{ "openapi": "3.1.1", "info": { "title": "Security & supply-chain explorers API", "version": "1.0.0", "summary": "Deterministic tools for people and AI agents.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://security.usefulweb.site" } ], "paths": { "/api/v1/tools": { "get": { "operationId": "listTools", "summary": "Catalog of all tools", "responses": { "200": { "description": "Tool list.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/api/v1/tools/{id}": { "get": { "operationId": "getTool", "summary": "Definition of one tool", "parameters": [ { "in": "path", "name": "id", "required": true, "schema": { "type": "string", "enum": [ "artifact-provenance-explorer", "container-image-explorer", "cve-relationship-graph", "dependency-vulnerability-explorer", "oauth-permission-explorer", "open-source-trust-explorer", "package-ecosystem-graph", "sbom-explorer", "security-advisory-timeline", "security-configuration-scanner" ] } } ], "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } }, "404": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/artifact-provenance-explorer/calculate": { "post": { "operationId": "calculateArtifactProvenanceExplorer", "summary": "Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.", "description": "Fetches (or reads pasted) npm registry attestations for a package version, verifies the Sigstore bundles with node:crypto (DSSE signature, Fulcio certificate chain to the pinned Sigstore root, Rekor signed entry timestamp, Merkle inclusion proof and checkpoint), parses the SLSA provenance (builder, workflow, source repository, commit, trigger) and cross-checks it against the package metadata (repository field, gitHead, tarball integrity).\n\nMethodology:\n- Attestations come from https://registry.npmjs.org/-/npm/v1/attestations/@ (or your paste); package metadata from https://registry.npmjs.org//.\n- Each Sigstore bundle is verified locally with node:crypto: the DSSE signature over the pre-authentication encoding (PAE); for provenance the Fulcio leaf certificate must chain to the pinned public-good Sigstore intermediate and root and be valid at the Rekor integratedTime; the publish attestation must be signed by a pinned npm registry key.\n- Transparency: the Rekor signed entry timestamp (SET) and checkpoint are verified against the pinned rekor.sigstore.dev key, the RFC 6962 Merkle inclusion proof must recompute the logged root hash, and the log entry must record the SHA-256 of this exact payload.\n- Cross-checks: in-toto subject = pkg:npm/@; subject SHA-512 = the registry tarball integrity; provenance repository = package.json repository; provenance commit = gitHead; Fulcio certificate extensions (source repository, digest, workflow) = the provenance claims.\n- Trust roots (npm keys, Rekor key, Fulcio certificates) are pinned snapshots from 2026-10-14, not refreshed via Sigstore TUF; rotated keys therefore show as failures, not as forgeries.", "tags": [ "security" ], "x-mcp-tool": "artifact_provenance_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactProvenanceExplorerInput" }, "examples": { "example1": { "summary": "Pasted attestations for sigstore@3.0.0 (offline)", "value": { "attestations": "{\"attestations\":[{\"predicateType\":\"https://github.com/npm/attestation/tree/main/specs/publish/v0.1\",\"bundle\":{\"mediaType\":\"application/vnd.dev.sigstore.bundle+json;version=0.2\",\"verificationMaterial\":{\"publicKey\":{\"hint\":\"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA\"},\"tlogEntries\":[{\"logIndex\":\"139985246\",\"logId\":{\"keyId\":\"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\"},\"kindVersion\":{\"kind\":\"intoto\",\"version\":\"0.0.2\"},\"integratedTime\":\"1728922429\",\"inclusionPromise\":{\"signedEntryTimestamp\":\"MEUCIQCPv6SdeeKeVR0qcmXMuRzhh/zvFcX/f9b7BABIS/m9oQIgTS6Ux+yB+ljKWDMcbEFbEUJD63yiUw0W9R29RRKR630=\"},\"inclusionProof\":{\"logIndex\":\"18080984\",\"rootHash\":\"3QgSU4Sc5SaBpOIdtK7rq7YVvUIJa9ffmOBQJfAQ5No=\",\"treeSize\":\"18080985\",\"hashes\":[\"1VqcNP+E3GU18mbDgJETsYPoJoPiBbklVeJL1pT1cEU=\",\"TeoPJKP5nSkHigJeomgyX9aZZoddHPj9jYR2XBUXPmY=\",\"HYGE0qSPvaESM2IDQSij67KLAB+szi1KVxV/Rs/4oao=\",\"r5Dfj7qJpQin2WUzTTguka3V50Bo0mAIFHd3M/J1m/A=\",\"cj+mVHbPlEBj7SJvZUjTJ8GkBUjsTGRxO06+EhHpJI0=\",\"BjFsBrJyNhKTEH8w+f2KSzUI3erf7mABm3Xr99SHEn0=\",\"CrflNtVzHLcNx9sn8RoxU3TY97achLRHZbZywxnnJ8o=\",\"b3n5wXbbRN5E/WP1khHFeMJvwBNMYl7/pbbqIlmnA9k=\",\"pApK2lHZXMFTp32RUjqXhUaDn5VreViydgGWY2r35G8=\",\"7LYCkPo3kGZ6HBsTTt82Y2+LSJb6pYZspK4VhzDvQvA=\",\"rAAfgmPXo8TJp1LmkVDhAYrf0WzE4X4/mDuW1pwVM3Y=\",\"gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw=\"],\"checkpoint\":{\"envelope\":\"rekor.sigstore.dev - 1193050959916656506\\n18080985\\n3QgSU4Sc5SaBpOIdtK7rq7YVvUIJa9ffmOBQJfAQ5No=\\n\\n— rekor.sigstore.dev wNI9ajBGAiEAwmhqxQCnAv0coCsInw/SWm9h46zL6f0/o4tDrPu7uOICIQD/DsMW0cIMG0lNfqFtXBcl23j7YhsqIQudE5RSlyElRw==\\n\"}},\"canonicalizedBody\":\"eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7ImtleWlkIjoiU0hBMjU2OmpsM2J3c3d1ODBQampva0NnaDBvMnc1YzJVNExoUUFFNTdnajljejFrekEiLCJwdWJsaWNLZXkiOiJMUzB0TFMxQ1JVZEpUaUJRVlVKTVNVTWdTMFZaTFMwdExTMEtUVVpyZDBWM1dVaExiMXBKZW1vd1EwRlJXVWxMYjFwSmVtb3dSRUZSWTBSUlowRkZNVTlzWWpONlRVRkdSbmhZUzBocFNXdFJUelZqU2pOWmFHdzFhVFpWVUhBclNXaDFkR1ZDU21KMVNHTkJOVlZ2WjB0dk1FVlhkR3hYZDFjMlMxTmhTMjlVVGtWWlREZEtiRU5SYVZadWEyaENhM1JWWjJjOVBRb3RMUzB0TFVWT1JDQlFWVUpNU1VNZ1MwVlpMUzB0TFMwPSIsInNpZyI6IlRVVlZRMGxHV0d0TE0xSlNjVzVqWW1FdmRVNW9iRmhEUzFaeVVIRjFjMnRCYjBSdU1YcERNamczSzBWdGNtRXlRV2xGUVc1Q05WWndaMHhDZVhNMFV6VnNWRUUyVm5od2RGaHZSbFpLU0drMlIwaENPVGRHUzI4MmFXWTJUVWs5In1dfSwiaGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA2YWE0ZTYwMWYzMjc2ODMyODg0MjAzYTlhMmI3Nzg0NGQ0ZWUzZmRiMGY3NWE0NjA3ODQ5MzE0Y2I4N2QwYWEifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0MzMxZWIxMGI2ZjE4NDM3ZjZkYWM2OTdmN2Q3NWEyMGZjZjZlZWI5N2FmODRmMDAyZDIxYTkzYmUyOTk3YzdkIn19fX0=\"}],\"timestampVerificationData\":{\"rfc3161Timestamps\":[]}},\"dsseEnvelope\":{\"payload\":\"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInN1YmplY3QiOlt7Im5hbWUiOiJwa2c6bnBtL3NpZ3N0b3JlQDMuMC4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjNjNzMyMjdlMTg3NzEwZGUyNWEwYzcwNzBiM2VhNWRlZmZlNWJiMzgxM2RmMzZiZWY1ZmYyY2I5YjFhMDc4YzM2MzZjOThmMzFmODIyM2ZkOGExN2RjNmJlZWZhNDZhOGI4OTQ0ODk1NTc1MzFjNzA5MTEwMDBkODdmZTY2ZDc4In19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ucG0vYXR0ZXN0YXRpb24vdHJlZS9tYWluL3NwZWNzL3B1Ymxpc2gvdjAuMSIsInByZWRpY2F0ZSI6eyJuYW1lIjoic2lnc3RvcmUiLCJ2ZXJzaW9uIjoiMy4wLjAiLCJyZWdpc3RyeSI6Imh0dHBzOi8vcmVnaXN0cnkubnBtanMub3JnIn19\",\"payloadType\":\"application/vnd.in-toto+json\",\"signatures\":[{\"sig\":\"MEUCIFXkK3RRqncba/uNhlXCKVrPquskAoDn1zC287+Emra2AiEAnB5VpgLBys4S5lTA6VxptXoFVJHi6GHB97FKo6if6MI=\",\"keyid\":\"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA\"}]}},\"signedAccessSignatureUrl\":\"\"},{\"predicateType\":\"https://slsa.dev/provenance/v1\",\"bundle\":{\"mediaType\":\"application/vnd.dev.sigstore.bundle+json;version=0.2\",\"verificationMaterial\":{\"x509CertificateChain\":{\"certificates\":[{\"rawBytes\":\"MIIGtTCCBjugAwIBAgIUFZbCpi3CDAWvgrLHxtg1Y7uuzmUwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQxMDE0MTYxMzQ1WhcNMjQxMDE0MTYyMzQ1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEf1geHKJmqtJp8PDuLWzA/2kUwTWxIQZuDpBv+oyuT7r/Ja7Ro8kGEQrJ/DBFSpT/npc35Pk3LmmRylyYoedRt6OCBVowggVWMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUmohazNhKN4gAImBmQV8TTMyBpeswHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYwYDVR0RAQH/BFkwV4ZVaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWpzLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMBIGCisGAQQBg78wAQIEBHB1c2gwNgYKKwYBBAGDvzABAwQoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAVBgorBgEEAYO/MAEEBAdSZWxlYXNlMCIGCisGAQQBg78wAQUEFHNpZ3N0b3JlL3NpZ3N0b3JlLWpzMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wZQYKKwYBBAGDvzABCQRXDFVodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMwOAYKKwYBBAGDvzABDQQqDCgzYTU3YTc0MWJmYjlmN2MzYmNhNjliNjNlMTcwZmMyOGU5NDMyZTY5MB8GCisGAQQBg78wAQ4EEQwPcmVmcy9oZWFkcy9tYWluMBkGCisGAQQBg78wAQ8ECwwJNDk1NTc0NTU1MCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlMBgGCisGAQQBg78wAREECgwINzEwOTYzNTMwZQYKKwYBBAGDvzABEgRXDFVodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAUBgorBgEEAYO/MAEUBAYMBHB1c2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvYWN0aW9ucy9ydW5zLzExMzMxMjkwMzg3L2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwgYkGCisGAQQB1nkCBAIEewR5AHcAdQDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAZKLzphoAAAEAwBGMEQCIHQ9LL9LECgBdY6bClnXOGR7hznz7bzwEz0gPvFmanWuAiBeeN3h0wium7ANLgDTBsFqY/df2Op54BC9EAtias1ZJjAKBggqhkjOPQQDAwNoADBlAjEA2bLa8wNOQQ43ANDZOFJ85DDyn4DaFWQFjoWlQP3RFIYQ9WDD4a5km9mVxQ9og82+AjApsAV76yLFvmDXHiOHNptbeDageiM1/nWekZZJj1Cix43RclqCNu0Q4+fNKeqlrnU=\"}]},\"tlogEntries\":[{\"logIndex\":\"139985224\",\"logId\":{\"keyId\":\"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\"},\"kindVersion\":{\"kind\":\"intoto\",\"version\":\"0.0.2\"},\"integratedTime\":\"1728922425\",\"inclusionPromise\":{\"signedEntryTimestamp\":\"MEUCICdHXEjie6kN9q31KFPR+3uU0aoV7DrM3MQfhyU0USvSAiEAnu7lzyeQLrbqYXO7aXR2vxWctF1qYSR4y8ErAlDI59I=\"},\"inclusionProof\":{\"logIndex\":\"18080962\",\"rootHash\":\"fM8KxP/V5eJtk7Dsf1sQAGWiC/L3QYumuzrRdhTc6Qc=\",\"treeSize\":\"18080963\",\"hashes\":[\"Z5LqT/yzIYCvllsIhcpuwWgMS7NOP/fXUhZce4z17hE=\",\"HYGE0qSPvaESM2IDQSij67KLAB+szi1KVxV/Rs/4oao=\",\"r5Dfj7qJpQin2WUzTTguka3V50Bo0mAIFHd3M/J1m/A=\",\"cj+mVHbPlEBj7SJvZUjTJ8GkBUjsTGRxO06+EhHpJI0=\",\"BjFsBrJyNhKTEH8w+f2KSzUI3erf7mABm3Xr99SHEn0=\",\"CrflNtVzHLcNx9sn8RoxU3TY97achLRHZbZywxnnJ8o=\",\"b3n5wXbbRN5E/WP1khHFeMJvwBNMYl7/pbbqIlmnA9k=\",\"pApK2lHZXMFTp32RUjqXhUaDn5VreViydgGWY2r35G8=\",\"7LYCkPo3kGZ6HBsTTt82Y2+LSJb6pYZspK4VhzDvQvA=\",\"rAAfgmPXo8TJp1LmkVDhAYrf0WzE4X4/mDuW1pwVM3Y=\",\"gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw=\"],\"checkpoint\":{\"envelope\":\"rekor.sigstore.dev - 1193050959916656506\\n18080963\\nfM8KxP/V5eJtk7Dsf1sQAGWiC/L3QYumuzrRdhTc6Qc=\\n\\n— rekor.sigstore.dev wNI9ajBEAiBSSvf+ycholemEa7s9BZU1/y3ydkVbkeEESu61+iXtZQIgQmmlIGuzYrjIruUdMqYQCUzXOpQ34ldW2vD3gebXi40=\\n\"}},\"canonicalizedBody\":\"eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7InB1YmxpY0tleSI6IkxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVWQwVkVORFFtcDFaMEYzU1VKQlowbFZSbHBpUTNCcE0wTkVRVmQyWjNKTVNIaDBaekZaTjNWMWVtMVZkME5uV1VsTGIxcEplbW93UlVGM1RYY0tUbnBGVmsxQ1RVZEJNVlZGUTJoTlRXTXliRzVqTTFKMlkyMVZkVnBIVmpKTlVqUjNTRUZaUkZaUlVVUkZlRlo2WVZka2VtUkhPWGxhVXpGd1ltNVNiQXBqYlRGc1drZHNhR1JIVlhkSWFHTk9UV3BSZUUxRVJUQk5WRmw0VFhwUk1WZG9ZMDVOYWxGNFRVUkZNRTFVV1hsTmVsRXhWMnBCUVUxR2EzZEZkMWxJQ2t0dldrbDZhakJEUVZGWlNVdHZXa2w2YWpCRVFWRmpSRkZuUVVWbU1XZGxTRXRLYlhGMFNuQTRVRVIxVEZkNlFTOHlhMVYzVkZkNFNWRmFkVVJ3UW5ZS0syOTVkVlEzY2k5S1lUZFNiemhyUjBWUmNrb3ZSRUpHVTNCVUwyNXdZek0xVUdzelRHMXRVbmxzZVZsdlpXUlNkRFpQUTBKV2IzZG5aMVpYVFVFMFJ3cEJNVlZrUkhkRlFpOTNVVVZCZDBsSVowUkJWRUpuVGxaSVUxVkZSRVJCUzBKblozSkNaMFZHUWxGalJFRjZRV1JDWjA1V1NGRTBSVVpuVVZWdGIyaGhDbnBPYUV0T05HZEJTVzFDYlZGV09GUlVUWGxDY0dWemQwaDNXVVJXVWpCcVFrSm5kMFp2UVZVek9WQndlakZaYTBWYVlqVnhUbXB3UzBaWGFYaHBORmtLV2tRNGQxbDNXVVJXVWpCU1FWRklMMEpHYTNkV05GcFdZVWhTTUdOSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRETk9jRm96VGpCaU0wcHNURE5PY0FwYU0wNHdZak5LYkV4WGNIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjMkl6WkhwTU0wcHNZa2RXYUdNeVZYVmxWekZ6VVVoS2JGcHVUWFpoUjFab0NscElUWFppVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQUtZVWhXYVdSWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVSkpSME5wYzBkQlVWRkNaemM0ZDBGUlNVVkNTRUl4WXpKbmQwNW5XVXRMZDFsQ1FrRkhSQXAyZWtGQ1FYZFJiMDB5UlRGT01rVXpUa1JHYVZwdFNUVmFhbVJxVFRKS2FsbFVXVFZaYWxsNldsUkZNMDFIV21wTmFtaHNUMVJSZWsxdFZUSlBWRUZXQ2tKbmIzSkNaMFZGUVZsUEwwMUJSVVZDUVdSVFdsZDRiRmxZVG14TlEwbEhRMmx6UjBGUlVVSm5OemgzUVZGVlJVWklUbkJhTTA0d1lqTktiRXd6VG5BS1dqTk9NR0l6U214TVYzQjZUVUl3UjBOcGMwZEJVVkZDWnpjNGQwRlJXVVZFