vendor_published_at among them; null when none is held. An advisory this vendor published before it is not held.",
- "type": [
- "string",
- "null"
- ]
- },
- "history_backfill": {
- "anyOf": [
- {
- "anyOf": [
- {
- "enum": [
- "complete",
- "in_progress",
- "not_started",
- "not_supported"
- ],
- "type": "string"
- },
- {
- "type": "string"
- }
- ]
- },
- {
- "type": "null"
- }
- ],
- "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
- },
- "latest_vendor_published_at": {
- "description": "The latest vendor_published_at among them; null when none is held.",
- "type": [
- "string",
- "null"
- ]
- },
- "vendor": {
- "description": "The vendor slug.",
- "type": "string"
- },
- "vendor_display_name": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "required": [
- "vendor",
- "vendor_display_name",
- "advisories",
- "earliest_vendor_published_at",
- "latest_vendor_published_at",
- "history_backfill"
- ],
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its earliest_vendor_published_at is not held, so no advisory from a vendor is not a finding that it published none."
- },
- "vendors_not_fully_held": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, the earliest held dated after 1 January of cve_year, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
- }
- },
- "required": [
- "returned",
- "cap",
- "at_cap",
- "cve_year",
- "vendor_windows",
- "vendors_not_fully_held"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "advisories": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "affected_products": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_ids": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "our_first_seen_at": {
+ "description": "When EchelonGraph first recorded the advisory; not the vendor's date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "summary": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "title": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_advisory_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor_published_at": {
+ "description": "The date the vendor gives for the advisory.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "withdrawn": {
+ "description": "true: the vendor withdrew (rescinded) this advisory; report it as withdrawn.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "at_cap": {
+ "description": "true: the answer is full, so the vendor feeds may hold more advisories for this CVE than it lists.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "cap": {
+ "description": "The most the API returns for one CVE, newest first.",
+ "type": "number"
+ },
+ "cve_year": {
+ "description": "The year in the CVE ID.",
+ "type": "number"
+ },
+ "returned": {
+ "description": "The advisories in this answer.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "vendor_windows": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "advisories": {
+ "description": "How many advisories EchelonGraph holds from this vendor, withdrawn ones not counted.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "earliest_vendor_published_at": {
+ "description": "The earliest vendor_published_at among them; null when none is held. Not where the window begins: see held_since.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "held_since": {
+ "description": "The start of the window EchelonGraph has read this vendor's advisories from; null when none is held or the API does not say. An advisory this vendor published before it may not be held, even when earliest_vendor_published_at is older.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "history_backfill": {
+ "anyOf": [
+ {
+ "anyOf": [
+ {
+ "enum": [
+ "complete",
+ "in_progress",
+ "not_started",
+ "not_supported"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "string"
+ }
+ ]
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "history_backfill: complete (the vendor's published history has been read back as far as its source goes), in_progress or not_started (it is still being read, so the vendor's older advisories are not all held yet), or not_supported (EchelonGraph has no history read for that vendor, so what it holds is what the vendor's feed has carried)."
+ },
+ "latest_vendor_published_at": {
+ "description": "The latest vendor_published_at among them; null when none is held.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vendor": {
+ "description": "The vendor slug.",
+ "type": "string"
+ },
+ "vendor_display_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "vendor",
+ "vendor_display_name",
+ "advisories",
+ "earliest_vendor_published_at",
+ "latest_vendor_published_at",
+ "held_since",
+ "history_backfill"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Each vendor's window in what EchelonGraph holds; null when the windows could not be read. An advisory a vendor published before its held_since may not be held, even when its earliest_vendor_published_at is older, so no advisory from a vendor is not a finding that it published none."
+ },
+ "vendors_not_fully_held": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The vendors with no advisory in this answer that may have published one EchelonGraph does not hold: none held, held_since after 1 January of cve_year or not known, or history_backfill in_progress or not_started. No advisory from them is not a finding that they published none. null when the windows could not be read."
