[benjaminhuo]

kubescape_get_vulnerability_details currently returns []v1beta1.Match as its typed output, which generates an outputSchema.type of ["null", "array"].

MCP clients expecting an object-rooted output schema reject the entire tools/list response, making all tools from the server unavailable. This was reproduced with the DSH MCP client.

This change wraps the structured output in {"matches": [...]}, producing an object-rooted output schema. It preserves the existing array-shaped text content and tool error behavior.

Regression tests check object-rooted input/output schemas across all registered tools and exercise the affected tool through MCP calls, covering successful responses, missing arguments, missing resources, and initialization failures. The schema regression test fails against the original v0.3.0 implementation and passes with this fix.

Validation:

• make fmt
• make lint — zero issues
• make test-only — all unit tests passed
• Linux amd64 build passed

The full make test target stopped after the Linux amd64 build because sha256sum is unavailable on the macOS development host; lint and unit tests were run separately.

[dimetron]

LGTM. Object-rooted output schema fixes the tools/list rejection, and the new schema test guards all tools. Nits (non-blocking): note the structuredContent shape change in release notes; error paths could return the zero-value output; consider adding the object-root rule to AGENTS.md output-schema pitfalls.