EchelonGraph MCP Server

Official

by echelongraph

Overview Schema Source Related Servers Discussions Admin

JavaScript

Remote

How one CVE is fixed

cve_remediation

Read-onlyIdempotent

Retrieve how one CVE is fixed, per its sources: vendor advisories, patches, mitigations, CISA KEV required actions, fixed versions, and installed-package verdict.

Instructions

How one CVE is fixed, as its sources state it, in one answer. Every text is relayed as stated by its source; EchelonGraph has not tested it. An empty list or a remediation_state of none_in_source or not_parsed is not a finding that no fix exists. Returns fix_status (the API's fix-status rule, as CVE Pulse shows it: state and basis), cisa (for a KEV-listed CVE CISA's required_action, due_date, short_description and notes_urls, verbatim; CISA's required_action is directed at US federal civilian agencies (under BOD 26-04, which replaced BOD 22-01 on 10 June 2026) and is not EchelonGraph's advice.), fixed_branches (each affected package with fixed_branches: every affected range, introduced and fixed or last_affected, and fixed_version, one range's fix), vendor_remediations (each vendor advisory naming the CVE, newest first, at most 20, with remediation_state, remediation_kinds and items, each with kind, source_category, text and url), fix_references (references NVD or the CNA tagged Patch or Mitigation), patches, coverage and failed_sections. kind is the vendor's own category, never read from the text: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other. remediation_state is parsed, none_in_source (none listed for this CVE), not_parsed (that vendor's remediation is not read) or withdrawn. ecosystem, package and version (all three or none, sent in request headers, never in the URL) add installed, the verdict at that version, and fixed_in, the lowest unaffected version above it, or null with fixed_in_reason. A section the API could not read is named in failed_sections, not relayed as empty. A REJECTED CVE answers not_assessed. Past 30,000 characters of JSON, the first text block holds data cut to fit, and the note says what the cut leaves out and where to read it (TEXT CUT); so is structured data (DATA CUT), unless full: true. Cut, vendor texts are shortened first; kinds, states and URLs are kept.

Input Schema

TableJSON Schema

Name	Required	Description
`full`	No	true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.
`cve_id`	Yes	a CVE ID, e.g. CVE-2021-44228
`package`	No	Installed version, with ecosystem and version: the package name in that ecosystem, such as org.apache.logging.log4j:log4j-core. Sent in a request header.
`version`	No	Installed version, with ecosystem and package: the version installed, such as 2.14.1. Sent in a request header.
`ecosystem`	No	Installed version, with package and version: the package's ecosystem, such as npm, PyPI or Maven. Sent in a request header.

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv3.0.2Oct 17, 2026

addedInput schema / properties / ecosystem

Added value: +{
+  "description": "Installed version, with package and version: the package's ecosystem, such as npm, PyPI or Maven. Sent in a request header.",
+  "type": "string"
+}

addedInput schema / properties / full

Added value: +{
+  "description": "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.",
+  "type": "boolean"
+}

addedInput schema / properties / package

Added value: +{
+  "description": "Installed version, with ecosystem and version: the package name in that ecosystem, such as org.apache.logging.log4j:log4j-core. Sent in a request header.",
+  "type": "string"
+}

addedInput schema / properties / version

Added value: +{
+  "description": "Installed version, with ecosystem and package: the version installed, such as 2.14.1. Sent in a request header.",
+  "type": "string"
+}

