Previous value: -"array"New value: +[
+  "array",
+  "null"
+]

Previous value: -"object"New value: +[
+  "object",
+  "null"
+]

Previous value: -"object"New value: +[
+  "object",
+  "null"
+]

Previous value: -"object"New value: +"array"

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "domain": {
+          "type": "string"
+        },
+        "live_headers": {
+          "type": "object"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "report": {
+          "type": "object"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "technologies": {
+          "type": "object"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [
+        "domain"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Previous value: -{
-  "$defs": {
-    "AbuseIpdbInfo": {
-      "properties": {
-        "abuse_score": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "country": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "is_tor": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "isp": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "status": {
-          "enum": [
-            "ok",
-            "skipped",
-            "rate_limited",
-            "error",
-            "pro_only"
-          ],
-          "type": "string"
-        },
-        "total_reports": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "usage_type": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "status"
-      ],
-      "type": "object"
-    },
-    "AuditResponse": {
-      "properties": {
-        "domain": {
-          "type": "string"
-        },
-        "live_headers": {
-          "additionalProperties": {
-            "type": "string"
-          },
-          "type": "object"
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "report": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/DomainReportResponse"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "summary": {
-          "type": "string"
-        },
-        "technologies": {
-          "$ref": "#/$defs/AuditTechInfo"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "domain"
-      ],
-      "type": "object"
-    },
-    "AuditTechInfo": {
-      "properties": {
-        "categories": {
-          "additionalProperties": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "type": "object"
-        },
-        "count": {
-          "type": "integer"
-        },
-        "summary": {
-          "type": "string"
-        },
-        "technologies": {
-          "items": {
-            "$ref": "#/$defs/TechItem"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "CertificateSummary": {
-      "additionalProperties": true,
-      "properties": {
-        "common_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "issuer": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "not_after": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "not_before": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "CertificatesInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "certificates": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/CertificateSummary"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "crtsh_status": {
-          "anyOf": [
-            {
-              "enum": [
-                "ok",
-                "timeout",
-                "rate_limited",
-                "unavailable",
-                "error"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "error": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "total_certificates": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "DomainDnsInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "a": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "aaaa": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cname": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "mx": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/MxDnsRecord"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "ns": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "soa": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SoaInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "total_txt_records": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "txt": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "DomainReportResponse": {
-      "properties": {
-        "certificates": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/CertificatesInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "dns": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/DomainDnsInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "domain": {
-          "type": "string"
-        },
-        "email_security": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/EmailSecurityInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reputation": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/DomainReputationInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reverse_dns": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/ReverseDnsInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "risk": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/RiskInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "ssl": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SslInfoEmbedded"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "subdomains": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SubdomainsInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "summary": {
-          "type": "string"
-        },
-        "threat": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/ThreatInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "waf": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/WafInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "whois": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/WhoisInfoEmbedded"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "domain"
-      ],
-      "type": "object"
-    },
-    "DomainReputationInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "abuseipdb": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/AbuseIpdbInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "shodan": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/ShodanRepInfo"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "EmailSecurityInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "dkim_selectors": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "dkim_status": {
-          "anyOf": [
-            {
-              "enum": [
-                "verified",
-                "unverifiable"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "dmarc": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "grade": {
-          "anyOf": [
-            {
-              "enum": [
-                "A",
-                "B",
-                "C",
-                "F"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "issues": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "spf": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "MxDnsRecord": {
-      "properties": {
-        "host": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "priority": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "ReverseDnsInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "ip": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "ptr": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "shared_hosting": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "RiskFactor": {
-      "properties": {
-        "detail": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "max": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "score": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "RiskInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "factors": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/RiskFactor"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "grade": {
-          "anyOf": [
-            {
-              "enum": [
-                "A",
-                "B",
-                "C",
-                "D",
-                "F"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "max_score": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "score": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ShodanRepInfo": {
-      "properties": {
-        "asn": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "city": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "country_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "hostnames": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "isp": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "last_update": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "org": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "os": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "ports": {
-          "items": {
-            "type": "integer"
-          },
-          "type": "array"
-        },
-        "reason": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "status": {
-          "enum": [
-            "ok",
-            "skipped",
-            "restricted",
-            "rate_limited",
-            "error",
-            "pro_only"
-          ],
-          "type": "string"
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vulns": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "status"
-      ],
-      "type": "object"
-    },
-    "SoaInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "mname": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "rname": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "serial": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "SslInfoEmbedded": {
-      "additionalProperties": true,
-      "properties": {
-        "alpn": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cert_valid": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "common_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "days_remaining": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "error": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "grade": {
-          "anyOf": [
-            {
-              "enum": [
-                "A",
-                "B",
-                "C",
-                "D",
-                "F"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "issuer": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "not_after": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "not_before": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "san": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "serial_number": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "tls_version": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "validation_errors": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "version": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "SubdomainsInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "count": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "found_via_crtsh": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "found_via_wordlist": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "sources": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "subdomains": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "summary": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "warnings": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "TechItem": {
-      "properties": {
-        "category": {
-          "type": "string"
-        },
-        "name": {
-          "type": "string"
-        },
-        "source": {
-          "type": "string"
-        },
-        "version": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "name",
-        "category",
-        "source"
-      ],
-      "type": "object"
-    },
-    "ThreatInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "tags": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "threat_types": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "url_count": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "urlhaus_status": {
-          "anyOf": [
-            {
-              "enum": [
-                "clean",
-                "listed",
-                "error",
-                "skipped"
-              ],
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "urls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/ThreatUrlEntry"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "urls_online": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ThreatUrlEntry": {
-      "additionalProperties": true,
-      "properties": {
-        "date_added": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "status": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "tags": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "threat": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    },
-    "WafInfo": {
-      "additionalProperties": true,
-      "properties": {
-        "detected": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "waf_present": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "WhoisInfoEmbedded": {
-      "additionalProperties": true,
-      "properties": {
-        "creation_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "error": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "expiry_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "name_servers": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "raw_length": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "registrar": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "status": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "updated_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/AuditResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Removed value: -"AbuseIPDB reputation check (Pro tier only)."

Removed value: -null

Removed value: -"AbuseIPDB confidence-of-abuse score (0-100). Only present when status='ok'."

Removed value: -"Abuse Score"

Removed value: -null

Removed value: -"ISO 3166-1 alpha-2 country code from AbuseIPDB geolocation (may differ from RIPE)."

Removed value: -"Country"

Removed value: -null

Removed value: -"AbuseIPDB's Tor exit flag (cross-reference with top-level tor_exit field)."

Removed value: -"Is Tor"

Removed value: -null

Removed value: -"ISP name as reported by AbuseIPDB."

Removed value: -"Isp"

Removed value: -null

Removed value: -"Human-readable reason string. Present when status is skipped/rate_limited/error/pro_only."

Removed value: -"Reason"

Removed value: -"'ok' = data fetched; 'skipped' = API key not configured; 'rate_limited' = AbuseIPDB quota exceeded; 'error' = transient HTTP/network failure; 'pro_only' = returned on Free tier as upsell hint (see upgrade_url)."

Removed value: -"Status"

Removed value: -null

Removed value: -"Number of reports submitted against this IP in the last 90 days."

