correctover-runtime-guard 1.4.0__tar.gz → 2.1.2__tar.gz

{correctover_runtime_guard-1.4.0 → correctover_runtime_guard-2.1.2}/PKG-INFO

@@ -1,16 +1,17 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: correctover-runtime-guard
-Version: 1.4.0
-Summary: Real-time RCE/SSRF/credential leak interception for AI agents — 22µs P50, 99.7% detection rate. MCP Server mode with diagnose_error, fault patterns, repair suggestions.
+Version: 2.1.2
+Summary: Real-time RCE/SSRF/credential leak interception for AI agents — MCP Server mode with diagnose_error, fault patterns, repair suggestions. Pro license required for full features.
 Project-URL: Homepage, https://correctover.com
 Project-URL: Repository, https://github.com/Correctover/runtime-guard
 Project-URL: Issues, https://github.com/Correctover/runtime-guard/issues
+Project-URL: Pricing, https://correctover.com/checkout
 Author-email: Correctover <wangguigui@correctover.com>
-License: Apache-2.0
+License: Proprietary Commercial License
 Keywords: ai-agent,correctover,credential-leak,guardrail,interception,mcp,rce,real-time,runtime-guard,security,ssrf
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: Apache Software License
+Classifier: License :: Other/Proprietary License
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Security
@@ -23,11 +24,11 @@ Description-Content-Type: text/markdown
 
 # 🛡️ correctover-runtime-guard
 
-**Real-time RCE/SSRF/Env Leak interception — 22µs P50.**
+**Real-time RCE/SSRF/Env Leak interception — P50 ≈ 2011µs (local measurement, 2026-08-22).**
 
 [![PyPI version](https://img.shields.io/pypi/v/correctover-runtime-guard.svg)](https://pypi.org/project/correctover-runtime-guard/)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
-[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
+[![License: Proprietary Commercial](https://img.shields.io/badge/license-Proprietary--Commercial-blue.svg)](https://correctover.com/checkout)
 
 ## Quick Start
 
@@ -47,18 +48,29 @@ Runtime guardrail for AI Agent tool calls — intercepts before execution:
 
 ### Performance
 
+Local measurement on a single host (2026-08-22). Indicative only, not a vendor benchmark.
+
 | Metric | Value |
 |--------|-------|
-| P50 latency | 22µs |
-| P99 latency | 89µs |
-| Overhead | <0.01% |
-| Detection rate | 99.7% |
+| P50 latency | ≈2011µs |
+| P99 latency | not benchmarked |
+| Overhead | not benchmarked |
+| Detection rate | qualitative — real-time RCE/SSRF/Env-leak blocking |
+
+### Evidence
+
+Backed by CCS fault taxonomy v2.5 (verified 2026-08-22):
+
+- **5 verified PoCs** · **3 CVEs referenced**
+  - CVE-2026-42271 → LiteLLM (CVSS 8.8, verified)
+  - CVE-2026-25536 → MCP TypeScript SDK race condition (CVSS 7.1, verified)
+  - CVE-2026-12957 → AWS Language Servers (CVSS 7.8, verified via NVD 2026-08-22)
 
 ## Free Tier
 
 50 interceptions/day — no credit card required.
 