changedOutput schema / oneOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "properties": {
-      "coverage": {
-        "anyOf": [
-          {
-            "additionalProperties": false,
-            "properties": {
-              "item_text_cap": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "items_per_advisory_cap": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "parsed_vendors": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The vendors whose remediation EchelonGraph parses."
-              },
-              "sections_failed": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
-              },
-              "sections_relayed": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "vendor_advisory_limit": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "vendors_not_parsed": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
-              }
-            },
-            "required": [
-              "sections_relayed",
-              "sections_failed",
-              "parsed_vendors",
-              "vendors_not_parsed",
-              "vendor_advisory_limit",
-              "item_text_cap",
-              "items_per_advisory_cap"
-            ],
-            "type": "object"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "description": "What the answer covers; null where the answer says nothing about it."
-      },
-      "data": {
-        "additionalProperties": {},
-        "properties": {
-          "cisa": {
-            "anyOf": [
-              {
-                "additionalProperties": {},
-                "properties": {
-                  "due_date": {
-                    "type": [
-                      "string",
-                      "null"
-                    ]
-                  },
-                  "kev_listed": {
-                    "type": [
-                      "boolean",
-                      "null"
-                    ]
-                  },
-                  "notes_urls": {
-                    "anyOf": [
-                      {
-                        "items": {
-                          "type": "string"
-                        },
-                        "type": "array"
-                      },
-                      {
-                        "type": "null"
-                      }
-                    ]
-                  },
-                  "required_action": {
-                    "description": "CISA's requiredAction, verbatim. CISA's required_action is directed at US federal civilian agencies (BOD 22-01) and is not EchelonGraph's advice.",
-                    "type": [
-                      "string",
-                      "null"
-                    ]
-                  },
-                  "short_description": {
-                    "type": [
-                      "string",
-                      "null"
-                    ]
-                  }
-                },
-                "type": "object"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "coverage": {},
-          "cve_id": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "failed_sections": {
-            "anyOf": [
-              {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "fix_references": {
-            "anyOf": [
-              {
-                "items": {
-                  "additionalProperties": {},
-                  "properties": {
-                    "source": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "tags": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "type": "string"
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "url": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    }
-                  },
-                  "type": "object"
-                },
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "fixed_branches": {
-            "anyOf": [
-              {
-                "items": {
-                  "additionalProperties": {},
-                  "properties": {
-                    "ecosystem": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "fixed_branches": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "additionalProperties": {},
-                            "properties": {
-                              "advisory_id": {
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "fixed": {
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "introduced": {
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "last_affected": {
-                                "description": "The range's last affected version, where no fix is on record; never a fix.",
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "source": {
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              }
-                            },
-                            "type": "object"
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "fixed_version": {
-                      "description": "One range's fix, kept for compatibility; not the fix for every affected range.",
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "package_name": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    }
-                  },
-                  "type": "object"
-                },
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "not_assessed_reason": {
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "patches": {
-            "anyOf": [
-              {
-                "items": {},
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "state": {
-            "description": "assessed, or not_assessed for a CVE record rejected by its numbering authority.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "vendor_remediations": {
-            "anyOf": [
-              {
-                "items": {
-                  "additionalProperties": {},
-                  "properties": {
-                    "items": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "additionalProperties": {},
-                            "properties": {
-                              "fixed_build": {
-                                "description": "MSRC's FixedBuild; null elsewhere.",
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "kind": {
-                                "anyOf": [
-                                  {
-                                    "anyOf": [
-                                      {
-                                        "enum": [
-                                          "vendor_fix",
-                                          "workaround",
-                                          "mitigation",
-                                          "no_fix_planned",
-                                          "none_available",
-                                          "other"
-                                        ],
-                                        "type": "string"
-                                      },
-                                      {
-                                        "type": "string"
-                                      }
-                                    ]
-                                  },
-                                  {
-                                    "type": "null"
-                                  }
-                                ],
-                                "description": "The vendor's own category: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other."
