praxis-sec 1.0.0

package/cli/utils/standards/sources/iso-42001.js

@@ -0,0 +1,94 @@
+/**
+ * ISO/IEC 42001:2023 — AI Management System (AIMS).
+ * https://www.iso.org/standard/81230.html
+ *
+ * Control titles and structure follow the public Annex A outline; descriptions
+ * are paraphrased by Praxis (ISO text is copyrighted — not reproduced).
+ */
+
+export const name = 'iso-42001';
+export const version = '2023';
+export const title = 'ISO/IEC 42001 (AI Management System)';
+export const description = 'International standard for establishing, implementing, and maintaining an AI management system.';
+export const url = 'https://www.iso.org/standard/81230.html';
+
+export const controls = [
+  // A.5 — Policies related to AI
+  { id: 'A.5.2',   title: 'AI policy',                             description: 'Documented policy providing direction and support for AI development and use.' },
+  { id: 'A.5.5',   title: 'AI policy review',                      description: 'Policy reviewed for continued suitability and updated when AI usage changes.' },
+  // A.6 — Internal organization
+  { id: 'A.6.1.2', title: 'AI roles and responsibilities',         description: 'Roles, responsibilities, and authorities for AI-related work defined and assigned.' },
+  { id: 'A.6.2.4', title: 'AI system impact assessment',           description: 'Assess potential impacts of AI systems on individuals, groups of individuals, and societies.' },
+  { id: 'A.6.2.6', title: 'AI system design — privacy & security', description: 'Privacy and security embedded in AI system design through the lifecycle.' },
+  // A.7 — Resources for AI systems
+  { id: 'A.7.2',   title: 'Resources',                             description: 'Resources needed across the AI system lifecycle are determined and provided.' },
+  { id: 'A.7.4',   title: 'Quality of data for AI systems',        description: 'Data quality and integrity requirements defined for training, validation, and inference data.' },
+  { id: 'A.7.6',   title: 'AI system documentation',               description: 'Documentation of the AI system and its lifecycle phases maintained and traceable.' },
+  // A.8 — Assessment of AI system impact
+  { id: 'A.8.2',   title: 'Resources for AI systems',              description: 'AI compute, models, and tooling assets managed as organizational resources.' },
+  { id: 'A.8.4',   title: 'Tooling for AI systems',                description: 'Tools used in AI development, validation, and operation are evaluated and controlled.' },
+  // A.9 — AI system lifecycle
+  { id: 'A.9.2',   title: 'Information for users of AI systems',   description: 'Intended use, limitations, and risks communicated to users and interested parties.' },
+  { id: 'A.9.3',   title: 'AI system design and development', detectable: false,      description: 'Lifecycle objectives, processes, and acceptance criteria defined and followed.' },
+  { id: 'A.9.4',   title: 'AI system verification and validation', description: 'Verification and validation against acceptance criteria before deployment.' },
+  { id: 'A.9.5',   title: 'AI system operation and monitoring',    description: 'Deployed AI systems operated per policy and monitored for drift, misuse, and incidents.' },
+  // A.10 — Data for AI systems
+  { id: 'A.10.2',  title: 'Allocation of responsibilities',        description: 'Responsibilities for AI systems distributed among suppliers, customers, and partners.' },
+  { id: 'A.10.3',  title: 'Suppliers',                             description: 'AI-relevant supplier relationships governed by defined requirements and controls.' },
