v0.2.0: NVD source identifiers resolve to contributor names — ⚠️ breaking value change

NVD source identifiers resolve to contributor names — ⚠️ breaking value change

• weaknesses[].source and references[].source now emit NVD's published contributor name (e.g. CVE, CISA-ADP) instead of the raw identifier — the GUID is not preserved anywhere else, so a consumer matching the old value breaks on upgrade with no schema change to warn it (#46)
• New NvdSourceService caches NVD's source dictionary (/rest/json/source/2.0) behind a 24h TTL, single-flighted across concurrent callers (#46)
• Bounded retry budget keeps an unreachable source dictionary from stalling a CVE fetch on the full CVE retry budget; a caller-cancelled load no longer counts as an outage; brief-mode fetches skip the dictionary entirely
• deps: @biomejs/biome ^2.5.5 → ^2.5.6

CHANGELOG v0.2.0

v0.1.19: Shared CveRecord schema, history paging notices, CPE rejection translation

Shared CveRecord schema, history paging notices, CPE rejection translation

• nvd_audit_cpe and nvd_get_cve build from one shared CveRecord schema instead of drifting independently (#37)
• nvd_get_cve's advertised item schema now covers full mode, the default call, instead of describing brief-only fields (#38)
• nvd_get_cve_history gains a notice on empty and partial pages, matching the other paginating tools; also fixes a misreported unrevised CVE when order: oldest pages past the end (#42)
• an NVD parameter rejection on a CPE input now translates to invalid_cpe_format with a recovery hint on nvd_audit_cpe and nvd_search_cpes (#45)

CHANGELOG v0.1.19

v0.1.18: CVSS scoring fixes, empty-CVE CPE audits, exactPhrase search

CVSS scoring fixes, empty-CVE CPE audits, exactPhrase search

• CVSS entries scored 0.0 were dropped; v2 baseSeverity now read from NVD's own field instead of derived (#39)
• nvd_audit_cpe returns an empty success instead of cpe_not_found for a CPE with no known CVEs (#40, #41)
• nvd_search_cves gains exactPhrase for phrase matching (#44)
• docs/design.md error contracts corrected from InvalidParams to ValidationError (#43)
• deps: @types/node ^26.1.1 → ^26.1.2

CHANGELOG v0.1.18

v0.1.17: Paging notice fixes and nvd_get_cve brief-row consolidation

Paging notice fixes and nvd_get_cve brief-row consolidation

• nvd_search_cves, nvd_search_cpes, and nvd_audit_cpe distinguish an offset past the result set from an empty page NVD returned inside a range it says has matches (#34)
• nvd_search_cves and nvd_audit_cpe gain the next-page notice nvd_search_cpes already had (#36)
• nvd_get_cve's brief mode now calls the CVE service's toBriefCve() instead of duplicating the row inline, sharing BriefCveRecordSchema with nvd_search_cves (#35)

CHANGELOG v0.1.17

v0.1.16: CPE paging, get_cve rendering parity, enrichment docs

CPE paging, get_cve rendering parity, enrichment docs

• nvd_audit_cpe and nvd_search_cpes gain offset paging, echoed in enrichment (#31)
• nvd_get_cve's format() renders CPE match criteria and every language a record carries, matching structuredContent (#30)
• nvd_search_cves and nvd_get_cve brief rows carry a truncated description (#32)
• docs/design.md, README, and the CLAUDE.md/AGENTS.md tool template describe the enrichment block instead of the removed queryMeta envelope (#26)
• fix: removed a dead empty-result branch in the nvd-cve resource

CHANGELOG v0.1.16

v0.1.15: CVE history ordering, JSON-safe change values, and recovery hints

CVE history ordering, JSON-safe change values, and recovery hints

• nvd_get_cve_history gains an order input (newest/oldest) and no longer loses pages carrying Affected/SSVC change values (#27, #29)
• invalid_cve_id_format and cve_not_found now carry their declared recovery hints (#33)
• nvd_search_cves' severity filter is documented as exact-band, not a floor (#28)
• framework tooling and skills synced for mcp-ts-core 0.11.0
• deps: @cyanheads/mcp-ts-core ^0.10.14 → ^0.11.0

CHANGELOG v0.1.15

v0.1.14: Filter and severity context, English-default descriptions, rate_limited contract fix

Filter and severity context, English-default descriptions, rate_limited contract fix

Diagnostic output for narrow and empty result sets, English-first CVE descriptions with an opt-in, and the rate_limited error code aligned to the wire.

