Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Changed the definition of "update_product"
⟨119 unchanged words⟩ / factor-only edit runs no analysis and isfree.free; the product's VEX is re-evaluated against the new factors in the background (not metered), so ``get_product`` / ``get_product_vex`` show the new verdicts a few seconds later. ``kernel_version`` takes the same forms as in ``create_product`` ⟨74 unchanged words⟩
Changed the definition of "create_product" and "update_product"
⟨214 unchanged words⟩ retrying. Check ``whoami`` before a batch of creates. ``kernel_version`` is the kernel's release. For a stable kernel that is its version (``6.6.67``). For a CIP SLTS kernel pass its CIP release or the full ``uname -r``: ``4.19.325-cip136``, ``4.19.325-cip136-rt50``; a trailing local suffix such as ``-yocto-standard`` is accepted and ignored. The ``-cipN`` counter decides which of CIP's own backported fixes apply, so pass it whenever the device runs a CIP kernel — a bare ``4.19.325`` is analysed as the final 4.19 stable release (the ``.config`` never names the ``-cipN``). The known CIP releases of a series are listed by ``GET /api/kernel-releases?flavor=cip&series=4.19`` (add ``&rt=1`` for the RT tree). The returned ``kernel_release`` shows how the string was read (``flavor``, ``base``, ``series``, ``cip``, ``rt``, ``local``; null when the string is no release). Surrounding whitespace is trimmed. A version string the analysis cannot read (e.g. ``4.19.325cip136``, or anything non-ASCII) fails with "Unrecognized kernel version" [400] before anything is created or the upload is consumed. A CIP release must be on the stable base the uploaded ``.config``'s header names (the header shows the exact base; a CIP tag never changes it): ``4.19.300-cip90`` with a ``4.19.325`` config fails with "… is based on 4.19.300, but the .config header says 4.19.325" [400]. This is checked before the upload is consumed, so the same upload can be used again with the right release. A stable version, or a ``.config`` without a version header, is not checked.
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Authorization not required, issuer https://kernelscan.io
Changed the definition of "request_access"
Request anExplaininvitationhow toKernelScangetfromainsideKernelScanMCPaccount (no API key needed).UseSelf-registrationthisiswhenopena—
Certificate recorded, valid to 2026-12-10
Authorization not required
Added "list_product_vex_entries"; changed the definition of "get_product_vex" (10 tools before, 11 now)
Return theCycloneDX 1.6VEXdocumentMANIFEST for one of the caller'sproducts.products — metadata, not the document. Multi-megabyte CycloneDX documents (up to 8,000+ vulnerability entries) are not safe model-context payloads, so this tool returns a bounded manifest: CycloneDX format/spec version, product id, generated/expires timestamps, the VEX hash and the composite ETag identity, the uncompressed size in bytes, total + per-status vulnerability counts, and the authenticated REST download path. Reads from the 24hProductVexCache; if the cache is empty/expired thenext call to``get_product`` (or the REST endpoint) will regenerate it.Carries
First tool surface recorded: 10 tools (server version 1.26.0)
Showing the latest 17 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨120 unchanged words⟩ factor-only edit runs no analysis and is free. ``kernel_version`` takes the same forms as in ``create_product``: a stable version, or a CIP release / full ``uname -r`` such as ``4.19.325-cip136-rt50``, whose ``-cipN`` counter decides which CIP fixes apply. A changed version string the analysis cannot read fails with 400 and changes nothing; re-sending the stored value is always accepted. A CIP release must stay on the base its ``.config`` header names: whichever of the two the update changes is checked against the other ([400], before the upload is consumed).
{"properties":{"email":{"titleanyOf":[{"stringnull"}],"default":null,"title":"Email"},"name":{"anyOf":[{"type":"string ⟨12 unchanged words⟩ ,"default":null,"title":"Reason"}},"required":["email"],"title":"request_accessArguments","type":"object"}
Page through the VEX vulnerability entries of one of the caller's products. Returns COMPLETE CycloneDX vulnerability objects for one bounded page — never the root document, never all entries — plus ``returned``, ``total_matching``, and a ``next_cursor`` to continue with. Every result is bounded to 256 KiB: the page stops before the byte limit and returns a cursor when necessary. Entries are ordered by CVE id (ascending) and carry the same live ``kernelscan.io:exploit_maturity`` / ``kernelscan.io:kev`` properties as the REST download (ba…