+ }
+ },
+ "required": [
+ "returned",
+ "cap",
+ "at_cap",
+ "cve_year",
+ "vendor_windows",
+ "vendors_not_fully_held"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]v2.6.5check_sbom1 field changedInput schema / properties / sbom / descriptionPrevious value: -"a CycloneDX JSON or SPDX JSON document, as JSON text or as an object; its purls are read here and only they are sent"New value: +"a CycloneDX JSON or SPDX JSON document, as JSON text or as an object; its purls are read by this MCP server and only they are sent to the API; over the hosted endpoint (mcp.echelongraph.io) the document is the request body"cve_summary1 field changedOutput schema / oneOfPrevious value: -[
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "description": "What the answer covers; null where the answer says nothing about it.",
- "type": "null"
- },
- "data": {
- "additionalProperties": {},
- "properties": {
- "poller": {
- "anyOf": [
- {
- "additionalProperties": {},
- "properties": {
- "cves_ingested": {
- "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
- "type": [
- "number",
- "null"
- ]
- },
- "cves_skipped": {
- "description": "CVE records this instance's NVD poller skipped since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "http_retries": {
- "description": "HTTP retries this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "interval": {
- "description": "How often this instance's NVD poller polls.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_at": {
- "description": "When this instance's NVD poller last polled: never the feed's freshness.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_poll_dur_ms": {
- "description": "How long that poll took, in milliseconds.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_count": {
- "description": "Polls this instance's NVD poller made since the instance last started.",
- "type": [
- "number",
- "null"
- ]
- },
- "poll_errors": {
- "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so."
- },
- "summary": {
- "additionalProperties": {},
- "properties": {
- "critical": {
- "type": [
- "number",
- "null"
- ]
- },
- "high": {
- "type": [
- "number",
- "null"
- ]
- },
- "last_updated": {
- "type": [
- "string",
- "null"
- ]
- },
- "low": {
- "type": [
- "number",
- "null"
- ]
- },
- "medium": {
- "type": [
- "number",
- "null"
- ]
- },
- "none": {
- "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_critical": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_high": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_low": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_medium": {
- "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
- "type": [
- "number",
- "null"
- ]
- },
- "nvd_none": {
- "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
- "type": [
- "number",
- "null"
- ]
- },
- "rejected": {
- "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
- "type": [
- "number",
- "null"
- ]
- },
- "total": {
- "type": [
- "number",
- "null"
- ]
- },
- "unscored": {
- "description": "The same count as none, under its own name.",
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- }
- },
- "type": "object"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "type": "null"
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "poller": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cves_ingested": {
+ "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cves_skipped": {
+ "description": "CVE records this instance's NVD poller skipped since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "http_retries": {
+ "description": "HTTP retries this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "interval": {
+ "description": "How often this instance's NVD poller polls.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_at": {
+ "description": "When this instance's NVD poller last polled: never the feed's freshness.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_dur_ms": {
+ "description": "How long that poll took, in milliseconds.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_count": {
+ "description": "Polls this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_errors": {
+ "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so. A poller field the answer sends in a JSON type other than the one described here is left out of data and named in the note, and a poller that is neither a JSON object nor null is left out whole: summary is relayed either way."
+ },
+ "summary": {
+ "additionalProperties": {},
+ "properties": {
+ "critical": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "high": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "last_updated": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "low": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "medium": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "none": {
+ "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_critical": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_high": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_low": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_medium": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_none": {
+ "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "rejected": {
+ "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "unscored": {
+ "description": "The same count as none, under its own name.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]v2.6.3check_affectedcheck_sbomcve_exposure3 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / additionalPropertiesRemoved value: -falseOutput schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "oneOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "countries": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "exposed_hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "generated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_catalog_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_seen_in_observations": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_seen": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "method": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "top_countries": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "country": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "top_products": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "hosts": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "product": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "tracked": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "exposure_state": {
+ "anyOf": [
+ {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed",
+ "tracking_unknown"
+ ],
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer's count is, as the note's (exposure_state: …) tag says; not state, which says whether the answer is a dated measurement. exposed: data.exposed_hosts counts the services the radar holds on record for the CVE, above 0. measured_zero: the API marks the CVE as tracked with 0 services, a zero in the radar's sample. not_assessed: the CVE is outside the radar's tracked set, so its count, if any, is not a current measurement. tracking_unknown: the API does not say whether the radar tracks the CVE, so its 0 is not evidence either way. null: the answer carries no count."
