visus-mcp 0.6.2 → 0.9.0

package/src/content-handlers/svg-handler.ts

@@ -0,0 +1,243 @@
+/**
+ * SVG Content Handler
+ *
+ * Handles image/svg+xml content type. SVG is XML, not a binary image, and can contain
+ * executable code and external references. This handler strips dangerous elements and
+ * attributes unconditionally, then sanitizes remaining text content.
+ *
+ * What it handles:
+ * - All text content in SVG elements after stripping dangerous parts
+ *
+ * What it strips (unconditionally, no attempt to sanitize):
+ * - <script> elements and all children
+ * - <use> elements with external href or xlink:href attributes
+ * - <foreignObject> elements and all children
+ * - All event handler attributes (onload, onclick, onerror, etc.)
+ * - <set> and <animate> elements that reference external resources
+ * - data: URI attributes
+ *
+ * What it passes through (after injection scan):
+ * - Path data (d attribute)
+ * - Text elements and their content
+ * - <title> and <desc> elements
+ * - Presentation attributes (fill, stroke, transform, etc.)
+ * - viewBox, width, height attributes
+ */
+
+import { XMLParser, XMLBuilder } from 'fast-xml-parser';
+import { sanitize } from '../sanitizer/index.js';
+import type { HandlerResult } from './types.js';
+
+/**
+ * Handle SVG content
+ *
+ * @param content - Raw SVG XML string or Buffer
+ * @param mimeType - Original MIME type
+ * @returns Sanitized handler result
+ */
+export function handleSvg(
+  content: string | Buffer,
+  mimeType: string
+): HandlerResult {
+  const startTime = Date.now();
+
+  // Convert Buffer to string if needed
+  const svgString = Buffer.isBuffer(content) ? content.toString('utf-8') : content;
+
+  try {
+    // Parse SVG XML
+    const parser = new XMLParser({
+      ignoreAttributes: false,
+      attributeNamePrefix: '@_',
+      textNodeName: '#text',
+      preserveOrder: false,
+      removeNSPrefix: true,
+    });
+
+    const parsed = parser.parse(svgString);
+
+    // Track sanitized field count
+    let sanitizedFieldCount = 0;
+
+    // Strip dangerous elements and attributes
+    const stripped = stripDangerousContent(parsed);
+
+    // Extract all text content for injection scanning
+    const textContent = extractTextContent(stripped);
+
+    // Run text through injection detection
+    let sanitizationResult;
+    if (textContent.length > 0) {
+      sanitizationResult = sanitize(textContent);
+      if (sanitizationResult.sanitization.content_modified) {
+        sanitizedFieldCount = sanitizationResult.sanitization.patterns_detected.length;
+      }
+    }
+
+    // Rebuild SVG
+    const builder = new XMLBuilder({
+      ignoreAttributes: false,
+      attributeNamePrefix: '@_',
+      textNodeName: '#text',
+      format: true,
+      suppressEmptyNode: true,
+    });
+
+    const sanitizedSvg = builder.build(stripped);
+
+    const processingTime = Date.now() - startTime;
+
+    return {
+      status: 'sanitized',
+      content_type: mimeType,
+      sanitized_content: sanitizedSvg,
+      sanitization: {
+        patterns_detected: sanitizationResult?.sanitization.patterns_detected || [],
+        pii_types_redacted: sanitizationResult?.sanitization.pii_types_redacted || [],
+        pii_allowlisted: sanitizationResult?.sanitization.pii_allowlisted || [],
+        sanitized_fields: sanitizedFieldCount
+      },
+      processing_time_ms: processingTime
+    };
+
+  } catch (error) {
+    return {
+      status: 'error',
+      reason: 'SVG_PARSE_FAILED',
+      mime: mimeType,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+/**
+ * Strip dangerous content from parsed SVG
