@4da/mcp-server 4.6.1 → 4.6.3

package/dist/index.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: Apache-2.0
 /**
- * 4DA MCP Server - Internal Use Only
+ * 4DA MCP Server
  *
- * This MCP server provides tool and resource access to 4DA's local database
- * for use with Claude Desktop and other MCP-compatible hosts.
+ * Provides dependency-intelligence tools (CVE scanning, dependency health,
+ * upgrade planning, ecosystem news, decision/agent memory) to Claude Code,
+ * Claude Desktop, and other MCP hosts. Runs locally; the only data leaving the
+ * machine is public package names/versions sent to registries (OSV, npm, etc.).
  *
- * IMPORTANT: This server is designed for LOCAL use only. It reads from the
- * user's local 4DA SQLite database. It does NOT implement authentication
- * or authorization - it trusts the local environment.
- *
- * Do NOT expose this server over a network without adding proper auth.
+ * SECURITY: the server trusts its local environment and does NOT implement
+ * authentication. The optional --http transport is intended for localhost use;
+ * do NOT expose it over a network without putting your own auth in front.
  */
 /**
- * 4DA MCP Server v4.6.0 — Dependency Intelligence for AI Coding Agents
+ * 4DA MCP Server v4.6.3 — Dependency Intelligence for AI Coding Agents
  *
  * 14 tools across 5 categories. Live vulnerability scanning (OSV.dev),
  * ecosystem news, persistent memory, and tech stack awareness for any MCP host.
@@ -51,7 +51,7 @@ import { createDatabase, FourDADatabase } from "./db.js";
 // =============================================================================
 const server = new Server({
     name: "4da-server",
-    version: "4.6.0",
+    version: "4.6.3",
 }, {
     capabilities: {
         tools: { listChanged: true },
@@ -86,7 +86,9 @@ function getDatabase() {
             if (detected.length > 0) {
                 console.error(`[4DA]   Detected: ${detected.join(", ")} | ${scan.dependencies.length} deps, ${scan.devDependencies.length} dev deps`);
                 // Initialize live intelligence with per-ecosystem resolved versions
-                liveIntel.initFromMultiEcosystem(cwd, scan.depsByEcosystem);
+                // (depTargets carries platform-gated dep info so advisories can be
+                // flagged platform-relevant for the host).
+                liveIntel.initFromMultiEcosystem(cwd, scan.depsByEcosystem, scan.depTargets);
                 if (liveIntel.isEnabled()) {
                     console.error(`[4DA]   Live intelligence: enabled (OSV.dev + HN)`);
                     // Background prefetch — non-blocking, warms cache for first tool call
@@ -142,8 +144,12 @@ function getDatabase() {
                     liveIntel.initFromDependencyGroups([...groups.values()]);
                 }
             }
-            catch {
-                // Non-fatal — live intel just won't have version data
+            catch (err) {
+                // Non-fatal — live intel just won't have version data — but log to stderr
+                // so a silent empty scan (e.g. project_dependencies schema drift) is
+                // diagnosable rather than looking like "no vulnerabilities".
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(`[4da] dependency-group init from 4DA DB failed (continuing without version data): ${msg}`);
             }
         }
     }
@@ -287,7 +293,7 @@ async function main() {
     const args = process.argv.slice(2);
     // Version
     if (args.includes("--version") || args.includes("-v")) {
-        console.log("@4da/mcp-server 4.6.0");
+        console.log("@4da/mcp-server 4.6.3");
         return;
     }
     // Help
@@ -376,7 +382,7 @@ async function main() {
         process.exit(0);
     });
     const toolCount = getSlimToolList().length;
-    console.error(`4DA MCP Server v4.6.0 started — ${toolCount} tools, stdio transport`);
+    console.error(`4DA MCP Server v4.6.3 started — ${toolCount} tools, stdio transport`);
     console.error("  Use --http for Streamable HTTP, --setup to configure editors, --doctor to check health");
 }
 main().catch((error) => {

