{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to analyze, without protocol or path (e.g. 'example.com', 'shopify.com')",
      "title": "Domain",
      "type": "string"
    },
    "include_all_txt": {
      "default": false,
      "description": "Return every TXT record (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory.",
      "title": "Include All Txt",
      "type": "boolean"
    }
  },
  "required": [
    "domain"
  ],
  "title": "domain_reportArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to audit, without protocol or path (e.g. 'example.com', 'shopify.com')",
      "title": "Domain",
      "type": "string"
    },
    "include_all_txt": {
      "default": false,
      "description": "Return every TXT record under report.dns.txt (default: False, only SPF/DMARC/DKIM/MTA-STS/TLS-RPT kept). report.dns.total_txt_records is always emitted with the honest pre-filter count. Default filter strips vendor verification strings (google-site-verification, ms=, facebook-domain-verification, etc.) that bloat the response without security signal. Set True only when you need the raw TXT inventory.",
      "title": "Include All Txt",
      "type": "boolean"
    }
  },
  "required": [
    "domain"
  ],
  "title": "audit_domainArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to scan, without protocol or path (e.g. 'example.com'). Bare IPs and private-resolving domains are rejected.",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "contrast_scanArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Target domain to fingerprint and CVE-audit (e.g. 'example.com'). IPs and internal hostnames are rejected.",
      "maxLength": 253,
      "minLength": 1,
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "tech_stack_cve_auditArguments"
}

{
  "type": "object",
  "properties": {
    "ip": {
      "description": "Public IPv4 or IPv6 address to investigate (e.g. '8.8.8.8', '1.1.1.1'). Private/reserved IPs are rejected.",
      "title": "Ip",
      "type": "string"
    }
  },
  "required": [
    "ip"
  ],
  "title": "threat_reportArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to query, without protocol or path (e.g. 'example.com', 'cloudflare.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "dns_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to query WHOIS for (e.g. 'example.com', 'github.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "whois_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to check SSL/TLS certificate for (e.g. 'example.com', 'api.stripe.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "ssl_checkArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Root domain to enumerate subdomains for (e.g. 'example.com', 'tesla.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "subdomain_enumArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to fingerprint (e.g. 'example.com', 'shopify.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "tech_fingerprintArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to check for threats (e.g. 'suspicious-site.com', 'example.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "threat_intelArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to look up in web archives (e.g. 'example.com', 'archive.org')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "wayback_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to scan live HTTP headers for (e.g. 'example.com', 'api.github.com')",
      "title": "Domain",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default ('') returns slim findings — raw header values capped at 500 chars with total_value_length carrying the honest pre-truncation length. Pass 'full' to restore the full raw value (useful for inspecting full CSP directives on sites like GitHub where the CSP header exceeds 4 KB). Allowed: '' or 'full'.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "scan_headersArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to analyze email configuration for (e.g. 'example.com', 'google.com')",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "email_mxArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to audit email authentication posture for (e.g. 'example.com')",
      "title": "Domain",
      "type": "string"
    },
    "selectors": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "Optional comma-separated custom DKIM selectors to probe",
      "title": "Selectors"
    }
  },
  "required": [
    "domain"
  ],
  "title": "email_security_postureArguments"
}

{
  "type": "object",
  "properties": {
    "email": {
      "description": "Full email address to check (e.g. 'user@tempmail.com', 'test@guerrillamail.com')",
      "title": "Email",
      "type": "string"
    }
  },
  "required": [
    "email"
  ],
  "title": "email_disposableArguments"
}

{
  "type": "object",
  "properties": {
    "email": {
      "description": "Full email address to verify (e.g. 'admin@example.com', 'user@gmail.com'). Must contain '@'.",
      "title": "Email",
      "type": "string"
    }
  },
  "required": [
    "email"
  ],
  "title": "email_verifyArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Registrable domain to fetch robots.txt for (e.g. 'example.com', 'github.com'). No scheme, no path, no port. Subdomains accepted; the bot fetches https://<domain>/robots.txt with HTTP fallback.",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "robots_txtArguments"
}