-                              },
-                              "product_count": {
-                                "type": [
-                                  "number",
-                                  "null"
-                                ]
-                              },
-                              "product_ids": {
-                                "anyOf": [
-                                  {
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "type": "array"
-                                  },
-                                  {
-                                    "type": "null"
-                                  }
-                                ],
-                                "description": "The vendor's own product identifiers the item applies to, the first 16."
-                              },
-                              "source_category": {
-                                "description": "The vendor's own name for the category (CSAF vendor_fix, MSRC Vendor Fix, Palo Alto work_around).",
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "source_subcategory": {
-                                "description": "MSRC's SubType, e.g. Security Update; null elsewhere.",
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "text": {
-                                "description": "The vendor's text, verbatim but for HTML markup removed, cut at coverage.item_text_cap characters (text_truncated).",
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              },
-                              "text_chars": {
-                                "description": "The length of the vendor's text in characters.",
-                                "type": [
-                                  "number",
-                                  "null"
-                                ]
-                              },
-                              "text_truncated": {
-                                "type": [
-                                  "boolean",
-                                  "null"
-                                ]
-                              },
-                              "url": {
-                                "type": [
-                                  "string",
-                                  "null"
-                                ]
-                              }
-                            },
-                            "type": "object"
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "items_total": {
-                      "type": [
-                        "number",
-                        "null"
-                      ]
-                    },
-                    "remediation_kinds": {
-                      "anyOf": [
-                        {
-                          "items": {
-                            "anyOf": [
-                              {
-                                "enum": [
-                                  "vendor_fix",
-                                  "workaround",
-                                  "mitigation",
-                                  "no_fix_planned",
-                                  "none_available",
-                                  "other"
-                                ],
-                                "type": "string"
-                              },
-                              {
-                                "type": "string"
-                              }
-                            ]
-                          },
-                          "type": "array"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
-                    },
-                    "remediation_state": {
-                      "anyOf": [
-                        {
-                          "anyOf": [
-                            {
-                              "enum": [
-                                "parsed",
-                                "none_in_source",
-                                "not_parsed",
-                                "withdrawn"
-                              ],
-                              "type": "string"
-                            },
-                            {
-                              "type": "string"
-                            }
-                          ]
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ],
-                      "description": "parsed; none_in_source (parsed, and the advisory lists no remediation for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory); withdrawn (the vendor rescinded it)."
-                    },
-                    "vendor": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_advisory_id": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_display_name": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "vendor_published_at": {
-                      "type": [
-                        "string",
-                        "null"
-                      ]
-                    },
-                    "withdrawn": {
-                      "type": [
-                        "boolean",
-                        "null"
-                      ]
-                    }
-                  },
-                  "type": "object"
-                },
-                "type": "array"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          }
-        },
-        "type": "object"
-      },
-      "freshness": {
-        "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
-        "type": "null"
-      },
-      "measured_at": {
-        "anyOf": [
-          {
-            "description": "An RFC 3339 instant.",
-            "type": "string"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
-      },
-      "method": {
-        "description": "How the numbers were produced.",
-        "type": "string"
-      },
-      "notes": {
-        "description": "Caveats, one sentence each.",
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "state": {
-        "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
-        "enum": [
-          "measured",
-          "not_assessed"
-        ],
-        "type": "string"
-      }
-    },
-    "required": [
-      "state",
-      "measured_at",
-      "method",
-      "coverage",
-      "freshness",
-      "notes",
-      "data"
-    ],
-    "type": "object"
-  },
-  {
-    "additionalProperties": false,
-    "properties": {
-      "coverage": {
-        "anyOf": [
-          {
-            "additionalProperties": false,
-            "properties": {
-              "item_text_cap": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "items_per_advisory_cap": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "parsed_vendors": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The vendors whose remediation EchelonGraph parses."
-              },
-              "sections_failed": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
-              },
-              "sections_relayed": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "vendor_advisory_limit": {
-                "type": [
-                  "number",
-                  "null"
-                ]
-              },
-              "vendors_not_parsed": {
-                "anyOf": [
-                  {