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "exposure_state",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "in_scope": {
+ "description": "The API's tracked verdict: whether the CVE is in the radar's tracked set; null when the answer does not say.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "in_scope"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+ ],
+ "type": "object"
+}cve_intelcve_summary2 fields changedInput schema / $schemaRemoved value: -"http://json-schema.org/draft-07/schema#"Output schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "oneOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "poller": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "cves_ingested": {
+ "description": "CVE records this instance's NVD poller wrote since the instance last started: never the feed's size or intake.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cves_skipped": {
+ "description": "CVE records this instance's NVD poller skipped since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "http_retries": {
+ "description": "HTTP retries this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "interval": {
+ "description": "How often this instance's NVD poller polls.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_at": {
+ "description": "When this instance's NVD poller last polled: never the feed's freshness.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_poll_dur_ms": {
+ "description": "How long that poll took, in milliseconds.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_count": {
+ "description": "Polls this instance's NVD poller made since the instance last started.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "poll_errors": {
+ "description": "Polls of this instance's NVD poller that failed since the instance last started: never the feed's reliability.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "poller holds the in-memory counters of the NVD poller of the one API instance that answered (cves_ingested, cves_skipped, http_retries, poll_count, poll_errors, last_poll_at, last_poll_dur_ms, interval), counted since that instance last started and zeroed on every restart: they describe that instance, never the feed's size, intake, reliability or freshness. Whenever the answer carries poller the note says so."
+ },
+ "summary": {
+ "additionalProperties": {},
+ "properties": {
+ "critical": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "high": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "last_updated": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "low": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "medium": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "none": {
+ "description": "The active CVEs with no severity band from any source: CVEs not yet scored, not a severity rating of None.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_critical": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Critical: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_high": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is High: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_low": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Low: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_medium": {
+ "description": "Of the active CVEs total counts, those whose NVD CVSS severity label is Medium: NVD's label, as provenance, never EchelonGraph's severity band.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "nvd_none": {
+ "description": "Of the active CVEs total counts, those with no Critical, High, Medium or Low NVD CVSS severity label, many of them with an NVD CVSS v2 score instead: neither a count of CVEs rated None nor the count of CVEs with no severity, which is none.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "rejected": {
+ "description": "The CVE records rejected (withdrawn) by their numbering authority, which total and every other count here leave out: withdrawn records, never vulnerabilities.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "unscored": {
+ "description": "The same count as none, under its own name.",
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+ ],
+ "type": "object"
+}epss_historyexposure_radar2 fields changedInput schema / $schemaRemoved value: -"http://json-schema.org/draft-07/schema#"Output schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "oneOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "engines": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "pci_likely": {
+ "type": "number"
+ },
+ "pii_likely": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_engines": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "engine": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "engine",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "correlations": {
+ "type": "number"
+ },
+ "distinct_hosts": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "kev_cves_exposed": {
+ "type": "number"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "newest_kev": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "added_date": {
+ "type": "string"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "exposed_hosts": {
+ "type": "number"
+ },
+ "exposure_state": {
+ "enum": [
+ "exposed",
+ "measured_zero",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ },
+ "vuln_name": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "exposure_state"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "ransomware_cves": {
+ "type": "number"
+ },
+ "ransomware_hosts": {
+ "type": "number"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "country": {
+ "type": "string"
+ },
+ "hosts": {
+ "type": "number"
+ }
+ },
+ "required": [
+ "country",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_cves": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "cve_id": {
+ "type": "string"
+ },
+ "cvss_v3_score": {
+ "type": "number"
+ },
+ "epss_score": {
+ "type": "number"
+ },
+ "hosts": {
+ "type": "number"
+ },
+ "ransomware": {
+ "type": "boolean"
+ },
+ "severity": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "cve_id",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "hosts": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "hosts"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "trend": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "new_exposures": {
+ "type": "number"
+ },
+ "week": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "week",
+ "new_exposures"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "distinct_repos": {
+ "type": "number"
+ },
+ "distinct_secrets": {
+ "type": "number"
+ },
+ "generated_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_providers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "provider": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "provider",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_types": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "secret_type": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "secret_type",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "counted_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "era": {
+ "additionalProperties": false,
+ "properties": {
+ "dual": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "legacy": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "modern": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "legacy",
+ "dual",
+ "modern",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "not_assessed": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_assessed_by_reason": {
+ "additionalProperties": false,
+ "properties": {
