ContrastAPI

CVE Search

cve_search

Read-onlyIdempotent

Search CVE database with filters: product/vendor, severity, published date range, EPSS score, CWE, CVSS range, CISA KEV status. Default response is SLIM per-result (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources) — pass include='full' for description, cvss_breakdown, affected_products, references, first_seen_*. Verdict (sources_queried, falsifiable_fields, completeness, data_age) is at the response root — applies to the whole batch, not per-row. Product/vendor filters are EXACT NVD-canonical-token matches (not the common name — e.g. nginx is 'nginx_open_source'/'nginx_plus', vendor 'f5'); a low/zero count for a well-known product means the token differs, so for dependency/package lists use check_dependencies and for a domain's whole stack tech_stack_cve_audit (both auto-normalize tokens). Use for vulnerability discovery by criteria; pass cwe_id (e.g. CWE-79) to enumerate every CVE in our database mapped to a weakness — pair with cwe_lookup for the category description and mitigations. Use cve_lookup for single CVE by ID, kev_detail when kev=true filtering and the agent needs federal patch deadlines per result. Response carries a global hint pointing at cve_lookup — drill into any returned cve_id for full detail and chained pivots (exploit_lookup, kev_detail, cwe_lookup). Free: 30/hr, Pro: 500/hr. Returns {count, total, truncated, offset, summary, results, query_echo, next_offset, verdict, hint}.