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFUZENaMjl5UW1kRlJRcEJXVTh2VFVGRlNVSkRNRTFMTW1nd1pFaENlazlwT0haa1J6bHlXbGMwZFZsWFRqQmhWemwxWTNrMWJtRllVbTlrVjBveFl6SldlVmt5T1hWa1IxWjFDbVJETldwaU1qQjNXbEZaUzB0M1dVSkNRVWRFZG5wQlFrTlJVbGhFUmxadlpFaFNkMk42YjNaTU1tUndaRWRvTVZscE5XcGlNakIyWXpKc2JtTXpVbllLWTIxVmRtTXliRzVqTTFKMlkyMVZkR0Z1VFhaTWJXUndaRWRvTVZscE9UTmlNMHB5V20xNGRtUXpUWFpqYlZaeldsZEdlbHBUTlRWaVYzaEJZMjFXYlFwamVUbHZXbGRHYTJONU9YUlpWMngxVFVSblIwTnBjMGRCVVZGQ1p6YzRkMEZSYjBWTFozZHZUVEpGTVU0eVJUTk9SRVpwV20xSk5WcHFaR3BOTWtwcUNsbFVXVFZaYWxsNldsUkZNMDFIV21wTmFtaHNUMVJSZWsxdFZUSlBWRUZrUW1kdmNrSm5SVVZCV1U4dlRVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOEtZak5PTUZwWFVYZE9kMWxMUzNkWlFrSkJSMFIyZWtGQ1JFRlJjRVJEWkc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFpqTW14dVl6TlNkZ3BqYlZWMll6SnNibU16VW5aamJWVjBZVzVOZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFVVZGeFJFTm5lbGxVVlROWlZHTXdUVmRLYlZscWJHMU9NazE2Q2xsdFRtaE9hbXhwVG1wT2JFMVVZM2RhYlUxNVQwZFZOVTVFVFhsYVZGazFUVUk0UjBOcGMwZEJVVkZDWnpjNGQwRlJORVZGVVhkUVkyMVdiV041T1c4S1dsZEdhMk41T1hSWlYyeDFUVUpyUjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZEZDNkS1RrUnJNVTVVWXpCT1ZGVXhUVU56UjBOcGMwZEJVVkZDWnpjNGR3cEJVa0ZGU0ZGM1ltRklVakJqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3elRuQmFNMDR3WWpOS2JFMUNaMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZDa05uZDBsT2VrVjNUMVJaZWs1VVRYZGFVVmxMUzNkWlFrSkJSMFIyZWtGQ1JXZFNXRVJHVm05a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFlLWXpKc2JtTXpVblpqYlZWMll6SnNibU16VW5aamJWVjBZVzVOZGt4dFpIQmtSMmd4V1drNU0ySXpTbkphYlhoMlpETk5kbU50Vm5OYVYwWjZXbE0xTlFwaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkpOUlV0bmQyOU5Na1V4VGpKRk0wNUVSbWxhYlVrMUNscHFaR3BOTWtwcVdWUlpOVmxxV1hwYVZFVXpUVWRhYWsxcWFHeFBWRkY2VFcxVk1rOVVRVlZDWjI5eVFtZEZSVUZaVHk5TlFVVlZRa0ZaVFVKSVFqRUtZekpuZDFkM1dVdExkMWxDUWtGSFJIWjZRVUpHVVZKT1JFVjBiMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RtTXliRzVqTTFKMlkyMVZkZ3BqTW14dVl6TlNkbU50VlhSaGJrMTJXVmRPTUdGWE9YVmplVGw1WkZjMWVreDZSWGhOZWsxNFRXcHJkMDE2WnpOTU1rWXdaRWRXZEdOSVVucE1la1YzQ2tabldVdExkMWxDUWtGSFJIWjZRVUpHWjFGSlJFRmFkMlJYU25OaFYwMTNaMWxyUjBOcGMwZEJVVkZDTVc1clEwSkJTVVZsZDFJMVFVaGpRV1JSUkdRS1VGUkNjWGh6WTFKTmJVMWFTR2g1V2xwNlkwTnZhM0JsZFU0ME9ISm1LMGhwYmt0QlRIbHVkV3BuUVVGQldrdE1lbkJvYjBGQlFVVkJkMEpIVFVWUlF3cEpTRkU1VEV3NVRFVkRaMEprV1RaaVEyeHVXRTlIVWpkb2VtNTZOMko2ZDBWNk1HZFFka1p0WVc1WGRVRnBRbVZsVGpOb01IZHBkVzAzUVU1TVowUlVDa0p6Um5GWkwyUm1Nazl3TlRSQ1F6bEZRWFJwWVhNeFdrcHFRVXRDWjJkeGFHdHFUMUJSVVVSQmQwNXZRVVJDYkVGcVJVRXlZa3hoT0hkT1QxRlJORE1LUVU1RVdrOUdTamcxUkVSNWJqUkVZVVpYVVVacWIxZHNVVkF6VWtaSldWRTVWMFJFTkdFMWEyMDViVlo0VVRsdlp6Z3lLMEZxUVhCelFWWTNObmxNUmdwMmJVUllTR2xQU0U1d2RHSmxSR0ZuWldsTk1TOXVWMlZyV2xwS2FqRkRhWGcwTTFKamJIRkRUblV3VVRRclprNUxaWEZzY201VlBRb3RMUzB0TFVWT1JDQkRSVkpVU1VaSlEwRlVSUzB0TFMwdCIsInNpZyI6IlRVVlJRMGxJUzJkTkszUTViMmhUY1RSMkt6RjBlVXRVYmpCTFRrNUhkVXhYUVVrNWFFMDJORXRsWkdVd1EyeHRRV2xDYlZRelJtUkxWMEY2WkRaNWIweENkVFEwVldrNVdrMWxPRnBGWW5NeU9IZEVWMVZ1V0cxbVVXVnlaejA5In1dfSwiaGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgxMWU2OGM0YjNlYjFmYjRiZjc4Y2ZhMWEzYTUxYzFjMjE4MmM0ZWMxZTU0M2VlZDdmODM2YzMwMTk4ODMwMmMifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhMTU0MDliZjRhYTIwYjdlOTNlM2FhZmJlMzllMTE3MDVlZTAyYzIxM2Q3N2M5YzQ1YzE3Y2JlZDM5YzMyMzhhIn19fX0=\"}],\"timestampVerificationData\":{\"rfc3161Timestamps\":[]}},\"dsseEnvelope\":{\"payload\":\"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS9zaWdzdG9yZUAzLjAuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIzYzczMjI3ZTE4NzcxMGRlMjVhMGM3MDcwYjNlYTVkZWZmZTViYjM4MTNkZjM2YmVmNWZmMmNiOWIxYTA3OGMzNjM2Yzk4ZjMxZjgyMjNmZDhhMTdkYzZiZWVmYTQ2YThiODk0NDg5NTU3NTMxYzcwOTExMDAwZDg3ZmU2NmQ3OCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qcyIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbCJ9fSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoicHVzaCIsInJlcG9zaXRvcnlfaWQiOiI0OTU1NzQ1NTUiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiNzEwOTYzNTMifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWpzQHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiIzYTU3YTc0MWJmYjlmN2MzYmNhNjliNjNlMTcwZmMyOGU5NDMyZTY5In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qcy9hY3Rpb25zL3J1bnMvMTEzMzEyOTAzODcvYXR0ZW1wdHMvMSJ9fX19\",\"payloadType\":\"application/vnd.in-toto+json\",\"signatures\":[{\"sig\":\"MEQCIHKgM+t9ohSq4v+1tyKTn0KNNGuLWAI9hM64Kede0ClmAiBmT3FdKWAzd6yoLBu44Ui9ZMe8ZEbs28wDWUnXmfQerg==\",\"keyid\":\"\"}]}},\"signedAccessSignatureUrl\":\"\"}]}", "packageMetadata": "{\n \"name\": \"sigstore\",\n \"version\": \"3.0.0\",\n \"repository\": {\n \"url\": \"git+https://github.com/sigstore/sigstore-js.git\",\n \"type\": \"git\"\n },\n \"gitHead\": \"3a57a741bfb9f7c3bca69b63e170fc28e9432e69\",\n \"dist\": {\n \"integrity\": \"sha512-PHMifhh3EN4loMcHCz6l3v/luzgT3za+9f8subGgeMNjbJjzH4Ij/YoX3Gvu+kaouJRIlVdTHHCREADYf+ZteA==\",\n \"tarball\": \"https://registry.npmjs.org/sigstore/-/sigstore-3.0.0.tgz\",\n \"attestations\": {\n \"url\": \"https://registry.npmjs.org/-/npm/v1/attestations/sigstore@3.0.0\",\n \"provenance\": {\n \"predicateType\": \"https://slsa.dev/provenance/v1\"\n }\n }\n }\n}" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactProvenanceExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/container-image-explorer/calculate": { "post": { "operationId": "calculateContainerImageExplorer", "summary": "Inspect a container image: platforms, layers, base image, root user, labels and cosign signature.", "description": "Reads an image straight from its registry (Docker Hub, GHCR, Quay or any OCI registry with anonymous pull): the index and per-platform manifests, layer sizes, digest, and the config blob (creation date, user, environment variable names, OCI labels such as source and revision, build history). Flags root user, likely secrets in env / build args, end-of-life base distributions, missing provenance labels and whether a cosign signature is published.\n\nMethodology:\n- Registry access follows the Docker / OCI distribution token flow: an anonymous request is answered with a WWW-Authenticate Bearer challenge, a pull-scoped token is requested from the advertised realm (auth.docker.io, ghcr.io/token, …) and the request is retried. Only public images work.\n- GET /v2//manifests/ with OCI + Docker media types; for an index / manifest list the platforms are listed and the requested platform manifest is fetched. BuildKit attestation manifests (provenance / SBOM, platform unknown/unknown) are counted. The config blob is fetched by digest and its SHA-256 is checked against the manifest.\n- Cosign signatures are looked up by cosign's tag convention (sha256-.sig) for the image digest. Signatures stored only via the OCI referrers API or Sigstore bundles are not detected, and a found signature is not cryptographically verified here.\n- Root user: config.User empty, root or 0. Secrets: env names and build-arg names (from history \"RUN |n NAME=…\") matching password/secret/token/key patterns; values are never shown.\n- Base distribution is guessed from history, labels and env text and compared with an endoflife.date snapshot (2026-10-14). This tool does NOT scan layers for vulnerable packages — that needs a scanner such as Trivy or Grype run against the image.", "tags": [ "security" ], "x-mcp-tool": "container_image_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ContainerImageExplorerInput" }, "examples": { "example1": { "summary": "Pasted manifest + config of an illustrative Node app image (offline)", "value": { "manifestJson": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.oci.image.manifest.v1+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.oci.image.config.v1+json\",\n \"digest\": \"sha256:7db22f7fd3e9f15baca89f8609989af9e7f39dd33dc62fc1186370a7bc4c7ad8\",\n \"size\": 1588\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.oci.image.layer.v1.tar+gzip\",\n \"digest\": \"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"size\": 50450000\n },\n {\n \"mediaType\": \"application/vnd.oci.image.layer.v1.tar+gzip\",\n \"digest\": \"sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"size\": 39820000\n },\n {\n \"mediaType\": \"application/vnd.oci.image.layer.v1.tar+gzip\",\n \"digest\": \"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\",\n \"size\": 12300000\n }\n ]\n}", "configJson": "{\"architecture\":\"amd64\",\"os\":\"linux\",\"created\":\"2024-03-12T09:41:07Z\",\"config\":{\"Env\":[\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\"NODE_VERSION=18.19.1\",\"YARN_VERSION=1.22.19\",\"NODE_ENV=production\",\"SENTRY_DSN=https://public@sentry.example/1\"],\"Cmd\":[\"node\",\"server.js\"],\"WorkingDir\":\"/app\",\"ExposedPorts\":{\"3000/tcp\":{}},\"Labels\":{\"org.opencontainers.image.source\":\"https://github.com/example/shop-api\",\"org.opencontainers.image.revision\":\"9f2c1d7e4b5a\",\"org.opencontainers.image.base.name\":\"docker.io/library/node:18-buster\"}},\"rootfs\":{\"type\":\"layers\",\"diff_ids\":[\"sha256:1111111111111111111111111111111111111111111111111111111111111111\",\"sha256:2222222222222222222222222222222222222222222222222222222222222222\",\"sha256:3333333333333333333333333333333333333333333333333333333333333333\"]},\"history\":[{\"created\":\"2024-02-13T00:00:00Z\",\"created_by\":\"# debian.sh --arch 'amd64' out/ 'buster' '@1707782400'\",\"comment\":\"debuerreotype 0.15\"},{\"created\":\"2024-02-14T00:00:00Z\",\"created_by\":\"ENV NODE_VERSION=18.19.1\",\"empty_layer\":true},{\"created\":\"2024-02-14T00:00:00Z\",\"created_by\":\"RUN /bin/sh -c set -ex && curl -fsSLO https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-x64.tar.xz && tar -xJf node-v18.19.1-linux-x64.tar.xz -C /usr/local --strip-components=1\"},{\"created\":\"2024-03-12T09:41:05Z\",\"created_by\":\"WORKDIR /app\",\"empty_layer\":true},{\"created\":\"2024-03-12T09:41:07Z\",\"created_by\":\"RUN |1 NPM_TOKEN=npm_xxxxxxxx /bin/sh -c npm ci --omit=dev # buildkit\"},{\"created\":\"2024-03-12T09:41:07Z\",\"created_by\":\"CMD [\\\"node\\\" \\\"server.js\\\"]\",\"empty_layer\":true}]}" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ContainerImageExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/cve-relationship-graph/calculate": { "post": { "operationId": "calculateCveRelationshipGraph", "summary": "One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.", "description": "Looks up a vulnerability in OSV.dev and maps everything connected to it: alias IDs (CVE, GHSA, distro advisories), affected packages with their vulnerable version ranges and fixed versions, fix commits, references grouped into advisories, fixes, reports and exploits, whether CISA lists it as known-exploited (KEV) and its FIRST EPSS exploitation probability.\n\nMethodology:\n- The advisory is read from OSV.dev (https://api.osv.dev/v1/vulns/{id}); CVE records there often carry no package data, so up to 3 alias records (GHSA first) are fetched and merged.\n- Version ranges are rendered from OSV events (introduced / fixed / last_affected); GIT ranges become fix-commit nodes. Fixed versions are sorted numerically.\n- References are grouped by OSV type, refined with URL patterns: commits and pull requests = fix; NVD, GHSA, vendor PSIRT pages = advisory; issue trackers and mailing lists = report; Exploit-DB, Packet Storm and PoC repositories = exploit.\n- KEV membership is checked against the full CISA Known Exploited Vulnerabilities JSON feed; EPSS (probability of exploitation activity in the next 30 days) comes from api.first.org.