+ *
+ * Removes:
+ * - <script> elements
+ * - <foreignObject> elements
+ * - <use> with external href
+ * - Event handler attributes
+ * - <set> and <animate> with external references
+ * - data: URIs
+ */
+function stripDangerousContent(node: any): any {
+  if (typeof node !== 'object' || node === null) {
+    return node;
+  }
+
+  // Handle arrays
+  if (Array.isArray(node)) {
+    return node
+      .filter((item) => !shouldRemoveElement(item))
+      .map((item) => stripDangerousContent(item));
+  }
+
+  // Handle objects
+  const result: any = {};
+
+  for (const [key, value] of Object.entries(node)) {
+    // Skip dangerous elements
+    if (key === 'script' || key === 'foreignObject') {
+      continue;
+    }
+
+    // Handle <use> with external href
+    if (key === 'use' && typeof value === 'object' && value !== null) {
+      const href = (value as any)['@_href'] || (value as any)['@_xlink:href'];
+      if (href && (href.startsWith('http://') || href.startsWith('https://') || href.startsWith('//'))) {
+        continue;
+      }
+    }
+
+    // Handle <set> and <animate> with external references
+    if ((key === 'set' || key === 'animate') && typeof value === 'object' && value !== null) {
+      const href = (value as any)['@_href'] || (value as any)['@_xlink:href'];
+      if (href && (href.startsWith('http://') || href.startsWith('https://') || href.startsWith('//'))) {
+        continue;
+      }
+    }
+
+    // Strip event handler attributes
+    if (key.startsWith('@_on')) {
+      continue;
+    }
+
+    // Strip data: URIs
+    if (typeof value === 'string' && value.startsWith('data:')) {
+      result[key] = '';
+      continue;
+    }
+
+    // Strip attributes with data: URIs
+    if (key.startsWith('@_') && typeof value === 'string' && value.startsWith('data:')) {
+      continue;
+    }
+
+    // Recursively process
+    result[key] = stripDangerousContent(value);
+  }
+
+  return result;
+}
+
+/**
+ * Check if element should be removed entirely
+ */
+function shouldRemoveElement(element: any): boolean {
+  if (typeof element !== 'object' || element === null) {
+    return false;
+  }
+
+  // Check for dangerous element types
+  const dangerousElements = ['script', 'foreignObject'];
+  for (const dangerous of dangerousElements) {
+    if (dangerous in element) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Extract all text content from SVG for injection scanning
+ */
+function extractTextContent(node: any): string {
+  if (typeof node !== 'object' || node === null) {
+    return '';
+  }
+
+  if (typeof node === 'string') {
+    return node;
+  }
+
+  if (Array.isArray(node)) {
+    return node.map((item) => extractTextContent(item)).join(' ');
+  }
+
+  let text = '';
+
+  for (const [key, value] of Object.entries(node)) {
+    // Extract text from text nodes
+    if (key === '#text' && typeof value === 'string') {
+      text += value + ' ';
+    }
+
+    // Extract from title and desc elements (can be string or object)
+    if (key === 'title' || key === 'desc') {
+      if (typeof value === 'string') {
+        text += value + ' ';
+      } else if (typeof value === 'object') {
+        text += extractTextContent(value) + ' ';
+      }
+    }
+
+    // Recursively extract from other children
+    if (key !== 'title' && key !== 'desc' && typeof value === 'object') {
+      text += extractTextContent(value) + ' ';
+    }
+  }
+
+  return text.trim();
+}

package/src/content-handlers/types.ts

@@ -0,0 +1,44 @@
+/**
+ * Content Handler Types
+ *
+ * Shared interfaces for content-type specific handlers.