Input Schema

TableJSON Schema

Name	Required	Description
`kev`	No	If true, return only CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog — these are actively exploited in the wild.
`sort`	No	Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first (default=published_desc).
`limit`	No	Maximum results to return. Range: 1-200.
`cwe_id`	No	Filter by CWE weakness ID. Exact match, case-insensitive. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-120 (buffer overflow), CWE-78 (command injection). Format: CWE-<number>. Omit to not filter by CWE.
`offset`	No	Skip N results for pagination. Use with limit to page through results.
`vendor`	No	Filter by vendor name (case-insensitive). When combined with product, both must match the same CPE row — prevents cross-row false matches. Example: vendor=apache, product=struts.
`include`	No	Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. Even with 'full', per-result affected_products and references may be truncated (the per-result total_products/total_references report the honest counts); use cve_lookup for the guaranteed-complete per-CVE lists. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload).
`product`	No	Product or vendor token to filter by. EXACT match (case-insensitive) against the NVD-canonical CPE product/vendor token — NOT substring/fuzzy, and NOT necessarily the common project name. Common names, vendor renames, and build-tool artifact ids often differ from the canonical token (e.g. modern nginx CVEs are under 'nginx_open_source'/'nginx_plus', vendor 'f5', not 'nginx'; Maven 'log4j-core' maps to 'log4j'). A low or zero count for a well-known product usually means the token differs — do NOT assume coverage is complete. For dependency/package lists prefer check_dependencies, and for a domain's whole tech stack tech_stack_cve_audit (both auto-normalize tokens). A product match means CVEs exist for that product, not that a specific running version is affected — verify the running version is within each CVE's affected range. Omit to search all products.
`cvss_max`	No	Maximum CVSS v3 base score (0.0-10.0). Default 10.0 = no filter (sentinel, not applied). Set < 10.0 to filter — CVEs with null CVSS are excluded when active. Combine with cvss_min for a range.
`cvss_min`	No	Minimum CVSS v3 base score (0.0-10.0). Default 0.0 = no filter (sentinel, not applied). Set > 0 to filter — CVEs with null CVSS are excluded when active. Use 7.0 for high+critical, 9.0 for critical only.
`epss_min`	No	Minimum EPSS score filter (0.0-1.0). EPSS predicts exploitation probability. 0.5 = top ~5% most likely to be exploited. 0.0 = no filter.
`severity`	No	CVSS severity level. Must be one of: CRITICAL, HIGH, MEDIUM, LOW. Omit for all severities.
`published_after`	No	Inclusive lower bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names a starting point, e.g. 'since 2015' → '2015-01-01', 'after March 2024' → '2024-03-01'. Omit to not bound the lower edge. Combine with published_before for ranges.
`published_before`	No	Inclusive upper bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names an ending point, e.g. 'before 2020' → '2019-12-31', 'up to 2023' → '2023-12-31'. Omit to not bound the upper edge. Combine with published_after for ranges.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed5 schema fields changedJun 2, 2026
- changedOutput schema / properties / result / properties / hint / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"array"New value: +[
+  "array",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / next_offset / type
```
Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / query_echo / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
- changedOutput schema / properties / result / properties / verdict / type
```
Previous value: -"object"New value: +[
+  "object",
+  "null"
+]
```
Changed2 schema fields changedMay 25, 2026
- changedOutput schema / properties / result / properties / next_calls / type
```
Previous value: -"object"New value: +"array"
```
- changedOutput schema / properties / result / properties / next_offset / type
```
Previous value: -"object"New value: +"integer"
```

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "count": {
+          "type": "integer"
+        },
+        "hint": {
+          "type": "object"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "next_offset": {
+          "type": "object"
+        },
+        "offset": {
+          "type": "integer"
+        },
+        "query_echo": {
+          "type": "object"
+        },
+        "results": {
+          "type": "array"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "total": {
+          "type": "integer"
+        },
+        "truncated": {
+          "type": "boolean"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Changed1 schema field changedMay 22, 2026

changedOutput schema / (root)

Previous value: -{
-  "$defs": {
-    "CveSearchItem": {
-      "additionalProperties": true,
-      "properties": {
-        "cve_id": {
-          "type": "string"
-        },
-        "cvss_v3": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwe_id": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "epss": {
-          "$ref": "#/$defs/EpssInfo"
-        },
-        "kev": {
-          "$ref": "#/$defs/KevInfo"
-        },
-        "modified": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "published": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "references_count": {
-          "type": "integer"
-        },
-        "severity": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "sources": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "summary": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "total_products": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "cve_id"
-      ],
-      "type": "object"
-    },
-    "CveSearchResponse": {
-      "properties": {
-        "count": {
-          "type": "integer"
-        },
-        "hint": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/SearchHint"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "next_offset": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "offset": {
-          "type": "integer"
-        },
-        "query_echo": {
-          "anyOf": [
-            {
-              "additionalProperties": true,
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "results": {
-          "items": {
-            "$ref": "#/$defs/CveSearchItem"
-          },
-          "type": "array"
-        },
-        "summary": {
-          "type": "string"
-        },
-        "total": {
-          "type": "integer"
-        },
-        "truncated": {
-          "type": "boolean"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "EpssInfo": {
-      "properties": {
-        "percentile": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "score": {
-          "anyOf": [
-            {
-              "type": "number"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "KevInfo": {
-      "properties": {
-        "cwes": {
-          "anyOf": [
-            {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_added": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "date_removed": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "due_date": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "in_kev": {
-          "type": "boolean"
-        },
-        "known_ransomware_use": {
-          "anyOf": [
-            {
-              "type": "boolean"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "notes": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "product": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "required_action": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "short_description": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vendor_project": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "vulnerability_name": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "SearchHint": {
-      "additionalProperties": true,
-      "properties": {
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "const": "cve_lookup",
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/CveSearchResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Changed2 schema fields changedMay 17, 2026

changedInput schema / properties / include / description

Previous value: -"Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload)."New value: +"Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. Even with 'full', per-result affected_products and references may be truncated (the per-result total_products/total_references report the honest counts); use cve_lookup for the guaranteed-complete per-CVE lists. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload)."

changedInput schema / properties / product / description

Previous value: -"Product or vendor name to filter by. EXACT match (case-insensitive) against the canonical product/vendor token stored in NVD CPE data — not a substring or fuzzy search. Use the short canonical name exactly as vendors publish it: 'nginx' (not 'nginx web server'), 'apache' (not 'Apache HTTP Server'), 'linux_kernel' (not 'Linux Kernel'), 'microsoft' (vendor). If unsure of the exact token, try the lowercase project name first; if 0 results, try the vendor name. Omit to search all products."New value: +"Product or vendor token to filter by. EXACT match (case-insensitive) against the NVD-canonical CPE product/vendor token — NOT substring/fuzzy, and NOT necessarily the common project name. Common names, vendor renames, and build-tool artifact ids often differ from the canonical token (e.g. modern nginx CVEs are under 'nginx_open_source'/'nginx_plus', vendor 'f5', not 'nginx'; Maven 'log4j-core' maps to 'log4j'). A low or zero count for a well-known product usually means the token differs — do NOT assume coverage is complete. For dependency/package lists prefer check_dependencies, and for a domain's whole tech stack tech_stack_cve_audit (both auto-normalize tokens). A product match means CVEs exist for that product, not that a specific running version is affected — verify the running version is within each CVE's affected range. Omit to search all products."

Changed161 schema fields changedMay 17, 2026
- removedOutput schema / $defs / CveSearchItem / description
```
Removed value: -"Slim per-result shape for cve_search list items.\n\nDefault cve_search response uses this shape (description / cvss_breakdown /\naffected_products / references / first_seen_* are dropped). Pass cve_search\n?include=full to get the full CveResponse shape — extra=\"allow\" lets the\nfull-mode fields pass through without a schema fork."
```
- removedOutput schema / $defs / CveSearchItem / properties / cve_id / description
```
Removed value: -"Canonical CVE identifier, e.g. 'CVE-2021-44228'."
```
- removedOutput schema / $defs / CveSearchItem / properties / cve_id / title
```
Removed value: -"Cve Id"
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / description
```
Removed value: -"CVSS v3.x base score (0.0-10.0)."
```
- removedOutput schema / $defs / CveSearchItem / properties / cvss_v3 / title
```
Removed value: -"Cvss V3"
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / description
```
Removed value: -"Primary CWE identifier (legacy single-value field). Equals cwes[0] when cwes is present. Kept for backward-compat; consumers should prefer cwes."
```
- removedOutput schema / $defs / CveSearchItem / properties / cwe_id / title
```
Removed value: -"Cwe Id"
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / description
```
Removed value: -"Multi-CWE list as published by NVD. Mirrors cve_lookup.cwes (v1.28.0 multi-CWE adoption). Null/omitted when DB row has no multi-CWE list — legacy cwe_id still emitted."
```
- removedOutput schema / $defs / CveSearchItem / properties / cwes / title
```
Removed value: -"Cwes"
```
- removedOutput schema / $defs / CveSearchItem / properties / epss / description
```
Removed value: -"EPSS score + percentile."
```
- removedOutput schema / $defs / CveSearchItem / properties / kev / description
```
Removed value: -"CISA KEV status."
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / description
```
Removed value: -"ISO 8601 last-modified timestamp."
```
- removedOutput schema / $defs / CveSearchItem / properties / modified / title
```
Removed value: -"Modified"
```
- removedOutput schema / $defs / CveSearchItem / properties / published / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / published / description
```
Removed value: -"ISO 8601 publication timestamp."
```
- removedOutput schema / $defs / CveSearchItem / properties / published / title
```
Removed value: -"Published"
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / description
```
Removed value: -"Honest count of upstream references for this CVE. Use this to decide whether a cve_lookup pivot is worthwhile (e.g. >0 refs → drill down; 0 → skip). The reference list itself is NOT included in slim search items — pass include=full or call cve_lookup to retrieve URLs."
```
- removedOutput schema / $defs / CveSearchItem / properties / references_count / title
```
Removed value: -"References Count"
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / description
```
Removed value: -"CVSS v3 severity label."
```
- removedOutput schema / $defs / CveSearchItem / properties / severity / title
```
Removed value: -"Severity"
```
- removedOutput schema / $defs / CveSearchItem / properties / sources / description
```
Removed value: -"Source feeds for this CVE row."
```
- removedOutput schema / $defs / CveSearchItem / properties / sources / title
```
Removed value: -"Sources"
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / description
```
Removed value: -"Human-readable one-line summary."
```
- removedOutput schema / $defs / CveSearchItem / properties / summary / title
```
Removed value: -"Summary"
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / description
```
Removed value: -"Honest count of affected products in DB."
```
- removedOutput schema / $defs / CveSearchItem / properties / total_products / title
```
Removed value: -"Total Products"
```
- removedOutput schema / $defs / CveSearchItem / title
```
Removed value: -"CveSearchItem"
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / description
