diff --git a/AGENTS.md b/AGENTS.md
index 0ba35bde..1ab3edbe 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -167,7 +167,7 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   │   ├── trace.rs      # `ado-aw trace`: correlate audit telemetry with the local IR graph
 │   │   ├── whatif.rs     # `ado-aw whatif`: static downstream skip classification for failures
 │   │   ├── lint.rs       # `ado-aw lint`: structural workflow lint checks
-│   │   └── catalog.rs    # `ado-aw catalog`: list in-tree registries (tools, runtimes, models, etc.)
+│   │   └── catalog.rs    # `ado-aw catalog`: list in-tree registries (safe-outputs, runtimes, tools, engines, models, pinned versions)
 │   ├── detect.rs         # Agentic workflow detection — discovers compiled pipelines; used by all lifecycle commands
 │   ├── update_check.rs   # Version update check — queries GitHub Releases and prints advisory when newer version is available
 │   ├── ndjson.rs         # NDJSON parsing utilities
diff --git a/docs/mcp-author.md b/docs/mcp-author.md
index a683f908..4c932796 100644
--- a/docs/mcp-author.md
+++ b/docs/mcp-author.md
@@ -23,7 +23,7 @@ workflows.
 | `trace_failure` | Trace a build's failed-job chain using audit data plus any local IR graph. | `{ "build_id_or_url": "123", "step": null, "org": null, "project": null, "pat": null }` |
 | `whatif` | Classify downstream jobs if a step or job fails. | `{ "source_path": "...", "failing_id": "Agent" }` |
 | `lint_workflow` | Run structural lint checks. | `{ "source_path": "agents/example.md" }` |
-| `catalog` | List safe-outputs, runtimes, tools, engines, and models. | `{ "kind": "safe-outputs" }` |
+| `catalog` | List safe-outputs, runtimes, tools, engines, models, and pinned versions. | `{ "kind": "safe-outputs" }` |
 | `audit_build` | Download and analyze a build; same shape as `ado-aw audit --json`. | `{ "build_id_or_url": "123", "org": null, "project": null, "pat": null, "artifacts": null, "no_cache": false }` |
 
 ## Trust model