\n- Severity is the source database rating when present, otherwise derived from the CVSS v3.x base score computed from the vector (FIRST formulas).", "tags": [ "security" ], "x-mcp-tool": "cve_relationship_graph", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CveRelationshipGraphInput" }, "examples": { "example1": { "summary": "Log4Shell from pasted OSV + KEV + EPSS (offline)", "value": { "osvJson": "{\n \"schema_version\": \"1.9.0\",\n \"id\": \"GHSA-jfh8-c2jp-5v3q\",\n \"modified\": \"2025-10-22T19:37:02.616807Z\",\n \"published\": \"2021-12-10T00:40:56Z\",\n \"aliases\": [\n \"CVE-2021-44228\"\n ],\n \"summary\": \"Remote code injection in Log4j\",\n \"details\": \"# Summary\\n\\nLog4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.\\n\\u2026(trimmed)\",\n \"severity\": [\n {\n \"type\": \"CVSS_V3\",\n \"score\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H\"\n }\n ],\n \"affected\": [\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.13.0\"\n },\n {\n \"fixed\": \"2.15.0\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.0-beta9\"\n },\n {\n \"fixed\": \"2.3.1\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.apache.logging.log4j:log4j-core\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.apache.logging.log4j/log4j-core\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"2.4\"\n },\n {\n \"fixed\": \"2.12.2\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.ops4j.pax.logging:pax-logging-log4j2\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"1.8.0\"\n },\n {\n \"fixed\": \"1.9.2\"\n }\n ]\n }\n ]\n },\n {\n \"package\": {\n \"name\": \"org.ops4j.pax.logging:pax-logging-log4j2\",\n \"ecosystem\": \"Maven\",\n \"purl\": \"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2\"\n },\n \"ranges\": [\n {\n \"type\": \"ECOSYSTEM\",\n \"events\": [\n {\n \"introduced\": \"1.10.0\"\n },\n {\n \"fixed\": \"1.10.8\"\n }\n ]\n }\n ]\n }\n ],\n \"references\": [\n {\n \"type\": \"ADVISORY\",\n \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-44228\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://github.com/apache/logging-log4j2/pull/608\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.debian.org/security/2021/dsa-5020\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://www.kb.cert.org/vuls/id/930724\"\n },\n {\n \"type\": \"ADVISORY\",\n \"url\": \"https://github.com/advisories/GHSA-7rjr-3q55-vv33\"\n },\n {\n \"type\": \"PACKAGE\",\n \"url\": \"https://github.com/apache/logging-log4j2\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://github.com/tangxiaofeng7/apache-log4j-poc\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://issues.apache.org/jira/browse/LOG4J2-3198\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"https://logging.apache.org/log4j/2.x/security.html\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html\"\n },\n {\n \"type\": \"WEB\",\n \"url\": \"http://www.openwall.com/lists/oss-security/2021/12/10/1\"\n }\n ],\n \"database_specific\": {\n \"cwe_ids\": [\n \"CWE-20\",\n \"CWE-400\",\n \"CWE-502\",\n \"CWE-917\"\n ],\n \"severity\": \"CRITICAL\",\n \"github_reviewed\": true,\n \"nvd_published_at\": \"2021-12-10T10:15:00Z\"\n }\n}", "kevJson": "{\n \"cveID\": \"CVE-2021-44228\",\n \"vendorProject\": \"Apache\",\n \"product\": \"Log4j2\",\n \"vulnerabilityName\": \"Apache Log4j2 Remote Code Execution Vulnerability\",\n \"dateAdded\": \"2021-12-10\",\n \"shortDescription\": \"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.\",\n \"requiredAction\": \"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.\",\n \"dueDate\": \"2021-12-24\",\n \"knownRansomwareCampaignUse\": \"Known\",\n \"forensicTriage\": \"No\",\n \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2021-44228\",\n \"cwes\": [\n \"CWE-20\",\n \"CWE-400\",\n \"CWE-502\"\n ]\n}", "epssJson": "{\"status\": \"OK\", \"status-code\": 200, \"version\": \"1.0\", \"access\": \"public\", \"total\": 1, \"offset\": 0, \"limit\": 100, \"data\": [{\"cve\": \"CVE-2021-44228\", \"epss\": \"0.999990000\", \"percentile\": \"1.000000000\", \"date\": \"2026-10-13\"}]}" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CveRelationshipGraphResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/dependency-vulnerability-explorer/calculate": { "post": { "operationId": "calculateDependencyVulnerabilityExplorer", "summary": "Known vulnerabilities in your dependencies, and the version that fixes each one.", "description": "Reads npm (package.json, package-lock.json), Python (requirements.txt), Go (go.mod), Rust (Cargo.lock) and PHP (composer.lock) manifests, or lines like npm:lodash@4.17.20, and checks every exact package version against OSV.dev, the open vulnerability database that aggregates GitHub Security Advisories, PyPA, RustSec, Go and more. For each finding: severity, aliases (CVE/GHSA), and the nearest fixed version. You can also look up a single advisory ID.\n\nMethodology:\n- Exact versions come from lockfiles and == pins; for version ranges (^1.2.0, >=2.0) the lower bound is checked and the package is marked exact=false.\n- Each package@version is sent to the OSV.dev querybatch API; details for up to 60 distinct advisories are fetched from /v1/vulns/{id}.\n- Severity is the advisory database rating (GHSA: LOW/MODERATE/HIGH/CRITICAL); the CVSS vector is shown when published. fixedIn = the lowest fixed release above your version for that package; upgradeTo = the highest of those across a package's advisories.\n- Advisories are matched by OSV's version ranges; withdrawn advisories are not returned by OSV.", "tags": [ "security" ], "x-mcp-tool": "dependency_vulnerability_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DependencyVulnerabilityExplorerInput" }, "examples": { "example1": { "summary": "Two outdated packages", "value": { "manifest": "npm:lodash@4.17.20\npypi:requests@2.19.0" } }, "example2": { "summary": "Look up an advisory", "value": { "vulnId": "GHSA-35jh-r3h4-6jhm" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DependencyVulnerabilityExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/oauth-permission-explorer/calculate": { "post": { "operationId": "calculateOauthPermissionExplorer", "summary": "What an OAuth consent request really allows: scopes, risky combinations and flow problems.", "description": "Paste OAuth scopes or a full authorization URL for Google, GitHub, Microsoft Graph, Slack or generic OpenID Connect. Every scope is explained from the provider's official documentation with a sensitivity rating; risky combinations (read + send mail, offline access to files, push code + delete repositories, CI workflow edits) and unsafe request settings (implicit flow, missing PKCE or state, plain-HTTP redirect) are flagged. Unknown scopes are listed, never guessed.\n\nMethodology:\n- Input is split on spaces/commas; a full URL is parsed for scope, user_scope (Slack), client_id, redirect_uri, response_type, prompt, access_type, code_challenge(_method), state and nonce.\n- Provider = your choice, else the authorization host (accounts.google.com, github.com, login.microsoftonline.com, slack.com), else the provider most scopes uniquely belong to. Microsoft Graph scopes match with or without the https://graph.microsoft.com/ prefix, case-insensitively.\n- Scope descriptions come from a curated dataset copied from each provider's official scope reference (URL per scope). Only scopes found on those pages are included; anything else is reported as unknown.\n- Sensitivity (low/medium/high/critical) is an editorial rating of what a leaked token could do; Google's own Non-sensitive/Sensitive/Restricted class and Microsoft's admin-consent flag are shown where documented.\n- Risky combinations are rules over capabilities (e.g. mail.read + mail.send, repo.write + repo.delete, offline + files.read). Flow checks follow RFC 9700 (OAuth 2.0 Security BCP) and RFC 7636 (PKCE).", "tags": [ "security" ], "x-mcp-tool": "oauth_permission_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthPermissionExplorerInput" }, "examples": { "example1": { "summary": "Google consent URL with Gmail + offline access", "value": { "request": "https://accounts.google.com/o/oauth2/v2/auth?client_id=123.apps.googleusercontent.com&redirect_uri=https%3A%2F%2Fapp.example%2Fcb&response_type=code&access_type=offline&prompt=consent&scope=openid%20email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.readonly%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fgmail.send&state=xyz", "provider": "auto" } }, "example2": { "summary": "GitHub token scopes", "value": { "request": "repo delete_repo workflow read:org", "provider": "github" } }, "example3": { "summary": "Microsoft Graph implicit flow", "value": { "request": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=abc&response_type=token&redirect_uri=http%3A%2F%2Fapp.example%2Fcb&scope=offline_access%20Mail.Send%20Files.ReadWrite.All%20User.Read", "provider": "auto" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthPermissionExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/open-source-trust-explorer/calculate": { "post": { "operationId": "calculateOpenSourceTrustExplorer", "summary": "Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.", "description": "For a GitHub repository or a package (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems) combines deps.dev data (versions, licences, advisories, SLSA provenance, OpenSSF Scorecard) with GitHub activity (last push, releases, contributors, archived status) into an explained maintenance score and a list of trust signals, including whether releases are signed.\n\nMethodology:\n- Packages: deps.dev /v3/systems/{system}/packages/{name} (all versions, default version, deprecation) and /versions/{version} (licences, advisories, SLSA provenance, linked source repository).\n- Repository: deps.dev /v3/projects/{github.com/owner/repo} (stars, licence, OpenSSF Scorecard checks) and the unauthenticated GitHub REST API (repo, latest releases, contributor count via the Link header of ?per_page=1&anon=1). GitHub allows 60 unauthenticated requests per hour per IP; when rate-limited the score uses deps.dev data only.\n- Maintenance score = sum of available components ÷ their maximum × 100: recent commits (25), recent release (20), Scorecard Maintained (15), contributors (15), Scorecard Code-Review (10), Security-Policy (5), licence (10). Missing components are left out rather than counted as zero; archived repositories are capped at 10.\n- Release signing: the Scorecard \"Signed-Releases\" check (signatures or provenance attached to the last releases; -1 = no releases inspected) plus deps.dev's record of SLSA provenance / attestations for the package version.", "tags": [ "security" ], "x-mcp-tool": "open_source_trust_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenSourceTrustExplorerInput" }, "examples": { "example1": { "summary": "expressjs/express from pasted deps.dev + GitHub data (offline)", "value": { "depsdevProject": "{\"projectKey\": {\"id\": \"github.com/expressjs/express\"}, \"openIssuesCount\": 236, \"starsCount\": 69643, \"forksCount\": 25224, \"license\": \"MIT\", \"description\": \"Fast, unopinionated, minimalist web framework for node.\", \"homepage\": \"https://expressjs.com\", \"scorecard\": {\"date\": \"2026-08-24T00:00:00Z\", \"repository\": {\"name\": \"github.com/expressjs/express\", \"commit\": \"023767fe9872e029271df1418f73401bff20ff40\"}, \"scorecard\": {\"version\": \"v5.5.1-0.20260815060127-d1fab88f5463\", \"commit\": \"d1fab88f54636ff366076edfc5c239f97b3c8e66\"}, \"checks\": [{\"name\": \"Maintained\", \"documentation\": {\"shortDescription\": \"Determines if the project is \\\"actively maintained\\\".\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained\"}, \"score\": 10, \"reason\": \"17 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10\", \"details\": []}, {\"name\": \"Code-Review\", \"documentation\": {\"shortDescription\": \"Determines if the project requires human code review before pull requests (aka merge requests) are merged.