{
  "type": "object",
  "properties": {
    "url": {
      "description": "Full URL whose redirect chain to walk, e.g. 'https://bit.ly/3xyz' or 'http://example.com/old-path'. Must start with http:// or https://. Pass the URL exactly as you'd `curl -L` it; the server handles encoding.",
      "title": "Url",
      "type": "string"
    }
  },
  "required": [
    "url"
  ],
  "title": "redirect_chainArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Registrable domain to scrape brand assets for (e.g. 'github.com', 'stripe.com'). No scheme, no path, no port. The bot fetches https://<domain>/ with HTTP fallback.",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "brand_assetsArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Registrable domain to audit SEO for (e.g. 'example.com', 'shopify.com'). No scheme, no path, no port. Strictly homepage-only — the bot fetches https://<domain>/ with HTTP fallback and audits that single page (we do NOT crawl).",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "seo_auditArguments"
}

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Registrable domain to audit for AI-visibility / GEO readiness (e.g. 'example.com', 'shopify.com'). No scheme, no path, no port. Strictly homepage-only — the bot fetches https://<domain>/ with HTTP fallback (we do NOT crawl).",
      "title": "Domain",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ],
  "title": "geo_auditArguments"
}

{
  "type": "object",
  "properties": {
    "number": {
      "description": "Phone number in E.164 format: + followed by country code and number, no spaces or dashes. Examples: '+14155552671' (US), '+905551234567' (TR), '+442071234567' (UK). Wrong: '0555-123-4567', '(415) 555-2671'",
      "title": "Number",
      "type": "string"
    }
  },
  "required": [
    "number"
  ],
  "title": "phone_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "ip": {
      "description": "IPv4 or IPv6 address to investigate (e.g. '8.8.8.8', '2606:4700::1111')",
      "title": "Ip",
      "type": "string"
    }
  },
  "required": [
    "ip"
  ],
  "title": "ip_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "target": {
      "description": "Domain or IP address to look up ASN for (e.g. 'cloudflare.com', '8.8.8.8')",
      "title": "Target",
      "type": "string"
    },
    "include_full_prefixes": {
      "default": false,
      "description": "Return the full announced-prefixes list (default: False, returns first 50). ipv4_count and ipv6_count are always honest pre-truncation totals. Set True for network mapping or BGP route audits — Cloudflare AS13335 announces 2500+ prefixes.",
      "title": "Include Full Prefixes",
      "type": "boolean"
    }
  },
  "required": [
    "target"
  ],
  "title": "asn_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "cve_id": {
      "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2024-3094', 'CVE-2023-44487')",
      "title": "Cve Id",
      "type": "string"
    },
    "include_affected_products": {
      "default": false,
      "description": "Return the full affected_products list (default: False, returns first 20). Set True for bulk audits or dependency scanning of Log4j-class CVEs with 50+ products.",
      "title": "Include Affected Products",
      "type": "boolean"
    },
    "include_full_references": {
      "default": true,
      "description": "Return the full references list (default: True, returns all references). total_references is always emitted with the honest count; patch URL detection always runs against the full list, so patch_url/patch_available are unaffected. Set False to truncate to first 10 entries when bandwidth-bound.",
      "title": "Include Full References",
      "type": "boolean"
    },
    "include_reference_tags": {
      "default": true,
      "description": "Return structured references_full field with [{url, tags, source}] objects (NVD reference tags + source provenance) (default: True). Inspects which references are vendor patches (tags=['Patch']) vs exploit PoCs (tags=['Exploit']) vs mailing list discussions. Patch URL detection is tag-first when refs_with_tags is populated; legacy cached rows fall back to regex. Set False to skip the structured shape for legacy clients.",
      "title": "Include Reference Tags",
      "type": "boolean"
    },
    "include_severity_breakdown": {
      "default": true,
      "description": "Return severity_sources, severity_consensus, and severity_disagreement (multi-source severity breakdown) (default: True). Surfaces vendor disputes (e.g. CVE-2023-38545 NVD-CRITICAL vs GHSA-HIGH). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Consensus uses majority-bucket vote with highest-severity tie-break (CRITICAL > HIGH > MEDIUM > LOW > NONE). Set False to skip if downstream cannot tolerate the extra fields.",
      "title": "Include Severity Breakdown",
      "type": "boolean"
    }
  },
  "required": [
    "cve_id"
  ],
  "title": "cve_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "cve_id": {
      "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2021-44228', 'CVE-2024-3094')",
      "title": "Cve Id",
      "type": "string"
    }
  },
  "required": [
    "cve_id"
  ],
  "title": "calculate_risk_scoreArguments"
}

