Identity & description
Eight fields are required on every record regardless of status, including draft: these are the core submit-required fields. A draft record is not yet peer-reviewed; everything else is enrichment added before promotion to active. Once a record's status is active or deprecated, seven more fields become required (marked below) and the full field set applies.
| Field | Type | Description | |
|---|---|---|---|
| ave_id | string | required | Unique identifier. Format AVE-YYYY-NNNNN. Immutable once published; deprecated via status, never renumbered or deleted. |
| schema_version | string | required | Schema version this record was authored against, e.g. 1.1.0. |
| status | enum | required | active | deprecated | draft. |
| published | date-time | required once active/deprecated | ISO 8601 datetime of first publication. |
| last_updated | date-time | optional | ISO 8601 datetime of most recent update. |
| title | string | required | Human-readable title, max 120 chars. |
| attack_class | string | required | Behavioral category, e.g. external_instruction_fetch. Not a vulnerability_type string. |
| component_type | enum | optional | skill | prompt | mcp_server | plugin | agent | tool | other. |
| description | string | required | Full description of the vulnerability class. |
| behavioral_fingerprint | string | required | What the component DOES that is dangerous. Behavioral, not a byte signature. |
| behavioral_vector | string[] | optional | Short tags summarising the attack path, e.g. supply-chain, external-fetch. |
| example_patterns | string[] | optional | Illustrative attack payload strings or code fragments. Distinct from behavioral_vector (short tags) and indicators_of_compromise (defender observables): researcher-facing examples for detection-rule authoring. |
| severity | enum | required once active/deprecated | CRITICAL | HIGH | MEDIUM | LOW. Must agree with aivss.aivss_score. |
| aivss_score | number | optional | Top-level shortcut to aivss.aivss_score (0–10). Mirrors the nested value. |
| cvss_base_vector | string | optional | CVSS 4.0 base vector string. |
| mutation_count | integer | optional | Number of distinct real-world mutations observed. |
Framework mappings
owasp_mcp becomes required once a record is active or deprecated: at least one anchor, the core OWASP grounding every published record must have. The other framework fields are optional but strongly recommended when applicable. Add owasp_asi when the class maps to the OWASP Agentic Security Initiative Top 10. Add mitre_atlas when an ATLAS technique applies. Add nist_ai_rmf when relevant. A record without any ATLAS or NIST mapping is still valid; a published record without OWASP MCP is not.
| Field | Type | Description | |
|---|---|---|---|
| owasp_mcp | string[] | required once active/deprecated | OWASP MCP Top 10. Format: MCPNN. ≥1. |
| owasp_asi | string[] | optional | OWASP Agentic Security Initiative (ASI) Top 10. Format: ASINN. Add when the class maps to the Agentic Top 10; omit rather than force a poor fit. |
| mitre_atlas | string[] | optional | MITRE ATLAS technique IDs. Format: AML.Txxxx or AML.Txxxx.000. Add when a technique applies; omit if none exists yet. |
| nist_ai_rmf | string[] | optional | NIST AI RMF function and category mappings, e.g. MAP-1.5. |
| affected_platforms | string[] | optional | Agent platforms known to be affected. Fill as evidence accumulates; do not speculate. |
| affected_registries | string[] | optional | Skill/tool registries where this class has been observed. |
Provenance vector & trifecta profile
Two optional classification objects, both new in v1.1.0. Absent or null means not yet classified, not “does not apply.” Neither affects severity or aivss_score; they're descriptive, not scoring inputs.
| Field | Type | Description | |
|---|---|---|---|
| provenance_vector.entry_class | enum | optional | Origin point in the context supply chain: content | server_card | registry_metadata | runtime | transport | tool_response | tool_schema | server_card_document | model_generated | memory | retrieved_document | user_input | operator_config | skill_file. |
| provenance_vector.payload_surface | string | optional | The concrete field or channel carrying the payload, e.g. tool_schema.description. Free text; controlled vocabulary grown by convention. |
| provenance_vector.escalation | enum | optional | The authority jump this class performs when exploited: data_to_instruction | instruction_to_capability | capability_to_identity. Leave the whole object absent if none fits. |
| trifecta_profile.requires | string[] | optional | Lethal-trifecta conditions (Willison / Palo Alto) that must be present for this class to be exploitable: private_data | untrusted_content | external_comms. ≥1 if the object is present. |
| trifecta_profile.amplifies | string[] | optional | Conditions that worsen impact without being strict preconditions. Same enum as requires. |
Mitigation strategy
mitigation is an optional, vendor-neutral companion to the required prose remediation field: it names the class of defense, not a runnable control, so any enforcement tool can build a concrete implementation from these values.