+  { id: 'A.10.4',  title: 'Data provenance and preparation',       description: 'Origin, transformation, and preparation of AI data is recorded and controlled.' },
+  // A.11 — Information for interested parties
+  { id: 'A.11.2',  title: 'Reporting concerns', detectable: false,                    description: 'Concerns about AI system impacts can be raised, reviewed, and resolved.' },
+  { id: 'A.11.5',  title: 'Communication of incidents',            description: 'AI incidents communicated to relevant interested parties, including authorities where required.' },
+  // A.12 — Use of AI systems
+  { id: 'A.12.4',  title: 'Human oversight of AI use',             description: 'Appropriate human oversight applied to AI use to limit unintended consequences.' },
+  // A.13 — Third-party and customer relationships
+  { id: 'A.13.2',  title: 'Third-party AI supply',                 description: 'Third-party AI components and services assessed before adoption and monitored thereafter.' },
+];
+
+export function mapFinding(finding) {
+  const ids = new Set();
+  const cwe = finding.cwe || '';
+  const owasp = finding.owasp || '';
+  const cat = finding.category || '';
+  const rule = (finding.rule || '').toLowerCase();
+  const title = (finding.title || '').toLowerCase();
+  const text = rule + title;
+
+  // A.5 — policy / governance
+  if (cat === 'agentic' || /policy|governance|\.cursorrules|CLAUDE\.md|agent.?config/.test(text)) ids.add('A.5.2');
+  if (/no.?policy|missing.?policy/.test(text)) ids.add('A.5.5');
+
+  // A.6 — organization, impact, privacy/security by design
+  if (/poison|rag\b|retrieval|embedding|memory/.test(text)) {
+    ids.add('A.7.4'); ids.add('A.6.2.4');
+  }
+  if (cat === 'secrets' || cwe === 'CWE-200' || cwe === 'CWE-312' || cwe === 'CWE-798'
+      || owasp === 'ASI06' || /prompt.?inject|jailbreak/.test(text) || owasp === 'ASI01') {
+    ids.add('A.6.2.6');
+  }
+  if (/permission|role|segregation|least.?privilege/.test(text)) ids.add('A.6.1.2');
+
+  // A.7 — resources, data quality, documentation
+  if (cat === 'llm' || /inference|compute|gpu/.test(text)) ids.add('A.7.2');
+  if (/no.?model.?card|missing.?documentation/.test(text)) ids.add('A.7.6');
+
+  // A.8 — tooling
+  if (/mcp|tool.?poison|tool.?registry/.test(text) || cat === 'config') ids.add('A.8.4');
+  if (cat === 'llm') ids.add('A.8.2');
+
+  // A.9 — lifecycle: info to users, verification, monitoring
+  if (owasp === 'ASI08' || /human.?oversight|missing.?confirmation|auto.?accept|yolo/.test(text)) { ids.add('A.9.2'); ids.add('A.12.4'); }
+  if (/no.?verification|no.?validation|unverified/.test(text)) ids.add('A.9.4');
+  if (/no.?monitoring|no.?logging|telemetry|no.?observability/.test(text)) ids.add('A.9.5');
+
+  // A.10/A.13 — supply chain, third parties
+  if (cat === 'supply-chain' || cat === 'deps' || owasp === 'ASI04') {
+    ids.add('A.10.3'); ids.add('A.10.2'); ids.add('A.13.2');
+  }
+  if (/provenance|signature|hash|attestation/.test(text)) ids.add('A.10.4');
+
+  // A.11 — incident communication
+  if (/incident|report/.test(text) && cat !== 'secrets') ids.add('A.11.5');
+
+  return [...ids];
+}

package/cli/utils/standards/sources/mitre-atlas.js

@@ -0,0 +1,54 @@
+/**
+ * MITRE ATLAS — Adversarial Threat Landscape for AI Systems.
+ * https://atlas.mitre.org/
+ *
+ * Subset of techniques observable from static code/config analysis.
+ * Enriched with the vendored ATLAS knowledge snapshot (see atlas-knowledge.js).