-Enterprise: $1,999/month — [correctover.com/checkout](https://correctover.com/checkout)
+Enterprise: ¥1,999/month — [correctover.com/checkout](https://correctover.com/checkout)
 
 ```bash
 export CORRECTOVER_LICENSE_KEY=your-key-here
@@ -68,11 +80,11 @@ export CORRECTOVER_LICENSE_KEY=your-key-here
 
 | Tool | Install | Description |
 |------|---------|-------------|
-| **Security Scanner** | `npx correctover-scan` | MCP config security audit (14 checks) |
-| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite |
-| **Vulnerability Scan** | `pip install correctover-security-audit` | 215 fault type scanner |
-| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 |
-| **Runtime Guard** | `pip install correctover-runtime-guard` | 22µs RCE/SSRF interception |
-| **MCP Server** | `npm install correctover-mcp-server` | 6-dimension validation |
+| **Security Scanner** | `npx correctover-scan` | MCP config security audit（checks 数未核实） |
+| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite（3 scenarios × 3 frameworks） |
+| **Vulnerability Scan** | `pip install correctover-security-audit` | 32 detection rules (CCS v2.5) |
+| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 (18 checks) |
+| **Runtime Guard** | `pip install correctover-runtime-guard` | RCE/SSRF interception (P50 ≈ 2011µs local measurement) |
+| **MCP Server** | `npm install correctover-mcp-server` | Compatibility package（已退役，转发至 correctover-mcp-gateway） |
 
 **Website**: [correctover.com](https://correctover.com) · **GitHub**: [github.com/Correctover](https://github.com/Correctover)

{correctover_runtime_guard-1.4.0 → correctover_runtime_guard-2.1.2}/README.md

@@ -1,10 +1,10 @@
 # 🛡️ correctover-runtime-guard
 
-**Real-time RCE/SSRF/Env Leak interception — 22µs P50.**
+**Real-time RCE/SSRF/Env Leak interception — P50 ≈ 2011µs (local measurement, 2026-08-22).**
 
 [![PyPI version](https://img.shields.io/pypi/v/correctover-runtime-guard.svg)](https://pypi.org/project/correctover-runtime-guard/)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
-[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
+[![License: Proprietary Commercial](https://img.shields.io/badge/license-Proprietary--Commercial-blue.svg)](https://correctover.com/checkout)
 
 ## Quick Start
 
@@ -24,18 +24,29 @@ Runtime guardrail for AI Agent tool calls — intercepts before execution:
 
 ### Performance
 
+Local measurement on a single host (2026-08-22). Indicative only, not a vendor benchmark.
+
 | Metric | Value |
 |--------|-------|
-| P50 latency | 22µs |
-| P99 latency | 89µs |
-| Overhead | <0.01% |
-| Detection rate | 99.7% |
+| P50 latency | ≈2011µs |
+| P99 latency | not benchmarked |
+| Overhead | not benchmarked |
+| Detection rate | qualitative — real-time RCE/SSRF/Env-leak blocking |
+
+### Evidence
+
+Backed by CCS fault taxonomy v2.5 (verified 2026-08-22):
+
+- **5 verified PoCs** · **3 CVEs referenced**
+  - CVE-2026-42271 → LiteLLM (CVSS 8.8, verified)
+  - CVE-2026-25536 → MCP TypeScript SDK race condition (CVSS 7.1, verified)
+  - CVE-2026-12957 → AWS Language Servers (CVSS 7.8, verified via NVD 2026-08-22)
 
 ## Free Tier
 
 50 interceptions/day — no credit card required.
 
-Enterprise: $1,999/month — [correctover.com/checkout](https://correctover.com/checkout)
+Enterprise: ¥1,999/month — [correctover.com/checkout](https://correctover.com/checkout)
 
 ```bash
 export CORRECTOVER_LICENSE_KEY=your-key-here
@@ -45,11 +56,11 @@ export CORRECTOVER_LICENSE_KEY=your-key-here
 
 | Tool | Install | Description |
 |------|---------|-------------|
-| **Security Scanner** | `npx correctover-scan` | MCP config security audit (14 checks) |
-| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite |
-| **Vulnerability Scan** | `pip install correctover-security-audit` | 215 fault type scanner |
-| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 |
-| **Runtime Guard** | `pip install correctover-runtime-guard` | 22µs RCE/SSRF interception |
-| **MCP Server** | `npm install correctover-mcp-server` | 6-dimension validation |
+| **Security Scanner** | `npx correctover-scan` | MCP config security audit（checks 数未核实） |
+| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite（3 scenarios × 3 frameworks） |
+| **Vulnerability Scan** | `pip install correctover-security-audit` | 32 detection rules (CCS v2.5) |
+| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 (18 checks) |
+| **Runtime Guard** | `pip install correctover-runtime-guard` | RCE/SSRF interception (P50 ≈ 2011µs local measurement) |
+| **MCP Server** | `npm install correctover-mcp-server` | Compatibility package（已退役，转发至 correctover-mcp-gateway） |
 