| Field | Type | Description | |
|---|---|---|---|
| mitigation.strategy | string[] | optional | ≥1 of: deny_by_default | require_human_approval | pin_integrity | isolate_scope | validate_input | sanitize_output | verify_identity | sever_egress | least_privilege | provenance_label. |
| mitigation.enforcement_point | enum | optional | Where in the agent lifecycle a defense would sit: static_scan | server_card_fetch | runtime_proxy | agent_framework | downstream_system | network_layer. |
| mitigation.trifecta_control | enum | optional | Which trifecta leg to sever, conceptually: break_private_data | break_untrusted_content | break_external_comms | not_applicable. |
Detection & remediation
indicators_of_compromise and remediation both become required once a record is active or deprecated, with at least one IOC entry. A published record with no IOCs gives defenders nothing actionable to act on.
| Field | Type | Description | |
|---|---|---|---|
| indicators_of_compromise | string[] | required once active/deprecated | Observable IOC strings, ≥1. What defenders search for. |
| detection_methodology | string | optional | Step-by-step detection approach (static, semantic, sandbox). |
| remediation | string | required once active/deprecated | How to mitigate or prevent the class. Must be actionable. |
| kill_switch_active | boolean | optional | Whether a registry-level kill switch is currently active. Defaults to false. |
Provenance
references is required on every record, including draft: even an unreviewed record needs at least one citable source, the provenance signal a skeptic checks first. researcher becomes required once a record is active or deprecated: records must be attributable.
| Field | Type | Description | |
|---|---|---|---|
| references | array | required | Primary sources: CVEs, papers, disclosures, scan reports. ≥1. Each item: URI string or {tag, text, url} object. |
| researcher | string | required once active/deprecated | Name of the researcher or team who authored this record. |
| researcher_url | uri | optional | URL for the researcher or team. |
The aivss object: OWASP AIVSS v0.8
aivss becomes required once a record is active or deprecated. The aarf block records 10 agentic amplification factors that distinguish AIVSS from plain CVSS. Required sub-fields: cvss_base, aars, thm, mitigation_factor, aivss_score, spec_version.
| Field | Type | Description | |
|---|---|---|---|
| cvss_base | number | required | 0–10. |
| aarf | object | optional | 10 agentic amplification factors (0–1 each): autonomy, tool_use, multi_agent, non_determinism, self_modification, dynamic_identity, persistent_memory, natural_language_input, data_access, external_dependencies. |
| aars | number | required | Agentic Amplification & Reachability Score (0–10). |
| thm | number | required | Threat & Heuristic Multiplier (0.5–1.5). |
| mitigation_factor | number | required | 0–1. |
| aivss_score | number | required | Final composed score (0–10). Must agree with top-level severity. |
| aivss_severity | enum | optional | CRITICAL | HIGH | MEDIUM | LOW. |
| spec_version | const | required | Always “0.8”. |
| notes | string | optional | Free-text scoring rationale. |
Scanner evidence declarations (optional)
Scanner-facing defaults. The record declares baselines; the scanner assigns per-finding actuals. Never carry per-detection values like confidence in a record. See architecture for the declares-vs-assigns contract.
| Field | Type | Description | |
|---|---|---|---|
| evidence_kind_default | enum | optional | tool_description_pattern | config_schema | file_type_mismatch | behavioral_pattern | semantic_inference | multi_engine. |
| detection_stage | enum | optional | static_detection | runtime_observed | runtime_drift_detected. |
| detection_layer | enum | optional | content | server_card | registry_metadata | runtime | transport. |
| confidence_baseline | number | optional | 0–1. Base confidence before FP pipeline adjustment. |
| evidence_basis_engines | string[] | optional | pattern | yara | semgrep | llm | sandbox | magika. |
| derivable_into | string[] | optional | Toxic-flow chain IDs this class participates in. |
Per-detection runtime values belong only on the scanner finding: confidence, confidence_band, actual evidence_stage, confidence_reason, derived, line, match, suppressed.
Field relationships
Several AVE fields sound similar and mean different things. The notes below explain the distinctions.
Required fields
Eight fields are required on every record, including draft:
Seven more become required once status is active or deprecated:
Example record
Canonical schema: schema/ave-record.schema.json; the frozen v1.0.0 schema remains available for validating older records.