{
  "type": "object",
  "properties": {
    "vector": {
      "description": "CVSS v3.0 or v3.1 vector string, e.g. 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'. v2 vectors are rejected — use the cvss_v2_vector field on cve_lookup if you need v2.",
      "title": "Vector",
      "type": "string"
    }
  },
  "required": [
    "vector"
  ],
  "title": "get_cvss_detailsArguments"
}

{
  "type": "object",
  "properties": {
    "product": {
      "default": "",
      "description": "Product or vendor token to filter by. EXACT match (case-insensitive) against the NVD-canonical CPE product/vendor token — NOT substring/fuzzy, and NOT necessarily the common project name. Common names, vendor renames, and build-tool artifact ids often differ from the canonical token (e.g. modern nginx CVEs are under 'nginx_open_source'/'nginx_plus', vendor 'f5', not 'nginx'; Maven 'log4j-core' maps to 'log4j'). A low or zero count for a well-known product usually means the token differs — do NOT assume coverage is complete. For dependency/package lists prefer check_dependencies, and for a domain's whole tech stack tech_stack_cve_audit (both auto-normalize tokens). A product match means CVEs exist for that product, not that a specific running version is affected — verify the running version is within each CVE's affected range. Omit to search all products.",
      "title": "Product",
      "type": "string"
    },
    "severity": {
      "default": "",
      "description": "CVSS severity level. Must be one of: CRITICAL, HIGH, MEDIUM, LOW. Omit for all severities.",
      "enum": [
        "",
        "CRITICAL",
        "HIGH",
        "MEDIUM",
        "LOW"
      ],
      "title": "Severity",
      "type": "string"
    },
    "published_after": {
      "default": "",
      "description": "Inclusive lower bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names a starting point, e.g. 'since 2015' → '2015-01-01', 'after March 2024' → '2024-03-01'. Omit to not bound the lower edge. Combine with published_before for ranges.",
      "title": "Published After",
      "type": "string"
    },
    "published_before": {
      "default": "",
      "description": "Inclusive upper bound on publish date as YYYY-MM-DD (UTC). Pick this when the user names an ending point, e.g. 'before 2020' → '2019-12-31', 'up to 2023' → '2023-12-31'. Omit to not bound the upper edge. Combine with published_after for ranges.",
      "title": "Published Before",
      "type": "string"
    },
    "kev": {
      "default": false,
      "description": "If true, return only CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog — these are actively exploited in the wild.",
      "title": "Kev",
      "type": "boolean"
    },
    "epss_min": {
      "default": 0,
      "description": "Minimum EPSS score filter (0.0-1.0). EPSS predicts exploitation probability. 0.5 = top ~5% most likely to be exploited. 0.0 = no filter.",
      "maximum": 1,
      "minimum": 0,
      "title": "Epss Min",
      "type": "number"
    },
    "sort": {
      "default": "",
      "description": "Sort order for results. Must be one of: published_desc (newest first), epss_desc (most exploitable first), cvss_desc (most severe first). Omit for newest first (default=published_desc).",
      "enum": [
        "",
        "published_desc",
        "epss_desc",
        "cvss_desc"
      ],
      "title": "Sort",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "description": "Maximum results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "offset": {
      "default": 0,
      "description": "Skip N results for pagination. Use with limit to page through results.",
      "maximum": 5000,
      "minimum": 0,
      "title": "Offset",
      "type": "integer"
    },
    "cwe_id": {
      "default": "",
      "description": "Filter by CWE weakness ID. Exact match, case-insensitive. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-120 (buffer overflow), CWE-78 (command injection). Format: CWE-<number>. Omit to not filter by CWE.",
      "title": "Cwe Id",
      "type": "string"
    },
    "cvss_min": {
      "default": 0,
      "description": "Minimum CVSS v3 base score (0.0-10.0). Default 0.0 = no filter (sentinel, not applied). Set > 0 to filter — CVEs with null CVSS are excluded when active. Use 7.0 for high+critical, 9.0 for critical only.",
      "maximum": 10,
      "minimum": 0,
      "title": "Cvss Min",
      "type": "number"
    },
    "cvss_max": {
      "default": 10,
      "description": "Maximum CVSS v3 base score (0.0-10.0). Default 10.0 = no filter (sentinel, not applied). Set < 10.0 to filter — CVEs with null CVSS are excluded when active. Combine with cvss_min for a range.",
      "maximum": 10,
      "minimum": 0,
      "title": "Cvss Max",
      "type": "number"
    },
    "vendor": {
      "default": "",
      "description": "Filter by vendor name (case-insensitive). When combined with product, both must match the same CPE row — prevents cross-row false matches. Example: vendor=apache, product=struts.",
      "title": "Vendor",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Per-result detail level. Default (omit) returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at — only do this when the user explicitly wants drill-down on every result. Even with 'full', per-result affected_products and references may be truncated (the per-result total_products/total_references report the honest counts); use cve_lookup for the guaranteed-complete per-CVE lists. For single-CVE detail prefer cve_lookup; slim default keeps token cost ~70% lower on Log4j-class queries. Note: verdict is at the response root, not per-row (was deduplicated to save ~40% payload).",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "title": "cve_searchArguments"
}

