Previous value: -"array"New value: +[
+  "array",
+  "null"
+]

Previous value: -"object"New value: +[
+  "object",
+  "null"
+]

Previous value: -"object"New value: +"array"

Previous value: -nullNew value: +{
+  "properties": {
+    "result": {
+      "properties": {
+        "cves_by_tech": {
+          "type": "object"
+        },
+        "domain": {
+          "type": "string"
+        },
+        "exploit_findings": {
+          "type": "array"
+        },
+        "kev_findings": {
+          "type": "array"
+        },
+        "next_calls": {
+          "type": "object"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "technologies": {
+          "type": "object"
+        },
+        "verdict": {
+          "type": "object"
+        }
+      },
+      "required": [
+        "domain",
+        "technologies",
+        "summary"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "result"
+  ],
+  "type": "object"
+}

Previous value: -{
-  "$defs": {
-    "ErrorDetail": {
-      "properties": {
-        "code": {
-          "enum": [
-            "invalid_argument",
-            "not_found",
-            "rate_limit_exceeded",
-            "auth_required",
-            "tier_limit",
-            "upstream_timeout",
-            "upstream_error",
-            "internal_error"
-          ],
-          "type": "string"
-        },
-        "docs_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "message": {
-          "maxLength": 500,
-          "type": "string"
-        },
-        "retry_after_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "upgrade_url": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "code",
-        "message"
-      ],
-      "type": "object"
-    },
-    "ErrorResponse": {
-      "properties": {
-        "error": {
-          "$ref": "#/$defs/ErrorDetail"
-        }
-      },
-      "required": [
-        "error"
-      ],
-      "type": "object"
-    },
-    "PivotHint": {
-      "additionalProperties": true,
-      "properties": {
-        "input": {
-          "type": "string"
-        },
-        "params": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reason": {
-          "type": "string"
-        },
-        "tool": {
-          "enum": [
-            "cve_lookup",
-            "cve_search",
-            "cve_leading",
-            "bulk_cve_lookup",
-            "calculate_risk_score",
-            "get_cvss_details",
-            "exploit_lookup",
-            "kev_detail",
-            "cwe_lookup",
-            "subdomain_enum",
-            "ssl_check",
-            "tech_fingerprint",
-            "asn_lookup",
-            "ip_lookup",
-            "ioc_lookup",
-            "bulk_ioc_lookup",
-            "hash_lookup",
-            "threat_intel",
-            "threat_report",
-            "audit_domain",
-            "domain_report",
-            "dns_lookup",
-            "whois_lookup",
-            "wayback_lookup",
-            "scan_headers",
-            "check_headers",
-            "check_secrets",
-            "check_injection",
-            "check_dependencies",
-            "email_mx",
-            "email_security_posture",
-            "email_disposable",
-            "email_verify",
-            "robots_txt",
-            "redirect_chain",
-            "brand_assets",
-            "seo_audit",
-            "phone_lookup",
-            "username_lookup",
-            "password_check",
-            "phishing_check",
-            "atlas_technique_lookup",
-            "atlas_technique_search",
-            "bulk_atlas_technique_lookup",
-            "atlas_case_study_lookup",
-            "atlas_case_study_search",
-            "d3fend_defense_lookup",
-            "d3fend_defense_search",
-            "d3fend_defense_for_attack",
-            "d3fend_attack_coverage",
-            "sigma_rule_lookup",
-            "bulk_sigma_rule_lookup",
-            "tech_stack_cve_audit"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "tool",
-        "input",
-        "reason"
-      ],
-      "type": "object"
-    },
-    "TechStackCveAuditResponse": {
-      "additionalProperties": true,
-      "properties": {
-        "cves_by_tech": {
-          "additionalProperties": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "type": "object"
-        },
-        "domain": {
-          "type": "string"
-        },
-        "exploit_findings": {
-          "items": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "kev_findings": {
-          "items": {
-            "additionalProperties": true,
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "next_calls": {
-          "anyOf": [
-            {
-              "items": {
-                "$ref": "#/$defs/PivotHint"
-              },
-              "type": "array"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "summary": {
-          "type": "string"
-        },
-        "technologies": {
-          "additionalProperties": true,
-          "type": "object"
-        },
-        "verdict": {
-          "anyOf": [
-            {
-              "$ref": "#/$defs/Verdict"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        }
-      },
-      "required": [
-        "domain",
-        "technologies",
-        "summary"
-      ],
-      "type": "object"
-    },
-    "Verdict": {
-      "properties": {
-        "completeness": {
-          "enum": [
-            "complete",
-            "partial",
-            "minimal"
-          ],
-          "type": "string"
-        },
-        "data_age_seconds": {
-          "anyOf": [
-            {
-              "type": "integer"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "deterministic": {
-          "type": "boolean"
-        },
-        "falsifiable_fields": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_queried": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "sources_unavailable": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "deterministic"
-      ],
-      "type": "object"
-    }
-  },
-  "properties": {
-    "result": {
-      "anyOf": [
-        {
-          "$ref": "#/$defs/TechStackCveAuditResponse"
-        },
-        {
-          "$ref": "#/$defs/ErrorResponse"
-        }
-      ]
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "type": "object"
-}New value: +null

