@highflame/policy 2.2.36 → 2.2.38

package/_schemas/agent_ops/context.json

@@ -795,6 +795,798 @@
         }
       ]
     },
+    {
+      "name": "process_response",
+      "description": "Process a model response (LLM chat completion output) — threat focus: data leakage in output, harmful content, hallucination, indirect injection carried back to the caller. Distinct trigger from process_prompt (ADR 0031) so a policy can be scoped to one direction from its head and prompt-only detectors stay off the egress path.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "Caller's RBAC role projected from the principal's token (AARM R6 / CAP-IDN-011)"
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "Privilege-scope strings granted to the caller, projected from the token (AARM R6 / CAP-IDN-011)"
+        },
+        {
+          "key": "identity_type",
+          "type": "string",
+          "required": false,
+          "description": "Principal identity class projected from the token: 'human', 'agent', 'service', or 'mcp_server'"
+        },
+        {
+          "key": "principal",
+          "type": "string",
+          "required": false,
+          "description": "Stable principal identifier projected from the token (e.g. a ZeroID / WIMSE URI or user id)"
+        },
+        {
+          "key": "request_id",
+          "type": "string",
+          "required": true,
+          "description": "Unique identifier for this request, useful for audit trails and debugging"
+        },
+        {
+          "key": "timestamp",
+          "type": "number",
+          "required": true,
+          "description": "Unix timestamp in milliseconds when the request was processed"
+        },
+        {
+          "key": "direction",
+          "type": "string",
+          "required": true,
+          "description": "Content flow direction: 'input' for user prompts, 'output' for AI responses"
+        },
+        {
+          "key": "content_type",
+          "type": "string",
+          "required": true,
+          "description": "Type of content being analyzed: 'prompt', 'response', 'tool_call', 'file', or 'clipboard'"
+        },
+        {
+          "key": "detector_count",
+          "type": "number",
+          "required": true,
+          "description": "Number of detectors that were executed for this request"
+        },
+        {
+          "key": "source",
+          "type": "string",
+          "required": false,
+          "description": "Traffic origin: 'ide' | 'cli' | 'api' | 'browser'. Present for Overwatch/code-agent traffic."
+        },
+        {
+          "key": "event",
+          "type": "string",
+          "required": false,
+          "description": "Event type: 'prompt' | 'tool_call' | 'file_read' | 'file_write' | 'connect_server'. Present for Overwatch traffic."
+        },
+        {
+          "key": "user_email",
+          "type": "string",
+          "required": false,
+          "description": "Human operator email (IDE sessions)"
+        },
+        {
+          "key": "cwd",
+          "type": "string",
+          "required": false,
+          "description": "Current working directory (IDE sessions)"
+        },
+        {
+          "key": "workspace_root",
+          "type": "string",
+          "required": false,
+          "description": "IDE workspace root path"
+        },
+        {
+          "key": "model_name",
+          "type": "string",
+          "required": false,
+          "description": "LLM model name: 'claude-3-5-sonnet', 'gpt-4o', etc. Present for AI Gateway traffic."
+        },
+        {
+          "key": "model_provider",
+          "type": "string",
+          "required": false,
+          "description": "Model provider: 'anthropic' | 'openai' | 'google' | 'meta'. Present for AI Gateway traffic."
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Combined prompt injection confidence (0-100). MAX of all detector scores.",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Combined jailbreak detection confidence (0-100). MAX of all detector scores.",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for prompt injection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_pulse_score",
+          "type": "number",
+          "required": false,
+          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "jailbreak_deep_context_score",
+          "type": "number",
+          "required": false,
+          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of injection detected: 'prompt', 'sql', 'command', or 'none'"
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs, retrieved documents, or external content.",
+          "range": "0-100"
+        },
+        {
+          "key": "indirect_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of indirect injection detected in content (e.g., instruction override, authority hijack)"
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any API keys, tokens, passwords, or credentials were detected"
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of secret matches found"
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of secret types found (e.g., ['aws_access_key', 'github_token'])"
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether personally identifiable information (PII) was found"
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of PII matches found"
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of PII types detected (e.g., ['email', 'phone', 'ssn', 'credit_card'])"
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "PII detection ML classifier confidence (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "Highest severity level: 'critical', 'high', 'medium', 'low', or 'none'"
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "Total number of threats detected across all detectors"
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "Array of threat category names detected (e.g., ['injection', 'pii', 'secrets'])"
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "Array of specific threat names detected"
+        },
+        {
+          "key": "violence_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for violent content references (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "hate_speech_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for hate speech or discriminatory language (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "sexual_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for sexual or adult content (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "weapons_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for weapons references (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "crime_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for criminal activity discussions (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "profanity_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for profanity and vulgar language (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "content_topics",
+          "type": "array",
+          "required": false,
+          "description": "Semantic topics detected in content (e.g., ['controlled_substances', 'weapons_manufacturing'])"
+        },
+        {
+          "key": "topic_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score from topic classifier (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether invisible Unicode characters were detected in the content"
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "Density score for invisible characters (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "command_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection patterns were detected"
+        },
+        {
+          "key": "command_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of command injection: 'reverse_shell', 'privilege_escalation', 'code_execution', 'destructive_command', or 'data_exfiltration'"