Removed value: -"Total Reports"

Removed value: -null

Removed value: -"Upgrade link returned when status='pro_only'."

Removed value: -"Upgrade Url"

Removed value: -null

Removed value: -"AbuseIPDB usage classification: 'Data Center/Web Hosting/Transit', 'ISP', 'Mobile ISP', etc."

Removed value: -"Usage Type"

Removed value: -"AbuseIpdbInfo"

Removed value: -"Queried domain (lowercased, no scheme)."

Removed value: -"Domain"

Removed value: -"Filtered HTTP response headers from the origin (lowercased keys). Sensitive headers (Set-Cookie, Authorization, etc.) are stripped before serialization."

Removed value: -"Live Headers"

Removed value: -null

Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."

Removed value: -"Next Calls"

Removed value: -null

Removed value: -"Full domain intelligence report — same shape as /v1/domain/{domain}. Contains DNS, WHOIS, SSL, subdomains, threat intel, reputation, and verdict. See DomainReportResponse."

Removed value: -""

Removed value: -"One-line audit summary combining domain report summary + technology count."

Removed value: -"Summary"

Removed value: -"Technology fingerprint detected from live response headers. See AuditTechInfo."

Removed value: -null

Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."

Removed value: -"AuditResponse"

Removed value: -"Technology fingerprint subset embedded in /v1/audit (no domain echo — outer AuditResponse carries it)."

Removed value: -"Technologies grouped by category (e.g. {'cdn': ['Cloudflare'], 'webserver': ['nginx']})."

Removed value: -"Categories"

Removed value: -0

Removed value: -"Total number of detected technologies (== sum of categories)."

Removed value: -"Count"

Removed value: -""

Removed value: -"One-line summary of the detected stack."

Removed value: -"Summary"

Removed value: -"Detected technologies (name + category) inferred from response headers (e.g. Server, X-Powered-By)."

Removed value: -"Technologies"

Removed value: -"AuditTechInfo"

Removed value: -"Single cert entry inside CertificatesInfo.certificates."

Removed value: -null

Removed value: -"Cert Subject CN."

Removed value: -"Common Name"

Removed value: -null

Removed value: -"Cert issuer CN or O."

Removed value: -"Issuer"

Removed value: -null

Removed value: -"notAfter timestamp."

Removed value: -"Not After"

Removed value: -null

Removed value: -"notBefore timestamp."

Removed value: -"Not Before"

Removed value: -"CertificateSummary"

Removed value: -null

Removed value: -"Up to CT_MAX_CERTS recent unique certs (deduped by serial)."

Removed value: -"Certificates"

Removed value: -null

Removed value: -"Status of the crt.sh fetch behind certificates. Mirrors subdomains.crtsh_status so both halves of a domain_report agree on whether CT logs delivered. 'ok' means the upstream responded — total_certificates=0 with status='ok' is a real empty result. Anything else (timeout / rate_limited / unavailable / error) means the upstream did not deliver and the cert list may be missing entries."

Removed value: -"Crtsh Status"

Removed value: -null

Removed value: -"Populated when the crt.sh fetch failed (e.g. 'crt_sh_timeout', 'crt_sh_rate_limited', 'crt_sh_unavailable'). Distinguishes 'no certs found' from 'fetch failed'; risk_score skips the CT factor when this is set."

Removed value: -"Error"

Removed value: -null

Removed value: -"Total cert count from crt.sh (pre-dedup)."

Removed value: -"Total Certificates"

Removed value: -"CertificatesInfo"

Removed value: -"DNS records per type. Keys are omitted (not null) when the lookup for that type fails."

Removed value: -null

Removed value: -"A records (IPv4 addresses)."

Removed value: -"A"

Removed value: -null

Removed value: -"AAAA records (IPv6 addresses)."

Removed value: -"Aaaa"

Removed value: -null

Removed value: -"CNAME records."

Removed value: -"Cname"

Removed value: -null

Removed value: -"MX records as {priority, host} list."

Removed value: -"Mx"

Removed value: -null

Removed value: -"NS records (nameserver hostnames)."

Removed value: -"Ns"

Removed value: -null

Removed value: -"SOA record (zone authority)."

Removed value: -null

Removed value: -"Honest pre-filter TXT record count. Always emitted (domain_report, audit_domain, /v1/dns). Equals len(txt) when include_all_txt=true or on /v1/dns/{domain} (raw, unfiltered). 0 when no TXT records exist. Null only when the field is absent (older cached entries)."

Removed value: -"Total Txt Records"

Removed value: -null

Removed value: -"TXT records. By default in domain_report, filtered to security-relevant entries (SPF v=spf, DMARC v=DMARC, DKIM v=DKIM, MTA-STS v=STSv, TLS-RPT v=TLSRPTv). Pass ?include_all_txt=true to return every TXT including vendor verification strings."

Removed value: -"Txt"

Removed value: -"DomainDnsInfo"

Removed value: -null

Removed value: -"Certificate transparency log entries from crt.sh. Skipped in lite mode."

Removed value: -null

Removed value: -"Forward DNS record set (A/AAAA/MX/NS/TXT/CNAME/SOA). Empty dict when all lookups fail."

Removed value: -"Queried domain (echoed, lowercased)."

Removed value: -"Domain"

Removed value: -null

Removed value: -"SPF/DMARC/DKIM posture of the domain (email authentication grade)."

Removed value: -null

Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."

Removed value: -"Next Calls"

Removed value: -null

Removed value: -"IP-level reputation of the domain's resolved A record. Absent in lite mode AND when no A record resolves. On Free tier inner blocks carry {status:'pro_only'} stubs (agents should not treat as clean)."

Removed value: -null

Removed value: -"Reverse-DNS resolution of the domain's primary IPv4 (PTR + shared-hosting signal)."

Removed value: -null

Removed value: -"Composite risk scoring (0-100) with per-factor breakdown — drives the top-level risk_score alias."

Removed value: -null

Removed value: -"SSL/TLS certificate subset (CN, issuer, validity, grade). Full shape at top-level /v1/ssl/{domain}."

Removed value: -null

Removed value: -"Subdomain enumeration (wordlist + crt.sh). Skipped in lite mode (returns {subdomains:[], count:0})."

Removed value: -""

Removed value: -"One-line human summary aggregating IP, grade, WAF, and subdomain count."

Removed value: -"Summary"

Removed value: -null

Removed value: -"URLhaus threat intelligence for the domain (malware / phishing URL listings). Skipped in lite mode."

Removed value: -null

Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."

Removed value: -null

Removed value: -"WAF detection from live response headers (Cloudflare, AWS CloudFront, Akamai, Sucuri, etc.)."

Removed value: -null

Removed value: -"WHOIS extract (registrar, dates, nameservers, EPP status). Skipped in lite mode. Error branch populates `error`."

Removed value: -"DomainReportResponse"

Removed value: -"Reputation block inside DomainReportResponse (IP-level enrichment of the resolved A record).\n\nDiffers from IpLookupResponse.reputation: no firehol block here (FireHOL is IP-only)."

Removed value: -null

Removed value: -"AbuseIPDB enrichment for the domain's resolved IP. Pro tier only — free tier returns {status:'pro_only', reason, upgrade_url} stub."

