SARIF and JUnit output: --output sarif writes SARIF 2.1.0 that GitHub code scanning reads directly, and --output junit puts a run beside your unit tests in CI.
OpenTelemetry export: --otlp-endpoint exports the finished run as traces, with a span per phase and per request. An unreachable collector never changes the verdict.
Checks that read tool descriptions for intent: Five new checks look for hidden text, comments, instructions, secret paths and confusable names in every string the model reads, including descriptions inside inputSchema.
A link on every finding: Each finding carries a doc_url pointing to that check's row in the published inventory, so an archived report still explains itself.