{
  "type": "object",
  "properties": {
    "limit": {
      "default": 50,
      "description": "Maximum results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "offset": {
      "default": 0,
      "description": "Skip N results for pagination.",
      "maximum": 5000,
      "minimum": 0,
      "title": "Offset",
      "type": "integer"
    },
    "include": {
      "default": "",
      "description": "Per-result detail level. Default ('') returns slim list items (cve_id, summary, severity, cvss_v3, cwe_id, epss, kev, total_products, published, modified, sources). Pass 'full' to also return description, cvss_breakdown, affected_products, references, first_seen_source, first_seen_at. Slim default avoids description/summary duplication that bloats 50-item leading lists. Verdict is at the response root, not per-row (deduplicated for ~40% payload savings). Allowed: '' or 'full'.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "title": "cve_leadingArguments"
}

{
  "type": "object",
  "properties": {
    "cve_id": {
      "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2024-3094', 'CVE-2023-44487')",
      "title": "Cve Id",
      "type": "string"
    }
  },
  "required": [
    "cve_id"
  ],
  "title": "exploit_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "cve_ids": {
      "description": "List of CVE identifiers in format CVE-YYYY-NNNNN (e.g. ['CVE-2024-3094', 'CVE-2021-44228', 'CVE-2023-44487']). Maximum 50 per request (same cap for Free and Pro).",
      "items": {
        "type": "string"
      },
      "title": "Cve Ids",
      "type": "array"
    },
    "include_affected_products": {
      "default": false,
      "description": "Return the full affected_products list for each CVE in the batch (default: False, each CVE returns first 20). Set True for bulk dependency audits.",
      "title": "Include Affected Products",
      "type": "boolean"
    },
    "include_full_references": {
      "default": true,
      "description": "Return the full references list for each CVE in the batch (default: True). total_references is always emitted. Set False to truncate each item to first 10 entries when payload-bound.",
      "title": "Include Full References",
      "type": "boolean"
    },
    "include_reference_tags": {
      "default": true,
      "description": "Return structured references_full per CVE in the batch [{url, tags, source}]. Same shape as cve_lookup (default: True). Activates tag-first patch detection per item. Set False for legacy clients.",
      "title": "Include Reference Tags",
      "type": "boolean"
    },
    "include_severity_breakdown": {
      "default": true,
      "description": "Return severity_sources/consensus/disagreement per CVE in batch. Same shape as cve_lookup (default: True). cvss_v2 and cvss_v2_vector are always emitted (additive non-opt-in). Set False to skip if downstream cannot tolerate the extra fields.",
      "title": "Include Severity Breakdown",
      "type": "boolean"
    }
  },
  "required": [
    "cve_ids"
  ],
  "title": "bulk_cve_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "cve_id": {
      "description": "CVE identifier in format CVE-YYYY-NNNNN (e.g. 'CVE-2021-44228', 'CVE-2024-3094')",
      "title": "Cve Id",
      "type": "string"
    }
  },
  "required": [
    "cve_id"
  ],
  "title": "kev_detailArguments"
}

{
  "type": "object",
  "properties": {
    "cwe_id": {