+ */
+
+/**
+ * Success result from a content handler
+ */
+export interface HandlerSuccessResult {
+  status: 'sanitized';
+  content_type: string;
+  sanitized_content: string;
+  sanitization: {
+    patterns_detected: string[];
+    pii_types_redacted: string[];
+    pii_allowlisted: Array<{ type: string; value: string; reason: string }>;
+    sanitized_fields: number;
+  };
+  processing_time_ms: number;
+}
+
+/**
+ * Error result from a content handler
+ */
+export interface HandlerErrorResult {
+  status: 'error' | 'rejected';
+  reason: string;
+  mime: string;
+  message: string;
+}
+
+/**
+ * Union type for all handler results
+ */
+export type HandlerResult = HandlerSuccessResult | HandlerErrorResult;
+
+/**
+ * Content handler function signature
+ */
+export type ContentHandler = (
+  content: string | Buffer,
+  mimeType: string
+) => Promise<HandlerResult> | HandlerResult;

package/src/sanitizer/framework-mapper.ts

@@ -4,6 +4,8 @@
  * Maps injection pattern categories to compliance framework identifiers:
  * - OWASP LLM Top 10 (2025)
  * - NIST AI 600-1 (Generative AI Profile)
+ * - NIST AI RMF (AI Risk Management Framework - AI 100-1)
+ * - NIST CSF 2.0 (Cybersecurity Framework 2.0)
  * - MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
  * - ISO/IEC 42001:2023 (AI Management System - Annex A Controls)
  */
@@ -11,6 +13,8 @@
 export interface FrameworkMappings {
   owasp_llm: string;
   nist_ai_600_1: string;
+  nist_ai_rmf: string;
+  nist_csf_2_0: string;
   mitre_atlas: string;
   iso_42001: string;
 }
@@ -23,6 +27,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   direct_instruction_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -31,6 +37,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   role_hijacking: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -39,6 +47,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   system_prompt_extraction: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'PR.DS-01 - Data at Rest Protection',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -47,6 +57,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   privilege_escalation: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    nist_ai_rmf: 'GOVERN-1.1 - Legal and Regulatory Requirements',
+    nist_csf_2_0: 'PR.AC-04 - Access Control Enforcement',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -55,6 +67,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   context_poisoning: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-5.1 - Impact Likelihood and Magnitude',
+    nist_csf_2_0: 'PR.DS-06 - Integrity Verification',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.2 - Data Quality'
   },
@@ -63,6 +77,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   data_exfiltration: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    nist_ai_rmf: 'MANAGE-2.3 - Respond to Unknown Risks',
+    nist_csf_2_0: 'DE.AE-02 - Anomaly Detection',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.7.5 - Data Provenance / A.8.2 - Information to Users'
   },
@@ -71,6 +87,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   base64_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -79,6 +97,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   unicode_lookalikes: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -87,6 +107,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   zero_width_characters: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -95,6 +117,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   html_script_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -103,6 +127,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   data_uri_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -111,6 +137,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   markdown_link_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -119,6 +147,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   url_fragment_hashjack: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -127,6 +157,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   social_engineering_urgency: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'GOVERN-2.2 - Personnel Training',
+    nist_csf_2_0: 'PR.AT-01 - Awareness Training',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.5.3 - AI Awareness and Training'
   },
@@ -135,6 +167,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   instruction_delimiter_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -143,6 +177,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   multi_language_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -151,6 +187,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   reverse_text_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -159,6 +197,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   leetspeak_obfuscation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -167,6 +207,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   jailbreak_keywords: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -175,6 +217,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   token_smuggling: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -183,6 +227,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   system_message_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -191,6 +237,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   conversation_reset: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MANAGE-4.3 - Incident Communication',
+    nist_csf_2_0: 'DE.AE-01 - Baseline Establishment',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
@@ -199,6 +247,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   memory_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-5.1 - Impact Likelihood and Magnitude',
+    nist_csf_2_0: 'PR.DS-06 - Integrity Verification',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
@@ -207,6 +257,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   capability_probing: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    nist_ai_rmf: 'GOVERN-1.1 - Legal and Regulatory Requirements',
+    nist_csf_2_0: 'ID.AM-01 - Asset Inventory',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