package/dist/live/cvss.d.ts

@@ -0,0 +1,16 @@
+/**
+ * CVSS v3.0 / v3.1 base-score calculator.
+ *
+ * OSV advisories frequently expose severity only as a CVSS vector string
+ * (e.g. "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L") rather than a numeric
+ * base score. Without computing the score we cannot bucket the advisory into
+ * critical/high/medium/low — so this implements the published base-score
+ * formula. CVSS v4.0 vectors are not yet handled (returns null).
+ */
+/**
+ * Parse a CVSS vector string and return its base score (0.0–10.0), or null if
+ * the vector is not a recognizable v3.x base vector (missing required metrics,
+ * v2/v4, or malformed).
+ */
+export declare function cvssBaseScore(vector: string): number | null;
+//# sourceMappingURL=cvss.d.ts.map

package/dist/live/cvss.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * CVSS v3.0 / v3.1 base-score calculator.
+ *
+ * OSV advisories frequently expose severity only as a CVSS vector string
+ * (e.g. "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L") rather than a numeric
+ * base score. Without computing the score we cannot bucket the advisory into
+ * critical/high/medium/low — so this implements the published base-score
+ * formula. CVSS v4.0 vectors are not yet handled (returns null).
+ */
+const AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+const AC = { L: 0.77, H: 0.44 };
+const UI = { N: 0.85, R: 0.62 };
+const CIA = { N: 0, L: 0.22, H: 0.56 };
+// Privileges Required is scope-dependent.
+const PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
+const PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
+/** CVSS v3.1 "Roundup": smallest one-decimal value >= input (with float-safe integer math). */
+function roundUp(input) {
+    const intInput = Math.round(input * 100000);
+    if (intInput % 10000 === 0)
+        return intInput / 100000;
+    return (Math.floor(intInput / 10000) + 1) / 10;
+}
+/**
+ * Parse a CVSS vector string and return its base score (0.0–10.0), or null if
+ * the vector is not a recognizable v3.x base vector (missing required metrics,
+ * v2/v4, or malformed).
+ */
+export function cvssBaseScore(vector) {
+    if (!vector || !/CVSS:3\.[01]/i.test(vector) && !vector.includes("AV:"))
+        return null;
+    const metrics = {};
+    for (const part of vector.split("/")) {
+        const [k, v] = part.split(":");
+        if (k && v)
+            metrics[k.trim().toUpperCase()] = v.trim().toUpperCase();
+    }
+    const scope = metrics.S; // U (unchanged) | C (changed)
+    const prTable = scope === "C" ? PR_CHANGED : PR_UNCHANGED;
+    const av = AV[metrics.AV];
+    const ac = AC[metrics.AC];
+    const pr = prTable[metrics.PR];
+    const ui = UI[metrics.UI];
+    const c = CIA[metrics.C];
+    const i = CIA[metrics.I];
+    const a = CIA[metrics.A];
+    // All eight base metrics are mandatory; bail if any is unrecognized.
+    if ([av, ac, pr, ui, c, i, a].some((x) => x === undefined) || (scope !== "U" && scope !== "C")) {
+        return null;
+    }
+    const iscBase = 1 - (1 - c) * (1 - i) * (1 - a);
+    const impact = scope === "C"
+        ? 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15)
+        : 6.42 * iscBase;
+    if (impact <= 0)
+        return 0;
+    const exploitability = 8.22 * av * ac * pr * ui;
+    const raw = scope === "C" ? 1.08 * (impact + exploitability) : impact + exploitability;
+    return roundUp(Math.min(raw, 10));
+}
+//# sourceMappingURL=cvss.js.map