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
-                  },
-                  {
-                    "type": "null"
-                  }
-                ],
-                "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
-              }
-            },
-            "required": [
-              "sections_relayed",
-              "sections_failed",
-              "parsed_vendors",
-              "vendors_not_parsed",
-              "vendor_advisory_limit",
-              "item_text_cap",
-              "items_per_advisory_cap"
-            ],
-            "type": "object"
-          },
-          {
-            "type": "null"
-          }
-        ]
-      },
-      "error": {
-        "additionalProperties": false,
-        "properties": {
-          "kind": {
-            "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
-            "enum": [
-              "network",
-              "timeout",
-              "http",
-              "not_json",
-              "not_object",
-              "invalid_input",
-              "internal",
-              "unexpected_shape",
-              "radars"
-            ],
-            "type": "string"
-          },
-          "message": {
-            "description": "The cause: the API's own message, or what went wrong.",
-            "type": "string"
-          },
-          "path": {
-            "description": "The API path requested, when a request was made.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "status": {
-            "anyOf": [
-              {
-                "maximum": 9007199254740991,
-                "minimum": -9007199254740991,
-                "type": "integer"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The HTTP status, when the API answered one."
-          }
-        },
-        "required": [
-          "kind",
-          "path",
-          "status",
-          "message"
-        ],
-        "type": "object"
-      },
-      "freshness": {
-        "type": "null"
-      },
-      "measured_at": {
-        "type": "null"
-      },
-      "method": {
-        "type": "null"
-      },
-      "notes": {
-        "description": "Caveats, one sentence each.",
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "state": {
-        "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
-        "enum": [
-          "failed",
-          "invalid_input"
-        ],
-        "type": "string"
-      }
-    },
-    "required": [
-      "state",
-      "measured_at",
-      "method",
-      "coverage",
-      "freshness",
-      "notes",
-      "error"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "additionalProperties": {},
+    "properties": {
+      "coverage": {
+        "anyOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "installed_asked": {
+                "anyOf": [
+                  {
+                    "additionalProperties": false,
+                    "properties": {
+                      "ecosystem": {
+                        "type": "string"
+                      },
+                      "package": {
+                        "type": "string"
+                      },
+                      "version": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "ecosystem",
+                      "package",
+                      "version"
+                    ],
+                    "type": "object"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The installed version this call sent (in request headers), as given; null when none."
+              },
+              "item_text_cap": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "items_per_advisory_cap": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "parsed_vendors": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The vendors whose remediation EchelonGraph parses."
+              },
+              "sections_failed": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
+              },
+              "sections_relayed": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "vendor_advisory_limit": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "vendors_not_parsed": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
+              }
+            },
+            "required": [
+              "sections_relayed",
+              "sections_failed",
+              "parsed_vendors",
+              "vendors_not_parsed",
+              "vendor_advisory_limit",
+              "item_text_cap",
+              "items_per_advisory_cap",
+              "installed_asked"
+            ],
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "What the answer covers; null where the answer says nothing about it."
+      },
+      "data": {
+        "additionalProperties": {},
+        "properties": {
+          "cisa": {
+            "anyOf": [
+              {
+                "additionalProperties": {},
+                "properties": {
+                  "due_date": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "kev_listed": {
+                    "type": [
+                      "boolean",
+                      "null"
+                    ]
+                  },
+                  "notes_urls": {
+                    "anyOf": [
+                      {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "required_action": {
+                    "description": "CISA's requiredAction, verbatim. CISA's required_action is directed at US federal civilian agencies (under BOD 26-04, which replaced BOD 22-01 on 10 June 2026) and is not EchelonGraph's advice.",
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "short_description": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "coverage": {},
+          "cve_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "failed_sections": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "fix_references": {
+            "anyOf": [
+              {
+                "items": {
+                  "additionalProperties": {},
+                  "properties": {
+                    "source": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "tags": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "type": "string"
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "url": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "fix_status": {
+            "anyOf": [
+              {
+                "additionalProperties": {},
+                "properties": {
+                  "basis": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "described_by": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "listed_in_patch_table": {
+                    "type": [
+                      "boolean",
+                      "null"
+                    ]
+                  },
+                  "solution_by": {
+                    "anyOf": [
+                      {
+                        "additionalProperties": {},
+                        "properties": {
+                          "cna": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "section": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "statement": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        "type": "object"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "state": {
+                    "anyOf": [
+                      {
+                        "anyOf": [
+                          {