+ */
+
+import { getTechniqueDetails, atlasSnapshot, isKnownTechnique } from '../atlas-knowledge.js';
+
+export const name = 'mitre-atlas';
+export const version = '2024';
+export const title = 'MITRE ATLAS';
+export const description = 'Adversarial tactics, techniques, and case studies for AI systems.';
+export const url = 'https://atlas.mitre.org/';
+export const enrichmentSnapshot = () => atlasSnapshot();
+
+export { getTechniqueDetails, atlasSnapshot, isKnownTechnique };
+
+export const controls = [
+  { id: 'AML.T0010', title: 'ML Supply Chain Compromise',     description: 'Adversary compromises models/datasets/dependencies to gain access.' },
+  { id: 'AML.T0018', title: 'Manipulate AI Model',            description: 'Modify deployed model parameters or artifacts.' },
+  { id: 'AML.T0024', title: 'Exfiltration via ML Inference',  description: 'Leak training data or system info through inference outputs.' },
+  { id: 'AML.T0034', title: 'ML Model Poisoning',             description: 'Insert poisoned data into training/fine-tuning pipeline.' },
+  { id: 'AML.T0040', title: 'ML Model Inference API Access',  description: 'Abuse exposed inference APIs for evasion/extraction.' },
+  { id: 'AML.T0043', title: 'Craft Adversarial Data',         description: 'Carefully crafted input bypasses model decision boundaries.' },
+  { id: 'AML.T0048', title: 'External Harms',                 description: 'AI output causes financial, reputational, or societal damage.' },
+  { id: 'AML.T0051', title: 'LLM Prompt Injection',           description: 'Direct or indirect prompt injection alters LLM behavior.' },
+  { id: 'AML.T0053', title: 'LLM Plugin Compromise',          description: 'Malicious or vulnerable plugin/tool exposed to the LLM.' },
+  { id: 'AML.T0054', title: 'LLM Jailbreak',                  description: 'Bypass safety alignment via crafted prompts or roleplay.' },
+  { id: 'AML.T0057', title: 'LLM Data Leakage',               description: 'LLM emits training data, secrets, or system prompts.' },
+  { id: 'AML.T0070', title: 'RAG Poisoning',                  description: 'Inject malicious documents into retrieval index.' },
+];
+
+export function mapFinding(finding) {
+  const ids = new Set();
+  const cwe = finding.cwe || '';
+  const owasp = finding.owasp || '';
+  const cat = finding.category || '';
+  const rule = (finding.rule || '').toLowerCase();
+  const title = (finding.title || '').toLowerCase();
+
+  if (cat === 'supply-chain' || cat === 'deps' || owasp === 'ASI04') ids.add('AML.T0010');
+  if (owasp === 'ASI05' || /poison|tamper|memory/.test(rule + title)) { ids.add('AML.T0018'); ids.add('AML.T0034'); }
+  if (cat === 'secrets' || cwe === 'CWE-200' || cwe === 'CWE-312' || owasp === 'ASI06') { ids.add('AML.T0024'); ids.add('AML.T0057'); }
+  if (cat === 'api' && /llm|inference|model/.test(rule + title)) ids.add('AML.T0040');
+  if (/jailbreak|dan|roleplay|ignore.?instructions/.test(rule + title)) ids.add('AML.T0054');
+  if (/prompt.?inject|indirect.?inject/.test(rule + title) || owasp === 'ASI01') { ids.add('AML.T0043'); ids.add('AML.T0051'); }
+  if (owasp === 'ASI02' || /mcp|tool.?poison/.test(rule + title)) ids.add('AML.T0053');
+  if (/retrieval|vector.?store|rag\b|embedding/.test(rule + title)) ids.add('AML.T0070');
+  if (owasp === 'ASI10') ids.add('AML.T0048');
+
+  return [...ids];
+}

package/cli/utils/standards/sources/nist-ai-600-1.js

@@ -0,0 +1,45 @@
+/**
+ * NIST AI 600-1 — Generative AI Profile (companion to AI RMF 1.0).
+ * https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
+ *
+ * The profile lists actions tagged with prefixes for each RMF function
+ * (GV/MP/MS/MG) tailored to GenAI. We use a representative subset.