package/dist/live/index.d.ts

@@ -25,6 +25,7 @@ export declare class LiveIntelligence {
     private resolvedDeps;
     private auditDeps;
     private initialized;
+    private projectRoot;
     constructor(db: Database.Database);
     /**
      * Initialize with project data. Call once after project scan.
@@ -39,7 +40,7 @@ export declare class LiveIntelligence {
     initFromMultiEcosystem(projectPath: string, depsByEcosystem: Record<string, {
         deps: string[];
         devDeps: string[];
-    }>): void;
+    }>, depTargets?: Record<string, string>): void;
     /**
      * Initialize from dependency groups that each carry their own resolution
      * directory. Used in 4DA database mode, where dependencies span multiple
@@ -56,6 +57,13 @@ export declare class LiveIntelligence {
         deps: string[];
         devDeps: string[];
     }>): void;
+    /**
+     * Root directory the dependency set was resolved from, or null before init.
+     * For multi-manifest (grouped) init this is the deepest common ancestor of
+     * the group directories — honest scope reporting for tool output, instead
+     * of whatever `process.cwd()` happens to be.
+     */
+    getProjectRoot(): string | null;
     /**
      * Run vulnerability scan (returns cached if fresh, fetches otherwise).
      */

package/dist/live/index.js

@@ -32,6 +32,7 @@ export class LiveIntelligence {
     resolvedDeps = [];
     auditDeps = [];
     initialized = false;
+    projectRoot = null;
     constructor(db) {
         this.enabled = process.env.FOURDA_OFFLINE !== "true";
         this.cache = new LiveCache(db);
@@ -50,6 +51,7 @@ export class LiveIntelligence {
     initFromProject(projectPath, deps, devDeps, language) {
         this.resolvedDeps = resolveVersions(projectPath, deps, devDeps, language);
         this.auditDeps = resolveAuditVersions(projectPath, deps, devDeps, language);
+        this.projectRoot = projectPath;
         this.initialized = true;
     }
     /**
@@ -57,15 +59,16 @@ export class LiveIntelligence {
      * so Rust crates go to crates.io, npm packages to npm, etc.
      * Call once after project scan.
      */
-    initFromMultiEcosystem(projectPath, depsByEcosystem) {
+    initFromMultiEcosystem(projectPath, depsByEcosystem, depTargets = {}) {
         const allResolved = [];
         const allAudit = [];
         for (const [language, { deps, devDeps }] of Object.entries(depsByEcosystem)) {
-            allResolved.push(...resolveVersions(projectPath, deps, devDeps, language));
-            allAudit.push(...resolveAuditVersions(projectPath, deps, devDeps, language));
+            allResolved.push(...resolveVersions(projectPath, deps, devDeps, language, depTargets));
+            allAudit.push(...resolveAuditVersions(projectPath, deps, devDeps, language, depTargets));
         }
         this.resolvedDeps = dedupeDependencies(allResolved);
         this.auditDeps = dedupeDependencies(allAudit);
+        this.projectRoot = projectPath;
         this.initialized = true;
     }
     /**
@@ -87,8 +90,18 @@ export class LiveIntelligence {
         }
         this.resolvedDeps = dedupeDependencies(allResolved);
         this.auditDeps = dedupeDependencies(allAudit);
+        this.projectRoot = commonPathRoot(groups.map((g) => g.dir));
         this.initialized = true;
     }
+    /**
+     * Root directory the dependency set was resolved from, or null before init.
+     * For multi-manifest (grouped) init this is the deepest common ancestor of
+     * the group directories — honest scope reporting for tool output, instead
+     * of whatever `process.cwd()` happens to be.
+     */
+    getProjectRoot() {
+        return this.projectRoot;
+    }
     /**
      * Run vulnerability scan (returns cached if fresh, fetches otherwise).
      */
@@ -227,6 +240,26 @@ export class LiveIntelligence {
         };
     }
 }
+/**
+ * Deepest common ancestor of a set of directories (segment-wise, both slash
+ * styles). Null for an empty set; a single dir is its own root.
+ */
+function commonPathRoot(dirs) {
+    if (dirs.length === 0)
+        return null;
+    const split = (p) => p.replace(/\\/g, "/").replace(/\/+$/, "").split("/");
+    let common = split(dirs[0]);
+    for (const dir of dirs.slice(1)) {
+        const parts = split(dir);
+        let i = 0;
+        while (i < common.length && i < parts.length && common[i].toLowerCase() === parts[i].toLowerCase())
+            i++;
+        common = common.slice(0, i);
+        if (common.length === 0)
+            break;
+    }
+    return common.length > 0 ? common.join("/") : null;
+}
 function dedupeDependencies(deps) {
     const unique = new Map();
     for (const dep of deps) {
@@ -236,6 +269,9 @@ function dedupeDependencies(deps) {
             existing.isDirect ||= dep.isDirect;
             existing.devScopeKnown &&= dep.devScopeKnown;
             existing.isDev = existing.devScopeKnown && existing.isDev && dep.isDev;
+            // A crate reachable via ANY active path is active; keep a target label if present.
+            existing.platformActive ||= dep.platformActive;
+            existing.target = existing.target ?? dep.target;
         }
         else {
             unique.set(key, { ...dep });
@@ -250,6 +286,7 @@ function emptyVulnResult(projectPath, offline) {
         ecosystemsScanned: [],
         totalScanned: 0,
         totalVulnerable: 0,
+        platformInactiveVulnerable: 0,
         bySeverity: { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 },
         vulnerabilities: [],
         cleanCount: 0,