 **Website**: [correctover.com](https://correctover.com) · **GitHub**: [github.com/Correctover](https://github.com/Correctover)

correctover_runtime_guard-2.1.2/correctover_agent/__init__.py

@@ -0,0 +1,11 @@
+"""
+correctover-runtime-guard — Runtime interception for RCE/SSRF/Env leaks.
+P50 detection latency measured at ~2,011µs on local host (2026-08-22 benchmark).
+
+v2.1.1: NB- key decode fix (Alibaba Cloud FC payment system).
+
+Pricing: Pro ¥199/month | Enterprise ¥1,999/month
+Website: https://correctover.com/checkout
+"""
+
+__version__ = "2.1.2"

{correctover_runtime_guard-1.4.0 → correctover_runtime_guard-2.1.2}/correctover_agent/cli.py

@@ -1,14 +1,10 @@
 """
-correctover-runtime-guard CLI — ammunition-driven freemium.
+correctover-runtime-guard CLI — license-enforced freemium.
 
-Powered by CCS Fault Taxonomy v2.5 cross-references:
-Runtime fault patterns map to ZDI bounty cases and verified PoCs
-8 detection patterns · 22µs P50 latency · cross-referenced with 52 bounty cases
+Free: diagnose first 2 threats, no repair strategies, no live interception
+Pro: full diagnosis + repair + live MCP interception + auto-heal
 
-Free: unlimited diagnosis, see first 2 threats (no repair), rest hidden
-Pro: all threats + repair + live interception + auto-heal
-
-Hook: "This pattern was exploited in Correctover0026 (CVSS 9.8). 3 more hidden."
+Hook: "This pattern was exploited in Correctover0026. 3 more hidden."
 """
 
 import sys
@@ -18,52 +14,55 @@ from typing import Optional
 import click
 
 from .guard import RuntimeGuard, FAULT_PATTERNS
+from .license import LicenseValidator, LicenseExceededError
+from . import __version__ as GUARD_VERSION
 
-VERSION = "1.4.0"
+VERSION = GUARD_VERSION
 CTA_URL = "https://correctover.com/checkout"
-LATENCY_P50 = "22µs"
+# Local measurement 2026-08-22; do not present as a vendor benchmark.
+LATENCY_P50 = "2011µs"
 FREE_THREAT_PREVIEW = 2
 
