{
  "$schema": "https://verifymcp.io/schemas/changelog.json",
  "server": "com-vendo-ai-vendo-ai",
  "component": "api",
  "generated_at": "2026-09-20T21:28:49.453Z",
  "tracking_since": "2026-07-28",
  "counts": {
    "critical": 0,
    "security": 14,
    "functional": 0,
    "cosmetic": 0
  },
  "events": [
    {
      "id": "chg_01a09a43-803e-79a0-a052-71c7f2f52590",
      "kind": "check.verdict",
      "family": "transport",
      "subject_kind": "check",
      "subject": "transport",
      "subject_child": "",
      "from_code": "transport.verified",
      "to_code": "transport.http_error",
      "from_value": "pass",
      "to_value": "fail",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "status": "429",
        "transport": "streamable-http"
      },
      "occurred_on": "2026-09-13",
      "occurred_at": "2026-09-13 10:15:09.802674+00",
      "observed_since": "2026-09-12",
      "source": "scan",
      "summary": "Transport (pass → fail)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a09a43-803e-79a0-a052-71c7f2f52590"
    },
    {
      "id": "chg_01a09a43-8040-7ab3-827f-044549cfd97d",
      "kind": "check.unverifiable",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.injection_clean",
      "to_code": "toolsafety.unreachable",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-13",
      "occurred_at": "2026-09-13 10:15:09.802674+00",
      "observed_since": "2026-09-12",
      "source": "scan",
      "summary": "Tool safety (pass → unverified)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a09a43-8040-7ab3-827f-044549cfd97d"
    },
    {
      "id": "chg_01a09a43-8041-718d-8d33-71979742edad",
      "kind": "check.reason",
      "family": "auth-oauth",
      "subject_kind": "check",
      "subject": "auth-oauth",
      "subject_child": "",
      "from_code": "auth.none_undeclared",
      "to_code": "auth.none_unlisted",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-13",
      "occurred_at": "2026-09-13 10:15:09.802674+00",
      "observed_since": "2026-09-12",
      "source": "scan",
      "summary": "Authorization (Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a09a43-8041-718d-8d33-71979742edad"
    },
    {
      "id": "chg_01a09a43-8042-7d61-8ae8-66028654bcaf",
      "kind": "capture.status_changed",
      "family": "",
      "subject_kind": "server",
      "subject": "capture",
      "subject_child": "",
      "from_code": null,
      "to_code": null,
      "from_value": "verified",
      "to_value": "not_mcp",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "to": "not_mcp",
        "from": "verified"
      },
      "occurred_on": "2026-09-13",
      "occurred_at": "2026-09-13 10:15:09.802674+00",
      "observed_since": "2026-09-12",
      "source": "scan",
      "summary": "Endpoint reachability (reachable → not serving MCP)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a09a43-8042-7d61-8ae8-66028654bcaf"
    },
    {
      "id": "chg_01a0951e-540f-752c-aa93-87e816ca6193",
      "kind": "check.verdict",
      "family": "transport",
      "subject_kind": "check",
      "subject": "transport",
      "subject_child": "",
      "from_code": "transport.http_error",
      "to_code": "transport.verified",
      "from_value": "fail",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "transport": "streamable-http"
      },
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 10:16:27.717714+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "Transport (fail → pass)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a0951e-540f-752c-aa93-87e816ca6193"
    },
    {
      "id": "chg_01a0951e-5413-7158-8e66-6a61477125de",
      "kind": "check.reverified",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.unreachable",
      "to_code": "toolsafety.injection_clean",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 10:16:27.717714+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "Injection markers (unverified → pass)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a0951e-5413-7158-8e66-6a61477125de"
    },
    {
      "id": "chg_01a0951e-5413-76c5-a856-4c1675df4543",
      "kind": "check.appeared",
      "family": "tool-safety-manipulation",
      "subject_kind": "check",
      "subject": "tool-safety-manipulation",
      "subject_child": "",
      "from_code": null,
      "to_code": "toolsafety.manipulation_clean",
      "from_value": null,
      "to_value": "pass",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "units": "149",
        "judged": "149"
      },
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 10:16:27.717714+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "First check of Judged manipulation (pass)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a0951e-5413-76c5-a856-4c1675df4543"
    },
    {
      "id": "chg_01a0951e-5413-7b08-bc19-2e8cebc278e2",
      "kind": "check.reason",
      "family": "auth-oauth",
      "subject_kind": "check",
      "subject": "auth-oauth",
      "subject_child": "",
      "from_code": "auth.none_unlisted",
      "to_code": "auth.none_undeclared",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "auth": "none",
        "undeclared_tools": "149"
      },