package/dist/live/npm-registry.js

@@ -78,15 +78,20 @@ export class NpmRegistry {
         const result = new Map();
         if (names.length === 0)
             return result;
-        // Batch into groups of DOWNLOADS_BATCH_SIZE
-        for (let i = 0; i < names.length; i += DOWNLOADS_BATCH_SIZE) {
-            const batch = names.slice(i, i + DOWNLOADS_BATCH_SIZE);
+        // npm's bulk endpoint rejects scoped packages outright — a single "@scope/pkg"
+        // in a comma-joined request fails the WHOLE batch ("scoped packages are not
+        // currently supported in bulk lookups"), which previously zeroed downloads for
+        // every package in the group. Split them: unscoped go through the bulk endpoint,
+        // scoped are fetched individually (the single-package endpoint accepts them).
+        const scoped = names.filter((n) => n.startsWith("@"));
+        const unscoped = names.filter((n) => !n.startsWith("@"));
+        for (let i = 0; i < unscoped.length; i += DOWNLOADS_BATCH_SIZE) {
             if (!this.rateLimiter.canProceed("npm"))
                 break;
+            const batch = unscoped.slice(i, i + DOWNLOADS_BATCH_SIZE);
             try {
                 this.rateLimiter.consume("npm");
-                const scopedNames = batch.map((n) => encodeURIComponent(n));
-                const url = `${NPM_DOWNLOADS_URL}/${scopedNames.join(",")}`;
+                const url = `${NPM_DOWNLOADS_URL}/${batch.map((n) => encodeURIComponent(n)).join(",")}`;
                 const response = await fetchWithTimeout(url, {}, NPM_TIMEOUT_MS);
                 if (!response.ok)
                     continue;
@@ -98,7 +103,25 @@ export class NpmRegistry {
                 }
             }
             catch {
-                // Batch failure — continue with remaining batches
+                // Batch failure — continue with remaining batches.
+            }
+        }
+        // Scoped packages, one request each. The "@scope/pkg" path is sent literally
+        // (encoding the "/" breaks it); the single endpoint returns { downloads, ... }.
+        for (const name of scoped) {
+            if (!this.rateLimiter.canProceed("npm"))
+                break;
+            try {
+                this.rateLimiter.consume("npm");
+                const response = await fetchWithTimeout(`${NPM_DOWNLOADS_URL}/${name}`, {}, NPM_TIMEOUT_MS);
+                if (!response.ok)
+                    continue;
+                const data = (await response.json());
+                if (typeof data.downloads === "number")
+                    result.set(name, data.downloads);
+            }
+            catch {
+                // Skip this package's downloads — best-effort signal.
             }
         }
         return result;