+ */
+
+export const name = 'nist-ai-600-1';
+export const version = '1.0';
+export const title = 'NIST AI 600-1 (Generative AI Profile)';
+export const description = 'GenAI-specific risk management actions complementing NIST AI RMF 1.0.';
+export const url = 'https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf';
+
+export const controls = [
+  { id: 'GV-1.3-GAI', title: 'Govern: GenAI policies & procedures',     description: 'Establish policies addressing GenAI-specific risks.' },
+  { id: 'GV-4.1-GAI', title: 'Govern: organizational responsibility',   description: 'Define roles for GenAI risk decisions and tool use.' },
+  { id: 'MP-2.3-GAI', title: 'Map: dangerous/violent content risks',    description: 'Identify CBRN, malicious code, and harmful-output risks.' },
+  { id: 'MP-5.1-GAI', title: 'Map: information integrity',              description: 'Identify confabulation, prompt injection, data integrity risks.' },
+  { id: 'MS-2.6-GAI', title: 'Measure: harmful content / safety',       description: 'Assess outputs for harmful, biased, or unsafe content.' },
+  { id: 'MS-2.7-GAI', title: 'Measure: security and adversarial robustness', description: 'Evaluate robustness against adversarial inputs and exfiltration.' },
+  { id: 'MS-2.10-GAI', title: 'Measure: information security',          description: 'Test for leakage of training data, secrets, system prompts.' },
+  { id: 'MG-2.2-GAI', title: 'Manage: data privacy & confidentiality',  description: 'Mitigate disclosure of PII and confidential data.' },
+  { id: 'MG-3.2-GAI', title: 'Manage: third-party / supply chain',      description: 'Manage risks from third-party models, datasets, components.' },
+  { id: 'MG-4.1-GAI', title: 'Manage: ongoing monitoring',              description: 'Continuous monitoring for new GenAI risks post-deployment.' },
+];
+
+export function mapFinding(finding) {
+  const ids = new Set();
+  const cwe = finding.cwe || '';
+  const owasp = finding.owasp || '';
+  const cat = finding.category || '';
+  const rule = (finding.rule || '').toLowerCase();
+  const title = (finding.title || '').toLowerCase();
+
+  if (cat === 'agentic' || /agent.?config|\.cursorrules|CLAUDE\.md|\.windsurfrules/.test(rule + title)) { ids.add('GV-1.3-GAI'); ids.add('GV-4.1-GAI'); }
+  if (/prompt.?inject|jailbreak/.test(rule + title) || owasp === 'ASI01') { ids.add('MP-5.1-GAI'); ids.add('MS-2.7-GAI'); }
+  if (owasp === 'ASI05' || /poison|tamper|memory|rag\b|embedding/.test(rule + title)) ids.add('MP-5.1-GAI');
+  if (cat === 'llm' && /toxic|harm|unsafe/.test(rule + title)) { ids.add('MP-2.3-GAI'); ids.add('MS-2.6-GAI'); }
+  if (cat === 'secrets' || cwe === 'CWE-200' || cwe === 'CWE-312' || cwe === 'CWE-798' || owasp === 'ASI06') { ids.add('MG-2.2-GAI'); ids.add('MS-2.10-GAI'); }
+  if (cat === 'supply-chain' || cat === 'deps' || owasp === 'ASI04') ids.add('MG-3.2-GAI');
+  if (/mcp|tool.?poison/.test(rule + title) || owasp === 'ASI08' || owasp === 'ASI10') ids.add('MG-4.1-GAI');
+
+  return [...ids];
+}

package/cli/utils/standards/sources/owasp-llm.js

@@ -0,0 +1,45 @@
+/**
+ * OWASP Top 10 for LLM Applications (2025).