+ "bare_challenge_no_prm": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "challenge_unadjudicated": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "cross_origin_pointer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "identified_no_challenge": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "metadata_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_authorization_servers": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "no_http_answer": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_identified_as_mcp": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_invalid": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pointer_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "resource_mismatch": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_unreachable": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "identified_no_challenge",
+ "resource_mismatch",
+ "cross_origin_pointer",
+ "bare_challenge_no_prm",
+ "pointer_unreachable",
+ "pointer_invalid",
+ "no_authorization_servers",
+ "wellknown_unreachable",
+ "metadata_invalid",
+ "challenge_unadjudicated",
+ "no_http_answer",
+ "not_identified_as_mcp"
+ ],
+ "type": "object"
+ },
+ "own_controls_excluded": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "pending_readjudication": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "prm_via": {
+ "additionalProperties": false,
+ "properties": {
+ "header": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_path": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "wellknown_root": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "header",
+ "wellknown_path",
+ "wellknown_root"
+ ],
+ "type": "object"
+ },
+ "protected": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "transport": {
+ "additionalProperties": false,
+ "properties": {
+ "legacy_sse": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "not_measured": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "streamable_http": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "unknown": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "streamable_http",
+ "legacy_sse",
+ "unknown",
+ "not_measured"
+ ],
+ "type": "object"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "total",
+ "protected",
+ "pending_readjudication",
+ "not_assessed"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "authentication": {
+ "additionalProperties": false,
+ "properties": {
+ "not_determined": {
+ "type": "number"
+ },
+ "observed": {
+ "type": "number"
+ }
+ },
+ "type": "object"
+ },
+ "confirmed_exposed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "total": {
+ "type": "number"
+ },
+ "window": {
+ "additionalProperties": false,
+ "properties": {
+ "from": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "to": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ }
+ },
+ "required": [
+ "from",
+ "to"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "observed": {
+ "additionalProperties": false,
+ "properties": {
+ "by_category": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "last_24h": {
+ "type": "number"
+ },
+ "last_observation": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "top_countries": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "country": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "country",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_issuers": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "issuer": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "issuer",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "top_products": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "product": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "product",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "total": {
+ "type": "number"
+ },
+ "trend_30d": {
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "count": {
+ "type": "number"
+ },
+ "date": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "date",
+ "count"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "poller": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ "running": {
+ "type": "boolean"
+ }
+ },
+ "required": [
+ "running",
+ "last_run_at"
+ ],
+ "type": "object"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "exposed_databases": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "kev_exposure": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "leaked_credentials": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at"
+ ],
+ "type": "object"
+ },
+ "mcp_servers": {
+ "additionalProperties": false,
+ "properties": {
+ "enabled": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "enabled"
+ ],
+ "type": "object"
+ },
+ "shadow_ai": {
+ "additionalProperties": false,
+ "properties": {
+ "last_run_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "running": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "last_run_at",
+ "running"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "kev_exposure",
+ "exposed_databases",
+ "leaked_credentials",
+ "shadow_ai",
+ "mcp_servers"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "answered": {
+ "description": "The radars that answered. On a failure their answers are withheld.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "failed": {
+ "description": "The radars that could not be read.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "radars": {
+ "description": "The radars this tool reads.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "required": [
+ "radars",
+ "answered",
+ "failed"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "radars": {
+ "description": "Each radar that could not be read, and why.",
+ "items": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "unexpected_shape"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "type": "string"
+ },
+ "path": {
+ "type": "string"
+ },
+ "radar": {
+ "type": "string"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "radar",
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+ ],
+ "type": "object"
+}get_cve3 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / additionalPropertiesRemoved value: -falseOutput schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "oneOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "description": "What the answer covers; null where the answer says nothing about it.",
+ "type": "null"
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "type": "null"
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+ ],
+ "type": "object"
+}get_cweget_vendor_advisorykev_recentsearch_cves4 fields changedInput schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"Input schema / additionalPropertiesRemoved value: -falseInput schema / properties / offsetAdded value: +{
+ "description": "rows to skip (default 0)",
+ "maximum": 10000,
+ "minimum": 0,
+ "type": "integer"
+}Output schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "oneOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "cves": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cpe_configurations": {
+ "anyOf": [
+ {
+ "items": {},
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "NVD's configurations array as NVD sent it: each configuration and node with its operator (AND, OR) and negate, and each cpeMatch with criteria, vulnerable, versionStartIncluding, versionStartExcluding, versionEndIncluding, versionEndExcluding and matchCriteriaId. A cpeMatch with vulnerable false inside an AND configuration is the platform the vulnerable product runs on, not an affected product. Absent: EchelonGraph holds no stored NVD configuration for the CVE, which is not a finding that no product is affected."