+                            "enum": [
+                              "available",
+                              "fix_referenced",
+                              "fix_merged",
+                              "none_confirmed",
+                              "unknown"
+                            ],
+                            "type": "string"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "stated_in_record": {
+                    "type": [
+                      "boolean",
+                      "null"
+                    ]
+                  },
+                  "unread_inputs": {
+                    "anyOf": [
+                      {
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "vendor_released": {
+                    "anyOf": [
+                      {
+                        "additionalProperties": {},
+                        "properties": {
+                          "statement": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        "type": "object"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The API's fix-status rule for the CVE, the one CVE Pulse pages show: state is available (a fix is on record), fix_referenced (a reference tagged Patch, often a source commit, and no release confirmed), fix_merged (an upstream fix merged, not yet in a tagged release), none_confirmed (no fix evidence on record, which is not a finding that no fix exists) or unknown (an input could not be read). basis is the step of the rule that decided it; described_by is the CVE description's sentence naming the fix, solution_by the CVE record's solution sentence naming it (statement) and the CNA that wrote it (cna), stated_in_record that patch_evidence counts a fix the CVE record states with no sentence to quote, listed_in_patch_table that a fixed version or patch row is on record; unread_inputs names any input the API could not read. vendor_released (basis vendor_fix_released) is the vendor's own statement that a fix is released where the CVE record names no fixed version: its sentence, verbatim (statement, or null), never a version, so the fixed release is the vendor advisory's to name. solution_by's section is workarounds when the fix sentence is the record's workaround, not its solution."
+          },
+          "fixed_branches": {
+            "anyOf": [
+              {
+                "items": {
+                  "additionalProperties": {},
+                  "properties": {
+                    "ecosystem": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "fixed_branches": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "additionalProperties": {},
+                            "properties": {
+                              "advisory_id": {
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "fixed": {
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "introduced": {
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "last_affected": {
+                                "description": "The range's last affected version, where no fix is on record; never a fix.",
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "source": {
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              }
+                            },
+                            "type": "object"
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "fixed_branches_truncated": {
+                      "additionalProperties": false,
+                      "description": "Present only where the structured result's cut (DATA CUT) kept this package's first ranges, not all: total, its ranges in the answer; returned, the ones data keeps. The same call with full: true returns every range.",
+                      "properties": {
+                        "returned": {
+                          "maximum": 9007199254740991,
+                          "minimum": -9007199254740991,
+                          "type": "integer"
+                        },
+                        "total": {
+                          "maximum": 9007199254740991,
+                          "minimum": -9007199254740991,
+                          "type": "integer"
+                        }
+                      },
+                      "required": [
+                        "total",
+                        "returned"
+                      ],
+                      "type": "object"
+                    },
+                    "fixed_version": {
+                      "description": "One range's fix, kept for compatibility; not the fix for every affected range.",
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "package_name": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "fixed_in": {
+            "description": "With an installed version: the first version above it that no affected range on record holds, always above it, as the advisory states it: the fixed bound of the range holding it, moved past any overlapping range that still holds that bound (fixed_in_detail then names it). null when no range on record holds it, no fix is on record past the ranges holding it, or the version was not assessed, with fixed_in_reason saying which. Absent when no installed version was asked.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "fixed_in_detail": {
+            "description": "Set when fixed_in is not the fixed bound of the range holding the installed version: the overlapping ranges of the same record it moved past, which still hold that bound.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "fixed_in_reason": {
+            "description": "Why fixed_in is null; absent when fixed_in is a version.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "installed": {
+            "anyOf": [
+              {
+                "additionalProperties": {},
+                "properties": {
+                  "ecosystem": {
+                    "description": "The ecosystem asked for, in its canonical OSV spelling.",
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "ecosystem_recognised": {
+                    "type": [
+                      "boolean",
+                      "null"
+                    ]
+                  },
+                  "interval": {
+                    "anyOf": [
+                      {
+                        "additionalProperties": {},
+                        "properties": {
+                          "fixed": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "introduced": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "last_affected": {
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        "type": "object"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "The affected range holding the version (fixed is exclusive, last_affected inclusive); absent when none holds it."
+                  },
+                  "package": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "verdict": {
+                    "anyOf": [
+                      {
+                        "anyOf": [
+                          {
+                            "enum": [
+                              "affected",
+                              "not_affected",
+                              "undetermined",
+                              "not_assessed"
+                            ],
+                            "type": "string"
+                          },
+                          {