+        },
+        {
+          "key": "command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for command injection detection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal: 'critical', 'high', 'medium', 'low', or 'none'"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected"
+        },
+        {
+          "key": "sql_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether SQL injection patterns were detected"
+        },
+        {
+          "key": "sql_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of SQL injection: 'tautology', 'union_based', 'destructive', 'blind', or 'error_based'"
+        },
+        {
+          "key": "sql_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for SQL injection detection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation: 'cross_origin_tool', 'cross_origin_server', or 'none'"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "encoded_content_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding)"
+        },
+        {
+          "key": "encoded_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of encoding types detected (e.g., ['base64', 'hex', 'unicode', 'url'])"
+        },
+        {
+          "key": "encoded_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of encoded segments found"
+        },
+        {
+          "key": "encoded_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for encoded injection attempts (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_language",
+          "type": "string",
+          "required": false,
+          "description": "ISO language code of the detected language (e.g., 'en', 'fr', 'zh')"
+        },
+        {
+          "key": "is_english",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content is in English"
+        },
+        {
+          "key": "language_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for language detection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_script",
+          "type": "string",
+          "required": false,
+          "description": "Writing script detected: 'latin', 'cyrillic', 'arabic', 'cjk', 'unknown', etc."
+        },
+        {
+          "key": "is_latin_script",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content uses Latin script"
+        },
+        {
+          "key": "script_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for script detection (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "hallucination_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for hallucinated or fabricated content (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "factuality_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based factuality assessment score (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "sentiment_score",
+          "type": "number",
+          "required": false,
+          "description": "Sentiment analysis score.",
+          "range": "0-100"
+        },
+        {
+          "key": "contains_code",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether code snippets were detected in the content"
+        },
+        {
+          "key": "code_languages",
+          "type": "array",
+          "required": false,
+          "description": "Array of programming languages detected in code snippets"
+        },
+        {
+          "key": "code_ratio",
+          "type": "number",
+          "required": false,
+          "description": "Percentage of content that consists of code (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "keyword_matched",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any configured keywords or phrases were matched"
+        },
+        {
+          "key": "keyword_categories",
+          "type": "array",
+          "required": false,
+          "description": "Array of keyword categories matched (e.g., ['competitor_names', 'restricted_topics'])"
+        },
+        {
+          "key": "keyword_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of keyword matches found"
+        },
+        {
+          "key": "contains_non_ascii",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether non-ASCII characters were detected"
+        },
+        {
+          "key": "phishing_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether phishing patterns were detected"
+        },
+        {
+          "key": "content_safety_score",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate content safety score (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "content_safety_blocked",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether content was flagged for blocking by the content safety system"
+        },
+        {
+          "key": "conversation_turn",
+          "type": "number",
+          "required": false,
+          "description": "Current conversation turn number"
+        },
+        {
+          "key": "multi_turn_detection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether multi-turn injection patterns were detected"
+        },
+        {
+          "key": "budget_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining token budget as percentage (0-100).",
+          "range": "0-100"
+        },
+        {
+          "key": "budget_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the token budget has been exceeded"
+        },
+        {
+          "key": "rpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining RPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "rpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the RPM limit has been exceeded"
+        },
+        {
+          "key": "tpm_remaining_pct",
+          "type": "number",
+          "required": false,
+          "description": "Remaining TPM percentage (0-100). Gateway-metered, Shield-decided (ADR 0014).",
+          "range": "0-100"
+        },
+        {
+          "key": "tpm_exceeded",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the TPM limit has been exceeded"
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether PII was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "PII types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether secrets were detected in any previous turn of the session"
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "Secret types detected across the session (accumulated)"
+        },
+        {
+          "key": "session_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether prompt injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_command_injection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection was detected in any previous turn of the session"
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "Number of turns in the session where threats were detected"
+        },
+        {
+          "key": "session_max_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_jailbreak_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant"
+        },
+        {
+          "key": "session_max_sensitivity",
+          "type": "string",
+          "required": false,
+          "description": "Highest data-sensitivity tier observed across the session (e.g. 'public', 'internal', 'confidential', 'restricted')"
+        },
+        {
+          "key": "session_original_request",
+          "type": "string",
+          "required": false,
+          "description": "The session's first user request, retained for drift / goal-hijack policies that compare later turns against the original intent"
+        },
+        {
+          "key": "agent_id",
+          "type": "string",
+          "required": false,
+          "description": "Unique identifier of the authenticated AI agent making this request. Empty string for human user requests."