Removed value: -null

Removed value: -"Shodan enrichment for the domain's resolved IP. Pro tier only — free tier returns {status:'pro_only', reason, upgrade_url} stub."

Removed value: -"DomainReputationInfo"

Removed value: -null

Removed value: -"DKIM selectors that responded to probing (e.g. ['google', 'selector1']). Empty when none found."

Removed value: -"Dkim Selectors"

Removed value: -null

Removed value: -"Honest evidence label for DKIM. 'verified' when at least one selector responded (see dkim_selectors). 'unverifiable' when no probed selector matched — DKIM keys live at arbitrary operator-chosen selector names, so absence under common+date-based probes does not prove absence. Grade does not penalize 'unverifiable'."

Removed value: -"Dkim Status"

Removed value: -null

Removed value: -"DMARC record string (v=DMARC1; p=...; ...). Null when no DMARC record is published at _dmarc.<domain>."

Removed value: -"Dmarc"

Removed value: -null

Removed value: -"Email-auth grade. When DKIM is verified: A=SPF+DMARC+DKIM, B=2 of 3, C=1 of 3. When DKIM is unverifiable: A=SPF+DMARC, B=one of SPF/DMARC, F=neither — DKIM absence is not penalized because it cannot be proven without selector knowledge."

Removed value: -"Grade"

Removed value: -null

Removed value: -"Human-readable issues (missing SPF, weak DMARC policy, etc.)."

Removed value: -"Issues"

Removed value: -null

Removed value: -"SPF record string (v=spf1 ...). Null when no SPF is published."

Removed value: -"Spf"

Removed value: -"EmailSecurityInfo"

Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."

Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."

Removed value: -"Code"

Removed value: -null

Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."

Removed value: -"Docs Url"

Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."

Removed value: -"Message"

Removed value: -null

Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."

Removed value: -"Retry After Seconds"

Removed value: -null

Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."

Removed value: -"Upgrade Url"

Removed value: -"ErrorDetail"

Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."

Removed value: -"ErrorResponse"

Removed value: -"Single MX record embedded inside DomainReportResponse.dns.mx."

Removed value: -null

Removed value: -"MX hostname (trailing dot stripped)."

Removed value: -"Host"

Removed value: -null

Removed value: -"MX preference (lower = higher priority)."

Removed value: -"Priority"

Removed value: -"MxDnsRecord"

Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."

Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."

Removed value: -"Input"

Removed value: -null

Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."

Removed value: -"Params"

Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."

Removed value: -"Reason"

Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."

Removed value: -"Tool"

Removed value: -"PivotHint"

Removed value: -null

Removed value: -"Resolved IPv4 for the domain. Null when DNS fails or IP is private."

Removed value: -"Ip"

Removed value: -null

Removed value: -"PTR (reverse-DNS) hostname for the IP. Null when no PTR is published."

Removed value: -"Ptr"

Removed value: -null

Removed value: -"True when PTR hostname differs from the queried domain (shared hosting signal). Absent when PTR lookup fails."

Removed value: -"Shared Hosting"

Removed value: -"ReverseDnsInfo"

Removed value: -null

Removed value: -"Human-readable justification for the score."

Removed value: -"Detail"

Removed value: -null

Removed value: -"Maximum possible points for this factor."

Removed value: -"Max"

Removed value: -null

Removed value: -"Factor label (e.g. 'SSL/TLS', 'Email Security', 'IP Reputation')."

Removed value: -"Name"

Removed value: -null

Removed value: -"Points earned by this factor (can be negative for penalties)."

Removed value: -"Score"

Removed value: -"RiskFactor"

Removed value: -null

Removed value: -"Per-factor scoring breakdown (typically 8-9 factors)."

Removed value: -"Factors"

Removed value: -null

Removed value: -"Letter grade derived from score."

Removed value: -"Grade"

Removed value: -null

Removed value: -"Maximum achievable score (100 by default; drops by the corresponding factor's max when an upstream source fails — e.g. crt.sh timeout excludes the CT factor and max_score becomes 90, so grade is computed against the available signals)."

Removed value: -"Max Score"

Removed value: -null

Removed value: -"Cumulative risk score (0-100)."

Removed value: -"Score"

Removed value: -"RiskInfo"

Removed value: -"Shodan full API enrichment (Pro tier only). Richer than InternetDB fields at top level."

Removed value: -null

Removed value: -"ASN string per Shodan (e.g. 'AS13335'); may differ from top-level asn int."

Removed value: -"Asn"

Removed value: -null

Removed value: -"City name per Shodan geolocation."

Removed value: -"City"

Removed value: -null

Removed value: -"Country name per Shodan geolocation."

Removed value: -"Country Name"

Removed value: -"Hostnames observed pointing to this IP per Shodan."

Removed value: -"Hostnames"

Removed value: -null

Removed value: -"ISP per Shodan (may differ from AbuseIPDB/RIPE)."

Removed value: -"Isp"

Removed value: -null

Removed value: -"ISO 8601 timestamp of Shodan's most recent data point for this IP."

Removed value: -"Last Update"

Removed value: -null

Removed value: -"Organization name owning the IP per Shodan."

Removed value: -"Org"

Removed value: -null

Removed value: -"Shodan-detected operating system (fingerprint-based, best-effort)."

Removed value: -"Os"

Removed value: -"Open ports observed by Shodan full scan (superset of top-level InternetDB ports)."

Removed value: -"Ports"

Removed value: -null

Removed value: -"Human-readable reason. Present when status is skipped/restricted/rate_limited/error/pro_only."

Removed value: -"Reason"

Removed value: -"'ok' = data fetched; 'skipped' = API key not configured; 'restricted' = 403 (IP not available on free Shodan tier); 'rate_limited' = 429 quota exceeded; 'error' = transient HTTP/network failure; 'pro_only' = returned on Free tier as upsell hint."

Removed value: -"Status"

Removed value: -null

Removed value: -"Upgrade link returned when status='pro_only'."

Removed value: -"Upgrade Url"

Removed value: -"CVE IDs Shodan has associated with banners on this IP."

Removed value: -"Vulns"

Removed value: -"ShodanRepInfo"

Removed value: -"SOA record embedded inside DomainDnsInfo.soa."

Removed value: -null

Removed value: -"Primary nameserver (SOA MNAME)."

Removed value: -"Mname"

Removed value: -null

Removed value: -"Responsible party mailbox (SOA RNAME)."

Removed value: -"Rname"

Removed value: -null

Removed value: -"Zone serial number."

Removed value: -"Serial"

Removed value: -"SoaInfo"

Removed value: -"SSL subset embedded in the domain report. See top-level SslResponse for live SSL endpoint shape."

Removed value: -null

Removed value: -"Negotiated ALPN protocol (e.g. 'http/1.1', 'h2')."

Removed value: -"Alpn"

Removed value: -null

Removed value: -"True only when chain verified AND hostname matches AND not expired. False when cert is readable but fails one or more validation checks (see validation_errors)."

Removed value: -"Cert Valid"

Removed value: -null

Removed value: -"Leaf cert Subject CN."

Removed value: -"Common Name"

Removed value: -null

Removed value: -"Days until expiry. Negative when already expired."