+ * https://genai.owasp.org/llm-top-10/
+ */
+
+export const name = 'owasp-llm';
+export const version = '2025';
+export const title = 'OWASP Top 10 for LLM Applications';
+export const description = 'Most critical security risks for applications using large language models.';
+export const url = 'https://genai.owasp.org/llm-top-10/';
+
+export const controls = [
+  { id: 'LLM01', title: 'Prompt Injection',                  description: 'User or indirect input manipulates LLM behavior, bypassing instructions.' },
+  { id: 'LLM02', title: 'Sensitive Information Disclosure',  description: 'LLM reveals secrets, PII, or proprietary data via outputs.' },
+  { id: 'LLM03', title: 'Supply Chain',                      description: 'Compromised models, datasets, plugins, or upstream packages.' },
+  { id: 'LLM04', title: 'Data and Model Poisoning',          description: 'Tampered training, fine-tuning, or retrieval data biases the model.' },
+  { id: 'LLM05', title: 'Improper Output Handling',          description: 'Downstream systems trust LLM output without validation/escaping.' },
+  { id: 'LLM06', title: 'Excessive Agency',                  description: 'LLM granted excessive autonomy, permissions, or tool scope.' },
+  { id: 'LLM07', title: 'System Prompt Leakage',             description: 'System prompts containing secrets or rules are exposed.' },
+  { id: 'LLM08', title: 'Vector and Embedding Weaknesses',   description: 'RAG/vector stores leak data or accept poisoned embeddings.' },
+  { id: 'LLM09', title: 'Misinformation',                    description: 'Confidently wrong outputs propagate as fact.' },
+  { id: 'LLM10', title: 'Unbounded Consumption',             description: 'Resource exhaustion (cost, tokens, latency) via crafted prompts.' },
+];
+
+export function mapFinding(finding) {
+  const ids = new Set();
+  const cwe = finding.cwe || '';
+  const owasp = finding.owasp || '';
+  const cat = finding.category || '';
+  const rule = (finding.rule || '').toLowerCase();
+  const title = (finding.title || '').toLowerCase();
+
+  if (owasp === 'ASI01' || /prompt.?inject|jailbreak|goal.?hijack/.test(rule + title)) ids.add('LLM01');
+  if (cat === 'secrets' || cat === 'git-history' || cwe === 'CWE-200' || cwe === 'CWE-312' || cwe === 'CWE-522' || cwe === 'CWE-798' || owasp === 'ASI06') ids.add('LLM02');
+  if (cat === 'supply-chain' || cat === 'deps' || owasp === 'ASI04') ids.add('LLM03');
+  if (owasp === 'ASI05' || /poison|tamper/.test(rule + title)) ids.add('LLM04');
+  if (cwe === 'CWE-79' || cwe === 'CWE-94' || cwe === 'CWE-116' || /output.?handl|unescaped/.test(rule + title)) ids.add('LLM05');
+  if (cwe === 'CWE-269' || cwe === 'CWE-250' || owasp === 'ASI02' || owasp === 'ASI03') ids.add('LLM06');
+  if (/system.?prompt|prompt.?leak/.test(rule + title)) ids.add('LLM07');
+  if (/vector|embedding|rag\b|retrieval/.test(rule + title)) ids.add('LLM08');
+  if (owasp === 'ASI10' || /halluc|misinform/.test(rule + title)) ids.add('LLM09');
+  if (cat === 'api' || /rate.?limit|token.?abuse|unbounded|dos/.test(rule + title)) ids.add('LLM10');
+
+  return [...ids];
+}

package/cli/utils/standards/sources/owasp-ml.js

@@ -0,0 +1,45 @@
+/**
+ * OWASP Machine Learning Security Top 10.
+ * https://owasp.org/www-project-machine-learning-security-top-10/
+ *
+ * Covers classical ML model attacks (separate from the LLM Top 10).