Removed value: -"Structured failure body. Codes mirror app/exceptions.AppException\nsubclasses; agent retry / upgrade decisions key off `code`, not `message`."

Removed value: -"Stable machine-readable failure category. Agents key retry/upgrade decisions off this."

Removed value: -"Code"

Removed value: -null

Removed value: -"Documentation pointer (e.g. tool input contract) when code='invalid_argument'."

Removed value: -"Docs Url"

Removed value: -"Human-readable detail. Free text — never parse. Capped at 500 chars to prevent oversized upstream errors from bloating responses."

Removed value: -"Message"

Removed value: -null

Removed value: -"When code='rate_limit_exceeded', the minimum seconds to wait before retrying."

Removed value: -"Retry After Seconds"

Removed value: -null

Removed value: -"Pricing/upgrade URL when code='tier_limit' or 'rate_limit_exceeded' on the Free tier."

Removed value: -"Upgrade Url"

Removed value: -"ErrorDetail"

Removed value: -"MCP error envelope. Tool return type is always\n`SpecificResponse | ErrorResponse` — Union flag tells the agent which arm\narrived without parsing the inner body."

Removed value: -"ErrorResponse"

Removed value: -"A suggested follow-up MCP tool call. Surfaced inside response.next_calls so\nLLM agents can chain related lookups without manual prompting. Each hint names\nthe tool, the input value to pass, and a short reason explaining why this\npivot adds value in the current context."

Removed value: -"Suggested input value to pass to the tool — typically a CVE ID, CWE ID, domain, or IP. Pre-populated from the current response so the agent can call the next tool without re-deriving the argument."

Removed value: -"Input"

Removed value: -null

Removed value: -"Optional extra kwargs to pass alongside `input`. Used by pivot generators when the next call benefits from a secondary parameter, e.g. {'exclude_id': 'AML.T0051'} to skip the originating technique from a sibling-tactic search. Omitted when no extra args are needed."

Removed value: -"Params"

Removed value: -"Short rationale (one sentence) for why this follow-up call adds value, e.g. 'Federal patch deadline + ransomware association', 'Public exploits / PoC availability'."

Removed value: -"Reason"

Removed value: -"Canonical MCP tool name to call next. Constrained to known operation_ids in tools/list — adding a new tool here requires expanding the Literal."

Removed value: -"Tool"

Removed value: -"PivotHint"

Removed value: -"Response envelope for the MCP-only composite `tech_stack_cve_audit`.\n\nCombines technology fingerprint, per-tech CVE candidates, KEV matches,\nand exploit findings in a single agentic response. No tier gating — all\nfields (including `exploit_findings`) are sourced from local DB mirrors\nand are always present on the wire for every tier."