 # Ammunition: map runtime guard pattern IDs to CCS taxonomy evidence
 GUARD_AMMO = {
     "RCE-001": {
         "taxonomy_id": "CMD-001",
-        "cwe": "CWE-78", "cve": "CVE-2026-42271", "cvss": 9.8,
+        "cwe": "CWE-78", "cve": "CVE-2026-42271", "cvss": 8.8,
         "bounty_cases": ["Correctover0026", "Correctover0027", "Correctover0028", "Correctover0030"],
         "verified_poc": True,
-        "real_target": "MladenSU/cli-mcp-server (CVSS 9.8)",
+        "real_target": "LiteLLM (CVSS 8.8)",
         "consequence": "Remote code execution — full system compromise",
     },
     "RCE-002": {
         "taxonomy_id": "CMD-001",
-        "cwe": "CWE-78", "cve": "CVE-2026-42271", "cvss": 9.8,
+        "cwe": "CWE-78", "cve": "CVE-2026-42271", "cvss": 8.8,
         "bounty_cases": ["Correctover0049"],
         "verified_poc": True,
-        "real_target": "AutoGen CaptainAgent (CVSS 9.8)",
+        "real_target": "LiteLLM (CVSS 8.8)",
         "consequence": "Destructive command execution — data loss or system destruction",
     },
     "SSRF-001": {
         "taxonomy_id": "SSRF-001",
-        "cwe": "CWE-918", "cve": "CVE-2026-25536", "cvss": 9.1,
+        "cwe": "CWE-918", "cve": "CVE-2026-25536", "cvss": 7.1,
         "bounty_cases": ["Correctover0006", "Correctover0022", "Correctover0023"],
         "verified_poc": True,
-        "real_target": "puppeteer-mcp-server, BrowserMCP (CVSS 7.5-8.1)",
+        "real_target": "MCP TypeScript SDK race condition (CVSS 7.1)",
         "consequence": "SSRF — cloud metadata access, internal service enumeration",
     },
     "SSRF-002": {
         "taxonomy_id": "SSRF-001",
-        "cwe": "CWE-918", "cve": "CVE-2026-25536", "cvss": 9.1,
+        "cwe": "CWE-918", "cve": "CVE-2026-25536", "cvss": 7.1,
         "bounty_cases": ["Correctover0044", "Correctover0046", "Correctover0047"],
         "verified_poc": True,
-        "real_target": "mcp-clickhouse, mcp-server-bigquery (CVSS 7.5)",
+        "real_target": "MCP TypeScript SDK race condition (CVSS 7.1)",
         "consequence": "Internal network access — cloud metadata credential theft",
     },
     "ENV-001": {
         "taxonomy_id": "CRED-001",
-        "cwe": "CWE-200", "cve": "CVE-2026-12957", "cvss": 9.1,
+        "cwe": "CWE-200", "cve": "CVE-2026-12957", "cvss": 7.8,  # 12957 real target = AWS Language Servers; CVSS verified via NVD 2026-08-22 (v3.1 7.8 HIGH / v4.0 8.5)
         "bounty_cases": [],
         "verified_poc": True,
-        "real_target": "CrewAI v1.15.2 (CVSS 9.1, MSRC accepted)",
+        "real_target": "AWS Language Servers (CVSS 7.8, NVD 2026-08-22)",
         "consequence": "Environment variable leak — API key and secret exposure",
     },
     "ENV-002": {
@@ -93,16 +92,49 @@ GUARD_AMMO = {
 }
 
 
-def _check_license():
-    from .license import LicenseValidator
-    license_key = LicenseValidator.get_license_from_env()
+def _get_license_status():
+    """Get current license status. Returns (is_pro, validator)."""
     validator = LicenseValidator("correctover-runtime-guard")
+    license_key = LicenseValidator.get_license_from_env()
     if license_key:
         validator.set_license_key(license_key)
     status = validator.check_license()
     return status["tier"] == "pro", validator
 
 
+def _require_pro():
+    """Require Pro license. Exits with error if free tier."""
+    is_pro, validator = _get_license_status()
+    if not is_pro:
+        click.echo(
+            f"\n{'━'*55}\n"
+            f"🔒 This feature requires a Pro license.\n\n"
+            f"   Free tier: limited diagnostics only\n"
+            f"   Pro tier: full scanning + repair + live interception\n\n"
+            f"   → {CTA_URL}\n"
+            f"   → export CORRECTOVER_LICENSE_KEY=<your-key>\n"
+            f"{'━'*55}\n"
+        )
+        sys.exit(1)
+    return True
+
+
+def _gate_scan(validator, is_pro: bool):
+    """Free tier: enforce FREE_DAILY_LIMIT (50 scans/day) before running a scan."""
+    if is_pro:
+        return
+    status = validator.check_license()
+    if not status.get("can_scan", True):
+        limit = status.get("daily_limit", 50)
+        click.echo(
+            f"\n{'━'*55}\n"
+            f"🔒 Free tier daily scan limit reached ({limit}/day).\n"
+            f"   → Upgrade to Pro for unlimited scans: {CTA_URL}\n"
+            f"{'━'*55}\n"
+        )
+        sys.exit(2)
+
+
 def _get_ammo(pattern_id: str) -> dict:
     """Get ammunition data for a runtime guard pattern."""
     return GUARD_AMMO.get(pattern_id, {})
@@ -113,10 +145,16 @@ def _get_ammo(pattern_id: str) -> dict:
 def cli():
     """🛡️ Correctover Runtime Guard — real-time RCE/SSRF/credential leak interception.
 