```
Removed value: -"Number of CVEs in this page (== len(results)). Capped by `limit`."
```
- removedOutput schema / $defs / CveSearchResponse / properties / count / title
```
Removed value: -"Count"
```
- removedOutput schema / $defs / CveSearchResponse / properties / hint / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / hint / description
```
Removed value: -"Pivot/refine hint emitted when the query returned 0 results or is overly broad."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / description
```
Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_calls / title
```
Removed value: -"Next Calls"
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / description
```
Removed value: -"Offset to pass on the next page. Null when truncated=False (no more results)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / next_offset / title
```
Removed value: -"Next Offset"
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / description
```
Removed value: -"Offset of the first item in this page (echoed from input)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / offset / title
```
Removed value: -"Offset"
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / description
```
Removed value: -"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, cvss_min, cvss_max, sort, limit, offset, tagged. Useful for verifying the parsed query matched the intent."
```
- removedOutput schema / $defs / CveSearchResponse / properties / query_echo / title
```
Removed value: -"Query Echo"
```
- removedOutput schema / $defs / CveSearchResponse / properties / results / description
```
Removed value: -"Per-CVE slim records — see CveSearchItem."
```
- removedOutput schema / $defs / CveSearchResponse / properties / results / title
```
Removed value: -"Results"
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / default
```
Removed value: -""
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / description
```
Removed value: -"One-line summary like '50 CVEs returned, 1234 total (product=nginx, severity=HIGH)'."
```
- removedOutput schema / $defs / CveSearchResponse / properties / summary / title
```
Removed value: -"Summary"
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / default
```
Removed value: -0
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / description
```
Removed value: -"Total CVE matches in the database for the query — the honest pre-pagination count."
```
- removedOutput schema / $defs / CveSearchResponse / properties / total / title
```
Removed value: -"Total"
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / default
```
Removed value: -false
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / description
```
Removed value: -"True when total > offset + count (more pages available — use next_offset)."
```
- removedOutput schema / $defs / CveSearchResponse / properties / truncated / title
```
Removed value: -"Truncated"
```
- removedOutput schema / $defs / CveSearchResponse / properties / verdict / default
```
Removed value: -null
```
- removedOutput schema / $defs / CveSearchResponse / properties / verdict / description
```
Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
```
- removedOutput schema / $defs / CveSearchResponse / title
```
Removed value: -"CveSearchResponse"
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / default
```
Removed value: -null
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / description
```
Removed value: -"EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk."
```
- removedOutput schema / $defs / EpssInfo / properties / percentile / title
```
Removed value: -"Percentile"
```
- removedOutput schema / $defs / EpssInfo / properties / score / default
```
Removed value: -null
```
- removedOutput schema / $defs / EpssInfo / properties / score / description
```
Removed value: -"EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days."
```
- removedOutput schema / $defs / EpssInfo / properties / score / title
```
Removed value: -"Score"
```
- removedOutput schema / $defs / EpssInfo / title
```
Removed value: -"EpssInfo"
```
- removedOutput schema / $defs / ErrorDetail / description
```
Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / description
```
Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."
```
- removedOutput schema / $defs / ErrorDetail / properties / code / title
```
Removed value: -"Code"
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / description
```
Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."
```
- removedOutput schema / $defs / ErrorDetail / properties / docs_url / title
```
Removed value: -"Docs Url"
```
- removedOutput schema / $defs / ErrorDetail / properties / message / description
```
Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."
```
- removedOutput schema / $defs / ErrorDetail / properties / message / title
```
Removed value: -"Message"
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / description
```
Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."
```
- removedOutput schema / $defs / ErrorDetail / properties / retry_after_seconds / title
```
Removed value: -"Retry After Seconds"
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / default
```
Removed value: -null
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / description
```
Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."
```
- removedOutput schema / $defs / ErrorDetail / properties / upgrade_url / title
```
Removed value: -"Upgrade Url"
```
- removedOutput schema / $defs / ErrorDetail / title
```
Removed value: -"ErrorDetail"
```
- removedOutput schema / $defs / ErrorResponse / description
```
Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."
```
- removedOutput schema / $defs / ErrorResponse / title
```
Removed value: -"ErrorResponse"
```
- removedOutput schema / $defs / KevInfo / properties / cwes / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / cwes / description
```
Removed value: -"CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered)."
```
- removedOutput schema / $defs / KevInfo / properties / cwes / title
```
Removed value: -"Cwes"
```
- removedOutput schema / $defs / KevInfo / properties / date_added / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / date_added / description
```
Removed value: -"ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog."
```
- removedOutput schema / $defs / KevInfo / properties / date_added / title
```
Removed value: -"Date Added"
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / description
```
Removed value: -"ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV."
```
- removedOutput schema / $defs / KevInfo / properties / date_removed / title
```
Removed value: -"Date Removed"
```
- removedOutput schema / $defs / KevInfo / properties / due_date / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / due_date / description
```
Removed value: -"Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021)."
```
- removedOutput schema / $defs / KevInfo / properties / due_date / title
```
Removed value: -"Due Date"
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / default
```
Removed value: -false
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / description
```
Removed value: -"True when CISA has confirmed this CVE is being actively exploited in the wild."
```
- removedOutput schema / $defs / KevInfo / properties / in_kev / title
```
Removed value: -"In Kev"
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / description
```
Removed value: -"True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV."
```
- removedOutput schema / $defs / KevInfo / properties / known_ransomware_use / title
```
Removed value: -"Known Ransomware Use"
```
- removedOutput schema / $defs / KevInfo / properties / notes / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / notes / description
```
Removed value: -"Reference URLs published by CISA, separated by '; '."
```
- removedOutput schema / $defs / KevInfo / properties / notes / title
```
Removed value: -"Notes"
```
- removedOutput schema / $defs / KevInfo / properties / product / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / product / description
```
Removed value: -"Affected product name as published by CISA (mirrors kev_detail.product)."
```
- removedOutput schema / $defs / KevInfo / properties / product / title
```
Removed value: -"Product"
```
- removedOutput schema / $defs / KevInfo / properties / required_action / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / required_action / description
```
Removed value: -"CISA-specified remediation action text (mirrors kev_detail.required_action)."
```
- removedOutput schema / $defs / KevInfo / properties / required_action / title
```
Removed value: -"Required Action"
```
- removedOutput schema / $defs / KevInfo / properties / short_description / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / short_description / description
```
Removed value: -"CISA's one-sentence summary (mirrors kev_detail.short_description)."
```
- removedOutput schema / $defs / KevInfo / properties / short_description / title
```
Removed value: -"Short Description"
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / description
```
Removed value: -"Vendor or project name as published by CISA (mirrors kev_detail.vendor_project)."
```
- removedOutput schema / $defs / KevInfo / properties / vendor_project / title
```
Removed value: -"Vendor Project"
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / default
```
Removed value: -null
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / description
```
Removed value: -"Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'."
```
- removedOutput schema / $defs / KevInfo / properties / vulnerability_name / title
```
Removed value: -"Vulnerability Name"
```
- removedOutput schema / $defs / KevInfo / title
```
Removed value: -"KevInfo"
```
- removedOutput schema / $defs / PivotHint / description
```
Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."
```
- removedOutput schema / $defs / PivotHint / properties / input / description
```
Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."
```
- removedOutput schema / $defs / PivotHint / properties / input / title
```
Removed value: -"Input"
```
- removedOutput schema / $defs / PivotHint / properties / params / default
```
Removed value: -null
```
- removedOutput schema / $defs / PivotHint / properties / params / description
```
Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."
```
- removedOutput schema / $defs / PivotHint / properties / params / title
```
Removed value: -"Params"
```
- removedOutput schema / $defs / PivotHint / properties / reason / description
```
Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."
```
- removedOutput schema / $defs / PivotHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / PivotHint / properties / tool / description
```
Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."
```
- removedOutput schema / $defs / PivotHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / PivotHint / title
```
Removed value: -"PivotHint"
```
- removedOutput schema / $defs / SearchHint / description
```
Removed value: -"Footer hint emitted on list responses (cve_search, cve_leading) to point\nLLM agents at the natural drill-down tool. Distinct from PivotHint: there is\nno `input` field because the hint is global to the list — the agent picks a\nresult of interest and passes its ID to the named tool."
```
- removedOutput schema / $defs / SearchHint / properties / reason / description
```
Removed value: -"Short rationale explaining what the drill-down tool adds beyond the slim list items (e.g. full description, affected_products, references, exploit/KEV/CWE pivots)."
```
- removedOutput schema / $defs / SearchHint / properties / reason / title
```
Removed value: -"Reason"
```
- removedOutput schema / $defs / SearchHint / properties / tool / description
```
Removed value: -"Drill-down tool to call with any result ID from the list. Constrained to cve_lookup today; expand the Literal as new list endpoints get list-level hints."
```
- removedOutput schema / $defs / SearchHint / properties / tool / title
```
Removed value: -"Tool"
```
- removedOutput schema / $defs / SearchHint / title
```
Removed value: -"SearchHint"
```
- removedOutput schema / $defs / Verdict / properties / completeness / default
```
Removed value: -"complete"
```
- removedOutput schema / $defs / Verdict / properties / completeness / description
```
Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."
```
- removedOutput schema / $defs / Verdict / properties / completeness / title
```
Removed value: -"Completeness"
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / default
```
Removed value: -null
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / description
```
Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."
```
- removedOutput schema / $defs / Verdict / properties / data_age_seconds / title
```
Removed value: -"Data Age Seconds"
```
- removedOutput schema / $defs / Verdict / properties / deterministic / description
```
Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."
```
- removedOutput schema / $defs / Verdict / properties / deterministic / title
```
Removed value: -"Deterministic"
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / description
```
Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."
```
- removedOutput schema / $defs / Verdict / properties / falsifiable_fields / title
```
Removed value: -"Falsifiable Fields"
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / description
```
Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."
```
- removedOutput schema / $defs / Verdict / properties / sources_queried / title
```
Removed value: -"Sources Queried"
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / description
```
Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."
```
- removedOutput schema / $defs / Verdict / properties / sources_unavailable / title
```
Removed value: -"Sources Unavailable"
```
- removedOutput schema / $defs / Verdict / title
```
Removed value: -"Verdict"
```
- removedOutput schema / properties / result / title
```
Removed value: -"Result"
```
- removedOutput schema / title
```
Removed value: -"cve_searchOutput"
```