package/dist/live/osv-scanner.d.ts

@@ -15,6 +15,14 @@ export declare class OsvScanner {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     scan(deps: ResolvedDependency[], projectPath: string): Promise<VulnerabilityScanResult>;
     private batchQuery;
+    /**
+     * Hydrate advisory detail for the given IDs. Cache-first (24h), then fetch the
+     * misses from `/v1/vulns/{id}` with bounded concurrency. A failed fetch is
+     * skipped (not fatal) — the caller falls back to the index-only shape so a
+     * real advisory is never silently dropped just because its detail 404'd.
+     */
+    private hydrateDetails;
+    private fetchDetail;
 }
 export declare function extractCvssScore(severity: Array<{
     type: string;

package/dist/live/osv-scanner.js

@@ -7,11 +7,17 @@
  *
  * Privacy: sends only package names + versions (public manifest data).
  */
-import { fetchWithTimeout } from "./http-utils.js";
+import { fetchWithTimeout, fetchJson } from "./http-utils.js";
+import { cvssBaseScore } from "./cvss.js";
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
+const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const OSV_TIMEOUT_MS = 15_000;
 const OSV_CACHE_TTL = 3600; // 1 hour
+const OSV_DETAIL_TTL = 86_400; // 24 hours — advisory details change rarely
 const MAX_BATCH_SIZE = 1000;
+// Bounded concurrency for advisory-detail hydration. Only the *vulnerable*
+// subset is hydrated (not every scanned dep), so this stays small in practice.
+const HYDRATE_CONCURRENCY = 8;
 export class OsvScanner {
     cache;
     rateLimiter;
@@ -61,6 +67,7 @@ export class OsvScanner {
         }
         const allVulns = [...cachedVulns, ...fetchedVulns];
         const vulnerablePackages = new Set(allVulns.map((v) => v.package));
+        const platformInactiveVulnerable = new Set(allVulns.filter((v) => !v.platformActive).map((v) => v.package)).size;
         const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 };
         for (const v of allVulns) {
             bySeverity[v.severity]++;
@@ -71,6 +78,7 @@ export class OsvScanner {
             ecosystemsScanned: ecosystems,
             totalScanned: scannable.length,
             totalVulnerable: vulnerablePackages.size,
+            platformInactiveVulnerable,
             bySeverity,
             vulnerabilities: allVulns,
             cleanCount: offline ? 0 : scannable.length - vulnerablePackages.size,
@@ -80,7 +88,10 @@ export class OsvScanner {
         };
     }
     async batchQuery(deps) {
-        const results = [];
+        // Phase 1 — enumerate advisory IDs per dep via the lightweight batch index.
+        // querybatch returns only `{ id, modified }`; the rich fields (severity,
+        // fixed version, summary, references) come from per-advisory hydration below.
+        const matches = [];
         for (let offset = 0; offset < deps.length; offset += MAX_BATCH_SIZE) {
             if (!this.rateLimiter.canProceed("osv")) {
                 throw new Error("OSV rate limit reached before all dependency batches completed");
@@ -101,26 +112,68 @@ export class OsvScanner {
             this.rateLimiter.consume("osv");
             const data = (await response.json());
             for (let i = 0; i < chunk.length; i++) {
-                const dep = chunk[i];
-                const osvResult = data.results[i];
-                const depVulns = [];
-                if (osvResult?.vulns && osvResult.vulns.length > 0) {
-                    for (const vuln of osvResult.vulns) {
-                        depVulns.push(mapVulnerability(vuln, dep));
-                    }
-                }
-                // Cache per-dep (even empty results to avoid re-fetching clean deps)
-                const cacheKey = `osv:${dep.ecosystem}:${dep.name}:${dep.version}`;
-                this.cache.set(cacheKey, depVulns, "osv", OSV_CACHE_TTL);
-                results.push(...depVulns);
+                const ids = (data.results[i]?.vulns ?? []).map((v) => v.id);
+                matches.push({ dep: chunk[i], ids });
             }
         }
+        // Phase 2 — hydrate each unique advisory once (cached, bounded concurrency).
+        const uniqueIds = [...new Set(matches.flatMap((m) => m.ids))];
+        const detailById = await this.hydrateDetails(uniqueIds);
+        // Phase 3 — map to entries and cache per-dep (empty results cached too, so
+        // clean deps are not re-queried).
+        const results = [];
+        for (const { dep, ids } of matches) {
+            // Drop advisories OSV has withdrawn/retracted — surfacing them is a false
+            // positive. Un-hydrated ids (detail fetch failed) are kept: we can't know,
+            // and dropping a real advisory is worse than keeping an un-enriched one.
+            const liveIds = ids.filter((id) => !detailById.get(id)?.withdrawn);
+            const depVulns = liveIds.map((id) => mapVulnerability(detailById.get(id) ?? { id }, dep));