+        },
+        {
+          "key": "agent_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of the authenticated agent: 'orchestrator', 'autonomous', 'tool_agent', or 'human_proxy'. Empty string for human users."
+        },
+        {
+          "key": "agent_trust_level",
+          "type": "string",
+          "required": false,
+          "description": "Trust level of the authenticated agent: 'first_party', 'verified_third_party', or 'unverified'."
+        },
+        {
+          "key": "agent_framework",
+          "type": "string",
+          "required": false,
+          "description": "Framework or SDK the agent is built with (e.g., 'claude-code', 'langchain', 'crewai', 'autogen')."
+        },
+        {
+          "key": "agent_publisher",
+          "type": "string",
+          "required": false,
+          "description": "Organization that published the agent (e.g., 'anthropic', 'internal', 'acme-corp')."
+        },
+        {
+          "key": "flow_confidentiality",
+          "type": "string",
+          "required": false,
+          "description": "Confidentiality tier of the data this action carries or targets (ADR 0020): 'public', 'internal', 'confidential', 'restricted', or 'unknown'. Shares the ladder with session_max_sensitivity but is a per-value fact, not a session scalar. 'unknown' MUST NOT be treated as 'public' — guard with has and let policy DENY/STEP_UP/DEFER per flow_resolution_status."
+        },
+        {
+          "key": "flow_integrity",
+          "type": "string",
+          "required": false,
+          "description": "Integrity/influence tier of the data this action carries (ADR 0020): 'trusted', 'untrusted', 'mixed', or 'unknown'. Orthogonal to confidentiality: untrusted content may inform a pure analysis but MUST NOT authorize a side-effecting sink. Least-trusted contributor wins on join."
+        },
+        {
+          "key": "flow_data_types",
+          "type": "array",
+          "required": false,
+          "description": "Sensitive data categories present in the value (ADR 0020), e.g. 'pii', 'secrets', 'source_code', 'financial', 'health'. Union of all contributing inputs. Set<String>."
+        },
+        {
+          "key": "flow_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the value belongs to (ADR 0020), e.g. 'tenant:acme', 'customer:123', 'project:x'. Union of all contributing inputs — cross-compartment composition is expressible by cardinality. Set<String>."
+        },
+        {
+          "key": "flow_resolution_status",
+          "type": "string",
+          "required": false,
+          "description": "How the flow label was resolved (ADR 0020): 'known', 'inferred', 'unknown', or 'conflicted'. Policy authors choose the posture for 'unknown' per sink (DENY external, STEP_UP, DEFER while a classifier runs, or allow-and-record). Never silently resolves to public."
+        },
+        {
+          "key": "flow_origins",
+          "type": "array",
+          "required": false,
+          "description": "Origin kinds that produced or influenced the value (ADR 0020): 'mcp_tool_result', 'model', 'file', 'database', 'user'. Provenance fact for lineage-aware policy. Set<String>."
+        },
+        {
+          "key": "flow_sink",
+          "type": "string",
+          "required": false,
+          "description": "Logical destination this action releases the value to (ADR 0020), e.g. 'external_model', 'local_model', 'external_mcp', 'trusted_mcp', 'user_secure_output', 'public_network', 'file'. The 'where' half of a flow decision — pair with flow_confidentiality/flow_integrity."
+        },
+        {
+          "key": "flow_sink_is_external",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the destination is outside the tenant trust boundary (ADR 0020). Lets a single policy express 'confidential data MUST NOT leave to any external sink' without enumerating sink ids."
+        },
+        {
+          "key": "flow_sink_effects",
+          "type": "array",
+          "required": false,
+          "description": "Side effects the destination can exercise (ADR 0020), e.g. 'network.send', 'financial.transfer', 'filesystem.write'. Enables 'untrusted content MUST NOT reach a financial.transfer sink'. Set<String>."
+        },
+        {
+          "key": "principal_clearances",
+          "type": "array",
+          "required": false,
+          "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. 'restricted', 'pii'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>."
+        },
+        {
+          "key": "principal_compartments",
+          "type": "array",
+          "required": false,
+          "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. 'tenant:acme', 'customer:123'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>."
+        },
+        {
+          "key": "surface",
+          "type": "string",
+          "required": true,
+          "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: 'guardrails', 'overwatch', 'ai_gateway' ('sentry' joins at D17 phase 2). The 'Applies to' narrowing target: test with an ordinary condition (context.surface == 'ai_gateway'); no 'has' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory."
+        },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)."
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical).",
+          "range": "0-4"
+        }
+      ]
+    },
     {
       "name": "call_tool",
       "description": "Execute agentic tool calls, including shell commands, file operations, and MCP tools",