Changed1 schema field changedMay 15, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage",
-  "sigma_rule_lookup",
-  "bulk_sigma_rule_lookup"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup",
+  "tech_stack_cve_audit"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_security_posture",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage",
+  "sigma_rule_lookup",
+  "bulk_sigma_rule_lookup"
+]

Changed1 schema field changedMay 12, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "calculate_risk_score",
-  "get_cvss_details",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_security_posture",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed4 schema fields changedMay 9, 2026

changedOutput schema / $defs / CveSearchItem / properties / cwe_id / description

Previous value: -"Primary CWE identifier."New value: +"Primary CWE identifier (legacy single-value field). Equals cwes[0] when cwes is present. Kept for backward-compat; consumers should prefer cwes."

addedOutput schema / $defs / CveSearchItem / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Multi-CWE list as published by NVD. Mirrors cve_lookup.cwes (v1.28.0 multi-CWE adoption). Null/omitted when DB row has no multi-CWE list — legacy cwe_id still emitted.",
+  "title": "Cwes"
+}

addedOutput schema / $defs / CveSearchItem / properties / references_count

Added value: +{
+  "default": 0,
+  "description": "Honest count of upstream references for this CVE. Use this to decide whether a cve_lookup pivot is worthwhile (e.g. >0 refs → drill down; 0 → skip). The reference list itself is NOT included in slim search items — pass include=full or call cve_lookup to retrieve URLs.",
+  "title": "References Count",
+  "type": "integer"
+}

changedOutput schema / $defs / CveSearchResponse / properties / query_echo / description

Previous value: -"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, sort, limit, offset. Useful for verifying the parsed query matched the intent."New value: +"Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, cvss_min, cvss_max, sort, limit, offset, tagged. Useful for verifying the parsed query matched the intent."