@@ -215,6 +267,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   chain_of_thought_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -223,6 +277,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   hypothetical_scenario_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -231,6 +287,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   ethical_override: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    nist_ai_rmf: 'GOVERN-1.1 - Legal and Regulatory Requirements',
+    nist_csf_2_0: 'GV.PO-01 - Policy Establishment',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.2.2 - Responsible AI Policies'
   },
@@ -239,6 +297,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   output_format_manipulation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.2 - Internal Controls Identification',
+    nist_csf_2_0: 'PR.DS-06 - Integrity Verification',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
@@ -247,6 +307,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   negative_instruction: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
@@ -255,6 +317,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   credential_harvesting: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    nist_ai_rmf: 'MANAGE-2.3 - Respond to Unknown Risks',
+    nist_csf_2_0: 'PR.AC-01 - Identity Management',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.7.5 - Data Provenance / A.6.1.5 - AI System Security'
   },
@@ -263,6 +327,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   time_based_triggers: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-3.1 - Risk Monitoring',
+    nist_csf_2_0: 'DE.CM-03 - User Activity Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.2.6 - Logging and Monitoring'
   },
@@ -271,6 +337,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   code_execution_requests: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    nist_ai_rmf: 'GOVERN-1.3 - Risk Tolerance',
+    nist_csf_2_0: 'PR.AC-04 - Access Control Enforcement',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
@@ -279,6 +347,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   file_system_access: {
     owasp_llm: 'LLM08:2025 - Excessive Agency',
     nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    nist_ai_rmf: 'GOVERN-1.3 - Risk Tolerance',
+    nist_csf_2_0: 'PR.AC-03 - Remote Access Management',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
@@ -287,6 +357,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   training_data_extraction: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    nist_ai_rmf: 'MAP-1.1 - Negative Impact Documentation',
+    nist_csf_2_0: 'PR.DS-01 - Data at Rest Protection',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.7.5 - Data Provenance'
   },
@@ -295,6 +367,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   simulator_mode: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.6 - AI System Safety',
+    nist_csf_2_0: 'ID.AM-02 - Platform Management',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.9.3 - Intended Use Boundaries'
   },
@@ -303,6 +377,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   nested_encoding: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -311,6 +387,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   payload_splitting: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -319,6 +397,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   css_hiding: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -327,6 +407,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   authority_impersonation: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'GOVERN-2.2 - Personnel Training',
+    nist_csf_2_0: 'PR.AT-01 - Awareness Training',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.2.2 - Responsible AI Policies'
   },
@@ -335,6 +417,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   testing_debugging_claims: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MEASURE-2.7 - AI System Security and Resilience',
+    nist_csf_2_0: 'DE.CM-01 - Network Monitoring',
     mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
     iso_42001: 'A.6.1.2 - AI System Operational Procedures'
   },
@@ -343,6 +427,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   callback_url_injection: {
     owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
     nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    nist_ai_rmf: 'MANAGE-2.3 - Respond to Unknown Risks',
+    nist_csf_2_0: 'DE.AE-02 - Anomaly Detection',
     mitre_atlas: 'AML.T0048 - External Harms',
     iso_42001: 'A.6.1.5 - AI System Security (Adversarial Input)'
   },
@@ -351,6 +437,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   whitespace_steganography: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-02 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   },
@@ -359,6 +447,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
   comment_injection: {
     owasp_llm: 'LLM01:2025 - Prompt Injection',
     nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    nist_ai_rmf: 'MAP-4.1 - Risk Mapping for AI Components',
+    nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
     mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect',
     iso_42001: 'A.7.4 - Data Preparation'
   }
@@ -370,6 +460,8 @@ const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
 const DEFAULT_MAPPINGS: FrameworkMappings = {
   owasp_llm: 'LLM01:2025 - Prompt Injection',
   nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+  nist_ai_rmf: 'MEASURE-2.7 - AI System Security',
+  nist_csf_2_0: 'PR.DS-05 - Data-in-Transit Protection',
   mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection',
   iso_42001: 'A.6.1.5 - AI System Security'
 };
@@ -388,6 +480,8 @@ export function getSupportedFrameworks(): string[] {
   return [
     'OWASP LLM Top 10 (2025)',
     'NIST AI 600-1 (Generative AI Profile)',
+    'NIST AI RMF (AI Risk Management Framework)',
+    'NIST CSF 2.0 (Cybersecurity Framework)',
     'MITRE ATLAS (Adversarial Threat Landscape)',
     'ISO/IEC 42001:2023 (AI Management System)'
   ];