+            const cacheKey = `osv:${dep.ecosystem}:${dep.name}:${dep.version}`;
+            this.cache.set(cacheKey, depVulns, "osv", OSV_CACHE_TTL);
+            results.push(...depVulns);
+        }
         return results;
     }
+    /**
+     * Hydrate advisory detail for the given IDs. Cache-first (24h), then fetch the
+     * misses from `/v1/vulns/{id}` with bounded concurrency. A failed fetch is
+     * skipped (not fatal) — the caller falls back to the index-only shape so a
+     * real advisory is never silently dropped just because its detail 404'd.
+     */
+    async hydrateDetails(ids) {
+        const out = new Map();
+        const toFetch = [];
+        for (const id of ids) {
+            const cached = this.cache.get(`osv:detail:${id}`);
+            if (cached)
+                out.set(id, cached);
+            else
+                toFetch.push(id);
+        }
+        for (let i = 0; i < toFetch.length; i += HYDRATE_CONCURRENCY) {
+            const slice = toFetch.slice(i, i + HYDRATE_CONCURRENCY);
+            const settled = await Promise.allSettled(slice.map((id) => this.fetchDetail(id)));
+            settled.forEach((res, j) => {
+                if (res.status === "fulfilled" && res.value) {
+                    const id = slice[j];
+                    out.set(id, res.value);
+                    this.cache.set(`osv:detail:${id}`, res.value, "osv", OSV_DETAIL_TTL);
+                }
+            });
+        }
+        return out;
+    }
+    async fetchDetail(id) {
+        try {
+            return await fetchJson(`${OSV_VULN_URL}${encodeURIComponent(id)}`, {}, OSV_TIMEOUT_MS);
+        }
+        catch {
+            return null;
+        }
+    }
 }
 function mapVulnerability(vuln, dep) {
-    const cvssScore = extractCvssScore(vuln.severity);
-    const severity = cvssScore !== null ? cvssToSeverity(cvssScore) : guessSeverityFromId(vuln.id);
+    const { severity, cvssScore } = deriveSeverity(vuln);
     const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem);
     return {
         package: dep.name,
@@ -140,21 +193,59 @@ function mapVulnerability(vuln, dep) {
             .filter((r) => r.type === "ADVISORY" || r.type === "WEB")
             .map((r) => r.url)
             .slice(0, 3),
+        target: dep.target,
+        platformActive: dep.platformActive,
     };
 }
+/**
+ * Derive a severity bucket honestly: a CVSS base score (numeric or computed
+ * from a vector) wins; otherwise the GitHub-advisory label; otherwise unknown.
+ * Never fabricates a default bucket — an advisory with no severity signal is
+ * reported as `unknown`, not silently labeled "medium".
+ */
+function deriveSeverity(vuln) {
+    const cvssScore = extractCvssScore(vuln.severity);
+    if (cvssScore !== null)
+        return { severity: cvssToSeverity(cvssScore), cvssScore };
+    const label = labelToSeverity(vuln.database_specific?.severity);
+    if (label !== "unknown")
+        return { severity: label, cvssScore: null };
+    return { severity: "unknown", cvssScore: null };
+}
+function labelToSeverity(label) {
+    switch ((label || "").toUpperCase()) {
+        case "CRITICAL":
+            return "critical";
+        case "HIGH":
+            return "high";
+        case "MODERATE":
+        case "MEDIUM":
+            return "medium";
+        case "LOW":
+            return "low";
+        default:
+            return "unknown";
+    }
+}
 export function extractCvssScore(severity) {
     if (!severity || severity.length === 0)
         return null;
-    // OSV commonly returns a CVSS vector rather than a numeric base score.
-    // Without a full CVSS calculator, treating the vector's "3.1" version as
-    // the score is worse than leaving severity unknown.
+    // Prefer an explicit numeric base score when present.
     for (const s of severity) {
         const raw = s.score.trim();
-        if (!/^\d+(?:\.\d+)?$/.test(raw))
-            continue;
-        const num = Number(raw);
-        if (!isNaN(num) && num >= 0 && num <= 10)
-            return num;
+        if (/^\d+(?:\.\d+)?$/.test(raw)) {
+            const num = Number(raw);
+            if (!isNaN(num) && num >= 0 && num <= 10)
+                return num;
+        }
+    }
+    // OSV most often gives a CVSS *vector* string — compute its base score.
+    for (const s of severity) {
+        if (s.score.includes("AV:")) {
+            const score = cvssBaseScore(s.score);
+            if (score !== null)
+                return score;
+        }
     }
     return null;
 }
@@ -169,12 +260,6 @@ function cvssToSeverity(score) {
         return "low";
     return "unknown";
 }
-function guessSeverityFromId(id) {
-    // GHSA severity is sometimes encoded in the advisory
-    if (id.startsWith("GHSA-"))
-        return "medium"; // conservative default
-    return "unknown";
-}
 function extractFixedVersion(affected, packageName, ecosystem) {
     if (!affected)
         return null;