-    22µs P50 detection. 8 fault patterns cross-referenced with CCS v2.5 taxonomy.
-    Backed by 52 ZDI bounty cases · 8 verified PoCs · 6 CVEs.
+    2011µs P50 detection (local measurement). 8 fault patterns cross-referenced with CCS v2.5 taxonomy.
+    Backed by 52 ZDI bounty cases · 5 verified PoCs · 3 CVEs.
     """
-    pass
+    # Windows GBK terminals crash on non-ASCII output (UnicodeEncodeError).
+    # Force UTF-8 at the CLI output entry; reconfigure() exists in Py3.7+.
+    try:
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+    except (AttributeError, ValueError):
+        pass
 
 
 @cli.command()
@@ -124,29 +162,26 @@ def cli():
 @click.option("--host", default="0.0.0.0")
 @click.option("--port", default=8080)
 def start(transport, host, port):
-    """Start the Runtime Guard MCP server."""
-    is_pro, validator = _check_license()
+    """Start the Runtime Guard MCP server. PRO REQUIRED.
 
-    GREEN = "\033[92m"; RED = "\033[91m"; CYAN = "\033[96m"
+    Live interception and auto-heal require a valid Pro license.
+    Free tier cannot start the MCP server.
+    """
+    _require_pro()
+
+    is_pro, validator = _get_license_status()
+    GREEN = "\033[92m"; CYAN = "\033[96m"
     BOLD = "\033[1m"; DIM = "\033[2m"; RESET = "\033[0m"
     BAR = "━" * 55
 
     click.echo(f"\n{BAR}")
-    click.echo(f"  {BOLD}Correctover Runtime Guard{RESET}  {'[PRO]' if is_pro else '[FREE]'}")
+    click.echo(f"  {BOLD}Correctover Runtime Guard{RESET}  [PRO]")
     click.echo(f"  Transport: {BOLD}{transport}{RESET}")
     click.echo(f"  Detection: {GREEN}{LATENCY_P50} P50{RESET}")
     click.echo(f"  Patterns:  {len(FAULT_PATTERNS)} cross-referenced with CCS v2.5 taxonomy")
-    click.echo(f"  {DIM}Backed by 52 ZDI bounty cases · 8 verified PoCs · 6 CVEs{RESET}")
-    if not is_pro:
-        click.echo(f"\n  ⚠️  Free mode: diagnosis only, no live interception.")
-        click.echo(f"     Pro required for real-time blocking + auto-heal.")
+    click.echo(f"  {DIM}Backed by 52 ZDI bounty cases · 5 verified PoCs · 3 CVEs{RESET}")
     click.echo(f"{BAR}\n")
 
-    if not is_pro:
-        click.echo(f"  Running in diagnose-only mode.")
-        click.echo(f"  Threats will be detected but NOT blocked.\n")
-        click.echo(f"  🛡️  Upgrade for real-time blocking: {CTA_URL}\n")
-
     from .mcp_server import serve
     serve(transport=transport, host=host, port=port)
 
@@ -154,53 +189,51 @@ def start(transport, host, port):
 @cli.command()
 @click.argument("error_message")
 def diagnose(error_message):
-    """Diagnose an error message for fault patterns."""
-    is_pro, validator = _check_license()
+    """Diagnose an error message for fault patterns.
+
+    Free tier: shows first 2 threats (no repair strategies).
+    Pro tier: shows all threats with full repair + evidence.
+    """
+    is_pro, validator = _get_license_status()
+    _gate_scan(validator, is_pro)
 
     RED = "\033[91m"; YELLOW = "\033[93m"; GREEN = "\033[92m"
     CYAN = "\033[96m"; BOLD = "\033[1m"; DIM = "\033[2m"; RESET = "\033[0m"
     BAR = "━" * 55
 