+                            "type": "string"
+                          }
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "affected (a range on record holds the version), not_affected (no range on record holds it), undetermined (a range could not be decided at it) or not_assessed (the record names no such package for this CVE, or the lookup did not run)."
+                  },
+                  "version": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "version_evidence": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The installed version asked for, as the API read it from the request headers, and its verdict against this CVE; absent when none was asked."
+          },
+          "not_assessed_reason": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "patches": {
+            "anyOf": [
+              {
+                "items": {},
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "state": {
+            "description": "assessed, or not_assessed for a CVE record rejected by its numbering authority.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "vendor_remediations": {
+            "anyOf": [
+              {
+                "items": {
+                  "additionalProperties": {},
+                  "properties": {
+                    "items": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "additionalProperties": {},
+                            "properties": {
+                              "fixed_build": {
+                                "description": "MSRC's FixedBuild; null elsewhere.",
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "kind": {
+                                "anyOf": [
+                                  {
+                                    "anyOf": [
+                                      {
+                                        "enum": [
+                                          "vendor_fix",
+                                          "workaround",
+                                          "mitigation",
+                                          "no_fix_planned",
+                                          "none_available",
+                                          "other"
+                                        ],
+                                        "type": "string"
+                                      },
+                                      {
+                                        "type": "string"
+                                      }
+                                    ]
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "The vendor's own category: vendor_fix, workaround, mitigation, no_fix_planned, none_available or other."
+                              },
+                              "product_count": {
+                                "type": [
+                                  "number",
+                                  "null"
+                                ]
+                              },
+                              "product_ids": {
+                                "anyOf": [
+                                  {
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "type": "array"
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "The vendor's own product identifiers the item applies to, the first 16."
+                              },
+                              "source_category": {
+                                "description": "The vendor's own name for the category (CSAF vendor_fix, MSRC Vendor Fix, Palo Alto work_around).",
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "source_subcategory": {
+                                "description": "MSRC's SubType, e.g. Security Update; null elsewhere.",
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "text": {
+                                "description": "The vendor's text, verbatim but for HTML markup removed, cut at coverage.item_text_cap characters (text_truncated).",
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              },
+                              "text_chars": {
+                                "description": "The length of the vendor's text in characters.",
+                                "type": [
+                                  "number",
+                                  "null"
+                                ]
+                              },
+                              "text_truncated": {
+                                "type": [
+                                  "boolean",
+                                  "null"
+                                ]
+                              },
+                              "url": {
+                                "type": [
+                                  "string",
+                                  "null"
+                                ]
+                              }
+                            },
+                            "type": "object"
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "items_total": {
+                      "type": [
+                        "number",
+                        "null"
+                      ]
+                    },
+                    "remediation_kinds": {
+                      "anyOf": [
+                        {
+                          "items": {
+                            "anyOf": [
+                              {
+                                "enum": [
+                                  "vendor_fix",
+                                  "workaround",
+                                  "mitigation",
+                                  "no_fix_planned",
+                                  "none_available",
+                                  "other"
+                                ],
+                                "type": "string"
+                              },
+                              {
+                                "type": "string"
+                              }
+                            ]
+                          },
+                          "type": "array"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "remediation_state": {
+                      "anyOf": [
+                        {
+                          "anyOf": [
+                            {
+                              "enum": [
+                                "parsed",
+                                "none_in_source",
+                                "not_parsed",
+                                "withdrawn"
+                              ],
+                              "type": "string"
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ]
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "parsed; none_in_source (parsed, and the advisory lists no remediation for this CVE, which is not a finding that no fix exists); not_parsed (EchelonGraph does not read this vendor's remediation, or has not yet read this advisory); withdrawn (the vendor rescinded it)."
+                    },
+                    "vendor": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_advisory_id": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_display_name": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "vendor_published_at": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "withdrawn": {
+                      "type": [