      "description": "CWE identifier — accepts 'CWE-79', 'cwe-79', or bare '79'. Common values: CWE-79 (XSS), CWE-89 (SQL injection), CWE-78 (command injection), CWE-502 (deserialization), CWE-22 (path traversal), CWE-120 (buffer overflow).",
      "title": "Cwe Id",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default ('') returns slim record (first 3 mitigations, first 3 examples; extended_description is null). total_mitigations / total_examples are always honest pre-truncation counts. Pass 'full' to populate extended_description and return the full mitigations + examples lists.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "required": [
    "cwe_id"
  ],
  "title": "cwe_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "technique_id": {
      "description": "MITRE ATLAS technique id, format 'AML.T####' or 'AML.T####.###' for sub-techniques (e.g. 'AML.T0000', 'AML.T0051' LLM Prompt Injection, 'AML.T0000.000').",
      "title": "Technique Id",
      "type": "string"
    }
  },
  "required": [
    "technique_id"
  ],
  "title": "atlas_technique_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "technique_ids": {
      "description": "List of MITRE ATLAS technique ids in format 'AML.T####' or 'AML.T####.###' (e.g. ['AML.T0051', 'AML.T0043', 'AML.T0000.000']). Up to 50 per call. Case-insensitive; normalized + de-duplicated server-side. Each id counts as 1 request toward the rate limit.",
      "items": {
        "type": "string"
      },
      "maxItems": 50,
      "title": "Technique Ids",
      "type": "array"
    }
  },
  "required": [
    "technique_ids"
  ],
  "title": "bulk_atlas_technique_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "keyword": {
      "default": "",
      "description": "Substring match against technique name + description (case-insensitive). Min 2 chars. Example: 'prompt injection', 'model evasion', 'poisoning'. Omit to list all.",
      "title": "Keyword",
      "type": "string"
    },
    "tactic": {
      "default": "",
      "description": "Filter by ATLAS tactic id, format 'AML.TA####'. Examples: 'AML.TA0002' (Reconnaissance), 'AML.TA0007' (ML Attack Staging). Omit for all tactics.",
      "title": "Tactic",
      "type": "string"
    },
    "maturity": {
      "default": "",
      "description": "Filter by maturity: 'demonstrated' (observed in real attacks), 'feasible' (theoretical), or 'realized' (newer ATLAS classification, treat similar to demonstrated). Omit for all.",
      "enum": [
        "",
        "demonstrated",
        "feasible",
        "realized"
      ],
      "title": "Maturity",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "description": "Max results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default ('') returns slim records (description truncated to 240 chars; drill via atlas_technique_lookup for full text). Pass 'full' for full description on every row — large catalogs (167 techniques) can return ~100KB at full.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    },
    "exclude_id": {
      "default": "",
      "description": "Optional ATLAS technique id to exclude from results, format 'AML.T####' or 'AML.T####.###'. Useful when chaining from atlas_technique_lookup to fetch siblings without echoing self in the same-tactic search.",
      "title": "Exclude Id",
      "type": "string"
    }
  },
  "title": "atlas_technique_searchArguments"
}

