{
  "about": "Newly disclosed MCP and agent-tool vulnerabilities, matched against the resources a2ally has scanned. A match means a scanned artifact's name or URL names the affected product — a reason to re-scan and read the advisory, not a verdict on the artifact.",
  "feed": {
    "mode": "import",
    "endpoint": "POST /v1/mcp-risk-watch/import",
    "accepts": "NVD 2.0 JSON ({vulnerabilities: [...]}) or {cves: [...]}",
    "live_polling": "not wired — a scheduled importer is the remaining feed step",
    "entries": 0
  },
  "registry": {
    "artifacts_scanned": 0,
    "artifacts_matched": 0,
    "matches": 0
  },
  "entries": [],
  "methodology": "Matching is by name: an entry matches a scanned artifact when one of its affected-product names appears in the artifact's name or canonical URL (normalized). Name matching over- and under-counts — CPE-exact matching against scan contents is future work, and this surface never claims a scanned artifact is vulnerable, only that it names an affected product."
}