Removed value: -"Map of `name/version` → list of CVE IDs for that product."

Removed value: -"Cves By Tech"

Removed value: -"Normalized input domain (clean_domain applied)."

Removed value: -"Domain"

Removed value: -"Public exploit / PoC availability per matched CVE (local ExploitDB mirror). Always present; empty list when none found."

Removed value: -"Exploit Findings"

Removed value: -"CISA KEV records for matched CVEs. Empty when no KEV matches."

Removed value: -"Kev Findings"

Removed value: -null

Removed value: -"Suggested follow-up MCP tool calls. Ordered by relevance; agents should chain these without re-prompting the user."

Removed value: -"Next Calls"

Removed value: -"Human-readable triage summary — N techs, M CVEs, K KEV-listed."

Removed value: -"Summary"

Removed value: -"Tech fingerprint payload — {technologies, categories, count, summary}."

Removed value: -"Technologies"

Removed value: -null

Removed value: -"Falsifiability metadata: sources_queried, sources_unavailable, completeness, deterministic flag. Lets agents distinguish 'no data' from 'source failed' without re-running the call."

Removed value: -"TechStackCveAuditResponse"

Removed value: -"complete"

Removed value: -"'complete' = every planned source returned data; 'partial' = at least one source in sources_unavailable failed or was skipped; 'minimal' = only the primary/required source returned, optional enrichment missing."

Removed value: -"Completeness"

Removed value: -null

Removed value: -"Seconds elapsed since the oldest cached source was fetched, or null when every source was queried live for this request. Use to judge freshness."

Removed value: -"Data Age Seconds"

Removed value: -"True when the response is fully reproducible from the listed sources for the same input at the same moment (no randomness, no model inference). False for endpoints that include probabilistic scoring or LLM output."

Removed value: -"Deterministic"

Removed value: -"Top-level response fields whose values a caller can independently re-derive from the named upstream sources (e.g. 'dns', 'ssl', 'whois'). Fields not in this list are derived/computed and cannot be directly re-verified."

Removed value: -"Falsifiable Fields"

Removed value: -"Canonical source identifiers successfully consulted for this response (e.g. 'ripe_stat', 'shodan_internetdb', 'firehol'). Agent-readable list, order not significant."

Removed value: -"Sources Queried"

Removed value: -"Sources that were expected but not returned — either intentionally skipped (lite mode, tier gating) or failed (quota, timeout, upstream down). Empty list means every planned source produced data."

Removed value: -"Sources Unavailable"

Removed value: -"Verdict"

Removed value: -"Result"

Removed value: -"tech_stack_cve_auditOutput"

Previous value: -"Response envelope for the MCP-only composite `tech_stack_cve_audit`.\n\nCombines technology fingerprint, per-tech CVE candidates, KEV matches,\nand (Pro-only) exploit findings in a single agentic response. Free tier\ndrops `exploit_findings` entirely (field absent, not None) via the\n`_serialize_drop_none_exploit_findings` model serializer below."New value: +"Response envelope for the MCP-only composite `tech_stack_cve_audit`.\n\nCombines technology fingerprint, per-tech CVE candidates, KEV matches,\nand exploit findings in a single agentic response. No tier gating — all\nfields (including `exploit_findings`) are sourced from local DB mirrors\nand are always present on the wire for every tier."

Removed value: -[
-  {
-    "items": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "type": "array"
-  },
-  {
-    "type": "null"
-  }
-]

Removed value: -null

Previous value: -"Pro tier only: public exploit / PoC availability per CVE. Absent on Free."New value: +"Public exploit / PoC availability per matched CVE (local ExploitDB mirror). Always present; empty list when none found."

Added value: +{
+  "additionalProperties": true,
+  "type": "object"
+}

Added value: +"array"