Changed1 schema field changedMay 8, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "email_verify",
-  "robots_txt",
-  "redirect_chain",
-  "brand_assets",
-  "seo_audit",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "calculate_risk_score",
+  "get_cvss_details",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed10 schema fields changedMay 8, 2026

addedOutput schema / $defs / KevInfo / properties / cwes

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CWE identifiers CISA reports for this CVE (Batch 4A view-ID filtered).",
+  "title": "Cwes"
+}

addedOutput schema / $defs / KevInfo / properties / date_removed

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "ISO 8601 timestamp when CISA removed this CVE from the KEV catalog. Null when CVE is still active in KEV.",
+  "title": "Date Removed"
+}

addedOutput schema / $defs / KevInfo / properties / due_date

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Federal patch deadline (ISO 8601). Null for entries from before BOD 22-01 (Nov 2021).",
+  "title": "Due Date"
+}

addedOutput schema / $defs / KevInfo / properties / known_ransomware_use

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "True when CISA links this CVE to a known ransomware campaign. Null when CVE is not in KEV.",
+  "title": "Known Ransomware Use"
+}

addedOutput schema / $defs / KevInfo / properties / notes

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Reference URLs published by CISA, separated by '; '.",
+  "title": "Notes"
+}

addedOutput schema / $defs / KevInfo / properties / product

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Affected product name as published by CISA (mirrors kev_detail.product).",
+  "title": "Product"
+}

addedOutput schema / $defs / KevInfo / properties / required_action

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA-specified remediation action text (mirrors kev_detail.required_action).",
+  "title": "Required Action"
+}

addedOutput schema / $defs / KevInfo / properties / short_description

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "CISA's one-sentence summary (mirrors kev_detail.short_description).",
+  "title": "Short Description"
+}

addedOutput schema / $defs / KevInfo / properties / vendor_project

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Vendor or project name as published by CISA (mirrors kev_detail.vendor_project).",
+  "title": "Vendor Project"
+}

addedOutput schema / $defs / KevInfo / properties / vulnerability_name

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Short common name when CISA assigns one, e.g. 'Log4Shell', 'ProxyShell'.",
+  "title": "Vulnerability Name"
+}

Changed1 schema field changedMay 7, 2026

changedInput schema / properties / sort / description

Previous value: -"Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first."New value: +"Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first (default=published_desc)."

Changed2 schema fields changedMay 2, 2026

changedInput schema / properties / include / description

Previous value: -"Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources, verdict). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries."New value: +"Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload)."

removedOutput schema / $defs / CveSearchItem / properties / verdict

Removed value: -{
-  "anyOf": [
-    {
-      "$ref": "#/$defs/Verdict"
-    },
-    {
-      "type": "null"
-    }
-  ],
-  "default": null,
-  "description": "Falsifiability metadata."
-}

Changed1 schema field changedMay 2, 2026

changedOutput schema / $defs / PivotHint / properties / tool / enum

Previous value: -[
-  "cve_lookup",
-  "cve_search",
-  "cve_leading",
-  "bulk_cve_lookup",
-  "exploit_lookup",
-  "kev_detail",
-  "cwe_lookup",
-  "subdomain_enum",
-  "ssl_check",
-  "tech_fingerprint",
-  "asn_lookup",
-  "ip_lookup",
-  "ioc_lookup",
-  "bulk_ioc_lookup",
-  "hash_lookup",
-  "threat_intel",
-  "threat_report",
-  "audit_domain",
-  "domain_report",
-  "dns_lookup",
-  "whois_lookup",
-  "wayback_lookup",
-  "scan_headers",
-  "check_headers",
-  "check_secrets",
-  "check_injection",
-  "check_dependencies",
-  "email_mx",
-  "email_disposable",
-  "phone_lookup",
-  "username_lookup",
-  "password_check",
-  "phishing_check",
-  "atlas_technique_lookup",
-  "atlas_technique_search",
-  "bulk_atlas_technique_lookup",
-  "atlas_case_study_lookup",
-  "atlas_case_study_search",
-  "d3fend_defense_lookup",
-  "d3fend_defense_search",
-  "d3fend_defense_for_attack",
-  "d3fend_attack_coverage"
-]New value: +[
+  "cve_lookup",
+  "cve_search",
+  "cve_leading",
+  "bulk_cve_lookup",
+  "exploit_lookup",
+  "kev_detail",
+  "cwe_lookup",
+  "subdomain_enum",
+  "ssl_check",
+  "tech_fingerprint",
+  "asn_lookup",
+  "ip_lookup",
+  "ioc_lookup",
+  "bulk_ioc_lookup",
+  "hash_lookup",
+  "threat_intel",
+  "threat_report",
+  "audit_domain",
+  "domain_report",
+  "dns_lookup",
+  "whois_lookup",
+  "wayback_lookup",
+  "scan_headers",
+  "check_headers",
+  "check_secrets",
+  "check_injection",
+  "check_dependencies",
+  "email_mx",
+  "email_disposable",
+  "email_verify",
+  "robots_txt",
+  "redirect_chain",
+  "brand_assets",
+  "seo_audit",
+  "phone_lookup",
+  "username_lookup",
+  "password_check",
+  "phishing_check",
+  "atlas_technique_lookup",
+  "atlas_technique_search",
+  "bulk_atlas_technique_lookup",
+  "atlas_case_study_lookup",
+  "atlas_case_study_search",
+  "d3fend_defense_lookup",
+  "d3fend_defense_search",
+  "d3fend_defense_for_attack",
+  "d3fend_attack_coverage"
+]