{
  "type": "object",
  "properties": {
    "case_study_id": {
      "description": "MITRE ATLAS case study id, format 'AML.CS####' (e.g. 'AML.CS0000', 'AML.CS0014').",
      "title": "Case Study Id",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default (omit/empty) returns slim (description truncated to 240 chars). Pass 'full' for the verbose narrative — case-study descriptions can run 1-3KB.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "required": [
    "case_study_id"
  ],
  "title": "atlas_case_study_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "keyword": {
      "default": "",
      "description": "Substring match against case study name + description (case-insensitive). Min 2 chars. Example: 'evasion', 'data poisoning'. Omit to list all.",
      "title": "Keyword",
      "type": "string"
    },
    "technique_id": {
      "default": "",
      "description": "Filter to case studies that include this ATLAS technique id, format 'AML.T####' or 'AML.T####.###' (e.g. 'AML.T0051'). Omit for any technique.",
      "title": "Technique Id",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "description": "Max results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default ('') returns slim records (description truncated to 240 chars). Pass 'full' for full description on every row.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "title": "atlas_case_study_searchArguments"
}

{
  "type": "object",
  "properties": {
    "defense_id": {
      "description": "D3FEND defense slug from the ontology URI fragment (CamelCase), e.g. 'TokenBinding', 'FileHashing', 'CertificatePinning'.",
      "title": "Defense Id",
      "type": "string"
    }
  },
  "required": [
    "defense_id"
  ],
  "title": "d3fend_defense_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "keyword": {
      "default": "",
      "description": "Substring match against defense label, description, or parent_label (case-insensitive). Min 2 chars. Example: 'token', 'hashing', 'sandbox'. Omit to list all.",
      "title": "Keyword",
      "type": "string"
    },
    "tactic": {
      "default": "",
      "description": "Filter by D3FEND tactic. One of: Model, Harden, Detect, Isolate, Deceive, Evict, Restore. Omit for all tactics.",
      "enum": [
        "",
        "Model",
        "Harden",
        "Detect",
        "Isolate",
        "Deceive",
        "Evict",
        "Restore"
      ],
      "title": "Tactic",
      "type": "string"
    },
    "artifact": {
      "default": "",
      "description": "Filter by exact targeted digital artifact (case-insensitive), e.g. 'Access Token', 'File', 'Process'. Omit for any artifact.",
      "title": "Artifact",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "description": "Max results to return. Range: 1-200.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default (omit/empty) returns slim rows (drops the deterministic ontology `uri` field, ~60 chars/row saved). Pass 'full' to get `uri` back on every row. The slug `defense_id` is always returned and uniquely identifies the defense.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    },
    "exclude_id": {
      "default": "",
      "description": "Optional D3FEND defense slug (CamelCase, e.g. 'TokenBinding') to omit from results. Useful when chaining from d3fend_defense_lookup so the originating defense is not echoed back in its own siblings list. Omit when not needed.",
      "title": "Exclude Id",
      "type": "string"
    }
  },
  "title": "d3fend_defense_searchArguments"
}