+ */
+
+export const name = 'owasp-ml';
+export const version = '2023';
+export const title = 'OWASP Machine Learning Security Top 10';
+export const description = 'Top risks specific to machine learning systems.';
+export const url = 'https://owasp.org/www-project-machine-learning-security-top-10/';
+
+export const controls = [
+  { id: 'ML01', title: 'Input Manipulation Attack',  description: 'Adversarial inputs cause incorrect predictions.' },
+  { id: 'ML02', title: 'Data Poisoning Attack',      description: 'Tainted training data biases or backdoors model.' },
+  { id: 'ML03', title: 'Model Inversion Attack',     description: 'Reconstruct training data from model outputs.' },
+  { id: 'ML04', title: 'Membership Inference Attack', description: 'Determine if a record was in the training set.' },
+  { id: 'ML05', title: 'Model Theft',                description: 'Steal model weights via API or filesystem access.' },
+  { id: 'ML06', title: 'AI Supply Chain Attacks',    description: 'Compromised pretrained models or libraries.' },
+  { id: 'ML07', title: 'Transfer Learning Attack',   description: 'Backdoors propagated from upstream pretrained model.' },
+  { id: 'ML08', title: 'Model Skewing',              description: 'Feedback loops bias online models.' },
+  { id: 'ML09', title: 'Output Integrity Attack',    description: 'Tamper with model outputs in transit.' },
+  { id: 'ML10', title: 'Model Poisoning',            description: 'Malicious modifications to model parameters.' },
+];
+
+export function mapFinding(finding) {
+  const ids = new Set();
+  const owasp = finding.owasp || '';
+  const cat = finding.category || '';
+  const rule = (finding.rule || '').toLowerCase();
+  const title = (finding.title || '').toLowerCase();
+
+  if (/adversarial|prompt.?inject|jailbreak/.test(rule + title) || owasp === 'ASI01') ids.add('ML01');
+  if (owasp === 'ASI05' || /poison|tamper|rag\b|embedding/.test(rule + title)) { ids.add('ML02'); ids.add('ML10'); }
+  if (/inversion|extract.?training/.test(rule + title)) ids.add('ML03');
+  if (/membership.?inference/.test(rule + title)) ids.add('ML04');
+  if (/model.?(?:theft|steal|exfil)|weights.?leak/.test(rule + title)) ids.add('ML05');
+  if (cat === 'supply-chain' || cat === 'deps' || owasp === 'ASI04') ids.add('ML06');
+  if (/pretrain|fine.?tune.?backdoor|transfer.?learn/.test(rule + title)) ids.add('ML07');
+  if (/feedback.?loop|skew/.test(rule + title)) ids.add('ML08');
+  if (/output.?integrity|response.?tamper/.test(rule + title)) ids.add('ML09');
+
+  return [...ids];
+}

package/cli/utils/threat-intel.js

@@ -0,0 +1,265 @@
+/**
+ * Threat Intelligence Feed
+ * =========================
+ *
+ * Loads and queries Praxis's threat intelligence database.
+ *
+ * Data sources (merged by `cli/utils/intel/`):
+ *   - OSV.dev               package advisories (npm, PyPI, Go, ...)
+ *   - GitHub Advisory DB    cross-ecosystem advisories
+ *   - CISA KEV              actively-exploited CVEs
+ *   - EPSS                  exploit-likelihood scores
+ *   - NVD                   CVE detail enrichment
+ *   - Gitleaks rules        extra secret-detection patterns
+ *   - Snyk / Socket / GitGuardian / Sonatype / Phylum   (paid, optional)
+ *
+ * Bundled-seed fields (maliciousSkillHashes, compromisedMcpServers,
+ * maliciousConfigSignatures) are loaded from `cli/data/threat-intel.json`
+ * when no merged feed is on disk yet.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
+import * as intel from './intel/index.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const SEED_PATH = path.resolve(__dirname, '..', 'data', 'threat-intel.json');
+const mergedFeedPath = () => path.join(os.homedir(), '.praxis', 'threat-intel.json');
+
+let _cache = null;
+
+export class ThreatIntel {
+  /**
+   * Load threat intel data.