Removed value: -"Days Remaining"

Removed value: -null

Removed value: -"Populated only on probe failure (timeout, connection refused, no port 443). Cert validation issues are NOT errors here — see cert_valid + validation_errors instead."

Removed value: -"Error"

Removed value: -null

Removed value: -"SSL grade. A/B/C: cert_valid AND TLS modern. D: cert readable but invalid (self-signed, hostname mismatch, untrusted root). F: probe failure, expired, or legacy TLS."

Removed value: -"Grade"

Removed value: -null

Removed value: -"Leaf cert issuer organization name."

Removed value: -"Issuer"

Removed value: -null

Removed value: -"notAfter (expiry) timestamp (ISO 8601 / UTC)."

Removed value: -"Not After"

Removed value: -null

Removed value: -"notBefore timestamp (ISO 8601 / UTC)."

Removed value: -"Not Before"

Removed value: -null

Removed value: -"Subject Alternative Names."

Removed value: -"San"

Removed value: -null

Removed value: -"Hex-encoded cert serial number."

Removed value: -"Serial Number"

Removed value: -null

Removed value: -"Negotiated TLS protocol (e.g. 'TLSv1.3', 'TLSv1.2'). Empty on handshake failure."

Removed value: -"Tls Version"

Removed value: -null

Removed value: -"Canonical validation failure tags when cert_valid is False. Values: 'expired', 'self_signed', 'hostname_mismatch', 'untrusted_root', 'chain_incomplete'. Empty/null when cert_valid is True."

Removed value: -"Validation Errors"

Removed value: -null

Removed value: -"X.509 version as returned by the ssl module (int 3 for v3; empty string on some parse paths)."

Removed value: -"Version"

Removed value: -"SslInfoEmbedded"

Removed value: -null

Removed value: -"Total subdomains discovered."

Removed value: -"Count"

Removed value: -null

Removed value: -"Count discovered via crt.sh CT log query."

Removed value: -"Found Via Crtsh"

Removed value: -null

Removed value: -"Count discovered via DNS brute-force wordlist."

Removed value: -"Found Via Wordlist"

Removed value: -null

Removed value: -"Sources that produced hits (subset of ['wordlist', 'crt_sh'])."

Removed value: -"Sources"

Removed value: -null

Removed value: -"Sorted unique subdomain list."

Removed value: -"Subdomains"

Removed value: -null

Removed value: -"One-line human-readable summary."

Removed value: -"Summary"

Removed value: -null

Removed value: -"Non-fatal warnings (e.g. 'crt.sh timeout', 'result truncated')."

Removed value: -"Warnings"

Removed value: -"SubdomainsInfo"

Removed value: -"Category"

Removed value: -"Name"

Removed value: -"Source"

Removed value: -null

Removed value: -"Version"

Removed value: -"TechItem"

Removed value: -null

Removed value: -"Deduped list of tags (up to 20)."

Removed value: -"Tags"

Removed value: -null

Removed value: -"Deduped list of threat classes across all URLs."

Removed value: -"Threat Types"

Removed value: -null

Removed value: -"Total URLs URLhaus has seen for this domain."

Removed value: -"Url Count"

Removed value: -null

Removed value: -"URLhaus lookup outcome. 'skipped' in lite mode; 'error' on API failure (treat as unavailable, not clean)."

Removed value: -"Urlhaus Status"

Removed value: -null

Removed value: -"Up to 20 offending URL entries."

Removed value: -"Urls"

Removed value: -null

Removed value: -"Subset of url_count currently marked online."

Removed value: -"Urls Online"

Removed value: -"ThreatInfo"

Removed value: -"Single offending URL entry inside ThreatInfo.urls."

Removed value: -null

Removed value: -"When URLhaus first saw this URL."

Removed value: -"Date Added"

Removed value: -null

Removed value: -"URLhaus status for this URL ('online', 'offline')."

Removed value: -"Status"

Removed value: -null

Removed value: -"Tags assigned by URLhaus (malware family, kit, etc.)."

Removed value: -"Tags"

Removed value: -null

Removed value: -"Threat class (e.g. 'malware_download', 'phishing')."

Removed value: -"Threat"

Removed value: -null

Removed value: -"Offending URL observed in URLhaus."

Removed value: -"Url"

Removed value: -"ThreatUrlEntry"

Removed value: -"complete"

Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."

Removed value: -"Completeness"

Removed value: -null

Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."

Removed value: -"Data Age Seconds"

Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."

Removed value: -"Deterministic"

Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."

Removed value: -"Falsifiable Fields"

Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."

Removed value: -"Sources Queried"

Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."

Removed value: -"Sources Unavailable"

Removed value: -"Verdict"

Removed value: -null

Removed value: -"WAF product names detected from response headers (e.g. ['Cloudflare', 'AWS CloudFront'])."

Removed value: -"Detected"

Removed value: -null

Removed value: -"True when `detected` is non-empty."

Removed value: -"Waf Present"

Removed value: -"WafInfo"

Removed value: -"WHOIS subset embedded in the domain report. Fields are best-effort regex extracts from the raw WHOIS text."

Removed value: -null

Removed value: -"Domain creation date (format depends on registrar)."

Removed value: -"Creation Date"

Removed value: -null

Removed value: -"Populated when the WHOIS TCP query failed (e.g. no WHOIS server for TLD, socket timeout)."

Removed value: -"Error"

Removed value: -null

Removed value: -"Domain expiry date (format depends on registrar)."

Removed value: -"Expiry Date"

Removed value: -null

Removed value: -"Authoritative nameservers per WHOIS."

Removed value: -"Name Servers"

Removed value: -null

Removed value: -"Byte length of raw WHOIS response (sanity indicator)."

Removed value: -"Raw Length"

Removed value: -null

Removed value: -"Registrar name as reported by the WHOIS server."

Removed value: -"Registrar"

Removed value: -null

Removed value: -"EPP domain status (e.g. 'clientTransferProhibited'). String or list depending on registrar."

Removed value: -"Status"

Removed value: -null

Removed value: -"Last-updated timestamp from WHOIS."

Removed value: -"Updated Date"

Removed value: -"WhoisInfoEmbedded"

Removed value: -"Result"

Removed value: -"audit_domainOutput"

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup"
+]

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Previous value: -"Honest pre-filter TXT record count (always emitted on domain_report). Equals len(txt) when include_all_txt=true. Null on /v1/dns/{domain} where TXT is not filtered."New value: +"Honest pre-filter TXT record count. Always emitted (domain_report, audit_domain, /v1/dns). Equals len(txt) when include_all_txt=true or on /v1/dns/{domain} (raw, unfiltered). 0 when no TXT records exist. Null only when the field is absent (older cached entries)."