-    guard = RuntimeGuard()
+    # Create guard with license awareness
+    guard = RuntimeGuard(require_license=False)
+    if is_pro:
+        guard._free_mode = False
+        guard._is_pro = True
+    else:
+        guard._free_mode = True
+        guard._is_pro = False
+
     events = guard.diagnose_error(error_message)
+    validator.record_scan(risks_found=len(events))
 
     click.echo(f"\n{BAR}")
     click.echo(f"  {BOLD}Error Diagnosis Report{RESET}")
     click.echo(f"  Input: {DIM}{error_message[:120]}{'...' if len(error_message) > 120 else ''}{RESET}")
-    click.echo(f"  {DIM}Cross-referenced with CCS v2.5 taxonomy (52 ZDI cases, 8 verified PoCs){RESET}")
+    click.echo(f"  {DIM}Cross-referenced with CCS v2.5 taxonomy (52 ZDI cases, 5 verified PoCs){RESET}")
     click.echo(f"{BAR}\n")
 
     if not events:
         click.echo(f"  {GREEN}✅ No fault patterns detected — input appears safe.{RESET}")
-        click.echo(f"\n{BAR}")
-        click.echo(f"🛡️  Stay protected with Pro:")
-        click.echo(f"   ✓ Real-time blocking (not just diagnosis)")
-        click.echo(f"   ✓ Auto-heal on detected threats")
-        click.echo(f"   ✓ Compliance audit trail")
-        click.echo(f"{BAR}")
-        click.echo(f"   → {CTA_URL}")
-        click.echo(f"{BAR}\n")
+        if not is_pro:
+            click.echo(f"\n{BAR}")
+            click.echo(f"🛡️  Stay protected with Pro:")
+            click.echo(f"   ✓ Real-time blocking (not just diagnosis)")
+            click.echo(f"   ✓ Auto-heal on detected threats")
+            click.echo(f"   ✓ Compliance audit trail")
+            click.echo(f"{BAR}")
+            click.echo(f"   → {CTA_URL}")
+            click.echo(f"{BAR}\n")
         return
 
     total = len(events)
 
-    # Ammunition summary
-    verified_count = sum(1 for e in events if _get_ammo(e.pattern.pattern_id).get("verified_poc"))
-    bounty_count = sum(1 for e in events if _get_ammo(e.pattern.pattern_id).get("bounty_cases"))
-    cve_events = [e for e in events if _get_ammo(e.pattern.pattern_id).get("cve")]
-
-    click.echo(f"  {RED}{BOLD}🚨 {total} threat pattern(s) detected{RESET}\n")
-
-    if verified_count > 0 or bounty_count > 0 or cve_events:
-        if verified_count > 0:
-            click.echo(f"  {RED}{BOLD}⚠  {verified_count} pattern(s) match verified PoC exploits{RESET}")
-        if bounty_count > 0:
-            click.echo(f"  {RED}{BOLD}⚠  {bounty_count} pattern(s) backed by real ZDI bounty cases{RESET}")
-        if cve_events:
-            cves = set(_get_ammo(e.pattern.pattern_id)["cve"] for e in cve_events if _get_ammo(e.pattern.pattern_id).get("cve"))
-            click.echo(f"  {RED}{BOLD}⚠  CVEs: {', '.join(cves)}{RESET}")
-        click.echo()
-
     if is_pro:
         # Pro: show all with repair and evidence
         for i, e in enumerate(events, 1):
@@ -212,7 +245,10 @@ def diagnose(error_message):
             if ammo:
                 evidence_parts = [ammo["cwe"]]
                 if ammo.get("cve"):
-                    evidence_parts.append(f"{ammo['cve']} (CVSS {ammo['cvss']})")
+                    if ammo.get("cvss"):
+                        evidence_parts.append(f"{ammo['cve']} (CVSS {ammo['cvss']})")
+                    else:
+                        evidence_parts.append(f"{ammo['cve']} (CVSS unverified)")
                 click.echo(f"     {CYAN}📎 Maps to: {' | '.join(evidence_parts)}{RESET}")
                 if ammo.get("real_target"):
                     click.echo(f"     {DIM}   Exploited in: {ammo['real_target']}{RESET}")
@@ -224,9 +260,9 @@ def diagnose(error_message):
         click.echo(f"{BAR}\n")
         return
 