{
  "type": "object",
  "properties": {
    "attack_technique_id": {
      "description": "ATT&CK technique id matching 'T####' or 'T####.###' (e.g. 'T1059', 'T1550.001'). Use this to bridge from CVE/ATLAS findings to D3FEND mitigations.",
      "title": "Attack Technique Id",
      "type": "string"
    },
    "limit": {
      "default": 30,
      "description": "Cap on `defenses` array length. Default 30; popular T-codes (T1059, T1078) map to 30-50+ defenses. `total` and `coverage_by_tactic` always reflect the honest pre-truncation count.",
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default (omit/empty) returns slim rows (drops the deterministic ontology `uri` — popular T-codes with 15+ defenses save ~900 chars). Pass 'full' to get `uri` back on every row.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    },
    "exclude_id": {
      "default": "",
      "description": "Optional D3FEND defense slug to omit from the defenses list. Used when chaining from d3fend_defense_lookup so the originating defense is not echoed back in its own 'see also' results.",
      "title": "Exclude Id",
      "type": "string"
    }
  },
  "required": [
    "attack_technique_id"
  ],
  "title": "d3fend_defense_for_attackArguments"
}

{
  "type": "object",
  "properties": {
    "attack_technique_ids": {
      "description": "List of ATT&CK technique ids (T#### or T####.###) to assess. Capped at 500 — extra entries are dropped server-side. Example: ['T1059', 'T1550.001', 'T1190', 'T9999'].",
      "items": {
        "type": "string"
      },
      "maxItems": 500,
      "title": "Attack Technique Ids",
      "type": "array"
    }
  },
  "required": [
    "attack_technique_ids"
  ],
  "title": "d3fend_attack_coverageArguments"
}

{
  "type": "object",
  "properties": {
    "rule_id": {
      "description": "Sigma rule UUID (RFC 4122, 36 chars, hyphenated). Example: '195e1b9d-bfc2-4ffa-ab4e-35aef69815f8'. Obtained from the REST sigma_rule_search endpoint or external SIEM correlation.",
      "maxLength": 50,
      "title": "Rule Id",
      "type": "string"
    }
  },
  "required": [
    "rule_id"
  ],
  "title": "sigma_rule_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "rule_ids": {
      "description": "List of Sigma rule UUIDs in RFC 4122 format. Up to 50 per call (same cap for Free and Pro). Each rule_id counts as 1 request toward the hourly quota. Per-item validation: invalid-format ids return status='invalid_format', unknown UUIDs return status='not_found' — the whole call does not fail.",
      "items": {
        "type": "string"
      },
      "maxItems": 50,
      "title": "Rule Ids",
      "type": "array"
    }
  },
  "required": [
    "rule_ids"
  ],
  "title": "bulk_sigma_rule_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "indicator": {
      "description": "Indicator of Compromise: IP address, domain, full URL, or file hash in MD5/SHA1/SHA256 format (e.g. '8.8.8.8', 'evil.com', 'https://evil.com/malware.exe', 'd41d8cd98f00b204e9800998ecf8427e')",
      "title": "Indicator",
      "type": "string"
    }
  },
  "required": [
    "indicator"
  ],
  "title": "ioc_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "file_hash": {
      "description": "File hash to look up. Accepts MD5 (32 chars), SHA-1 (40 chars), or SHA-256 (64 chars). Lowercase hex only, no spaces. Example: 'd41d8cd98f00b204e9800998ecf8427e'",
      "title": "File Hash",
      "type": "string"
    }
  },
  "required": [
    "file_hash"
  ],
  "title": "hash_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "sha1_hash": {
      "description": "Full SHA-1 hash of the password as 40 lowercase hexadecimal characters (e.g. '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8' for 'password')",
      "title": "Sha1 Hash",
      "type": "string"
    }
  },
  "required": [
    "sha1_hash"
  ],
  "title": "password_checkArguments"
}

{
  "type": "object",
  "properties": {
    "url": {
      "description": "Full URL to check, including protocol (e.g. 'https://suspicious-login.com/verify', 'http://evil.com/payload.exe')",
      "title": "Url",
      "type": "string"
    }
  },
  "required": [
    "url"
  ],
  "title": "phishing_checkArguments"
}