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Added value: +{
+  "AbuseIpdbInfo": {
+    "description": "AbuseIPDB reputation check (Pro tier only).",
+    "properties": {
+      "abuse_score": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "AbuseIPDB confidence-of-abuse score (0-100). Only present when status='ok'.",
+        "title": "Abuse Score"
+      },
+      "country": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 3166-1 alpha-2 country code from AbuseIPDB geolocation (may differ from RIPE).",
+        "title": "Country"
+      },
+      "is_tor": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "AbuseIPDB's Tor exit flag (cross-reference with top-level tor_exit field).",
+        "title": "Is Tor"
+      },
+      "isp": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISP name as reported by AbuseIPDB.",
+        "title": "Isp"
+      },
+      "reason": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable reason string. Present when status is skipped/rate_limited/error/pro_only.",
+        "title": "Reason"
+      },
+      "status": {
+        "description": "'ok' = data fetched; 'skipped' = API key not configured; 'rate_limited' = AbuseIPDB quota exceeded; 'error' = transient HTTP/network failure; 'pro_only' = returned on Free tier as upsell hint (see upgrade_url).",
+        "enum": [
+          "ok",
+          "skipped",
+          "rate_limited",
+          "error",
+          "pro_only"
+        ],
+        "title": "Status",
+        "type": "string"
+      },
+      "total_reports": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Number of reports submitted against this IP in the last 90 days.",
+        "title": "Total Reports"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Upgrade link returned when status='pro_only'.",
+        "title": "Upgrade Url"
+      },
+      "usage_type": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "AbuseIPDB usage classification: 'Data Center/Web Hosting/Transit', 'ISP', 'Mobile ISP', etc.",
+        "title": "Usage Type"
+      }
+    },
+    "required": [
+      "status"
+    ],
+    "title": "AbuseIpdbInfo",
+    "type": "object"
+  },
+  "AuditResponse": {
+    "properties": {
+      "domain": {
+        "description": "Queried domain (lowercased, no scheme).",
+        "title": "Domain",
+        "type": "string"
+      },
+      "live_headers": {
+        "additionalProperties": {
+          "type": "string"
+        },
+        "description": "Filtered HTTP response headers from the origin (lowercased keys). Sensitive headers (Set-Cookie, Authorization, etc.) are stripped before serialization.",
+        "title": "Live Headers",
+        "type": "object"
+      },
+      "next_calls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/PivotHint"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user.",
+        "title": "Next Calls"
+      },
+      "report": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/DomainReportResponse"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Full domain intelligence report — same shape as /v1/domain/{domain}. Contains DNS, WHOIS, SSL, subdomains, threat intel, reputation, and verdict. See DomainReportResponse."
+      },
+      "summary": {
+        "default": "",
+        "description": "One-line audit summary combining domain report summary + technology count.",
+        "title": "Summary",
+        "type": "string"
+      },
+      "technologies": {
+        "$ref": "#/$defs/AuditTechInfo",
+        "description": "Technology fingerprint detected from live response headers. See AuditTechInfo."
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
+      }
+    },
+    "required": [
+      "domain"
+    ],
+    "title": "AuditResponse",
+    "type": "object"
+  },
+  "AuditTechInfo": {
+    "description": "Technology fingerprint subset embedded in /v1/audit (no domain echo — outer AuditResponse carries it).",
+    "properties": {
+      "categories": {
+        "additionalProperties": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "description": "Technologies grouped by category (e.g. {'cdn': ['Cloudflare'], 'webserver': ['nginx']}).",
+        "title": "Categories",
+        "type": "object"
+      },
+      "count": {
+        "default": 0,
+        "description": "Total number of detected technologies (== sum of categories).",
+        "title": "Count",
+        "type": "integer"
+      },
+      "summary": {
+        "default": "",
+        "description": "One-line summary of the detected stack.",
+        "title": "Summary",
+        "type": "string"
+      },
+      "technologies": {
+        "description": "Detected technologies (name + category) inferred from response headers (e.g. Server, X-Powered-By).",
+        "items": {
+          "$ref": "#/$defs/TechItem"
+        },
+        "title": "Technologies",
+        "type": "array"
+      }
+    },
+    "title": "AuditTechInfo",
+    "type": "object"
+  },
+  "CertificateSummary": {
+    "additionalProperties": true,
+    "description": "Single cert entry inside CertificatesInfo.certificates.",
+    "properties": {
+      "common_name": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Cert Subject CN.",
+        "title": "Common Name"
+      },
+      "issuer": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Cert issuer CN or O.",
+        "title": "Issuer"
+      },
+      "not_after": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "notAfter timestamp.",
+        "title": "Not After"
+      },
+      "not_before": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "notBefore timestamp.",
+        "title": "Not Before"
+      }
+    },
+    "title": "CertificateSummary",
+    "type": "object"
+  },
+  "CertificatesInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "certificates": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/CertificateSummary"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Up to CT_MAX_CERTS recent unique certs (deduped by serial).",
+        "title": "Certificates"
+      },
+      "crtsh_status": {
+        "anyOf": [
+          {
+            "enum": [
+              "ok",
+              "timeout",
+              "rate_limited",
+              "unavailable",
+              "error"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Status of the crt.sh fetch behind certificates. Mirrors subdomains.crtsh_status so both halves of a domain_report agree on whether CT logs delivered. 'ok' means the upstream responded — total_certificates=0 with status='ok' is a real empty result. Anything else (timeout / rate_limited / unavailable / error) means the upstream did not deliver and the cert list may be missing entries.",
+        "title": "Crtsh Status"
+      },
+      "error": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Populated when the crt.sh fetch failed (e.g. 'crt_sh_timeout', 'crt_sh_rate_limited', 'crt_sh_unavailable'). Distinguishes 'no certs found' from 'fetch failed'; risk_score skips the CT factor when this is set.",
+        "title": "Error"
+      },
+      "total_certificates": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Total cert count from crt.sh (pre-dedup).",
+        "title": "Total Certificates"
+      }
+    },
+    "title": "CertificatesInfo",
+    "type": "object"
+  },
+  "DomainDnsInfo": {
+    "additionalProperties": true,
+    "description": "DNS records per type. Keys are omitted (not null) when the lookup for that type fails.",
+    "properties": {
+      "a": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "A records (IPv4 addresses).",
+        "title": "A"
+      },
+      "aaaa": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "AAAA records (IPv6 addresses).",
+        "title": "Aaaa"
+      },
+      "cname": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CNAME records.",
+        "title": "Cname"
+      },
+      "mx": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/MxDnsRecord"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "MX records as {priority, host} list.",
+        "title": "Mx"
+      },
+      "ns": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "NS records (nameserver hostnames).",
+        "title": "Ns"
+      },
+      "soa": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/SoaInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "SOA record (zone authority)."
+      },
+      "total_txt_records": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Honest pre-filter TXT record count (always emitted on domain_report). Equals len(txt) when include_all_txt=true. Null on /v1/dns/{domain} where TXT is not filtered.",
+        "title": "Total Txt Records"
+      },
+      "txt": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "TXT records. By default in domain_report, filtered to security-relevant entries (SPF v=spf, DMARC v=DMARC, DKIM v=DKIM, MTA-STS v=STSv, TLS-RPT v=TLSRPTv). Pass ?include_all_txt=true to return every TXT including vendor verification strings.",
+        "title": "Txt"
+      }
+    },
+    "title": "DomainDnsInfo",
+    "type": "object"
+  },
+  "DomainReportResponse": {
+    "properties": {