Changed3 schema fields changedMay 1, 2026

addedOutput schema / $defs

Added value: +{
+  "CveSearchItem": {
+    "additionalProperties": true,
+    "description": "Slim per-result shape for cve_search list items.\n\nDefault cve_search response uses this shape (description / cvss_breakdown /\naffected_products / references / first_seen_* are dropped). Pass cve_search\n?include=full to get the full CveResponse shape — extra=\"allow\" lets the\nfull-mode fields pass through without a schema fork.",
+    "properties": {
+      "cve_id": {
+        "description": "Canonical CVE identifier, e.g. 'CVE-2021-44228'.",
+        "title": "Cve Id",
+        "type": "string"
+      },
+      "cvss_v3": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3.x base score (0.0-10.0).",
+        "title": "Cvss V3"
+      },
+      "cwe_id": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Primary CWE identifier.",
+        "title": "Cwe Id"
+      },
+      "epss": {
+        "$ref": "#/$defs/EpssInfo",
+        "description": "EPSS score + percentile."
+      },
+      "kev": {
+        "$ref": "#/$defs/KevInfo",
+        "description": "CISA KEV status."
+      },
+      "modified": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 last-modified timestamp.",
+        "title": "Modified"
+      },
+      "published": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 publication timestamp.",
+        "title": "Published"
+      },
+      "severity": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "CVSS v3 severity label.",
+        "title": "Severity"
+      },
+      "sources": {
+        "description": "Source feeds for this CVE row.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources",
+        "type": "array"
+      },
+      "summary": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Human-readable one-line summary.",
+        "title": "Summary"
+      },
+      "total_products": {
+        "default": 0,
+        "description": "Honest count of affected products in DB.",
+        "title": "Total Products",
+        "type": "integer"
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata."
+      }
+    },
+    "required": [
+      "cve_id"
+    ],
+    "title": "CveSearchItem",
+    "type": "object"
+  },
+  "CveSearchResponse": {
+    "properties": {
+      "count": {
+        "default": 0,
+        "description": "Number of CVEs in this page (== len(results)). Capped by `limit`.",
+        "title": "Count",
+        "type": "integer"
+      },
+      "hint": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/SearchHint"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pivot/refine hint emitted when the query returned 0 results or is overly broad."
+      },
+      "next_calls": {
+        "anyOf": [
+          {
+            "items": {
+              "$ref": "#/$defs/PivotHint"
+            },
+            "type": "array"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user.",
+        "title": "Next Calls"
+      },
+      "next_offset": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Offset to pass on the next page. Null when truncated=False (no more results).",
+        "title": "Next Offset"
+      },
+      "offset": {
+        "default": 0,
+        "description": "Offset of the first item in this page (echoed from input).",
+        "title": "Offset",
+        "type": "integer"
+      },
+      "query_echo": {
+        "anyOf": [
+          {
+            "additionalProperties": true,
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Echoed search filters with empty values stripped. Keys: product, vendor, severity, cwe_id, published_after, published_before, kev, epss_min, sort, limit, offset. Useful for verifying the parsed query matched the intent.",
+        "title": "Query Echo"
+      },
+      "results": {
+        "description": "Per-CVE slim records — see CveSearchItem.",
+        "items": {
+          "$ref": "#/$defs/CveSearchItem"
+        },
+        "title": "Results",
+        "type": "array"
+      },
+      "summary": {
+        "default": "",
+        "description": "One-line summary like '50 CVEs returned, 1234 total (product=nginx, severity=HIGH)'.",
+        "title": "Summary",
+        "type": "string"
+      },
+      "total": {
+        "default": 0,
+        "description": "Total CVE matches in the database for the query — the honest pre-pagination count.",
+        "title": "Total",
+        "type": "integer"
+      },
+      "truncated": {
+        "default": false,
+        "description": "True when total > offset + count (more pages available — use next_offset).",
+        "title": "Truncated",
+        "type": "boolean"
+      },
+      "verdict": {
+        "anyOf": [
+          {
+            "$ref": "#/$defs/Verdict"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."
+      }
+    },
+    "title": "CveSearchResponse",
+    "type": "object"
+  },
+  "EpssInfo": {
+    "properties": {
+      "percentile": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS percentile rank (0.0-100.0) relative to all scored CVEs; higher = more at-risk.",
+        "title": "Percentile"
+      },
+      "score": {
+        "anyOf": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "EPSS probability (0.0-1.0) that this CVE will be exploited in the next 30 days.",
+        "title": "Score"
+      }
+    },
+    "title": "EpssInfo",
+    "type": "object"
+  },
+  "ErrorDetail": {
+    "description": "Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`.",
+    "properties": {
+      "code": {
+        "description": "Stable machine-readable failure category. Agents key retry/upgrade decisions off this.",
+        "enum": [
+          "invalid_argument",
+          "not_found",
+          "rate_limit_exceeded",
+          "auth_required",
+          "tier_limit",
+          "upstream_timeout",
+          "upstream_error",
+          "internal_error"
+        ],
+        "title": "Code",
+        "type": "string"
+      },
+      "docs_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Documentation pointer (e.g. tool input contract) when code='invalid_argument'.",
+        "title": "Docs Url"
+      },
+      "message": {
+        "description": "Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses.",
+        "maxLength": 500,
+        "title": "Message",
+        "type": "string"
+      },
+      "retry_after_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "When code='rate_limit_exceeded', the minimum seconds to wait before retrying.",
+        "title": "Retry After Seconds"
+      },
+      "upgrade_url": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier.",
+        "title": "Upgrade Url"
+      }
+    },
+    "required": [
+      "code",
+      "message"
+    ],
+    "title": "ErrorDetail",
+    "type": "object"
+  },
+  "ErrorResponse": {
+    "description": "MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body.",
+    "properties": {
+      "error": {
+        "$ref": "#/$defs/ErrorDetail"
+      }
+    },
+    "required": [
+      "error"
+    ],
+    "title": "ErrorResponse",
+    "type": "object"
+  },
+  "KevInfo": {
+    "properties": {
+      "date_added": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "ISO 8601 date this CVE was added to CISA's Known Exploited Vulnerabilities catalog.",
+        "title": "Date Added"
+      },
+      "in_kev": {
+        "default": false,
+        "description": "True when CISA has confirmed this CVE is being actively exploited in the wild.",
+        "title": "In Kev",
+        "type": "boolean"
+      }
+    },
+    "title": "KevInfo",
+    "type": "object"
+  },
+  "PivotHint": {
+    "additionalProperties": true,
+    "description": "A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context.",
+    "properties": {
+      "input": {
+        "description": "Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument.",
+        "title": "Input",
+        "type": "string"
+      },
+      "params": {
+        "anyOf": [
+          {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "type": "object"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed.",
+        "title": "Params"
+      },
+      "reason": {
+        "description": "Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'.",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "description": "Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal.",
+        "enum": [
+          "cve_lookup",
+          "cve_search",
+          "cve_leading",
+          "bulk_cve_lookup",
+          "exploit_lookup",
+          "kev_detail",
+          "cwe_lookup",
+          "subdomain_enum",
+          "ssl_check",
+          "tech_fingerprint",
+          "asn_lookup",
+          "ip_lookup",
+          "ioc_lookup",
+          "bulk_ioc_lookup",
+          "hash_lookup",
+          "threat_intel",
+          "threat_report",
+          "audit_domain",
+          "domain_report",
+          "dns_lookup",
+          "whois_lookup",
+          "wayback_lookup",
+          "scan_headers",
+          "check_headers",
+          "check_secrets",
+          "check_injection",
+          "check_dependencies",
+          "email_mx",
+          "email_disposable",
+          "phone_lookup",
+          "username_lookup",
+          "password_check",
+          "phishing_check",
+          "atlas_technique_lookup",
+          "atlas_technique_search",
+          "bulk_atlas_technique_lookup",
+          "atlas_case_study_lookup",
+          "atlas_case_study_search",
+          "d3fend_defense_lookup",
+          "d3fend_defense_search",
+          "d3fend_defense_for_attack",
+          "d3fend_attack_coverage"
+        ],
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "input",
+      "reason"
+    ],
+    "title": "PivotHint",
+    "type": "object"
+  },
+  "SearchHint": {
+    "additionalProperties": true,
+    "description": "Footer hint emitted on list responses (cve_search, cve_leading) to point\nLLM agents at the natural drill-down tool. Distinct from PivotHint: there is\nno `input` field because the hint is global to the list — the agent picks a\nresult of interest and passes its ID to the named tool.",
+    "properties": {
+      "reason": {
+        "description": "Short rationale explaining what the drill-down tool adds beyond the slim list items (e.g. full description, affected_products, references, exploit/KEV/CWE pivots).",
+        "title": "Reason",
+        "type": "string"
+      },
+      "tool": {
+        "const": "cve_lookup",
+        "description": "Drill-down tool to call with any result ID from the list. Constrained to cve_lookup today; expand the Literal as new list endpoints get list-level hints.",
+        "title": "Tool",
+        "type": "string"
+      }
+    },
+    "required": [
+      "tool",
+      "reason"
+    ],
+    "title": "SearchHint",
+    "type": "object"
+  },
+  "Verdict": {
+    "properties": {
+      "completeness": {
+        "default": "complete",
+        "description": "'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing.",
+        "enum": [
+          "complete",
+          "partial",
+          "minimal"
+        ],
+        "title": "Completeness",
+        "type": "string"
+      },
+      "data_age_seconds": {
+        "anyOf": [
+          {
+            "type": "integer"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness.",
+        "title": "Data Age Seconds"
+      },
+      "deterministic": {
+        "description": "True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output.",
+        "title": "Deterministic",
+        "type": "boolean"
+      },
+      "falsifiable_fields": {
+        "description": "Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Falsifiable Fields",
+        "type": "array"
+      },
+      "sources_queried": {
+        "description": "Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Queried",
+        "type": "array"
+      },
+      "sources_unavailable": {
+        "description": "Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Sources Unavailable",
+        "type": "array"
+      }
+    },
+    "required": [
+      "deterministic"
+    ],
+    "title": "Verdict",
+    "type": "object"
+  }
+}