+                        "boolean",
+                        "null"
+                      ]
+                    }
+                  },
+                  "type": "object"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "type": "object"
+      },
+      "data_truncated": {
+        "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+        "type": "boolean"
+      },
+      "freshness": {
+        "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
+        "type": "null"
+      },
+      "measured_at": {
+        "anyOf": [
+          {
+            "description": "An RFC 3339 instant.",
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+      },
+      "method": {
+        "description": "How the numbers were produced.",
+        "type": "string"
+      },
+      "notes": {
+        "description": "Caveats, one sentence each.",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+        "enum": [
+          "measured",
+          "not_assessed"
+        ],
+        "type": "string"
+      },
+      "truncated": {
+        "additionalProperties": {
+          "additionalProperties": false,
+          "properties": {
+            "returned": {
+              "maximum": 9007199254740991,
+              "minimum": 0,
+              "type": "integer"
+            },
+            "thinned": {
+              "const": true,
+              "type": "boolean"
+            },
+            "total": {
+              "maximum": 9007199254740991,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "total",
+            "returned"
+          ],
+          "type": "object"
+        },
+        "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+        "propertyNames": {
+          "type": "string"
+        },
+        "type": "object"
+      }
+    },
+    "required": [
+      "state",
+      "measured_at",
+      "method",
+      "coverage",
+      "freshness",
+      "notes",
+      "data_truncated",
+      "data"
+    ],
+    "type": "object"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "coverage": {
+        "anyOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "installed_asked": {
+                "anyOf": [
+                  {
+                    "additionalProperties": false,
+                    "properties": {
+                      "ecosystem": {
+                        "type": "string"
+                      },
+                      "package": {
+                        "type": "string"
+                      },
+                      "version": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "ecosystem",
+                      "package",
+                      "version"
+                    ],
+                    "type": "object"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The installed version this call sent (in request headers), as given; null when none."
+              },
+              "item_text_cap": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "items_per_advisory_cap": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "parsed_vendors": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The vendors whose remediation EchelonGraph parses."
+              },
+              "sections_failed": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The sections the API could not read (its failed_sections); null when the answer does not say."
+              },
+              "sections_relayed": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "vendor_advisory_limit": {
+                "type": [
+                  "number",
+                  "null"
+                ]
+              },
+              "vendors_not_parsed": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The vendors in this answer whose remediation EchelonGraph does not parse."
+              }
+            },
+            "required": [
+              "sections_relayed",
+              "sections_failed",
+              "parsed_vendors",
+              "vendors_not_parsed",
+              "vendor_advisory_limit",
+              "item_text_cap",
+              "items_per_advisory_cap",
+              "installed_asked"
+            ],
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
+      "error": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+            "enum": [
+              "network",
+              "timeout",
+              "http",
+              "not_json",
+              "not_object",
+              "invalid_input",
+              "internal",
+              "unexpected_shape",
+              "radars"
+            ],
+            "type": "string"
+          },
+          "message": {
+            "description": "The cause: the API's own message, or what went wrong.",
+            "type": "string"
+          },
+          "path": {
+            "description": "The API path requested, when a request was made.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "status": {
+            "anyOf": [
+              {
+                "maximum": 9007199254740991,
+                "minimum": -9007199254740991,
+                "type": "integer"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The HTTP status, when the API answered one."
+          }
+        },
+        "required": [
+          "kind",
+          "path",
+          "status",
+          "message"
+        ],
+        "type": "object"
+      },
+      "freshness": {
+        "type": "null"
+      },
+      "measured_at": {
+        "type": "null"
+      },
+      "method": {
+        "type": "null"
+      },
+      "notes": {
+        "description": "Caveats, one sentence each.",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+        "enum": [
+          "failed",
+          "invalid_input"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "state",
+      "measured_at",
+      "method",
+      "coverage",
+      "freshness",
+      "notes",
+      "error"
+    ],
+    "type": "object"
+  }
+]

Addedv2.7.0Oct 6, 2026

TDQS

B3.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover read-only, non-destructive, idempotent nature. Description adds important behavior: data relayed verbatim without testing, empty results not meaning no fix, failed sections named, truncation behavior explained. Good beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very dense, long sentences with many parenthetical details. Not front-loaded; key purpose is buried. Could be much clearer with structured sections.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values needn't be explained, but description explains many. Covers edge cases like REJECTED CVE, truncation, failed sections. Somewhat verbose but complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline 3. Description mentions how ecosystem/package/version add 'installed' and 'fixed_in', and explains 'full' parameter's effect on truncation, adding some meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: relays how one CVE is fixed per its sources. Distinguishes from siblings like get_cve or cve_intel by focusing on remediation, though doesn't explicitly name the alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance, no mention of alternatives like check_affected or vendor_advisories_for_cve. Implied that this is for remediation info, but no routing help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server