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review\"}, \"score\": 10, \"reason\": \"all changesets reviewed\", \"details\": []}, {\"name\": \"Packaging\", \"documentation\": {\"shortDescription\": \"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging\"}, \"score\": -1, \"reason\": \"packaging workflow not detected\", \"details\": [\"Warn: no GitHub/GitLab publishing workflow detected.\"]}, {\"name\": \"Dangerous-Workflow\", \"documentation\": {\"shortDescription\": \"Determines if the project's GitHub Action workflows avoid dangerous patterns.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow\"}, \"score\": 10, \"reason\": \"no dangerous workflow patterns detected\", \"details\": []}, {\"name\": \"Binary-Artifacts\", \"documentation\": {\"shortDescription\": \"Determines if the project has generated executable (binary) artifacts in the source repository.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts\"}, \"score\": 10, \"reason\": \"no binaries found in the repo\", \"details\": []}, {\"name\": \"Pinned-Dependencies\", \"documentation\": {\"shortDescription\": \"Determines if the project has declared and pinned the dependencies of its build process.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies\"}, \"score\": 6, \"reason\": \"dependency not pinned by hash detected -- score normalized to 6\", \"details\": [\"Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:40\", \"Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:72\", \"Warn: npmCommand not pinned by hash: .github/workflows/legacy.yml:56\", \"Info: 18 out of 18 GitHub-owned GitHubAction dependencies pinned\", \"Info: 3 out of 3 third-party GitHubAction dependencies pinned\", \"Info: 0 out of 3 npmCommand dependencies pinned\"]}, {\"name\": \"CII-Best-Practices\", \"documentation\": {\"shortDescription\": \"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices\"}, \"score\": 0, \"reason\": \"no effort to earn an OpenSSF best practices badge detected\", \"details\": []}, {\"name\": \"Token-Permissions\", \"documentation\": {\"shortDescription\": \"Determines if the project's workflows follow the principle of least privilege.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions\"}, \"score\": 10, \"reason\": \"GitHub workflow tokens follow principle of least privilege\", \"details\": [\"Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci.yml:93\", \"Warn: jobLevel 'checks' permission set to 'write': .github/workflows/ci.yml:94\", \"Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:32\", \"Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:33\", \"Info: jobLevel 'contents' permission set to 'read': .github/workflows/legacy.yml:77\", \"Warn: jobLevel 'checks' permission set to 'write': .github/workflows/legacy.yml:78\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:17\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:25\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/legacy.yml:19\", \"Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18\"]}, {\"name\": \"License\", \"documentation\": {\"shortDescription\": \"Determines if the project has defined a license.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license\"}, \"score\": 10, \"reason\": \"license file detected\", \"details\": [\"Info: project has a license file: LICENSE:0\", \"Info: FSF or OSI recognized license: MIT License: LICENSE:0\"]}, {\"name\": \"Fuzzing\", \"documentation\": {\"shortDescription\": \"Determines if the project uses fuzzing.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing\"}, \"score\": 0, \"reason\": \"project is not fuzzed\", \"details\": [\"Warn: no fuzzer integrations found\"]}, {\"name\": \"Signed-Releases\", \"documentation\": {\"shortDescription\": \"Determines if the project cryptographically signs release artifacts.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases\"}, \"score\": -1, \"reason\": \"no releases found\", \"details\": []}, {\"name\": \"Security-Policy\", \"documentation\": {\"shortDescription\": \"Determines if the project has published a security policy.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy\"}, \"score\": 10, \"reason\": \"security policy file detected\", \"details\": [\"Info: security policy file detected: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found linked content: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found text in security policy: github.com/expressjs/.github/SECURITY.md:1\"]}, {\"name\": \"Branch-Protection\", \"documentation\": {\"shortDescription\": \"Determines if the default and release branches are protected with GitHub's branch protection settings.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection\"}, \"score\": -1, \"reason\": \"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md\", \"details\": []}, {\"name\": \"SAST\", \"documentation\": {\"shortDescription\": \"Determines if the project uses static code analysis.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast\"}, \"score\": 10, \"reason\": \"SAST tool is run on all commits\", \"details\": [\"Info: SAST configuration detected: CodeQL\", \"Info: all commits (30) are checked with a SAST tool\"]}], \"overallScore\": 8.5, \"metadata\": []}}", "githubRepo": "{\n \"full_name\": \"expressjs/express\",\n \"html_url\": \"https://github.com/expressjs/express\",\n \"description\": \"Fast, unopinionated, minimalist web framework for node.\",\n \"stargazers_count\": 69651,\n \"forks_count\": 25228,\n \"open_issues_count\": 236,\n \"pushed_at\": \"2026-10-09T16:24:39Z\",\n \"created_at\": \"2009-06-26T18:56:01Z\",\n \"archived\": false,\n \"disabled\": false,\n \"fork\": false,\n \"default_branch\": \"master\",\n \"license\": {\n \"key\": \"mit\",\n \"name\": \"MIT License\",\n \"spdx_id\": \"MIT\"\n },\n \"has_issues\": true\n}", "githubReleases": "[{\"tag_name\":\"v5.3.0\",\"published_at\":\"2026-10-09T12:50:31Z\",\"draft\":false,\"prerelease\":false},{\"tag_name\":\"v4.22.2\",\"published_at\":\"2026-05-11T18:54:02Z\",\"draft\":false,\"prerelease\":false},{\"tag_name\":\"v5.2.1\",\"published_at\":\"2025-12-01T20:54:44Z\",\"draft\":false,\"prerelease\":false}]", "contributorsCount": 394 } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenSourceTrustExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/package-ecosystem-graph/calculate": { "post": { "operationId": "calculatePackageEcosystemGraph", "summary": "Who depends on what: resolved dependency graph, duplicates and the blast radius of breaking changes.", "description": "Shows the resolved dependency graph of an npm, PyPI, Cargo or Maven package version from deps.dev (Open Source Insights): direct and transitive dependencies, depth, packages pulled in at several versions, which dependencies the most other packages in the tree rely on (their breaking changes hit hardest), how many published packages depend on this one, and which direct dependencies have a newer major version. Paste a deps.dev graph JSON to work offline.\n\nMethodology:\n- Graph: deps.dev v3 GetDependencies (GET api.deps.dev/v3/systems/{system}/packages/{name}/versions/{version}:dependencies), i.e. the dependency tree deps.dev resolved for that release on Linux; your lockfile can resolve differently. Blank version = the package's default version from GetPackage.\n- Depth = shortest path from the package (breadth-first). Duplicates = the same package name resolved at more than one version.\n- Blast radius inside the tree: for every dependency, the number of other packages in this graph that depend on it directly or transitively, and which of your direct dependencies pull it in. A breaking release of a package high in this list affects the most code paths.\n- Dependents (ecosystem-wide blast radius): deps.dev v3alpha GetDependents counts (direct + indirect dependents of this exact version). v3alpha is an unstable API; when it fails the count is omitted.\n- Major updates: for up to 20 direct dependencies the default version is fetched from deps.dev; a higher leading version number than the resolved one is a semver-major (potentially breaking) upgrade.", "tags": [ "security" ], "x-mcp-tool": "package_ecosystem_graph", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageEcosystemGraphInput" }, "examples": { "example1": { "summary": "Pasted deps.dev graph", "value": { "system": "npm", "graphJson": "{\"nodes\":[{\"versionKey\":{\"system\":\"NPM\",\"name\":\"my-app\",\"version\":\"1.0.0\"},\"bundled\":false,\"relation\":\"SELF\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"express\",\"version\":\"4.19.2\"},\"bundled\":false,\"relation\":\"DIRECT\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"debug\",\"version\":\"2.6.9\"},\"bundled\":false,\"relation\":\"INDIRECT\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"ms\",\"version\":\"2.0.0\"},\"bundled\":false,\"relation\":\"INDIRECT\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"body-parser\",\"version\":\"1.20.2\"},\"bundled\":false,\"relation\":\"INDIRECT\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"ms\",\"version\":\"2.1.3\"},\"bundled\":false,\"relation\":\"INDIRECT\",\"errors\":[]},{\"versionKey\":{\"system\":\"NPM\",\"name\":\"chalk\",\"version\":\"5.3.0\"},\"bundled\":false,\"relation\":\"DIRECT\",\"errors\":[]}],\"edges\":[{\"fromNode\":0,\"toNode\":1,\"requirement\":\"^4.19.2\"},{\"fromNode\":0,\"toNode\":6,\"requirement\":\"^5.3.0\"},{\"fromNode\":1,\"toNode\":2,\"requirement\":\"2.6.9\"},{\"fromNode\":1,\"toNode\":4,\"requirement\":\"1.20.2\"},{\"fromNode\":4,\"toNode\":2,\"requirement\":\"2.6.9\"},{\"fromNode\":2,\"toNode\":3,\"requirement\":\"2.0.0\"},{\"fromNode\":1,\"toNode\":5,\"requirement\":\"2.1.3\"}],\"error\":\"\"}", "includeDependents": false, "checkMajorUpdates": false, "maxNodes": 40 } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PackageEcosystemGraphResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/sbom-explorer/calculate": { "post": { "operationId": "calculateSbomExplorer", "summary": "Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.", "description": "Upload or paste a CycloneDX JSON or SPDX 2.x JSON software bill of materials. Lists every component with version, purl and type, classifies licences (permissive, weak / strong / network copyleft, unknown), draws the dependency tree when the SBOM records one, and checks every versioned purl against OSV.dev for known vulnerabilities.\n\nMethodology:\n- CycloneDX: components (including nested ones), metadata.component as root and the dependencies graph. SPDX 2.x: packages, purls from externalRefs, licenseConcluded (else licenseDeclared) and DEPENDS_ON / *_DEPENDENCY_OF / CONTAINS relationships.\n- Licences are classified from SPDX ids and expressions: for \"A OR B\" the more permissive option counts, for \"A AND B\" the more restrictive. NOASSERTION, missing and LicenseRef-* licences are reported as unknown. This flags review needs; it is not legal advice.\n- Dependency depth is the shortest path from the root component (breadth-first); components not reachable from the root are listed as unattached.