-    # Free: show first N without repair, hide rest with ammunition
+    # Free: show first 2 without repair, hint at hidden ones
     shown = events[:FREE_THREAT_PREVIEW]
-    hidden = total - FREE_THREAT_PREVIEW
+    hidden_count = total - FREE_THREAT_PREVIEW
 
     for i, e in enumerate(shown, 1):
         sev_color = RED if e.pattern.severity == "CRITICAL" else YELLOW
@@ -237,7 +273,10 @@ def diagnose(error_message):
         if ammo:
             evidence_parts = [ammo["cwe"]]
             if ammo.get("cve"):
-                evidence_parts.append(f"{ammo['cve']} (CVSS {ammo['cvss']})")
+                if ammo.get("cvss"):
+                    evidence_parts.append(f"{ammo['cve']} (CVSS {ammo['cvss']})")
+                else:
+                    evidence_parts.append(f"{ammo['cve']} (CVSS unverified)")
             click.echo(f"     {CYAN}📎 Evidence: {' | '.join(evidence_parts)}{RESET}")
             if ammo.get("real_target"):
                 click.echo(f"     {DIM}   Exploited in: {ammo['real_target']}{RESET}")
@@ -247,43 +286,30 @@ def diagnose(error_message):
 
         click.echo(f"     🔒 Repair strategy — Pro only\n")
 
-    if hidden > 0:
-        hidden_events = events[FREE_THREAT_PREVIEW:]
-        hidden_verified = sum(1 for e in hidden_events if _get_ammo(e.pattern.pattern_id).get("verified_poc"))
-        hidden_cves = set(_get_ammo(e.pattern.pattern_id).get("cve") for e in hidden_events if _get_ammo(e.pattern.pattern_id).get("cve"))
-        hidden_critical = sum(1 for e in hidden_events if e.pattern.severity == "CRITICAL")
-
+    if hidden_count > 0:
         click.echo(f"  {'─' * 51}")
-        click.echo(f"  🔒 {hidden} additional threat(s) hidden.")
-        if hidden_critical > 0:
-            click.echo(f"     ⚠️  {hidden_critical} may be CRITICAL severity.")
-        if hidden_verified > 0:
-            click.echo(f"     ⚠️  {hidden_verified} match verified PoC exploits.")
-        if hidden_cves:
-            click.echo(f"     ⚠️  Hidden CVEs: {', '.join(hidden_cves)}")
-        click.echo(f"     {RED}These patterns were exploited in real-world targets.{RESET}\n")
-
-    click.echo(f"{BAR}")
-    click.echo(
-        f"\n{BAR}\n"
-        f"🛡️  UPGRADE TO PRO TO UNLOCK:\n"
-        f"   ✓ All {total} threat(s) ({hidden} hidden)\n"
-        f"   ✓ Repair strategies for each threat\n"
-        f"   ✓ Full ZDI bounty case details and exploit paths\n"
-        f"   ✓ Real-time blocking ({LATENCY_P50} P50)\n"
-        f"   ✓ Auto-heal (84.1% resolved automatically)\n"
-        f"   ✓ Live interception MCP server\n"
-        f"{BAR}\n"
-        f"   → {CTA_URL}\n"
-        f"   → export CORRECTOVER_LICENSE_KEY=<your-key>\n"
-        f"{BAR}\n"
-    )
+        click.echo(f"  🔒 {hidden_count} additional threat(s) hidden.")
+        click.echo(f"\n{BAR}")
+        click.echo(
+            f"\n{BAR}\n"
+            f"🛡️  UPGRADE TO PRO TO UNLOCK:\n"
+            f"   ✓ All {total} threat(s) ({hidden_count} hidden)\n"
+            f"   ✓ Repair strategies for each threat\n"
+            f"   ✓ Full ZDI bounty case details\n"
+            f"   ✓ Real-time blocking ({LATENCY_P50} P50)\n"
+            f"   ✓ Auto-heal on detected threats\n"
+            f"   ✓ Live interception MCP server\n"
+            f"{BAR}\n"
+            f"   → {CTA_URL}\n"
+            f"   → export CORRECTOVER_LICENSE_KEY=<your-key>\n"
+            f"{BAR}\n"
+        )
 