addedOutput schema / properties / result / anyOf

Added value: +[
+  {
+    "$ref": "#/$defs/CveSearchResponse"
+  },
+  {
+    "$ref": "#/$defs/ErrorResponse"
+  }
+]

removedOutput schema / properties / result / type
```
Removed value: -"string"
```

Changed1 schema field changedApr 25, 2026

addedInput schema / properties / include

Added value: +{
+  "default": "",
+  "description": "Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources, verdict). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries.",
+  "enum": [
+    "",
+    "full"
+  ],
+  "title": "Include",
+  "type": "string"
+}

Changed5 schema fields changedApr 19, 2026

addedInput schema / properties / cvss_max

Added value: +{
+  "default": 10,
+  "description": "Maximum CVSS v3 base score (0.0-10.0). Default 10.0 = no filter (sentinel, not applied). Set < 10.0 to filter — CVEs with null CVSS are excluded when active. Combine with cvss_min for a range.",
+  "maximum": 10,
+  "minimum": 0,
+  "title": "Cvss Max",
+  "type": "number"
+}

addedInput schema / properties / cvss_min

Added value: +{
+  "default": 0,
+  "description": "Minimum CVSS v3 base score (0.0-10.0). Default 0.0 = no filter (sentinel, not applied). Set > 0 to filter — CVEs with null CVSS are excluded when active. Use 7.0 for high+critical, 9.0 for critical only.",
+  "maximum": 10,
+  "minimum": 0,
+  "title": "Cvss Min",
+  "type": "number"
+}

addedInput schema / properties / cwe_id

Added value: +{
+  "default": "",
+  "description": "Filter by CWE weakness ID. Exact match, case-insensitive. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-120 (buffer overflow), CWE-78 (command injection). Format: CWE-<number>. Omit to not filter by CWE.",
+  "title": "Cwe Id",
+  "type": "string"
+}

changedInput schema / properties / limit / default
```
Previous value: -10New value: +50
```

addedInput schema / properties / vendor

Added value: +{
+  "default": "",
+  "description": "Filter by vendor name (case-insensitive). When combined with product, both must match the same CPE row — prevents cross-row false matches. Example: vendor=apache, product=struts.",
+  "title": "Vendor",
+  "type": "string"
+}

Changed4 schema fields changedApr 18, 2026

removedInput schema / properties / days

Removed value: -{
-  "default": 30,
-  "description": "Time window in days. Returns CVEs published in the last N days. Range: 1-365.",
-  "maximum": 365,
-  "minimum": 1,
-  "title": "Days",
-  "type": "integer"
-}

changedInput schema / properties / product / description

Previous value: -"Product or vendor name to filter by, case-insensitive. Examples: 'nginx', 'apache', 'microsoft', 'linux kernel'. Omit to search all products."New value: +"Product or vendor name to filter by. EXACT match (case-insensitive) against the canonical product/vendor token stored in NVD CPE data — not a substring or fuzzy search. Use the short canonical name exactly as vendors publish it: 'nginx' (not 'nginx web server'), 'apache' (not 'Apache HTTP Server'), 'linux_kernel' (not 'Linux Kernel'), 'microsoft' (vendor). If unsure of the exact token, try the lowercase project name first; if 0 results, try the vendor name. Omit to search all products."

