Summary

• Add MCP pkg_vulns verbose support and explicit filter echo in text/JSON.
• Cap default advisory text output with surface-native hints while keeping verbose and JSON complete.
• Tighten zero-vulnerability wording, ASCII text formatting, docs, smoke coverage, and agentic eval coverage.

Verification

• bun test
• bun run build
• bun run smoke:mcp
• bun run smoke:cli
• bun run agent:e2e --agent claude --server local --workload eval/agentic/workloads/package-vulnerability-filter.md --timeout 300
• bun run agent:e2e --agent codex --server local --workload eval/agentic/workloads/package-vulnerability-filter.md --timeout 300

Agentic Eval Notes

• Claude used pkg_vulns with pinned version, min_severity, and verbose:true successfully.
• Codex used pkg_vulns JSON for the filtered pinned version and pkg_info JSON for latest status.
• Codex flagged a useful follow-up caveat: filtered nonAffectingVulnerabilityCount is visible, but non-affecting advisory identities are not returned in the detailed advisory list.