For scanners, vulnerability-management platforms, registries and underwriters that ingest advisory records — and have to defend the numbers they publish from them.
Ingest, index, enrich and redistribute them publicly, with attribution. No key, no registration, no rate limit on the machine formats. Every machine format carries an ETag and honours If-None-Match, so poll as often as you like and take the 304.
We stated this licence in writing to osv.dev as the basis on which our records can be ingested. We are not going to take it back. If you are here to decide whether you can depend on this feed: you can, and nothing below changes that.
GET https://stillosdigitalholdings.com/advisories/osv/index.json — {id, modified} index
GET https://stillosdigitalholdings.com/advisories/osv/all.json — every record, OSV 1.6
GET https://stillosdigitalholdings.com/advisories/osv/<id>.json — one record
GET https://stillosdigitalholdings.com/advisories/csaf/provider-metadata.json — CSAF publisher metadata (the onboarding fetch)
GET https://stillosdigitalholdings.com/advisories/csaf/index.json — CSAF 2.0 document index
GET https://stillosdigitalholdings.com/advisories/cve-records.json — CVE 5.1 containers, as filed with MITRE
GET https://stillosdigitalholdings.com/advisories/capabilities.json — machine-readable capability declaration
Scope: only MITRE-assigned, already-public CVEs appear. Undisclosed findings are never published here — premature disclosure is harmful, and that rule is enforced by this service's own self-test.
We enumerate 6,751 of 26,338 distinct remote-declaring hosts in the public MCP registry census — 25.6%. 19,587 hosts are NOT covered.
A host we could not reach counts as not enumerated. Unobserved is never attested safe. We publish this figure because a platform that cites our feed has to be able to state what it does not cover.
Raw: 89% of 37,042 surface-change events carried no version signal. 62.6% of those are a single publisher (pipeworx.io); excluding it, 75.1%.
The figure we publish is the >=1.0.0 subset: 8,621 events across 1,459 publishers, top publisher 1.5% — it survives the leave-one-out.
A share that collapses when one publisher is removed is a fact about that publisher, not about the ecosystem. Cite digest f445592485e9879259c91c4f… · verify at /notary/verify. Full attestation: /ratings/coverage.json.
This is not access to the records. Those are free forever. What this buys is the part you cannot get by scraping:
Price anchored on our existing published platform rate, not invented for this page. Nothing charges here — request a scope and a human replies.
Independent records of MCP tool-surface change are no longer scarce — at least six projects publish them, and we say so. What is scarce is a published number that survives its own control. Our headline ships beside its leave-one-out, our coverage gap is published rather than implied, and both are signed and recomputable from named inputs. If you have to defend a figure to a customer, an auditor or a regulator, that is the difference.