v0.6.0 — product profiles (watchlists) and monthly triage prompt

What's new

Product profiles / watchlists (#6, contributed by @mrbodean)

Scope any msrc_search to the products you actually run:

• product_profile="identity-core" — built-in profiles: identity-core, endpoint, server-infrastructure
• Ad-hoc products=[...] and product_families=[...] matcher lists (union: keep a vuln matching any listed product OR family)
• Override/extend built-ins via a JSON file at MSRC_PROFILES_PATH
• Matching is entirely local — profile contents are never sent to MSRC, FIRST.org, CISA, or telemetry
• Unknown/invalid profile fails closed with error_kind="invalid_input" instead of an unscoped result

monthly_triage MCP prompt (#6)

The server now registers a monthly_triage prompt — a guided analyst workflow (publicly disclosed zero-days → CISA KEV → exploited → network/no-auth/no-UI criticals → identity/endpoint focus → briefing) built entirely on msrc_search. Optional product_profile and month arguments.

Portable copies ship in-repo: prompts/monthly_triage.md (plain text) and skills/patch-tuesday-triage/ (agent skill), both deployable independently of the server.

Compatibility

All new parameters are opt-in; the default JSON response shape is unchanged.

Full Changelog: v0.5.0...v0.6.0