+      "certificates": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/CertificatesInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Certificate transparency log entries from crt.sh. Skipped in lite mode."
+      },
+      "dns": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/DomainDnsInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Forward DNS record set (A/AAAA/MX/NS/TXT/CNAME/SOA). Empty dict when all lookups fail."
+      },
+      "domain": {
+        "description": "Queried domain (echoed, lowercased).",
+        "title": "Domain",
+        "type": "string"
+      },
+      "email_security": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/EmailSecurityInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "SPF/DMARC/DKIM posture of the domain (email authentication grade)."
+      },
+      "next_calls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/PivotHint"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user.",
+        "title": "Next Calls"
+      },
+      "reputation": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/DomainReputationInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "IP-level reputation of the domain's resolved A record. Absent in lite mode AND when no A record resolves. On Free tier inner blocks carry {status:'pro_only'} stubs (agents should not treat as clean)."
+      },
+      "reverse_dns": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/ReverseDnsInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Reverse-DNS resolution of the domain's primary IPv4 (PTR + shared-hosting signal)."
+      },
+      "risk": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/RiskInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Composite risk scoring (0-100) with per-factor breakdown — drives the top-level risk_score alias."
+      },
+      "ssl": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/SslInfoEmbedded"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "SSL/TLS certificate subset (CN, issuer, validity, grade). Full shape at top-level /v1/ssl/{domain}."
+      },
+      "subdomains": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/SubdomainsInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Subdomain enumeration (wordlist + crt.sh). Skipped in lite mode (returns {subdomains:[], count:0})."
+      },
+      "summary": {
+        "default": "",
+        "description": "One-line human summary aggregating IP, grade, WAF, and subdomain count.",
+        "title": "Summary",
+        "type": "string"
+      },
+      "threat": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/ThreatInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "URLhaus threat intelligence for the domain (malware / phishing URL listings). Skipped in lite mode."
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
+      },
+      "waf": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/WafInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "WAF detection from live response headers (Cloudflare, AWS CloudFront, Akamai, Sucuri, etc.)."
+      },
+      "whois": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/WhoisInfoEmbedded"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "WHOIS extract (registrar, dates, nameservers, EPP status). Skipped in lite mode. Error branch populates `error`."
+      }
+    },
+    "required": [
+      "domain"
+    ],
+    "title": "DomainReportResponse",
+    "type": "object"
+  },
+  "DomainReputationInfo": {
+    "additionalProperties": true,
+    "description": "Reputation block inside DomainReportResponse (IP-level enrichment of the resolved A record).\n\nDiffers from IpLookupResponse.reputation: no firehol block here (FireHOL is IP-only).",
+    "properties": {
+      "abuseipdb": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/AbuseIpdbInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "AbuseIPDB enrichment for the domain's resolved IP. Pro tier only — free tier returns {status:'pro_only', reason, upgrade_url} stub."
+      },
+      "shodan": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/ShodanRepInfo"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Shodan enrichment for the domain's resolved IP. Pro tier only — free tier returns {status:'pro_only', reason, upgrade_url} stub."
+      }
+    },
+    "title": "DomainReputationInfo",
+    "type": "object"
+  },
+  "EmailSecurityInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "dkim_selectors": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "DKIM selectors that responded to probing (e.g. ['google', 'selector1']). Empty when none found.",
+        "title": "Dkim Selectors"
+      },
+      "dkim_status": {
+        "anyOf": [
+          {
+            "enum": [
+              "verified",
+              "unverifiable"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Honest evidence label for DKIM. 'verified' when at least one selector responded (see dkim_selectors). 'unverifiable' when no probed selector matched — DKIM keys live at arbitrary operator-chosen selector names, so absence under common+date-based probes does not prove absence. Grade does not penalize 'unverifiable'.",
+        "title": "Dkim Status"
+      },
+      "dmarc": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "DMARC record string (v=DMARC1; p=...; ...). Null when no DMARC record is published at _dmarc.<domain>.",
+        "title": "Dmarc"
+      },
+      "grade": {
+        "anyOf": [
+          {
+            "enum": [
+              "A",
+              "B",
+              "C",
+              "F"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Email-auth grade. When DKIM is verified: A=SPF+DMARC+DKIM, B=2 of 3, C=1 of 3. When DKIM is unverifiable: A=SPF+DMARC, B=one of SPF/DMARC, F=neither — DKIM absence is not penalized because it cannot be proven without selector knowledge.",
+        "title": "Grade"
+      },
+      "issues": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable issues (missing SPF, weak DMARC policy, etc.).",
+        "title": "Issues"
+      },
+      "spf": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "SPF record string (v=spf1 ...). Null when no SPF is published.",
+        "title": "Spf"
+      }
+    },
+    "title": "EmailSecurityInfo",
+    "type": "object"
+  },
+  "ErrorDetail": {
+    "description": "Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`.",
+    "properties": {
+      "code": {
+        "description": "Stable machine-readable failure category. Agents key retry/upgrade decisions off this.",
+        "enum": [
+          "invalid_argument",
+          "not_found",
+          "rate_limit_exceeded",
+          "auth_required",
+          "tier_limit",
+          "upstream_timeout",
+          "upstream_error",
+          "internal_error"
+        ],
+        "title": "Code",
+        "type": "string"
+      },
+      "docs_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Documentation pointer (e.g. tool input contract) when code='invalid_argument'.",
+        "title": "Docs Url"
+      },
+      "message": {
+        "description": "Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses.",
+        "maxLength": 500,
+        "title": "Message",
+        "type": "string"
+      },
+      "retry_after_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "When code='rate_limit_exceeded', the minimum seconds to wait before retrying.",
+        "title": "Retry After Seconds"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier.",
+        "title": "Upgrade Url"
+      }
+    },
+    "required": [
+      "code",
+      "message"
+    ],
+    "title": "ErrorDetail",
+    "type": "object"
+  },
+  "ErrorResponse": {
+    "description": "MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body.",
+    "properties": {
+      "error": {
+        "$ref": "#/$defs/ErrorDetail"
+      }
+    },
+    "required": [
+      "error"
+    ],
+    "title": "ErrorResponse",
+    "type": "object"
+  },
+  "MxDnsRecord": {
+    "description": "Single MX record embedded inside DomainReportResponse.dns.mx.",
+    "properties": {
+      "host": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "MX hostname (trailing dot stripped).",
+        "title": "Host"
+      },
+      "priority": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "MX preference (lower = higher priority).",
+        "title": "Priority"
+      }
+    },
+    "title": "MxDnsRecord",
+    "type": "object"
+  },
+  "PivotHint": {
+    "additionalProperties": true,
+    "description": "A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context.",
+    "properties": {
+      "input": {
+        "description": "Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument.",
+        "title": "Input",
+        "type": "string"
+      },
+      "params": {
+        "anyOf": [
+          {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed.",
+        "title": "Params"
+      },
+      "reason": {
+        "description": "Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'.",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "description": "Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal.",
+        "enum": [
+          "cve_lookup",
+          "cve_search",
+          "cve_leading",
+          "bulk_cve_lookup",
+          "exploit_lookup",
+          "kev_detail",