\n- Vulnerabilities: every versioned purl (qualifiers stripped) is sent to the OSV.dev querybatch API; up to 50 advisories are expanded via /v1/vulns/{id} for severity and the nearest fixed version. Components without a purl cannot be checked.", "tags": [ "security" ], "x-mcp-tool": "sbom_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SbomExplorerInput" }, "examples": { "example1": { "summary": "CycloneDX app SBOM, licences + tree only (offline)", "value": { "sbom": "{\n \"bomFormat\": \"CycloneDX\",\n \"specVersion\": \"1.5\",\n \"version\": 1,\n \"metadata\": {\n \"component\": {\n \"type\": \"application\",\n \"bom-ref\": \"app\",\n \"name\": \"demo-web-app\",\n \"version\": \"1.0.0\"\n }\n },\n \"components\": [\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/express@4.17.1\",\n \"name\": \"express\",\n \"version\": \"4.17.1\",\n \"purl\": \"pkg:npm/express@4.17.1\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/lodash@4.17.20\",\n \"name\": \"lodash\",\n \"version\": \"4.17.20\",\n \"purl\": \"pkg:npm/lodash@4.17.20\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/body-parser@1.19.0\",\n \"name\": \"body-parser\",\n \"version\": \"1.19.0\",\n \"purl\": \"pkg:npm/body-parser@1.19.0\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/node-forge@0.10.0\",\n \"name\": \"node-forge\",\n \"version\": \"0.10.0\",\n \"purl\": \"pkg:npm/node-forge@0.10.0\",\n \"licenses\": [\n {\n \"expression\": \"(BSD-3-Clause OR GPL-2.0)\"\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/sharp@0.32.0\",\n \"name\": \"sharp\",\n \"version\": \"0.32.0\",\n \"purl\": \"pkg:npm/sharp@0.32.0\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"Apache-2.0\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/%40demo/native-image-lib@8.14.2\",\n \"name\": \"@demo/native-image-lib\",\n \"version\": \"8.14.2\",\n \"purl\": \"pkg:npm/%40demo/native-image-lib@8.14.2\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"LGPL-2.1-or-later\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/internal-utils@2.0.0\",\n \"name\": \"internal-utils\",\n \"version\": \"2.0.0\",\n \"purl\": \"pkg:npm/internal-utils@2.0.0\"\n }\n ],\n \"dependencies\": [\n {\n \"ref\": \"app\",\n \"dependsOn\": [\n \"pkg:npm/express@4.17.1\",\n \"pkg:npm/lodash@4.17.20\",\n \"pkg:npm/sharp@0.32.0\",\n \"pkg:npm/internal-utils@2.0.0\"\n ]\n },\n {\n \"ref\": \"pkg:npm/express@4.17.1\",\n \"dependsOn\": [\n \"pkg:npm/body-parser@1.19.0\"\n ]\n },\n {\n \"ref\": \"pkg:npm/sharp@0.32.0\",\n \"dependsOn\": [\n \"pkg:npm/%40demo/native-image-lib@8.14.2\"\n ]\n },\n {\n \"ref\": \"pkg:npm/internal-utils@2.0.0\",\n \"dependsOn\": [\n \"pkg:npm/node-forge@0.10.0\"\n ]\n }\n ]\n}", "checkVulnerabilities": false } }, "example2": { "summary": "SPDX 2.3 Python service (offline)", "value": { "sbom": "{\n \"spdxVersion\": \"SPDX-2.3\",\n \"dataLicense\": \"CC0-1.0\",\n \"SPDXID\": \"SPDXRef-DOCUMENT\",\n \"name\": \"demo-python-service\",\n \"documentNamespace\": \"https://example.com/spdx/demo-python-service-1.0\",\n \"creationInfo\": {\n \"created\": \"2026-10-01T00:00:00Z\",\n \"creators\": [\n \"Tool: example\"\n ]\n },\n \"packages\": [\n {\n \"SPDXID\": \"SPDXRef-root\",\n \"name\": \"demo-python-service\",\n \"versionInfo\": \"1.0\",\n \"primaryPackagePurpose\": \"APPLICATION\",\n \"licenseConcluded\": \"NOASSERTION\",\n \"licenseDeclared\": \"NOASSERTION\"\n },\n {\n \"SPDXID\": \"SPDXRef-requests\",\n \"name\": \"requests\",\n \"versionInfo\": \"2.19.0\",\n \"licenseConcluded\": \"Apache-2.0\",\n \"externalRefs\": [\n {\n \"referenceCategory\": \"PACKAGE-MANAGER\",\n \"referenceType\": \"purl\",\n \"referenceLocator\": \"pkg:pypi/requests@2.19.0\"\n }\n ]\n },\n {\n \"SPDXID\": \"SPDXRef-urllib3\",\n \"name\": \"urllib3\",\n \"versionInfo\": \"1.23\",\n \"licenseConcluded\": \"MIT\",\n \"externalRefs\": [\n {\n \"referenceCategory\": \"PACKAGE-MANAGER\",\n \"referenceType\": \"purl\",\n \"referenceLocator\": \"pkg:pypi/urllib3@1.23\"\n }\n ]\n },\n {\n \"SPDXID\": \"SPDXRef-psycopg2\",\n \"name\": \"psycopg2\",\n \"versionInfo\": \"2.9.9\",\n \"licenseDeclared\": \"LGPL-3.0-or-later\",\n \"externalRefs\": [\n {\n \"referenceCategory\": \"PACKAGE-MANAGER\",\n \"referenceType\": \"purl\",\n \"referenceLocator\": \"pkg:pypi/psycopg2@2.9.9\"\n }\n ]\n }\n ],\n \"relationships\": [\n {\n \"spdxElementId\": \"SPDXRef-DOCUMENT\",\n \"relationshipType\": \"DESCRIBES\",\n \"relatedSpdxElement\": \"SPDXRef-root\"\n },\n {\n \"spdxElementId\": \"SPDXRef-root\",\n \"relationshipType\": \"DEPENDS_ON\",\n \"relatedSpdxElement\": \"SPDXRef-requests\"\n },\n {\n \"spdxElementId\": \"SPDXRef-root\",\n \"relationshipType\": \"DEPENDS_ON\",\n \"relatedSpdxElement\": \"SPDXRef-psycopg2\"\n },\n {\n \"spdxElementId\": \"SPDXRef-urllib3\",\n \"relationshipType\": \"DEPENDENCY_OF\",\n \"relatedSpdxElement\": \"SPDXRef-requests\"\n }\n ]\n}", "checkVulnerabilities": false } }, "example3": { "summary": "CycloneDX with OSV vulnerability check", "value": { "sbom": "{\n \"bomFormat\": \"CycloneDX\",\n \"specVersion\": \"1.5\",\n \"version\": 1,\n \"metadata\": {\n \"component\": {\n \"type\": \"application\",\n \"bom-ref\": \"app\",\n \"name\": \"demo-web-app\",\n \"version\": \"1.0.0\"\n }\n },\n \"components\": [\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/express@4.17.1\",\n \"name\": \"express\",\n \"version\": \"4.17.1\",\n \"purl\": \"pkg:npm/express@4.17.1\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/lodash@4.17.20\",\n \"name\": \"lodash\",\n \"version\": \"4.17.20\",\n \"purl\": \"pkg:npm/lodash@4.17.20\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/body-parser@1.19.0\",\n \"name\": \"body-parser\",\n \"version\": \"1.19.0\",\n \"purl\": \"pkg:npm/body-parser@1.19.0\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"MIT\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/node-forge@0.10.0\",\n \"name\": \"node-forge\",\n \"version\": \"0.10.0\",\n \"purl\": \"pkg:npm/node-forge@0.10.0\",\n \"licenses\": [\n {\n \"expression\": \"(BSD-3-Clause OR GPL-2.0)\"\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/sharp@0.32.0\",\n \"name\": \"sharp\",\n \"version\": \"0.32.0\",\n \"purl\": \"pkg:npm/sharp@0.32.0\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"Apache-2.0\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/%40demo/native-image-lib@8.14.2\",\n \"name\": \"@demo/native-image-lib\",\n \"version\": \"8.14.2\",\n \"purl\": \"pkg:npm/%40demo/native-image-lib@8.14.2\",\n \"licenses\": [\n {\n \"license\": {\n \"id\": \"LGPL-2.1-or-later\"\n }\n }\n ]\n },\n {\n \"type\": \"library\",\n \"bom-ref\": \"pkg:npm/internal-utils@2.0.0\",\n \"name\": \"internal-utils\",\n \"version\": \"2.0.0\",\n \"purl\": \"pkg:npm/internal-utils@2.0.0\"\n }\n ],\n \"dependencies\": [\n {\n \"ref\": \"app\",\n \"dependsOn\": [\n \"pkg:npm/express@4.17.1\",\n \"pkg:npm/lodash@4.17.20\",\n \"pkg:npm/sharp@0.32.0\",\n \"pkg:npm/internal-utils@2.0.0\"\n ]\n },\n {\n \"ref\": \"pkg:npm/express@4.17.1\",\n \"dependsOn\": [\n \"pkg:npm/body-parser@1.19.0\"\n ]\n },\n {\n \"ref\": \"pkg:npm/sharp@0.32.0\",\n \"dependsOn\": [\n \"pkg:npm/%40demo/native-image-lib@8.14.2\"\n ]\n },\n {\n \"ref\": \"pkg:npm/internal-utils@2.0.0\",\n \"dependsOn\": [\n \"pkg:npm/node-forge@0.10.0\"\n ]\n }\n ]\n}", "checkVulnerabilities": true } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SbomExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/security-advisory-timeline/calculate": { "post": { "operationId": "calculateSecurityAdvisoryTimeline", "summary": "Disclosures, affected ranges, fixes and withdrawals for a package on one timeline, with time-to-fix.", "description": "Merges every OSV.dev advisory for a package (npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, NuGet) or a list of advisory IDs into one chronological timeline: publication, last modification, withdrawal and fix releases with their registry release dates (npm and PyPI). For each advisory it lists affected version ranges and fixed versions, and measures how long before or after disclosure the fix shipped and how long vulnerable versions were current. Paste OSV JSON to work offline.\n\nMethodology:\n- Package mode: POST https://api.osv.dev/v1/query with {package:{name, ecosystem}} (up to 5 result pages). ID mode: GET https://api.osv.dev/v1/vulns/{id} for up to 50 IDs. Withdrawn advisories are kept and marked.\n- Affected ranges are rebuilt from OSV range events (introduced / fixed / last_affected / limit); GIT commit ranges are skipped. \"last_affected\" means no fixed version is published in the record.\n- Release dates: npm registry packument \"time\" field (registry.npmjs.org/) or the PyPI JSON API (earliest upload_time_iso_8601 per release). Other ecosystems: paste a {version: date} map.\n- Fix→disclosure days = advisory published − first fixed release date (positive: the fix shipped before the advisory, typical for coordinated disclosure; negative: users were exposed after disclosure). Vulnerable window = first fixed release − release of the introducing version (or the first release when \"introduced: 0\").", "tags": [ "security" ], "x-mcp-tool": "security_advisory_timeline", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecurityAdvisoryTimelineInput" }, "examples": { "example1": { "summary": "Pasted OSV records (fictional package)", "value": { "ecosystem": "npm", "packageName": "demo-parser", "osvJson": "[{\"id\":\"EXAMPLE-0001\",\"summary\":\"Prototype pollution in demo-parser merge()\",\"published\":\"2024-03-12T10:00:00Z\",\"modified\":\"2024-04-01T08:00:00Z\",\"database_specific\":{\"severity\":\"HIGH\"},\"affected\":[{\"package\":{\"ecosystem\":\"npm\",\"name\":\"demo-parser\"},\"ranges\":[{\"type\":\"SEMVER\",\"events\":[{\"introduced\":\"0\"},{\"fixed\":\"1.4.2\"},{\"introduced\":\"2.0.0\"},{\"fixed\":\"2.1.1\"}]}]}]},{\"id\":\"EXAMPLE-0002\",\"summary\":\"ReDoS in demo-parser tokenizer\",\"published\":\"2024-09-02T09:00:00Z\",\"modified\":\"2024-09-03T09:00:00Z\",\"database_specific\":{\"severity\":\"MODERATE\"},\"affected\":[{\"package\":{\"ecosystem\":\"npm\",\"name\":\"demo-parser\"},\"ranges\":[{\"type\":\"SEMVER\",\"events\":[{\"introduced\":\"2.0.0\"},{\"last_affected\":\"2.3.0\"}]}]}]},{\"id\":\"EXAMPLE-0003\",\"summary\":\"Incorrectly reported path traversal\",\"published\":\"2023-11-20T12:00:00Z\",\"modified\":\"2023-12-01T12:00:00Z\",\"withdrawn\":\"2023-12-01T12:00:00Z\",\"database_specific\":{\"severity\":\"LOW\"},\"affected\":[{\"package\":{\"ecosystem\":\"npm\",\"name\":\"demo-parser\"},\"ranges\":[{\"type\":\"SEMVER\",\"events\":[{\"introduced\":\"1.0.0\"},{\"fixed\":\"1.3.0\"}]}]}]}]", "releaseTimesJson": "{\"1.0.0\":\"2022-01-10T00:00:00Z\",\"1.3.0\":\"2023-06-01T00:00:00Z\",\"1.4.0\":\"2023-10-01T00:00:00Z\",\"1.4.2\":\"2024-03-05T00:00:00Z\",\"2.0.0\":\"2023-12-15T00:00:00Z\",\"2.1.1\":\"2024-03-06T00:00:00Z\",\"2.3.0\":\"2024-08-20T00:00:00Z\"}", "fetchReleaseDates": false } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecurityAdvisoryTimelineResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tools/security-configuration-scanner/calculate": { "post": { "operationId": "calculateSecurityConfigurationScanner", "summary": "Passive, graded check of a domain's TLS, security headers, DNS security and security.txt.", "description": "For a domain you are authorised to test, checks the live TLS certificate, HTTP security headers, HTTP→HTTPS redirect, DNSSEC (validated via Google Public DNS), CAA, SPF and DMARC, and /.well-known/security.txt (RFC 9116 Contact and Expires), then grades the result and lists concrete fixes. Passive single requests only. You can also paste headers, DNS records and a certificate summary for an offline review, including cookie flags.\n\nMethodology:\n- Only scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.\n- TLS + DNS: the DNS + Certificate Explorer is called once (resolver lookups of TXT/CAA/_dmarc and one TLS handshake on port 443, no CT search). Certificate findings: trust, hostname match, expiry (<14 days = warning), RSA key size, TLS 1.0/1.1.\n- DNSSEC: one query to the Google Public DNS JSON API (dns.google/resolve, do=1); AD=true means the answer was DNSSEC-validated.\n- Headers: one GET of https:/// analysed with HeaderLens rules (HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, version disclosure). Redirect: one GET of http:///; pass if it ends on https://.\n- security.txt (RFC 9116): Contact and Expires are required; Expires must be in the future, ideally less than a year ahead; served as text/plain.\n- Cookies: only checked from pasted headers (the live fetcher strips Set-Cookie). Only cookie names and flags are reported, never values.