package/dist/live/platform.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Target/platform awareness for dependency relevance.
+ *
+ * Cargo (and other ecosystems) gate dependencies behind a target: e.g.
+ * `[target.'cfg(windows)'.dependencies]` or `[target.x86_64-pc-windows-msvc.dependencies]`.
+ * A dependency that is only active on a platform the user does not build is NOT
+ * relevant to them - surfacing its advisory would be noise (the classic
+ * "GTK/webkit vuln shown to a Windows user" problem).
+ *
+ * This module evaluates a target spec against the HOST platform so the scanner
+ * can tag each dependency `platformActive` and let consumers suppress or label
+ * the irrelevant ones. It is deliberately conservative: anything it cannot
+ * confidently evaluate is treated as ACTIVE, so we never hide a real advisory.
+ */
+export interface HostTarget {
+    /** rustc-style os: "windows" | "macos" | "linux" | ... */
+    os: string;
+    /** "windows" | "unix" */
+    family: string;
+    /** rustc-style arch: "x86_64" | "aarch64" | ... */
+    arch: string;
+}
+export declare function hostTarget(): HostTarget;
+/**
+ * Is a dependency's target spec active on the host?
+ * `target` is null/empty for unconditional deps (always active).
+ * Returns true when active OR when the spec can't be confidently evaluated.
+ */
+export declare function targetActiveOnHost(target: string | null | undefined, host?: HostTarget): boolean;
+/** Evaluate a cfg predicate body (already unwrapped from `cfg( ... )`). */
+export declare function evalCfg(expr: string, host?: HostTarget): boolean;
+//# sourceMappingURL=platform.d.ts.map