+          "cwe_lookup",
+          "subdomain_enum",
+          "ssl_check",
+          "tech_fingerprint",
+          "asn_lookup",
+          "ip_lookup",
+          "ioc_lookup",
+          "bulk_ioc_lookup",
+          "hash_lookup",
+          "threat_intel",
+          "threat_report",
+          "audit_domain",
+          "domain_report",
+          "dns_lookup",
+          "whois_lookup",
+          "wayback_lookup",
+          "scan_headers",
+          "check_headers",
+          "check_secrets",
+          "check_injection",
+          "check_dependencies",
+          "email_mx",
+          "email_disposable",
+          "phone_lookup",
+          "username_lookup",
+          "password_check",
+          "phishing_check",
+          "atlas_technique_lookup",
+          "atlas_technique_search",
+          "bulk_atlas_technique_lookup",
+          "atlas_case_study_lookup",
+          "atlas_case_study_search",
+          "d3fend_defense_lookup",
+          "d3fend_defense_search",
+          "d3fend_defense_for_attack",
+          "d3fend_attack_coverage"
+        ],
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "input",
+      "reason"
+    ],
+    "title": "PivotHint",
+    "type": "object"
+  },
+  "ReverseDnsInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "ip": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Resolved IPv4 for the domain. Null when DNS fails or IP is private.",
+        "title": "Ip"
+      },
+      "ptr": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "PTR (reverse-DNS) hostname for the IP. Null when no PTR is published.",
+        "title": "Ptr"
+      },
+      "shared_hosting": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "True when PTR hostname differs from the queried domain (shared hosting signal). Absent when PTR lookup fails.",
+        "title": "Shared Hosting"
+      }
+    },
+    "title": "ReverseDnsInfo",
+    "type": "object"
+  },
+  "RiskFactor": {
+    "properties": {
+      "detail": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable justification for the score.",
+        "title": "Detail"
+      },
+      "max": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Maximum possible points for this factor.",
+        "title": "Max"
+      },
+      "name": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Factor label (e.g. 'SSL/TLS', 'Email Security', 'IP Reputation').",
+        "title": "Name"
+      },
+      "score": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Points earned by this factor (can be negative for penalties).",
+        "title": "Score"
+      }
+    },
+    "title": "RiskFactor",
+    "type": "object"
+  },
+  "RiskInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "factors": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/RiskFactor"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Per-factor scoring breakdown (typically 8-9 factors).",
+        "title": "Factors"
+      },
+      "grade": {
+        "anyOf": [
+          {
+            "enum": [
+              "A",
+              "B",
+              "C",
+              "D",
+              "F"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Letter grade derived from score.",
+        "title": "Grade"
+      },
+      "max_score": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Maximum achievable score (100 by default; drops by the corresponding factor's max when an upstream source fails — e.g. crt.sh timeout excludes the CT factor and max_score becomes 90, so grade is computed against the available signals).",
+        "title": "Max Score"
+      },
+      "score": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Cumulative risk score (0-100).",
+        "title": "Score"
+      }
+    },
+    "title": "RiskInfo",
+    "type": "object"
+  },
+  "ShodanRepInfo": {
+    "description": "Shodan full API enrichment (Pro tier only). Richer than InternetDB fields at top level.",
+    "properties": {
+      "asn": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ASN string per Shodan (e.g. 'AS13335'); may differ from top-level asn int.",
+        "title": "Asn"
+      },
+      "city": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "City name per Shodan geolocation.",
+        "title": "City"
+      },
+      "country_name": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Country name per Shodan geolocation.",
+        "title": "Country Name"
+      },
+      "hostnames": {
+        "description": "Hostnames observed pointing to this IP per Shodan.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Hostnames",
+        "type": "array"
+      },
+      "isp": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISP per Shodan (may differ from AbuseIPDB/RIPE).",
+        "title": "Isp"
+      },
+      "last_update": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 timestamp of Shodan's most recent data point for this IP.",
+        "title": "Last Update"
+      },
+      "org": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Organization name owning the IP per Shodan.",
+        "title": "Org"
+      },
+      "os": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Shodan-detected operating system (fingerprint-based, best-effort).",
+        "title": "Os"
+      },
+      "ports": {
+        "description": "Open ports observed by Shodan full scan (superset of top-level InternetDB ports).",
+        "items": {
+          "type": "integer"
+        },
+        "title": "Ports",
+        "type": "array"
+      },
+      "reason": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable reason. Present when status is skipped/restricted/rate_limited/error/pro_only.",
+        "title": "Reason"
+      },
+      "status": {
+        "description": "'ok' = data fetched; 'skipped' = API key not configured; 'restricted' = 403 (IP not available on free Shodan tier); 'rate_limited' = 429 quota exceeded; 'error' = transient HTTP/network failure; 'pro_only' = returned on Free tier as upsell hint.",
+        "enum": [
+          "ok",
+          "skipped",
+          "restricted",
+          "rate_limited",
+          "error",
+          "pro_only"
+        ],
+        "title": "Status",
+        "type": "string"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Upgrade link returned when status='pro_only'.",
+        "title": "Upgrade Url"
+      },
+      "vulns": {
+        "description": "CVE IDs Shodan has associated with banners on this IP.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Vulns",
+        "type": "array"
+      }
+    },
+    "required": [
+      "status"
+    ],
+    "title": "ShodanRepInfo",
+    "type": "object"
+  },
+  "SoaInfo": {
+    "additionalProperties": true,
+    "description": "SOA record embedded inside DomainDnsInfo.soa.",
+    "properties": {
+      "mname": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Primary nameserver (SOA MNAME).",
+        "title": "Mname"
+      },
+      "rname": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Responsible party mailbox (SOA RNAME).",
+        "title": "Rname"
+      },
+      "serial": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Zone serial number.",
+        "title": "Serial"
+      }
+    },
+    "title": "SoaInfo",
+    "type": "object"
+  },
+  "SslInfoEmbedded": {
+    "additionalProperties": true,
+    "description": "SSL subset embedded in the domain report. See top-level SslResponse for live SSL endpoint shape.",
+    "properties": {
+      "alpn": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Negotiated ALPN protocol (e.g. 'http/1.1', 'h2').",
+        "title": "Alpn"
+      },
+      "cert_valid": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "True only when chain verified AND hostname matches AND not expired. False when cert is readable but fails one or more validation checks (see validation_errors).",
+        "title": "Cert Valid"
+      },
+      "common_name": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Leaf cert Subject CN.",
+        "title": "Common Name"
+      },
+      "days_remaining": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Days until expiry. Negative when already expired.",
+        "title": "Days Remaining"
+      },
+      "error": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Populated only on probe failure (timeout, connection refused, no port 443). Cert validation issues are NOT errors here — see cert_valid + validation_errors instead.",
+        "title": "Error"
+      },
+      "grade": {
+        "anyOf": [
+          {
+            "enum": [
+              "A",
+              "B",
+              "C",
+              "D",
+              "F"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "SSL grade. A/B/C: cert_valid AND TLS modern. D: cert readable but invalid (self-signed, hostname mismatch, untrusted root). F: probe failure, expired, or legacy TLS.",
+        "title": "Grade"
+      },
+      "issuer": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Leaf cert issuer organization name.",
+        "title": "Issuer"
+      },
+      "not_after": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "notAfter (expiry) timestamp (ISO 8601 / UTC).",
+        "title": "Not After"
+      },