\n- Score: 100 minus 20 per high, 8 per medium, 3 per low finding; A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F; any high finding caps the grade at C.\n\nOnly scan systems you own or are authorised to test. This scanner is passive: a handful of ordinary single requests (the home page over HTTPS and HTTP, /.well-known/security.txt, public DNS and one TLS handshake) and no probing, fuzzing or port scanning.", "tags": [ "security" ], "x-mcp-tool": "security_configuration_scanner", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecurityConfigurationScannerInput" }, "examples": { "example1": { "summary": "Offline review of pasted findings", "value": { "domain": "shop.example.net", "mode": "pasted", "headers": "HTTP/2 200\ncontent-type: text/html\nstrict-transport-security: max-age=300\nx-content-type-options: nosniff\nserver: nginx/1.18.0\nset-cookie: session=abc; Path=/; HttpOnly\nset-cookie: __Host-csrf=x; Path=/; Secure; HttpOnly; SameSite=Strict", "dnsRecords": "CAA 0 issue \"letsencrypt.org\"\nTXT v=spf1 include:_spf.example.net ~all\nDMARC v=DMARC1; p=none\nDNSSEC no", "certificate": "issuer: CN=R11, O=Let's Encrypt, C=US\nvalidTo: 2026-10-20T12:00:00Z\nprotocol: TLSv1.3\nkeyType: ec\nhostnameMatches: yes\nauthorized: yes", "securityTxt": "Contact: mailto:security@example.net\nExpires: 2026-03-01T00:00:00Z\nPreferred-Languages: en", "httpsRedirect": "yes" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecurityConfigurationScannerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/workflows": { "get": { "operationId": "listWorkflows", "summary": "Multi-tool workflows", "responses": { "200": { "description": "Workflow list.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "ArtifactProvenanceExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "package": { "title": "npm package@version", "description": "Looks up registry.npmjs.org attestations and metadata. Leave empty when pasting.", "type": "string", "maxLength": 260 }, "attestations": { "title": "Or paste attestations JSON", "description": "The response of /-/npm/v1/attestations/@, or a single Sigstore bundle.", "type": "string", "maxLength": 2000000 }, "attestationsFile": { "title": "Or upload attestations / bundle (.json)", "type": "object", "description": "Upload as {filename, contentType?, contentBase64}. Max 1953 KiB. Accepts .json,.sigstore,application/json.", "additionalProperties": false, "required": [ "filename", "contentBase64" ], "properties": { "filename": { "type": "string" }, "contentType": { "type": "string" }, "contentBase64": { "type": "string" } } }, "packageMetadata": { "title": "Optional: package version metadata JSON", "description": "registry.npmjs.org// document, used for the repository / gitHead / integrity cross-checks in paste mode.", "type": "string", "maxLength": 500000 } }, "required": [] }, "ArtifactProvenanceExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "package", "version", "attestationCount", "verdict", "provenance", "publishAttestation", "signingIdentity", "attestationChecks", "crossChecks", "notVerified" ], "properties": { "package": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "attestationCount": { "type": "integer" }, "verdict": { "type": "string", "enum": [ "verified", "verified-with-mismatches", "signature-problems", "no-attestations" ] }, "provenance": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "predicateType", "buildType", "builderId", "sourceRepo", "commit", "ref", "workflowPath", "eventName", "invocationId" ], "properties": { "predicateType": { "type": "string" }, "buildType": { "type": [ "string", "null" ] }, "builderId": { "type": [ "string", "null" ] }, "sourceRepo": { "type": [ "string", "null" ] }, "commit": { "type": [ "string", "null" ] }, "ref": { "type": [ "string", "null" ] }, "workflowPath": { "type": [ "string", "null" ] }, "eventName": { "type": [ "string", "null" ] }, "invocationId": { "type": [ "string", "null" ] } } }, "publishAttestation": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "registry", "signedBy" ], "properties": { "registry": { "type": [ "string", "null" ] }, "signedBy": { "type": [ "string", "null" ] } } }, "signingIdentity": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "subjectAltName", "issuer", "oidcIssuer", "runnerEnvironment", "loggedAt" ], "properties": { "subjectAltName": { "type": [ "string", "null" ] }, "issuer": { "type": "string" }, "oidcIssuer": { "type": [ "string", "null" ] }, "runnerEnvironment": { "type": [ "string", "null" ] }, "loggedAt": { "type": [ "string", "null" ] } } }, "attestationChecks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "attestation", "checks" ], "properties": { "attestation": { "type": "string" }, "checks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "check", "status", "detail" ], "properties": { "check": { "type": "string" }, "status": { "type": "string", "enum": [ "pass", "fail", "skipped" ] }, "detail": { "type": "string" } } } } } } }, "crossChecks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "check", "status", "detail" ], "properties": { "check": { "type": "string" }, "status": { "type": "string", "enum": [ "pass", "fail", "skipped" ] }, "detail": { "type": "string" } } } }, "notVerified": { "type": "array", "items": { "type": "string" } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "ContainerImageExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "image": { "title": "Image reference", "type": "string", "maxLength": 300 }, "platform": { "title": "Platform", "description": "os/arch[/variant] picked from multi-platform images.", "type": "string", "maxLength": 40, "default": "linux/amd64" }, "manifestJson": { "title": "Or paste a manifest / index (JSON)", "description": "Offline mode, e.g. output of `docker buildx imagetools inspect --raw `.", "type": "string", "maxLength": 1000000 }, "configJson": { "title": "And its config blob (JSON)", "description": "e.g. `crane config ` or `docker inspect` Config section.", "type": "string", "maxLength": 2000000 } }, "required": [] }, "ContainerImageExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "image", "digest", "mediaType", "platforms", "attestationManifests", "selectedPlatform", "layers", "totalCompressedBytes", "config", "baseImage", "signature", "findings" ], "properties": { "image": { "type": [ "string", "null" ] }, "digest": { "type": [ "string", "null" ] }, "mediaType": { "type": [ "string", "null" ] }, "platforms": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "platform", "digest", "size" ], "properties": { "platform": { "type": "string" }, "digest": { "type": "string" }, "size": { "type": [ "integer", "null" ] } } } }, "attestationManifests": { "type": "integer" }, "selectedPlatform": { "type": [ "string", "null" ] }, "layers": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "digest", "size", "mediaType" ], "properties": { "digest": { "type": "string" }, "size": { "type": [ "integer", "null" ] }, "mediaType": { "type": [ "string", "null" ] } } } }, "totalCompressedBytes": { "type": "integer" }, "config": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "digestVerified", "created", "ageDays", "os", "architecture", "user", "runsAsRoot", "envNames", "labels", "exposedPorts", "entrypoint", "cmd", "historySteps", "healthcheck" ], "properties": { "digestVerified": { "type": [ "boolean", "null" ] }, "created": { "type": [ "string", "null" ] }, "ageDays": { "type": [ "integer", "null" ] }, "os": { "type": [ "string", "null" ] }, "architecture": { "type": [ "string", "null" ] }, "user": { "type": "string" }, "runsAsRoot": { "type": "boolean" }, "envNames": { "type": "array", "items": { "type": "string" } }, "labels": { "type": "object", "additionalProperties": { "type": "string" } }, "exposedPorts": { "type": "array", "items": { "type": "string" } }, "entrypoint": { "type": [ "string", "null" ] }, "cmd": { "type": [ "string", "null" ] }, "healthcheck": { "type": "boolean" }, "historySteps": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "created", "createdBy", "emptyLayer" ], "properties": { "created": { "type": [ "string", "null" ] }, "createdBy": { "type": "string" }, "emptyLayer": { "type": "boolean" } } } } } }, "baseImage": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "label", "distro", "version", "evidence", "eol", "status", "note" ], "properties": { "label": { "type": [ "string", "null" ] }, "distro": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "evidence": { "type": [ "string", "null" ] }, "eol": { "type": [ "string", "null" ] }, "status": { "type": "string", "enum": [ "supported", "eol", "extended-only", "unknown" ] }, "note": { "type": "string" } } }, "signature": { "type": "object", "additionalProperties": false, "required": [ "checked", "cosignTag", "found" ], "properties": { "checked": { "type": "boolean" }, "cosignTag": { "type": [ "string", "null" ] }, "found": { "type": [ "boolean", "null" ] } } }, "findings": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "level", "text" ], "properties": { "level": { "type": "string", "enum": [ "good", "info", "warning", "bad" ] }, "text": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "CveRelationshipGraphInput": { "type": "object", "additionalProperties": false, "properties": { "vulnId": { "title": "CVE, GHSA or OSV id", "type": "string", "maxLength": 80 }, "osvJson": { "title": "Or paste an OSV record (JSON)", "description": "Offline mode: an OSV vulnerability JSON, e.g. from api.osv.dev/v1/vulns/.", "type": "string", "maxLength": 2000000 }, "kevJson": { "title": "Optional: CISA KEV entry or catalog (JSON)", "type": "string", "maxLength": 5000000 }, "epssJson": { "title": "Optional: EPSS response (JSON)", "description": "FIRST API response or {\"epss\": 0.97, \"percentile\": 0.99}.", "type": "string", "maxLength": 100000 }, "enrichAliases": { "title": "Fetch alias records for packages", "description": "If the record lists no packages (typical for CVE records), fetch up to 3 alias advisories.", "type": "boolean", "default": true } }, "required": [] }, "CveRelationshipGraphResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "id", "summary", "aliases", "cves", "severity", "cvssVector", "cvssScore", "published", "modified", "withdrawn", "cwes", "packages", "gitFixes", "references", "kev", "epss", "relatedCount" ], "properties": { "id": { "type": "string" }, "summary": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "cves": { "type": "array", "items": { "type": "string" } }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvssVector": { "type": [ "string", "null" ] }, "cvssScore": { "type": [ "number", "null" ] }, "published": { "type": [ "string", "null" ] }, "modified": { "type": [ "string", "null" ] }, "withdrawn": { "type": [ "string", "null" ] }, "cwes": { "type": "array", "items": { "type": "string" } }, "packages": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "ecosystem", "name", "purl", "ranges", "fixed", "lastAffected", "source" ], "properties": { "ecosystem": { "type": "string" }, "name": { "type": "string" }, "purl": { "type": [ "string", "null" ] }, "ranges": { "type": "array", "items": { "type": "string" } }, "fixed": { "type": "array", "items": { "type": "string" } }, "lastAffected": { "type": "array", "items": { "type": "string" } }, "source": { "type": "string" } } } }, "gitFixes": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "repo", "commit" ], "properties": { "repo": { "type": "string" }, "commit": { "type": "string" } } } }, "references": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, "kev": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "dateAdded", "dueDate", "vendorProject", "product", "vulnerabilityName", "requiredAction", "knownRansomwareCampaignUse" ], "properties": { "dateAdded": { "type": "string" }, "dueDate": { "type": [ "string", "null" ] }, "vendorProject": { "type": "string" }, "product": { "type": "string" }, "vulnerabilityName": { "type": "string" }, "requiredAction": { "type": "string" }, "knownRansomwareCampaignUse": { "type": "string" } } }, "epss": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "cve", "score", "percentile", "date" ], "properties": { "cve": { "type": "string" }, "score": { "type": "number" }, "percentile": { "type": "number" }, "date": { "type": [ "string", "null" ] } } }, "relatedCount": { "type": "integer" } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "DependencyVulnerabilityExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "manifest": { "title": "Manifest, lockfile or package list", "type": "string", "maxLength": 5000000 }, "vulnId": { "title": "Or: look up one advisory ID", "type": "string", "maxLength": 60 } }, "required": [] }, "DependencyVulnerabilityExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "manifestKind", "packagesChecked", "skipped", "vulnerablePackages", "counts", "findings", "advisory" ], "properties": { "manifestKind": { "type": [ "string", "null" ] }, "packagesChecked": { "type": "integer" }, "skipped": { "type": "array", "items": { "type": "string" } }, "vulnerablePackages": { "type": "integer" }, "counts": { "type": "object", "additionalProperties": false, "required": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ], "properties": { "CRITICAL": { "type": "integer" }, "HIGH": { "type": "integer" }, "MODERATE": { "type": "integer" }, "LOW": { "type": "integer" }, "UNKNOWN": { "type": "integer" } } }, "findings": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "ecosystem", "name", "version", "exact", "upgradeTo", "vulnerabilities" ], "properties": { "ecosystem": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" }, "exact": { "type": "boolean" }, "upgradeTo": { "type": [ "string", "null" ] }, "vulnerabilities": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "aliases", "summary", "severity", "cvss", "published", "fixedIn", "url" ], "properties": { "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvss": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ] }, "fixedIn": { "type": [ "string", "null" ] }, "url": { "type": "string" } } } } } } }, "advisory": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "id", "aliases", "summary", "severity", "cvss", "published", "fixedIn", "url", "affectedPackages" ], "properties": { "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvss": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ] }, "fixedIn": { "type": [ "string", "null" ] }, "url": { "type": "string" }, "affectedPackages": { "type": "array", "items": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "OauthPermissionExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "request": { "title": "Scopes or authorization URL", "description": "Scopes separated by spaces or commas, or the whole URL from the consent link.", "type": "string", "maxLength": 20000 }, "provider": { "title": "Provider", "type": "string", "enum": [ "auto", "google", "github", "microsoft", "slack", "oidc" ], "default": "auto" } }, "required": [ "request" ] }, "OauthPermissionExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "provider", "providerDetection", "request", "scopes", "unknownScopes", "riskyCombinations", "flowNotes", "overallRisk", "counts" ], "properties": { "provider": { "type": [ "string", "null" ] }, "providerDetection": { "type": "string", "enum": [ "explicit", "url", "detected", "none" ] }, "request": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "host", "clientId", "redirectUri", "responseType", "prompt", "accessType", "codeChallengeMethod", "hasPkce", "hasState", "hasNonce" ], "properties": { "host": { "type": [ "string", "null" ] }, "clientId": { "type": [ "string", "null" ] }, "redirectUri": { "type": [ "string", "null" ] }, "responseType": { "type": [ "string", "null" ] }, "prompt": { "type": [ "string", "null" ] }, "accessType": { "type": [ "string", "null" ] }, "codeChallengeMethod": { "type": [ "string", "null" ] }, "hasPkce": { "type": "boolean" }, "hasState": { "type": "boolean" }, "hasNonce": { "type": "boolean" } } }, "scopes": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "scope", "provider", "known", "description", "sensitivity", "capabilities", "providerClass", "adminConsentRequired", "tokenType", "sourceUrl" ], "properties": { "scope": { "type": "string" }, "provider": { "type": [ "string", "null" ] }, "known": { "type": "boolean" }, "description": { "type": [ "string", "null" ] }, "sensitivity": { "type": "string", "enum": [ "low", "medium", "high", "critical", "unknown" ] }, "capabilities": { "type": "array", "items": { "type": "string" } }, "providerClass": { "type": [ "string", "null" ] }, "adminConsentRequired": { "type": [ "boolean", "null" ] }, "tokenType": { "type": [ "string", "null" ] }, "sourceUrl": { "type": [ "string", "null" ] } } } }, "unknownScopes": { "type": "array", "items": { "type": "string" } }, "riskyCombinations": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "label", "severity", "scopes", "why" ], "properties": { "id": { "type": "string" }, "label": { "type": "string" }, "severity": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] }, "scopes": { "type": "array", "items": { "type": "string" } }, "why": { "type": "string" } } } }, "flowNotes": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "severity", "note" ], "properties": { "severity": { "type": "string", "enum": [ "high", "medium", "low", "info" ] }, "note": { "type": "string" } } } }, "overallRisk": { "type": "string", "enum": [ "low", "medium", "high", "critical", "unknown" ] }, "counts": { "type": "object", "additionalProperties": false, "required": [ "total", "known", "unknown", "critical", "high" ], "properties": { "total": { "type": "integer" }, "known": { "type": "integer" }, "unknown": { "type": "integer" }, "critical": { "type": "integer" }, "high": { "type": "integer" } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "OpenSourceTrustExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "target": { "title": "GitHub repo or package", "type": "string", "maxLength": 300 }, "depsdevProject": { "title": "Or paste deps.dev project JSON", "description": "Offline mode: response of api.deps.dev/v3/projects/.", "type": "string", "maxLength": 1000000 }, "depsdevVersion": { "title": "Optional: deps.dev package version JSON", "type": "string", "maxLength": 1000000 }, "githubRepo": { "title": "Optional: GitHub repo JSON", "description": "Response of api.github.com/repos//.", "type": "string", "maxLength": 500000 }, "githubReleases": { "title": "Optional: GitHub releases JSON", "type": "string", "maxLength": 1000000 }, "contributorsCount": { "title": "Optional: contributor count", "type": "integer", "minimum": 0, "maximum": 1000000 } }, "required": [] }, "OpenSourceTrustExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "repo", "package", "github", "scorecard", "maintenance", "releaseSigning", "signals" ], "properties": { "repo": { "type": [ "string", "null" ] }, "package": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "system", "name", "version", "publishedAt", "defaultVersion", "versionCount", "deprecated", "licenses", "advisories", "provenance" ], "properties": { "system": { "type": "string" }, "name": { "type": "string" }, "version": { "type": [ "string", "null" ] }, "publishedAt": { "type": [ "string", "null" ] }, "defaultVersion": { "type": [ "string", "null" ] }, "versionCount": { "type": "integer" }, "deprecated": { "type": "boolean" }, "licenses": { "type": "array", "items": { "type": "string" } }, "advisories": { "type": "array", "items": { "type": "string" } }, "provenance": { "type": "boolean" } } }, "github": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "stars", "forks", "openIssues", "pushedAt", "createdAt", "archived", "license", "latestRelease", "contributors" ], "properties": { "stars": { "type": [ "integer", "null" ] }, "forks": { "type": [ "integer", "null" ] }, "openIssues": { "type": [ "integer", "null" ] }, "pushedAt": { "type": [ "string", "null" ] }, "createdAt": { "type": [ "string", "null" ] }, "archived": { "type": "boolean" }, "license": { "type": [ "string", "null" ] }, "latestRelease": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "tag", "publishedAt" ], "properties": { "tag": { "type": "string" }, "publishedAt": { "type": [ "string", "null" ] } } }, "contributors": { "type": [ "integer", "null" ] } } }, "scorecard": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "overall", "date", "checks" ], "properties": { "overall": { "type": [ "number", "null" ] }, "date": { "type": [ "string", "null" ] }, "checks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "score", "reason" ], "properties": { "name": { "type": "string" }, "score": { "type": "integer" }, "reason": { "type": "string" } } } } } }, "maintenance": { "type": "object", "additionalProperties": false, "required": [ "score", "components" ], "properties": { "score": { "type": [ "integer", "null" ] }, "components": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "points", "max", "explanation" ], "properties": { "name": { "type": "string" }, "points": { "type": "integer" }, "max": { "type": "integer" }, "explanation": { "type": "string" } } } } } }, "releaseSigning": { "type": "object", "additionalProperties": false, "required": [ "scorecardSignedReleases", "reason", "provenanceAttestations" ], "properties": { "scorecardSignedReleases": { "type": [ "integer", "null" ] }, "reason": { "type": [ "string", "null" ] }, "provenanceAttestations": { "type": "boolean" } } }, "signals": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "level", "text" ], "properties": { "level": { "type": "string", "enum": [ "good", "info", "warning", "bad" ] }, "text": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "PackageEcosystemGraphInput": { "type": "object", "additionalProperties": false, "properties": { "system": { "title": "Ecosystem", "type": "string", "enum": [ "npm", "pypi", "cargo", "maven" ], "default": "npm" }, "name": { "title": "Package name", "type": "string", "maxLength": 214 }, "version": { "title": "Version (blank = default/latest)", "type": "string", "maxLength": 100 }, "graphJson": { "title": "Or paste a deps.dev :dependencies JSON response", "description": "Output of GET https://api.deps.dev/v3/systems/{system}/packages/{name}/versions/{version}:dependencies", "type": "string", "maxLength": 3000000 }, "includeDependents": { "title": "Look up how many packages depend on it (deps.dev v3alpha)", "type": "boolean", "default": true }, "checkMajorUpdates": { "title": "Check direct dependencies for newer major versions", "type": "boolean", "default": true }, "maxNodes": { "title": "Max packages drawn in the graph", "type": "integer", "minimum": 5, "maximum": 60, "default": 40 } }, "required": [] }, "PackageEcosystemGraphResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "package", "dataSource", "counts", "direct", "duplicates", "mostDependedUpon", "dependents", "majorUpdates", "graphTruncated", "resolutionErrors" ], "properties": { "package": { "type": "object", "additionalProperties": false, "required": [ "system", "name", "version" ], "properties": { "system": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "dataSource": { "type": "string", "enum": [ "deps.dev", "pasted" ] }, "counts": { "type": "object", "additionalProperties": false, "required": [ "packages", "direct", "transitive", "edges", "maxDepth", "duplicatePackages" ], "properties": { "packages": { "type": "integer" }, "direct": { "type": "integer" }, "transitive": { "type": "integer" }, "edges": { "type": "integer" }, "maxDepth": { "type": "integer" }, "duplicatePackages": { "type": "integer" } } }, "direct": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "version", "requirement" ], "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "requirement": { "type": "string" } } } }, "duplicates": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "versions" ], "properties": { "name": { "type": "string" }, "versions": { "type": "array", "items": { "type": "string" } } } } }, "mostDependedUpon": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "version", "dependentsInTree", "depth", "pulledInBy" ], "properties": { "name": { "type": "string" }, "version": { "type": "string" }, "dependentsInTree": { "type": "integer" }, "depth": { "type": [ "integer", "null" ] }, "pulledInBy": { "type": "array", "items": { "type": "string" } } } } }, "dependents": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "total", "direct", "indirect" ], "properties": { "total": { "type": [ "integer", "null" ] }, "direct": { "type": [ "integer", "null" ] }, "indirect": { "type": [ "integer", "null" ] } } }, "majorUpdates": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "resolved", "latest", "requirement", "majorsBehind" ], "properties": { "name": { "type": "string" }, "resolved": { "type": "string" }, "latest": { "type": "string" }, "requirement": { "type": "string" }, "majorsBehind": { "type": "integer" } } } }, "graphTruncated": { "type": "boolean" }, "resolutionErrors": { "type": "array", "items": { "type": "string" } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "SbomExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "sbom": { "title": "SBOM (CycloneDX or SPDX JSON)", "type": "string", "maxLength": 5000000 }, "sbomFile": { "title": "Or upload an SBOM file", "type": "object", "description": "Upload as {filename, contentType?, contentBase64}. Max 4883 KiB. Accepts .json,.cdx.json,.spdx.json,application/json.", "additionalProperties": false, "required": [ "filename", "contentBase64" ], "properties": { "filename": { "type": "string" }, "contentType": { "type": "string" }, "contentBase64": { "type": "string" } } }, "checkVulnerabilities": { "title": "Check vulnerabilities on OSV.dev", "description": "Sends the component purls (not the SBOM) to api.osv.dev.", "type": "boolean", "default": true } }, "required": [] }, "SbomExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "format", "specVersion", "documentName", "root", "componentCount", "components", "licenseSummary", "licenseClassCounts", "copyleftComponents", "unknownLicenseComponents", "dependencyEdges", "directDependencies", "maxDepth", "vulnerabilityCheck", "vulnerabilities", "severityCounts" ], "properties": { "format": { "type": "string", "enum": [ "CycloneDX", "SPDX" ] }, "specVersion": { "type": "string" }, "documentName": { "type": [ "string", "null" ] }, "root": { "type": [ "string", "null" ] }, "componentCount": { "type": "integer" }, "components": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "ref", "name", "version", "purl", "type", "licenses", "licenseClass" ], "properties": { "ref": { "type": "string" }, "name": { "type": "string" }, "version": { "type": [ "string", "null" ] }, "purl": { "type": [ "string", "null" ] }, "type": { "type": "string" }, "licenses": { "type": "array", "items": { "type": "string" } }, "licenseClass": { "type": "string", "enum": [ "permissive", "weak-copyleft", "strong-copyleft", "network-copyleft", "public-domain", "proprietary", "unknown" ] } } } }, "licenseSummary": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "license", "class", "count" ], "properties": { "license": { "type": "string" }, "class": { "type": "string", "enum": [ "permissive", "weak-copyleft", "strong-copyleft", "network-copyleft", "public-domain", "proprietary", "unknown" ] }, "count": { "type": "integer" } } } }, "licenseClassCounts": { "type": "object", "additionalProperties": { "type": "integer" } }, "copyleftComponents": { "type": "array", "items": { "type": "string" } }, "unknownLicenseComponents": { "type": "array", "items": { "type": "string" } }, "dependencyEdges": { "type": "integer" }, "directDependencies": { "type": "integer" }, "maxDepth": { "type": "integer" }, "vulnerabilityCheck": { "type": "object", "additionalProperties": false, "required": [ "status", "purlsChecked", "detail" ], "properties": { "status": { "type": "string", "enum": [ "performed", "skipped", "failed" ] }, "purlsChecked": { "type": "integer" }, "detail": { "type": "string" } } }, "vulnerabilities": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "component", "version", "purl", "id", "aliases", "severity", "summary", "fixedIn" ], "properties": { "component": { "type": "string" }, "version": { "type": [ "string", "null" ] }, "purl": { "type": "string" }, "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "summary": { "type": "string" }, "fixedIn": { "type": [ "string", "null" ] } } } }, "severityCounts": { "type": "object", "additionalProperties": { "type": "integer" } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "SecurityAdvisoryTimelineInput": { "type": "object", "additionalProperties": false, "properties": { "ecosystem": { "title": "Ecosystem", "type": "string", "enum": [ "npm", "PyPI", "Go", "crates.io", "Maven", "RubyGems", "Packagist", "NuGet" ], "default": "npm" }, "packageName": { "title": "Package name", "type": "string", "maxLength": 214 }, "advisoryIds": { "title": "Or advisory IDs (one per line)", "type": "string", "maxLength": 5000 }, "osvJson": { "title": "Or paste OSV JSON (offline)", "description": "Response of POST https://api.osv.dev/v1/query, an array of OSV records, or one record.", "type": "string", "maxLength": 3000000 }, "releaseTimesJson": { "title": "Optional: pasted release dates (offline)", "description": "npm packument (uses \"time\"), PyPI JSON (uses \"releases\") or {\"1.2.3\": \"2024-01-01T00:00:00Z\"}.", "type": "string", "maxLength": 5000000 }, "fetchReleaseDates": { "title": "Look up fix release dates (npm / PyPI registry)", "type": "boolean", "default": true } }, "required": [] }, "SecurityAdvisoryTimelineResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "target", "dataSource", "advisories", "metrics", "events" ], "properties": { "target": { "type": [ "string", "null" ] }, "dataSource": { "type": "string", "enum": [ "osv-package", "osv-ids", "pasted" ] }, "advisories": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "aliases", "summary", "severity", "cvss", "package", "published", "modified", "withdrawn", "affectedRanges", "fixedVersions", "firstFixRelease", "firstFixReleaseDate", "introducedReleaseDate", "daysFixToDisclosure", "vulnerableWindowDays", "url" ], "properties": { "id": { "type": "string" }, "aliases": { "type": "array", "items": { "type": "string" } }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN" ] }, "cvss": { "type": [ "string", "null" ] }, "package": { "type": [ "string", "null" ] }, "published": { "type": [ "string", "null" ] }, "modified": { "type": [ "string", "null" ] }, "withdrawn": { "type": [ "string", "null" ] }, "affectedRanges": { "type": "array", "items": { "type": "string" } }, "fixedVersions": { "type": "array", "items": { "type": "string" } }, "firstFixRelease": { "type": [ "string", "null" ] }, "firstFixReleaseDate": { "type": [ "string", "null" ] }, "introducedReleaseDate": { "type": [ "string", "null" ] }, "daysFixToDisclosure": { "type": [ "integer", "null" ] }, "vulnerableWindowDays": { "type": [ "integer", "null" ] }, "url": { "type": "string" } } } }, "metrics": { "type": "object", "additionalProperties": false, "required": [ "advisories", "active", "withdrawn", "withoutFix", "withFixDate", "fixBeforeDisclosure", "medianDaysFixToDisclosure", "medianVulnerableWindowDays", "firstPublished", "lastPublished" ], "properties": { "advisories": { "type": "integer" }, "active": { "type": "integer" }, "withdrawn": { "type": "integer" }, "withoutFix": { "type": "integer" }, "withFixDate": { "type": "integer" }, "fixBeforeDisclosure": { "type": "integer" }, "medianDaysFixToDisclosure": { "type": [ "integer", "null" ] }, "medianVulnerableWindowDays": { "type": [ "integer", "null" ] }, "firstPublished": { "type": [ "string", "null" ] }, "lastPublished": { "type": [ "string", "null" ] } } }, "events": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "time", "kind", "advisory", "detail" ], "properties": { "time": { "type": "string" }, "kind": { "type": "string", "enum": [ "published", "modified", "withdrawn", "fix-released", "introduced" ] }, "advisory": { "type": "string" }, "detail": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } }, "SecurityConfigurationScannerInput": { "type": "object", "additionalProperties": false, "properties": { "domain": { "title": "Domain", "type": "string", "maxLength": 253 }, "mode": { "title": "Mode", "type": "string", "enum": [ "live", "pasted" ], "default": "live" }, "authorized": { "title": "I own this domain or am authorised to test it", "description": "Required for live scans.", "type": "boolean", "default": false }, "headers": { "title": "Pasted: HTTP response headers", "type": "string", "maxLength": 50000 }, "dnsRecords": { "title": "Pasted: DNS records", "type": "string", "maxLength": 20000 }, "certificate": { "title": "Pasted: certificate summary", "type": "string", "maxLength": 5000 }, "securityTxt": { "title": "Pasted: security.txt content", "type": "string", "maxLength": 20000 }, "httpsRedirect": { "title": "Pasted: does http:// redirect to https://?", "type": "string", "enum": [ "unknown", "yes", "no" ], "default": "unknown" } }, "required": [ "domain" ] }, "SecurityConfigurationScannerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "domain", "mode", "grade", "score", "counts", "findings", "certificate", "dnssec", "httpsRedirect", "securityTxt", "cookies", "notice" ], "properties": { "domain": { "type": "string" }, "mode": { "type": "string", "enum": [ "live", "pasted" ] }, "grade": { "type": "string", "enum": [ "A", "B", "C", "D", "F" ] }, "score": { "type": "integer" }, "counts": { "type": "object", "additionalProperties": false, "required": [ "high", "medium", "low", "info" ], "properties": { "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" }, "info": { "type": "integer" } } }, "findings": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "severity", "area", "finding", "fix" ], "properties": { "severity": { "type": "string", "enum": [ "high", "medium", "low", "info" ] }, "area": { "type": "string" }, "finding": { "type": "string" }, "fix": { "type": [ "string", "null" ] } } } }, "certificate": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "issuer", "validTo", "daysLeft", "protocol", "trusted" ], "properties": { "issuer": { "type": [ "string", "null" ] }, "validTo": { "type": [ "string", "null" ] }, "daysLeft": { "type": [ "integer", "null" ] }, "protocol": { "type": [ "string", "null" ] }, "trusted": { "type": [ "boolean", "null" ] } } }, "dnssec": { "type": [ "boolean", "null" ] }, "httpsRedirect": { "type": [ "boolean", "null" ] }, "securityTxt": { "type": "object", "additionalProperties": false, "required": [ "present", "contact", "expires", "expired", "signed", "fields" ], "properties": { "present": { "type": "boolean" }, "contact": { "type": "array", "items": { "type": "string" } }, "expires": { "type": [ "string", "null" ] }, "expired": { "type": [ "boolean", "null" ] }, "signed": { "type": "boolean" }, "fields": { "type": "array", "items": { "type": "string" } } } }, "cookies": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "secure", "httpOnly", "sameSite" ], "properties": { "name": { "type": "string" }, "secure": { "type": "boolean" }, "httpOnly": { "type": "boolean" }, "sameSite": { "type": [ "string", "null" ] } } } }, "notice": { "type": "string" } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }