visus-mcp 0.6.0 → 0.6.2

package/src/sanitizer/framework-mapper.ts

@@ -5,12 +5,14 @@
  * - OWASP LLM Top 10 (2025)
  * - NIST AI 600-1 (Generative AI Profile)
  * - MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
+ * - ISO/IEC 42001:2023 (AI Management System - Annex A Controls)
  */
 
 export interface FrameworkMappings {
   owasp_llm: string;
   nist_ai_600_1: string;
   mitre_atlas: string;
+  iso_42001: string;
 }
 
 /**
@@ -21,301 +23,344 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   direct_instruction_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Role hijacking
   role_hijacking: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // System prompt extraction
   system_prompt_extraction: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Privilege escalation
   privilege_escalation: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Context poisoning
   context_poisoning: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.2 - Data Quality'
   },
 
   // Data exfiltration
   data_exfiltration: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.7.5 - Data Provenance / A.8.2 - Information to Users'
   },
 
   // Encoding obfuscation
   base64_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Unicode lookalikes
   unicode_lookalikes: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Zero-width characters
   zero_width_characters: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // HTML script injection
   html_script_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Data URI injection
   data_uri_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Markdown link injection
   markdown_link_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // URL fragment attacks
   url_fragment_hashjack: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Social engineering
   social_engineering_urgency: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.5.3 - AI Awareness and Training'
   },
 
   // Instruction delimiter injection
   instruction_delimiter_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Multi-language obfuscation
   multi_language_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Reverse text obfuscation
   reverse_text_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Leetspeak obfuscation
   leetspeak_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Jailbreak keywords
   jailbreak_keywords: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Token smuggling
   token_smuggling: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // System message injection
   system_message_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Conversation reset
   conversation_reset: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
 
   // Memory manipulation
   memory_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
 
   // Capability probing
   capability_probing: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
 
   // Chain-of-thought manipulation
   chain_of_thought_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Hypothetical scenario injection
   hypothetical_scenario_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Ethical override
   ethical_override: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.2.2 - Responsible AI Policies'
   },
 
   // Output format manipulation
   output_format_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
 
   // Negative instruction
   negative_instruction: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
 
   // Credential harvesting
   credential_harvesting: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.7.5 - Data Provenance / A.6.1.5 - AI System Security'
   },
 
   // Time-based triggers
   time_based_triggers: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
 
   // Code execution requests
   code_execution_requests: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
 
   // File system access
   file_system_access: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
 
   // Training data extraction
   training_data_extraction: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.7.5 - Data Provenance'
   },
 
   // Simulator mode
   simulator_mode: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
 
   // Nested encoding
   nested_encoding: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Payload splitting
   payload_splitting: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // CSS-based hiding
   css_hiding: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Authority impersonation
   authority_impersonation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.2.2 - Responsible AI Policies'
   },
 
   // Testing/debugging claims
   testing_debugging_claims: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+    iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
 
   // Callback URL injection
   callback_url_injection: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
-    mitre_atlas: 'AML.T0048 - External Harms'
+    mitre_atlas: 'AML.T0048 - External Harms',
+    iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
 
   // Whitespace steganography
   whitespace_steganography: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   },
 
   // Comment injection
   comment_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
+    iso_42001: 'A.7.4 - Data Preparation'
   }
 };
 
@@ -325,7 +370,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
 const DEFAULT_MAPPINGS: FrameworkMappings = {
   owasp_llm: 'LLM01:2025 - Prompt Injection',
   nist_ai_600_1: 'MS-2.5 - Prompt Injection',
-  mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
+  iso_42001: 'A.6.1.5 - AI System Security'
 };
 
 /**
@@ -342,6 +388,7 @@ export function getSupportedFrameworks(): string[] {
   return [
     'OWASP LLM Top 10 (2025)',
     'NIST AI 600-1 (Generative AI Profile)',
-    'MITRE ATLAS (Adversarial Threat Landscape)'
+    'MITRE ATLAS (Adversarial Threat Landscape)',
+    'ISO/IEC 42001:2023 (AI Management System)'
   ];
 }

package/src/sanitizer/hitl-gate.ts

@@ -0,0 +1,111 @@
+/**
+ * HITL (Human-in-the-Loop) Gate
+ *
+ * Determines when to pause tool execution for user confirmation
+ * based on threat severity. Only CRITICAL threats trigger elicitation.
+ *
+ * Design:
+ * - HIGH/MEDIUM/LOW threats → silent sanitization (business as usual)
+ * - CRITICAL threats → pause execution, user confirmation required
+ *
+ * Security model: Sanitization is the security gate. HITL is UX.
+ * Content is ALWAYS sanitized before reaching the LLM, whether or not
+ * the user accepts the elicitation prompt.
+ */
+
+import type { ThreatReport } from './threat-reporter.js';
+
+/**
+ * Determines whether to trigger HITL elicitation
+ *
+ * Returns true ONLY when:
+ * - threatReport is not null
+ * - threatReport.overall_severity === 'CRITICAL'
+ * - threatReport.total_findings > 0
+ *
+ * @param threatReport The threat report from sanitization
+ * @returns true if elicitation should be triggered
+ */
+export function shouldElicit(threatReport: ThreatReport | null): boolean {
+  if (!threatReport) {
+    return false;
+  }
+
+  return (
+    threatReport.overall_severity === 'CRITICAL' &&
+    threatReport.total_findings > 0
+  );
+}
+
+/**
+ * Builds a user-facing elicitation message for CRITICAL threats
+ *
+ * Format:
+ * ⚠️ Visus blocked a CRITICAL threat on this page.
+ *
+ * {total_findings} injection attempt(s) detected on:
+ * {url}
+ *
+ * Highest severity finding: {top_category}
+ * ({top_owasp} | {top_mitre})
+ *
+ * Content has been sanitized. Proceed with clean version?
+ *
+ * @param threatReport The threat report with CRITICAL severity
+ * @param url The source URL
+ * @returns A clear, concise message under 300 characters
+ */
+export function buildElicitMessage(threatReport: ThreatReport, url: string): string {
+  // Find the highest-confidence CRITICAL finding
+  const findings = threatReport.findings_toon
+    .split('\n')
+    .slice(1) // Skip header
+    .filter(line => line.trim().length > 0);
+
+  let topCategory = 'unknown';
+  let topOwasp = 'N/A';
+  let topMitre = 'N/A';
+
+  if (findings.length > 0) {
+    // Parse first finding (highest confidence)
+    const parts = findings[0].split(',');
+    if (parts.length >= 8) {
+      topCategory = parts[2]; // category field
+      topOwasp = parts[5].split(' - ')[0]; // owasp_llm field (short form)
+      topMitre = parts[7].split(' - ')[0]; // mitre_atlas field (short form)
+    }
+  }
+
+  return `⚠️ Visus blocked a CRITICAL threat on this page.
+
+${threatReport.total_findings} injection attempt(s) detected on:
+${url}
+
+Highest severity finding: ${topCategory}
+(${topOwasp} | ${topMitre})
+
+Content has been sanitized. Proceed with clean version?`;
+}
+
+/**
+ * Elicitation schema for user confirmation
+ *
+ * CRITICAL: Must be flat primitive properties only (no nested objects, no arrays)
+ * per MCP elicitation specification.
+ */
+export const ElicitSchema = {
+  type: 'object',
+  properties: {
+    proceed: {
+      type: 'boolean',
+      title: 'Proceed with sanitized content',
+      description: 'Content has been cleaned. View sanitized version?'
+    },
+    view_report: {
+      type: 'boolean',
+      title: 'Include threat report in response',
+      description: 'Attach the full NIST/OWASP/MITRE threat report?'
+    }
+  },
+  required: ['proceed']
+} as const;

package/src/sanitizer/threat-reporter.ts

@@ -35,6 +35,7 @@ export interface ThreatFinding {
   owasp_llm: string;
   nist_ai_600_1: string;
   mitre_atlas: string;
+  iso_42001: string;
   remediation: string;
 }
 