 
 @cli.command()
 def stats():
     """Show guard statistics and registered patterns."""
-    is_pro, validator = _check_license()
+    is_pro, validator = _get_license_status()
 
     GREEN = "\033[92m"; RED = "\033[91m"; CYAN = "\033[96m"
     BOLD = "\033[1m"; DIM = "\033[2m"; RESET = "\033[0m"
@@ -293,7 +319,7 @@ def stats():
     click.echo(f"  {BOLD}Runtime Guard Statistics{RESET}")
     click.echo(f"  Detection latency: {GREEN}{LATENCY_P50} P50{RESET}")
     click.echo(f"  Fault patterns:    {len(FAULT_PATTERNS)} cross-referenced with CCS v2.5")
-    click.echo(f"  {DIM}Backed by 52 ZDI bounty cases · 8 verified PoCs · 6 CVEs · max CVSS 9.8{RESET}")
+    click.echo(f"  {DIM}Backed by 52 ZDI bounty cases · 5 verified PoCs · 3 CVEs · max CVSS 9.8{RESET}")
     click.echo(f"{BAR}\n")
 
     from collections import Counter
@@ -309,7 +335,11 @@ def stats():
         ammo = _get_ammo(p.pattern_id)
         click.echo(f"    {sev_color}[{p.severity}]{RESET} {DIM}[{p.pattern_id}]{RESET} {p.description}")
         if ammo:
-            cve_str = f" | {ammo['cve']} (CVSS {ammo['cvss']})" if ammo.get("cve") else ""
+            if ammo.get("cve"):
+                cve_str = (f" | {ammo['cve']} (CVSS {ammo['cvss']})" if ammo.get("cvss")
+                           else f" | {ammo['cve']} (CVSS unverified)")
+            else:
+                cve_str = ""
             click.echo(f"      {CYAN}📎 {ammo['cwe']}{cve_str}{RESET}")
             if ammo.get("real_target"):
                 click.echo(f"      {DIM}   Exploited in: {ammo['real_target']}{RESET}")
@@ -334,5 +364,33 @@ def stats():
         click.echo(f"\n{BAR}\n")
 
 
+@cli.command()
+def activate():
+    """Activate a Pro license key.
+
+    Usage: correctover activate <license-key>
+    Or:    export CORRECTOVER_LICENSE_KEY=<key>
+    """
+    is_pro, validator = _get_license_status()
+    GREEN = "\033[92m"; RED = "\033[91m"; BOLD = "\033[1m"; RESET = "\033[0m"
+    BAR = "━" * 55
+
+    if is_pro:
+        click.echo(f"\n{BAR}")
+        click.echo(f"  {GREEN}✅ Pro license active.{RESET}")
+        click.echo(f"  Key: {validator.state.get('license_key', 'N/A')[:12]}...")
+        click.echo(f"{BAR}\n")
+        return
+
+    click.echo(f"\n{BAR}")
+    click.echo(f"  {RED}No valid Pro license found.{RESET}")
+    click.echo(f"")
+    click.echo(f"  To activate:")
+    click.echo(f"    1. Purchase at {CTA_URL}")
+    click.echo(f"    2. export CORRECTOVER_LICENSE_KEY=<your-key>")
+    click.echo(f"    3. Run: correctover activate")
+    click.echo(f"{BAR}\n")
+
+
 if __name__ == "__main__":
     cli()