+   *
+   * Resolution order:
+   *   1. Merged multi-source feed at ~/.praxis/threat-intel.json (if present)
+   *   2. Bundled seed at cli/data/threat-intel.json
+   */
+  static load() {
+    if (_cache) return _cache;
+
+    let data = null;
+
+    try {
+      if (fs.existsSync(mergedFeedPath())) {
+        data = JSON.parse(fs.readFileSync(mergedFeedPath(), 'utf-8'));
+      }
+    } catch { /* fall through to seed */ }
+
+    if (!data) {
+      try {
+        data = JSON.parse(fs.readFileSync(SEED_PATH, 'utf-8'));
+      } catch {
+        data = emptyFeed();
+      }
+    }
+
+    // Ensure new fields exist even when reading the old seed.
+    data.cveAdvisories ||= [];
+    data.kevList ||= [];
+    data.kevDetails ||= {};
+    data.epssScores ||= {};
+    data.osvIndex ||= {};
+    data.ghsaIndex ||= {};
+    data.nvdDetails ||= {};
+    data.secretRules ||= [];
+
+    _cache = data;
+    return data;
+  }
+
+  /** @internal — for tests */
+  static _resetCache() { _cache = null; }
+
+  // ---- Legacy API (unchanged) ---------------------------------------------
+
+  static lookupHash(sha256) {
+    const data = ThreatIntel.load();
+    return (data.maliciousSkillHashes || []).find(h => h.sha256 === sha256) || null;
+  }
+
+  static lookupMcpServer(name, version = '*') {
+    const data = ThreatIntel.load();
+    return (data.compromisedMcpServers || []).find(s => {
+      if (s.name !== name) return false;
+      if (s.versions.includes('*')) return true;
+      return s.versions.some(v => {
+        if (v.startsWith('<')) return version < v.slice(1);
+        return v === version;
+      });
+    }) || null;
+  }
+
+  static matchSignatures(content) {
+    const data = ThreatIntel.load();
+    const matches = [];
+    for (const sig of data.maliciousConfigSignatures || []) {
+      try {
+        const re = new RegExp(sig.pattern, 'gi');
+        if (re.test(content)) matches.push(sig);
+      } catch { /* skip bad patterns */ }
+    }
+    return matches;
+  }
+
+  static hash(content) {
+    return createHash('sha256').update(content).digest('hex');
+  }
+
+  // ---- New: multi-source query API ----------------------------------------
+
+  /**
+   * Look up advisories for a package version. Checks the merged OSV index
+   * first; affected version ranges are evaluated naively (any match in
+   * the package's advisories is returned with isAffected=true|false).
+   *
+   * @param {string} pkg
+   * @param {string} version
+   * @param {string} ecosystem  'npm', 'PyPI', 'Go', etc.
+   */
+  static lookupOsv(pkg, version, ecosystem = 'npm') {
+    const data = ThreatIntel.load();
+    const advisories = data.osvIndex[`${ecosystem}/${pkg}`] || [];
+    return advisories.map(a => ({
+      ...a,
+      isAffected: version ? versionInRanges(version, a.ranges) : null,
+    }));
+  }
+
+  /** Look up GHSA advisories for a package. */
+  static lookupGhsa(pkg, ecosystem = 'npm') {
+    const data = ThreatIntel.load();
+    return data.ghsaIndex[`${ecosystem}/${pkg}`] || [];
+  }
+
+  /** EPSS exploit-likelihood for a CVE. Returns null if unknown. */
+  static getEpss(cve) {
+    const data = ThreatIntel.load();
+    return data.epssScores[cve] || null;
+  }
+
+  /** True if a CVE is in CISA KEV (actively exploited). */
+  static isInKev(cve) {
+    const data = ThreatIntel.load();
+    return Array.isArray(data.kevList) && data.kevList.includes(cve);
+  }
+
+  static getKevDetails(cve) {
+    const data = ThreatIntel.load();
+    return data.kevDetails?.[cve] || null;
+  }
+
+  /** Full NVD record for a CVE if previously enriched. */
+  static getNvdDetail(cve) {
+    const data = ThreatIntel.load();
+    return data.nvdDetails[cve] || null;
+  }
+
+  /**
+   * Extra secret detection regexes pulled from Gitleaks / GitGuardian.