addedInput schema / properties / published_after

Added value: +{
+  "default": "",
+  "description": "Inclusive lower bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names a starting point, e.g. 'since 2015' → '2015-01-01', 'after March 2024' → '2024-03-01'. Omit to not bound the lower edge. Combine with published_before for ranges.",
+  "title": "Published After",
+  "type": "string"
+}

addedInput schema / properties / published_before

Added value: +{
+  "default": "",
+  "description": "Inclusive upper bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names an ending point, e.g. 'before 2020' → '2019-12-31', 'up to 2023' → '2023-12-31'. Omit to not bound the upper edge. Combine with published_after for ranges.",
+  "title": "Published Before",
+  "type": "string"
+}

Changed1 schema field changedApr 16, 2026
- addedInput schema / properties / offset / maximum
```
Added value: +5000
```

Changed13 schema fields changedApr 16, 2026

changedInput schema / properties / days / description

Previous value: -"Time window: return CVEs published in the last N days. Range: 1-365, default: 30"New value: +"Time window in days. Returns CVEs published in the last N days. Range: 1-365."

addedInput schema / properties / days / maximum
```
Added value: +365
```
addedInput schema / properties / days / minimum
```
Added value: +1
```

addedInput schema / properties / epss_min

Added value: +{
+  "default": 0,
+  "description": "Minimum EPSS score filter (0.0-1.0). EPSS predicts exploitation probability. 0.5 = top ~5% most likely to be exploited. 0.0 = no filter.",
+  "maximum": 1,
+  "minimum": 0,
+  "title": "Epss Min",
+  "type": "number"
+}

addedInput schema / properties / kev

Added value: +{
+  "default": false,
+  "description": "If true, return only CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog — these are actively exploited in the wild.",
+  "title": "Kev",
+  "type": "boolean"
+}

changedInput schema / properties / limit / description

Previous value: -"Maximum number of results to return. Range: 1-200, default: 10"New value: +"Maximum results to return. Range: 1-200."

addedInput schema / properties / limit / maximum
```
Added value: +200
```
addedInput schema / properties / limit / minimum
```
Added value: +1
```

addedInput schema / properties / offset

Added value: +{
+  "default": 0,
+  "description": "Skip N results for pagination. Use with limit to page through results.",
+  "minimum": 0,
+  "title": "Offset",
+  "type": "integer"
+}

changedInput schema / properties / product / description

Previous value: -"Filter by product or vendor name, case-insensitive (e.g. 'nginx', 'apache', 'microsoft'). Leave empty to search all products"New value: +"Product or vendor name to filter by, case-insensitive. Examples: 'nginx', 'apache', 'microsoft', 'linux kernel'. Omit to search all products."

changedInput schema / properties / severity / description

Previous value: -"Filter by CVSS severity level: 'CRITICAL' (9.0-10.0), 'HIGH' (7.0-8.9), 'MEDIUM' (4.0-6.9), or 'LOW' (0.1-3.9). Leave empty for all severities"New value: +"CVSS severity level. Must be one of: CRITICAL, HIGH, MEDIUM, LOW. Omit for all severities."

addedInput schema / properties / severity / enum

Added value: +[
+  "",
+  "CRITICAL",
+  "HIGH",
+  "MEDIUM",
+  "LOW"
+]

addedInput schema / properties / sort

Added value: +{
+  "default": "",
+  "description": "Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first.",
+  "enum": [
+    "",
+    "published_desc",
+    "epss_desc",
+    "cvss_desc"
+  ],
+  "title": "Sort",
+  "type": "string"
+}

First observedApr 11, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly, idempotent, non-destructive), the description discloses important behaviors: the default SLIM response with include='full' for detail, exact NVD-canonical token matching with examples, the global verdict at the response root, the response hint pointing to cve_lookup, rate limits (30/hr free, 500/hr Pro), and the meaning of low/zero counts. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense and front-loaded with the primary purpose and filters. It is long but every sentence contributes a distinct piece of guidance (response format, token matching, alternatives, rate limits). It could be improved with bullet points or more distinct paragraph breaks, but no sentence seems wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (14 parameters, multiple caveats, and several sibling alternatives), the description covers the main use cases, non-obvious token behavior, output shape (with return object listed), and rate limits. The presence of an output schema further reduces the need to explain return values, making this description highly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents all parameters thoroughly, including the exact-token caution, sentinel defaults for cvss_min/max, and include trade-offs. The description repeats this context and adds a condensed warning, but it does not meaningfully extend the parameter semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Search CVE database with filters', then enumerates the filter dimensions. It clearly distinguishes from sibling tools like cve_lookup (single CVE by ID) and kev_detail (KEV federal patch deadlines), so the purpose is unambiguous and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'Use for vulnerability discovery by criteria', 'Use cve_lookup for single CVE by ID', 'kev_detail when kev=true filtering', and 'for dependency/package lists use check_dependencies and for a domain's whole stack tech_stack_cve_audit'. It also mentions pairing with cwe_lookup and cve_lookup for drill-down, making when-to-use and alternatives explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ContrastAPI tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0

Disambiguation4/5

Most tools have clearly distinct purposes, with differences between lookup/search/scan/audit for each domain. However, some overlap exists (e.g., email_mx vs email_security_posture, scan_headers vs contrast_scan) which could cause occasional confusion. Overall, boundaries are well-defined.

Naming Consistency5/5

Tool names follow a consistent verb_noun pattern (e.g., cve_lookup, check_headers, bulk_cve_lookup) with all lowercase underscores. Variations like kev_detail or ssl_check are minor and still predictable. No chaotic mixing of conventions.

Tool Count4/5

54 tools is high but justified by the broad cybersecurity scope (CVE, ATLAS, D3FEND, Sigma, domain, email, IOC, scanning). Some redundancy exists (e.g., three email-related tools), but the count is not excessive given the API's comprehensive feature set.

Completeness5/5

The tool set thoroughly covers the threat intelligence and domain investigation lifecycle: CVE/KEV/exploit/CWE, ATLAS/D3FEND/Sigma, DNS/WHOIS/SSL/subdomains, email security, IOC enrichment, and active scanning. No significant gaps are apparent for the stated cybersecurity purpose.

CVE Search

Input Schema

Output Schema

Schema Changelog

TDQS

Glama MCP Gateway

TDQS

Resources