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 10:16:27.717714+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "Authorization (Authorisation not fully verified: no authorisation is required to call this server, and 149 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a0951e-5413-7b08-bc19-2e8cebc278e2"
    },
    {
      "id": "chg_01a085a9-3263-7894-a574-7dee6e4664e0",
      "kind": "check.verdict",
      "family": "hsts",
      "subject_kind": "check",
      "subject": "hsts",
      "subject_child": "",
      "from_code": "headers.hsts_absent",
      "to_code": "headers.hsts_present",
      "from_value": "fail",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-09",
      "occurred_at": "2026-09-09 10:14:13.313058+00",
      "observed_since": "2026-09-08",
      "source": "scan",
      "summary": "HSTS header (fail → pass)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_01a085a9-3263-7894-a574-7dee6e4664e0"
    },
    {
      "id": "chg_019fb2e6-fe94-730c-a9c8-d04070e67e00",
      "kind": "check.verdict",
      "family": "transport",
      "subject_kind": "check",
      "subject": "transport",
      "subject_child": "",
      "from_code": "transport.verified",
      "to_code": "transport.http_error",
      "from_value": "pass",
      "to_value": "fail",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "status": "429",
        "transport": "streamable-http"
      },
      "occurred_on": "2026-07-30",
      "occurred_at": "2026-07-30 12:01:50.730281+00",
      "observed_since": "2026-07-29",
      "source": "scan",
      "summary": "Transport (pass → fail)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_019fb2e6-fe94-730c-a9c8-d04070e67e00"
    },
    {
      "id": "chg_019fb2e6-fe94-78e2-a319-ee2ee68b0f8f",
      "kind": "check.reason",
      "family": "auth-oauth",
      "subject_kind": "check",
      "subject": "auth-oauth",
      "subject_child": "",
      "from_code": "auth.none_undeclared",
      "to_code": "auth.none_unlisted",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-07-30",
      "occurred_at": "2026-07-30 12:01:50.730281+00",
      "observed_since": "2026-07-29",
      "source": "scan",
      "summary": "Authorization (Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_019fb2e6-fe94-78e2-a319-ee2ee68b0f8f"
    },
    {
      "id": "chg_019fb2e6-fe95-7d0a-a52a-cebae2a2e52d",
      "kind": "capture.status_changed",
      "family": "",
      "subject_kind": "server",
      "subject": "capture",
      "subject_child": "",
      "from_code": null,
      "to_code": null,
      "from_value": "verified",
      "to_value": "not_mcp",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "to": "not_mcp",
        "from": "verified"
      },
      "occurred_on": "2026-07-30",
      "occurred_at": "2026-07-30 12:01:50.730281+00",
      "observed_since": "2026-07-29",
      "source": "scan",
      "summary": "Endpoint reachability (reachable → not serving MCP)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_019fb2e6-fe95-7d0a-a52a-cebae2a2e52d"
    },
    {
      "id": "chg_019fadda-f67a-722d-8b96-309d068b3607",
      "kind": "check.unverifiable",
      "family": "auth-oauth",
      "subject_kind": "check",
      "subject": "auth-oauth",
      "subject_child": "",
      "from_code": "auth.challenge_only",
      "to_code": "auth.none_undeclared",
      "from_value": "fail",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "auth": "none",
        "undeclared_tools": "149"
      },
      "occurred_on": "2026-07-29",
      "occurred_at": "2026-07-29 12:30:36.138964+00",
      "observed_since": "2026-07-28",
      "source": "scan",
      "summary": "Authorization (fail → unverified)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_019fadda-f67a-722d-8b96-309d068b3607"
    },
    {
      "id": "chg_019fadda-f67a-788f-ab27-0fa5ea18f8f3",
      "kind": "check.reverified",
      "family": "transport",
      "subject_kind": "check",
      "subject": "transport",
      "subject_child": "",
      "from_code": "transport.auth_gated",
      "to_code": "transport.verified",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "transport": "streamable-http"
      },
      "occurred_on": "2026-07-29",
      "occurred_at": "2026-07-29 12:30:36.138964+00",
      "observed_since": "2026-07-28",
      "source": "scan",
      "summary": "Transport (unverified → pass)",
      "link": "https://verifymcp.io/servers/com-vendo-ai-vendo-ai/api#chg-chg_019fadda-f67a-788f-ab27-0fa5ea18f8f3"
    }
  ],
  "days": [
    {
      "date": "2026-09-13",
      "total": 25,
      "delta": -38,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 6
    },
    {
      "date": "2026-09-12",
      "total": 63,
      "delta": 38,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 8
    },
    {
      "date": "2026-09-09",
      "total": 25,
      "delta": 2,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-08-26",
      "total": 23,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-08-11",
      "total": 0,
      "delta": null,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-07-31",
      "total": 0,
      "delta": null,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-07-30",
      "total": 0,
      "delta": null,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 6
    },
    {
      "date": "2026-07-29",
      "total": 0,
      "delta": null,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 8
    }
  ]
}