+ },
+ "cpe_match": {
+ "description": "The record's CPE match criteria as one flat list, every configuration's cpeMatch entries together: the AND/OR operator and negate of each configuration and node, versionStartExcluding and matchCriteriaId are not in it, so a CPE that is only a platform a product runs on reads as one more entry."
+ },
+ "cve_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "cvss_v3_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "cvss_v4_severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "echelongraph_risk": {
+ "description": "EchelonGraph's 0-100 risk priority, fused from the score, exploitation and automatability: a rating only when score_assessed is true. With score_assessed false it is a placeholder.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_score": {
+ "description": "EchelonGraph's 0-10 score for the CVE: a score only when score_assessed is true. With score_assessed false it is a placeholder, not a rating.",
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "echelongraph_severity": {
+ "description": "The severity band of echelongraph_score: a rating only when score_assessed is true. With score_assessed false it is a placeholder (NONE).",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "epss_percentile": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "epss_score": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ghsa_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_added_date": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kev_listed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "kev_ransomware": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "modified": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "published": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "references": {},
+ "score_assessed": {
+ "description": "Whether EchelonGraph has scored the CVE. true: echelongraph_score, echelongraph_severity and echelongraph_risk are its score. false: the CVE is NOT YET SCORED, not scored 0, and any of those three it carries is a placeholder, not a rating; the API may leave them out. Absent (an API older than the field): the answer does not say whether the CVE was scored.",
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "score_confidence": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "score_unassessed_reason": {
+ "description": "Why score_assessed is false: no_signal, no source has yet published severity data EchelonGraph can score; or rejected, the record was withdrawn by its numbering authority and is never scored. Absent when the CVE is scored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "severity": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "updated_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "freshness": {
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+ "type": "null"
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "limit": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "offset": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "returned": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "search_relaxed": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "total_counted": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ },
+ "total_is_lower_bound": {
+ "type": [
+ "boolean",
+ "null"
+ ]
+ }
+ },
+ "required": [
+ "total",
+ "total_counted",
+ "total_is_lower_bound",
+ "search_relaxed",
+ "returned",
+ "limit",
+ "offset"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+ ],
+ "type": "object"
+}search_vendor_advisoriesvendor_advisories_for_cvev1.0.3cve_exposurecve_summaryexposure_radarget_cvesearch_cvesScored across 16 tools
Most tools target distinct axes: single-CVE record (get_cve), CVE search (search_cves), per-CVE enrichment (cve_intel), remediation (cve_remediation), EPSS history, and exposure. However, check_affected/scan_manifest/check_sbom share the same underlying 'check component vs advisory corpus' purpose and differ mainly by input shape, and vendor_advisories_for_cve vs get_vendor_advisory vs search_vendor_advisories have fuzzy boundaries. An agent can usually pick correctly, but a few choices require careful reading.
There is a recognizable scheme: get_* for single records (get_cve, get_cwe, get_vendor_advisory), search_* for lists (search_cves, search_vendor_advisories), check_*/scan_* for assessment, and resource-prefixed analytics (cve_*, kev_*, epss_*). The noun-only names like cve_exposure, exposure_radar, kev_recent and epss_history deviate from a strict verb_noun pattern, but the set remains predictable and readable.
Sixteen tools is at the heavier end for a single server, but this is a broad vulnerability-intelligence platform spanning CVE lookup, KEV, EPSS, exposure, SBOM/manifest scanning, CWE and vendor advisories, and each tool covers a distinct capability. Nothing is clearly redundant enough to remove, so the count is justified though slightly on the high side.
The surface covers the read lifecycle well: search and fetch CVEs, summaries, KEV and EPSS feeds, per-CVE intel/remediation, exposure radar, CWE grouping, vendor advisory search/detail, and component assessment via single version, lockfile or SBOM. Minor gaps remain, such as a direct 'list all CVEs affecting a package/ecosystem' query, but the core workflows have no dead ends.
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions, CPE configurations.
Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.
Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.
Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