{
  "type": "object",
  "properties": {
    "indicators": {
      "description": "List of indicators of compromise: IP addresses, domains, URLs, or file hashes (e.g. ['8.8.8.8', 'evil.com', 'd41d8cd98f00b204e9800998ecf8427e']). Maximum 50 per request (same cap for Free and Pro). Each indicator type is auto-detected.",
      "items": {
        "type": "string"
      },
      "title": "Indicators",
      "type": "array"
    }
  },
  "required": [
    "indicators"
  ],
  "title": "bulk_ioc_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "code": {
      "description": "Source code string to scan for secrets (can be a single file or code snippet)",
      "title": "Code",
      "type": "string"
    },
    "language": {
      "default": "generic",
      "description": "Programming language of the code. Must be one of: python, javascript, typescript, java, go, ruby, shell, bash, generic. Use 'generic' if unsure.",
      "enum": [
        "python",
        "javascript",
        "typescript",
        "java",
        "go",
        "ruby",
        "shell",
        "bash",
        "generic"
      ],
      "title": "Language",
      "type": "string"
    }
  },
  "required": [
    "code"
  ],
  "title": "check_secretsArguments"
}

{
  "type": "object",
  "properties": {
    "code": {
      "description": "Source code string to scan for injection vulnerabilities (can be a single file or code snippet)",
      "title": "Code",
      "type": "string"
    },
    "language": {
      "default": "generic",
      "description": "Programming language of the code. Must be one of: python, javascript, typescript, java, go, ruby, shell, bash, generic. Use 'generic' if unsure.",
      "enum": [
        "python",
        "javascript",
        "typescript",
        "java",
        "go",
        "ruby",
        "shell",
        "bash",
        "generic"
      ],
      "title": "Language",
      "type": "string"
    }
  },
  "required": [
    "code"
  ],
  "title": "check_injectionArguments"
}

{
  "type": "object",
  "properties": {
    "packages": {
      "description": "List of dependency packages to audit. Each item is an object with 'name' (required, max 200 chars, e.g. 'lodash', 'django', 'log4j-core') and optional 'version' (max 100 chars, e.g. '4.17.0', '2.14.1'). Only 'name' and 'version' fields are used; extra fields are ignored. Example: [{\"name\": \"lodash\", \"version\": \"4.17.0\"}, {\"name\": \"django\"}]. Maximum 50 per request (same cap for Free and Pro).",
      "items": {
        "additionalProperties": true,
        "type": "object"
      },
      "title": "Packages",
      "type": "array"
    }
  },
  "required": [
    "packages"
  ],
  "title": "check_dependenciesArguments"
}

{
  "type": "object",
  "properties": {
    "username": {
      "description": "Username string to search across platforms, without @ prefix (e.g. 'torvalds', 'johndoe', 'elonmusk')",
      "title": "Username",
      "type": "string"
    }
  },
  "required": [
    "username"
  ],
  "title": "username_lookupArguments"
}

{
  "type": "object",
  "properties": {
    "headers": {
      "description": "JSON string of HTTP header name-value pairs to validate. Example: '{\"Strict-Transport-Security\": \"max-age=31536000\", \"X-Frame-Options\": \"DENY\"}'. Include only security-relevant headers you want to analyze.",
      "title": "Headers",
      "type": "string"
    },
    "include": {
      "default": "",
      "description": "Detail level. Default ('') returns slim findings — raw header values capped at 500 chars with total_value_length carrying the honest pre-truncation length. Pass 'full' to restore the full raw value. Allowed: '' or 'full'.",
      "enum": [
        "",
        "full"
      ],
      "title": "Include",
      "type": "string"
    }
  },
  "required": [
    "headers"
  ],
  "title": "check_headersArguments"
}