{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Web Security MCP Finding v2",
  "type": "object",
  "required": [
    "finding",
    "category",
    "title",
    "observed_fact",
    "inference",
    "recommendation",
    "severity",
    "required_conditions",
    "confidence",
    "standalone_exploitability",
    "conditional_impact",
    "evidence"
  ],
  "additionalProperties": false,
  "properties": {
    "finding": {
      "type": "string",
      "minLength": 1
    },
    "category": {
      "type": "string",
      "minLength": 1
    },
    "title": {
      "type": "string",
      "minLength": 1
    },
    "observed_fact": {
      "type": "string",
      "minLength": 1
    },
    "inference": {
      "type": "string",
      "minLength": 1
    },
    "recommendation": {
      "type": "string",
      "minLength": 1
    },
    "severity": {
      "enum": [
        "info",
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "required_conditions": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "confidence": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "description": "Confidence in observed_fact only, not attack success or inference."
    },
    "standalone_exploitability": {
      "const": "none",
      "description": "This passive MVP does not demonstrate standalone exploits."
    },
    "conditional_impact": {
      "type": "object",
      "required": [
        "level",
        "description"
      ],
      "additionalProperties": false,
      "properties": {
        "level": {
          "enum": [
            "info",
            "low",
            "medium",
            "high",
            "critical",
            "configuration-dependent"
          ]
        },
        "description": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "evidence": {
      "type": "object",
      "description": "Structured untrusted observations. Cookie values are omitted."
    }
  }
}

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Web Security MCP Finding v2",
  "type": "object",
  "required": [
    "finding",
    "category",
    "title",
    "observed_fact",
    "inference",
    "recommendation",
    "severity",
    "required_conditions",
    "confidence",
    "standalone_exploitability",
    "conditional_impact",
    "evidence"
  ],
  "additionalProperties": false,
  "properties": {
    "finding": {
      "type": "string",
      "minLength": 1
    },
    "category": {
      "type": "string",
      "minLength": 1
    },
    "title": {
      "type": "string",
      "minLength": 1
    },
    "observed_fact": {
      "type": "string",
      "minLength": 1
    },
    "inference": {
      "type": "string",
      "minLength": 1
    },
    "recommendation": {
      "type": "string",
      "minLength": 1
    },
    "severity": {
      "enum": [
        "info",
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "required_conditions": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "confidence": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "description": "Confidence in observed_fact only, not attack success or inference."
    },
    "standalone_exploitability": {
      "const": "none",
      "description": "This passive MVP does not demonstrate standalone exploits."
    },
    "conditional_impact": {
      "type": "object",
      "required": [
        "level",
        "description"
      ],
      "additionalProperties": false,
      "properties": {
        "level": {
          "enum": [
            "info",
            "low",
            "medium",
            "high",
            "critical",
            "configuration-dependent"
          ]
        },
        "description": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "evidence": {
      "type": "object",
      "description": "Structured untrusted observations. Cookie values are omitted."
    }
  }
}