+      "not_before": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "notBefore timestamp (ISO 8601 / UTC).",
+        "title": "Not Before"
+      },
+      "san": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Subject Alternative Names.",
+        "title": "San"
+      },
+      "serial_number": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Hex-encoded cert serial number.",
+        "title": "Serial Number"
+      },
+      "tls_version": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Negotiated TLS protocol (e.g. 'TLSv1.3', 'TLSv1.2'). Empty on handshake failure.",
+        "title": "Tls Version"
+      },
+      "validation_errors": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Canonical validation failure tags when cert_valid is False. Values: 'expired', 'self_signed', 'hostname_mismatch', 'untrusted_root', 'chain_incomplete'. Empty/null when cert_valid is True.",
+        "title": "Validation Errors"
+      },
+      "version": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "X.509 version as returned by the ssl module (int 3 for v3; empty string on some parse paths).",
+        "title": "Version"
+      }
+    },
+    "title": "SslInfoEmbedded",
+    "type": "object"
+  },
+  "SubdomainsInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "count": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Total subdomains discovered.",
+        "title": "Count"
+      },
+      "found_via_crtsh": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Count discovered via crt.sh CT log query.",
+        "title": "Found Via Crtsh"
+      },
+      "found_via_wordlist": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Count discovered via DNS brute-force wordlist.",
+        "title": "Found Via Wordlist"
+      },
+      "sources": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Sources that produced hits (subset of ['wordlist', 'crt_sh']).",
+        "title": "Sources"
+      },
+      "subdomains": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Sorted unique subdomain list.",
+        "title": "Subdomains"
+      },
+      "summary": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "One-line human-readable summary.",
+        "title": "Summary"
+      },
+      "warnings": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Non-fatal warnings (e.g. 'crt.sh timeout', 'result truncated').",
+        "title": "Warnings"
+      }
+    },
+    "title": "SubdomainsInfo",
+    "type": "object"
+  },
+  "TechItem": {
+    "properties": {
+      "category": {
+        "title": "Category",
+        "type": "string"
+      },
+      "name": {
+        "title": "Name",
+        "type": "string"
+      },
+      "source": {
+        "title": "Source",
+        "type": "string"
+      },
+      "version": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "title": "Version"
+      }
+    },
+    "required": [
+      "name",
+      "category",
+      "source"
+    ],
+    "title": "TechItem",
+    "type": "object"
+  },
+  "ThreatInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "tags": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Deduped list of tags (up to 20).",
+        "title": "Tags"
+      },
+      "threat_types": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Deduped list of threat classes across all URLs.",
+        "title": "Threat Types"
+      },
+      "url_count": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Total URLs URLhaus has seen for this domain.",
+        "title": "Url Count"
+      },
+      "urlhaus_status": {
+        "anyOf": [
+          {
+            "enum": [
+              "clean",
+              "listed",
+              "error",
+              "skipped"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "URLhaus lookup outcome. 'skipped' in lite mode; 'error' on API failure (treat as unavailable, not clean).",
+        "title": "Urlhaus Status"
+      },
+      "urls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/ThreatUrlEntry"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Up to 20 offending URL entries.",
+        "title": "Urls"
+      },
+      "urls_online": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Subset of url_count currently marked online.",
+        "title": "Urls Online"
+      }
+    },
+    "title": "ThreatInfo",
+    "type": "object"
+  },
+  "ThreatUrlEntry": {
+    "additionalProperties": true,
+    "description": "Single offending URL entry inside ThreatInfo.urls.",
+    "properties": {
+      "date_added": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "When URLhaus first saw this URL.",
+        "title": "Date Added"
+      },
+      "status": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "URLhaus status for this URL ('online', 'offline').",
+        "title": "Status"
+      },
+      "tags": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Tags assigned by URLhaus (malware family, kit, etc.).",
+        "title": "Tags"
+      },
+      "threat": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Threat class (e.g. 'malware_download', 'phishing').",
+        "title": "Threat"
+      },
+      "url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Offending URL observed in URLhaus.",
+        "title": "Url"
+      }
+    },
+    "title": "ThreatUrlEntry",
+    "type": "object"
+  },
+  "Verdict": {
+    "properties": {
+      "completeness": {
+        "default": "complete",
+        "description": "'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing.",
+        "enum": [
+          "complete",
+          "partial",
+          "minimal"
+        ],
+        "title": "Completeness",
+        "type": "string"
+      },
+      "data_age_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness.",
+        "title": "Data Age Seconds"
+      },
+      "deterministic": {
+        "description": "True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output.",
+        "title": "Deterministic",
+        "type": "boolean"
+      },
+      "falsifiable_fields": {
+        "description": "Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Falsifiable Fields",
+        "type": "array"
+      },
+      "sources_queried": {
+        "description": "Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Queried",
+        "type": "array"
+      },
+      "sources_unavailable": {
+        "description": "Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Unavailable",
+        "type": "array"
+      }
+    },
+    "required": [
+      "deterministic"
+    ],
+    "title": "Verdict",
+    "type": "object"
+  },
+  "WafInfo": {
+    "additionalProperties": true,
+    "properties": {
+      "detected": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "WAF product names detected from response headers (e.g. ['Cloudflare', 'AWS CloudFront']).",
+        "title": "Detected"
+      },
+      "waf_present": {
+        "anyOf": [
+          {
+            "type": "boolean"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "True when `detected` is non-empty.",
+        "title": "Waf Present"
+      }
+    },
+    "title": "WafInfo",
+    "type": "object"
+  },
+  "WhoisInfoEmbedded": {
+    "additionalProperties": true,
+    "description": "WHOIS subset embedded in the domain report. Fields are best-effort regex extracts from the raw WHOIS text.",
+    "properties": {
+      "creation_date": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Domain creation date (format depends on registrar).",
+        "title": "Creation Date"
+      },
+      "error": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Populated when the WHOIS TCP query failed (e.g. no WHOIS server for TLD, socket timeout).",
+        "title": "Error"
+      },
+      "expiry_date": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Domain expiry date (format depends on registrar).",
+        "title": "Expiry Date"
+      },
+      "name_servers": {
+        "anyOf": [
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Authoritative nameservers per WHOIS.",
+        "title": "Name Servers"
+      },
+      "raw_length": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Byte length of raw WHOIS response (sanity indicator).",
+        "title": "Raw Length"
+      },
+      "registrar": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Registrar name as reported by the WHOIS server.",
+        "title": "Registrar"
+      },
+      "status": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPP domain status (e.g. 'clientTransferProhibited'). String or list depending on registrar.",
+        "title": "Status"
+      },
+      "updated_date": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Last-updated timestamp from WHOIS.",
+        "title": "Updated Date"
+      }
+    },
+    "title": "WhoisInfoEmbedded",
+    "type": "object"
+  }
+}

Added value: +[
+  {
+    "$ref": "#/$defs/AuditResponse"
+  },
+  {
+    "$ref": "#/$defs/ErrorResponse"
+  }
+]

Removed value: -"string"

Added value: +{
+  "default": false,
+  "description": "Return every TXT record under report.dns.txt (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). report.dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory.",
+  "title": "Include All Txt",
+  "type": "boolean"
+}