On this page
Schema Compatibility
MCP Audit publishes versioned JSON schemas for reports, policies, baselines, governance exports, and SBOM metadata.
Within a major schema version, new optional properties may be added while existing property names, required fields, types, and enumerated meanings remain stable. Removing a property, changing a required field's type, or changing an enumerated meaning requires a new major schema version.
Consumers should validate the declared schema version, ignore unknown optional fields when safe, reject unsupported major versions clearly, and retain the original artifact when transforming evidence. CycloneDX output carries MCP Audit compatibility information as metadata so the underlying CycloneDX contract remains intact.