Added:

• filtersApplied on nvd_search_cves — echoes the non-default filters a query applied (#19)
• severityMin/filteredCount on nvd_audit_cpe — page-relative count of CVEs the severity floor dropped from the fetched page (#19)
• filteredSeverity on nvd_search_cves rows — severity at the filtered CVSS version when it disagrees with the cross-version headline (#24)

Changed:

• Full-record descriptions default to English; new allLanguages input on nvd_get_cve and nvd_audit_cpe keeps every localized description (#23)

Fixed:

• rate_limited declares RateLimited, not ServiceUnavailable, across all five tools and docs/design.md (#25)
• nvd_get_cve format() falls back to the first description when a record has no English entry (#23)

218 tests pass; bun run devcheck clean.

CHANGELOG v0.1.14

v0.1.13: Retry pacing and CPE match criteria rendering

Retry pacing and CPE match criteria rendering

Retries no longer self-inflict NVD's rate limit, and nvd_audit_cpe's Configurations block carries real CPE data instead of bare operator lines.

Added:

• configurations[].operator — the group-level AND/OR marking jointly-required nodes; typed, normalized, and on structuredContent (#22)
• .github/SECURITY.md and .gitattributes
• Socket install scanning and a 3-day minimumReleaseAge supply-chain gate in bunfig.toml

Changed:

• Docker base pinned oven/bun:1.3 → oven/bun:1.3.14 on both stages, with BuildKit cache mounts
• Vendored framework scripts and skills resynced to the mcp-ts-core 0.10.14 line

Fixed:

• Retry wraps the pacing queue instead of running inside it — every attempt takes its own turn against the rate budget rather than firing up to 4 unpaced requests from one call (#21)
• A 403's Retry-After holds every pending request; a keyed call spends one patient retry across the window, a keyless call fails fast naming NVD_API_KEY (#21)
• Deterministic rejections opt out of retry via data.retryable === false; a refused API key raises ConfigurationError naming NVD_API_KEY instead of reporting a malformed CVE ID (#21)
• nvd_audit_cpe renders one line per CPE match — criteria, version bounds, operators — capped at 5 per CVE with a … N more trailer, replacing bare Operator: lines (#22)

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.14
• @biomejs/biome ^2.5.0 → ^2.5.3
• @types/node ^26.0.0 → ^26.1.1
• ignore ^7.0.5 → ^7.0.6
• tsc-alias ^1.8.17 → ^1.9.0
• vitest ^4.1.9 → ^4.1.10
• @socketsecurity/bun-security-scanner ^1.1.2 (new dev dependency)

bun audit 8 → 0 open advisories (2 high, 6 moderate), all transitive.

194 tests pass; bun run devcheck clean.

CHANGELOG v0.1.13

v0.1.12: mcp-ts-core ^0.10.9 maintenance

mcp-ts-core ^0.10.9 maintenance

Framework-maintenance only — vendored scripts/skills resynced to the 0.10.7–0.10.9 line; no server source or behavior change.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

Changed:

• check-dependency-specifiers devcheck step — fails on floating latest/*/dist-tag specifiers in package.json + bun.lock workspaces (cyanheads/mcp-ts-core#246)
• lint-packaging.ts check 10 — plugin-manifest correctness; gated by new devcheck.config.json packaging.pluginManifests flag (cyanheads/mcp-ts-core#240)
• Fresh-scaffold + worktree-deletion guards across build-changelog / devcheck / antipattern / skill-version scripts (cyanheads/mcp-ts-core#237, #242, #243)

178 tests pass; bun run devcheck clean.

v0.1.11: mcp-ts-core ^0.10.6, enrichment total() adoption

mcp-ts-core ^0.10.6, enrichment total() adoption

Adopts the framework's enrichment total() helper and the 0.10.x packaging tooling, with explicit createApp identity and a hardened Docker image.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• @types/node ^25.9.1 → ^25.9.3
• vitest ^4.1.7 → ^4.1.8

Changed:

• Enrichment total reported via ctx.enrich.total() under totalCount across nvd_search_cves, nvd_search_cpes, nvd_audit_cpe, nvd_get_cve_history; the framework now renders the Total trailer row
• createApp() sets name/title explicitly to nist-nvd-mcp-server
• Dockerfile gains an OCI version label (ARG APP_VERSION) and a bun-native /healthz HEALTHCHECK
• bundle chains clean-mcpb.ts to strip dependency-shipped agent docs from the .mcpb; lint-packaging adds the matching post-bundle content check
• check-framework-antipatterns.ts adds a z.coerce.boolean() env-flag rule
• nvd_search_cpes missing_search_input code corrected InvalidParams → ValidationError

178 tests pass; bun run devcheck clean.