+   * The scanner can merge these with its hardcoded SECRET_PATTERNS.
+   */
+  static getExtraSecretRules() {
+    const data = ThreatIntel.load();
+    return data.secretRules || [];
+  }
+
+  // ---- Update / freshness -------------------------------------------------
+
+  /**
+   * Run a multi-source threat-intel update.
+   *
+   * @param {object} [options]   forwarded to `intel.runUpdate`
+   *                             ({ sources, force, onProgress })
+   */
+  static async update(options = {}) {
+    const result = await intel.runUpdate(options);
+    _cache = null; // force re-read on next load()
+    return {
+      updated: true,
+      version: result.merged.version,
+      sources: result.meta.sources,
+    };
+  }
+
+  /** True if the merged feed is older than `maxAgeMs`. */
+  static isStale(maxAgeMs) {
+    return intel.isStale(maxAgeMs);
+  }
+
+  static stats() {
+    const data = ThreatIntel.load();
+    return {
+      version: data.version,
+      updated: data.updated,
+      hashes: data.maliciousSkillHashes?.length || 0,
+      servers: data.compromisedMcpServers?.length || 0,
+      signatures: data.maliciousConfigSignatures?.length || 0,
+      configs: data.knownVulnerableConfigs?.length || 0,
+      cveAdvisories: (data.cveAdvisories || []).length,
+      kevEntries: (data.kevList || []).length,
+      epssScores: Object.keys(data.epssScores || {}).length,
+      nvdDetails: Object.keys(data.nvdDetails || {}).length,
+      extraSecretRules: (data.secretRules || []).length,
+      sources: data.sources || null,
+    };
+  }
+}
+
+function emptyFeed() {
+  return {
+    version: '0.0.0',
+    maliciousSkillHashes: [],
+    compromisedMcpServers: [],
+    maliciousConfigSignatures: [],
+    knownVulnerableConfigs: [],
+    cveAdvisories: [],
+    kevList: [],
+    kevDetails: {},
+    epssScores: {},
+    osvIndex: {},
+    ghsaIndex: {},
+    nvdDetails: {},
+    secretRules: [],
+  };
+}
+
+/**
+ * Naive evaluation of OSV "ranges" against a version. OSV's range model is
+ * { type: 'SEMVER'|'ECOSYSTEM'|'GIT', events: [{introduced}, {fixed}] }.
+ * We compare numerically for the SEMVER case and string-equal for fixed
+ * versions otherwise. A null/empty range list returns true (assume affected).
+ */
+function versionInRanges(version, ranges) {
+  if (!Array.isArray(ranges) || ranges.length === 0) return true;
+  for (const r of ranges) {
+    let introduced = '0';
+    let fixed = null;
+    for (const evt of r.events || []) {
+      if (evt.introduced) introduced = evt.introduced;
+      if (evt.fixed) fixed = evt.fixed;
+    }
+    if (compareSemver(version, introduced) >= 0) {
+      if (!fixed) return true;
+      if (compareSemver(version, fixed) < 0) return true;
+    }
+  }
+  return false;
+}
+
+function compareSemver(a, b) {
+  const pa = String(a).split('.').map(p => parseInt(p, 10) || 0);
+  const pb = String(b).split('.').map(p => parseInt(p, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const da = pa[i] || 0;
+    const db = pb[i] || 0;
+    if (da !== db) return da - db;
+  }
+  return 0;
+}