diff --git a/plugins/magpie-security/skills/issue-sync/gather.md b/plugins/magpie-security/skills/issue-sync/gather.md
index 94ba3e6e..320dd955 100644
--- a/plugins/magpie-security/skills/issue-sync/gather.md
+++ b/plugins/magpie-security/skills/issue-sync/gather.md
@@ -767,7 +767,7 @@ Concretely, for each closed-`announced` tracker in this run:
    already read).
 2. Call the API:
    ```bash
-   vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
+   uv run --project <framework>/tools/vetted-ops vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
      | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
    ```
 3. Interpret:
diff --git a/tools/cve-org/tool.md b/tools/cve-org/tool.md
index 361dea31..9af4dbf8 100644
--- a/tools/cve-org/tool.md
+++ b/tools/cve-org/tool.md
@@ -66,7 +66,7 @@ Recipe:
 
 ```bash
 # Read-only, no auth required. Returns JSON.
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '.cveMetadata.state'
 ```
 
@@ -90,7 +90,7 @@ Extract the `datePublished` alongside the state when you need to
 print *"published on YYYY-MM-DD"* in the reporter email:
 
 ```bash
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
 ```
 
diff --git a/tools/osv/tool.md b/tools/osv/tool.md
index 4cfe7716..e983da0f 100644
--- a/tools/osv/tool.md
+++ b/tools/osv/tool.md
@@ -66,13 +66,13 @@ Fetch the OSV JSON record by its primary ID (or alias):
 
 ```bash
 # Read-only, unauthenticated. Returns complete OSV schema JSON.
-vetted-op-read --caller <caller> osv-get-vuln <ID>
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID>
 ```
 
 Extracting alias identifiers (e.g., resolving a GHSA ID to corresponding CVE IDs):
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
   | jq -r '{id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -90,7 +90,7 @@ Example JSON response:
 Extracting affected version ranges and fixed versions:
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln <ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID> \
   | jq -r '.affected[] | {package: .package.name, ecosystem: .package.ecosystem, fixed: [.ranges[].events[] | select(.fixed != null) | .fixed]}'
 ```
 
@@ -99,7 +99,7 @@ vetted-op-read --caller <caller> osv-get-vuln <ID> \
 Check if a given package release is subject to any known advisories:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -110,7 +110,7 @@ Common ecosystems: `PyPI`, `Maven`, `npm`, `crates.io`, `Go`, `Packagist`, `NuGe
 Check if a public upstream commit SHA is indexed in OSV as a fix or vulnerability reference:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -119,7 +119,7 @@ vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
 Evaluate multiple dependencies in a single round-trip:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
   | jq -r '.results | to_entries[] | {query: .key, vuln_count: ((.value.vulns // []) | length)}'
 ```