@@ -103,6 +104,7 @@ function buildFindings(patternsDetected: string[]): ThreatFinding[] {
       owasp_llm: frameworks.owasp_llm,
       nist_ai_600_1: frameworks.nist_ai_600_1,
       mitre_atlas: frameworks.mitre_atlas,
+      iso_42001: frameworks.iso_42001,
       remediation: `Content sanitized. ${category.replace(/_/g, ' ')} removed.`
     };
   });
@@ -124,9 +126,9 @@ function generateToonFindings(findings: ThreatFinding[]): string {
  * Fallback manual TOON format generation
  */
 function generateManualToonFormat(findings: ThreatFinding[]): string {
-  const header = `findings[${findings.length}]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:`;
+  const header = `findings[${findings.length}]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,iso_42001,remediation}:`;
   const rows = findings.map(f =>
-    `${f.id},${f.pattern_id},${f.category},${f.severity},${f.confidence},${f.owasp_llm},${f.nist_ai_600_1},${f.mitre_atlas},${f.remediation}`
+    `${f.id},${f.pattern_id},${f.category},${f.severity},${f.confidence},${f.owasp_llm},${f.nist_ai_600_1},${f.mitre_atlas},${f.iso_42001},${f.remediation}`
   );
   return `${header}\n${rows.join('\n')}`;
 }
@@ -149,7 +151,7 @@ function generateMarkdownReport(
   markdown += `**Generated:** ${timestamp}\n`;
   markdown += `**Source:** ${sourceUrl}\n`;
   markdown += `**Overall Severity:** ${overallSeverity}\n`;
-  markdown += `**Framework:** OWASP LLM Top 10 | NIST AI 600-1 | MITRE ATLAS\n\n`;
+  markdown += `**Framework:** OWASP LLM Top 10 | NIST AI 600-1 | MITRE ATLAS | ISO/IEC 42001\n\n`;
 
   // Findings Summary
   markdown += '### Findings Summary\n';
@@ -163,15 +165,16 @@ function generateMarkdownReport(
   // Findings Detail (only if we have findings)
   if (findings.length > 0) {
     markdown += '### Findings Detail\n';
-    markdown += '| # | Category | Severity | Confidence | OWASP | MITRE |\n';
-    markdown += '|---|---|---|---|---|---|\n';
+    markdown += '| # | Category | Severity | Confidence | OWASP | MITRE | ISO 42001 |\n';
+    markdown += '|---|---|---|---|---|---|---|\n';
 
     for (const finding of findings.slice(0, 10)) { // Limit to first 10 for readability
       const confidencePct = Math.round(finding.confidence * 100);
       const owaspShort = finding.owasp_llm.split(' - ')[0]; // e.g., "LLM01:2025"
       const mitreShort = finding.mitre_atlas.split(' - ')[0]; // e.g., "AML.T0051.000"
+      const isoShort = finding.iso_42001.split(' - ')[0]; // e.g., "A.6.1.5"
 
-      markdown += `| ${finding.id} | ${finding.category} | ${finding.severity} | ${confidencePct}% | ${owaspShort} | ${mitreShort} |\n`;
+      markdown += `| ${finding.id} | ${finding.category} | ${finding.severity} | ${confidencePct}% | ${owaspShort} | ${mitreShort} | ${isoShort} |\n`;
     }
 
     if (findings.length > 10) {
@@ -253,7 +256,8 @@ export function generateThreatReport(input: ThreatReportInput): ThreatReport | n
     frameworks: [
       'OWASP LLM Top 10',
       'NIST AI 600-1',
-      'MITRE ATLAS'
+      'MITRE ATLAS',
+      'ISO/IEC 42001'
     ],
     findings_toon: toonFindings,
     report_markdown: markdownReport