test(tools): comprehensive test suite for obtain_cves module (+49 tests)

[manus-use]

Summary

Comprehensive test suite for the obtain_cves tool module — 49 fully-mocked tests covering the entire CVE discovery pipeline.

What's tested

Component	Tests	Coverage
TOOL_SPEC	4	Schema structure, required fields, types
_get_all_cves_from_nvd	6	Pagination (single/multi/three-page), empty results, URL construction (severity filters, date range)
_get_all_cves_from_github	7	Single page, Link-header pagination, advisory filtering (no cve_id), connection/HTTP errors, date extraction, headers, CVSS inclusion
_filter_cves_by_epss	7	Threshold logic (EPSS >0.05 OR percentile >0.5), empty input, EPSS data enrichment, missing data exclusion, URL construction, exact boundary values
_enrich_with_cisa_kev	4	KEV flag marking, empty catalog, URL verification, in-place mutation
_submit_in_batches	4	Field formatting, missing metrics/descriptions, batch chunking
obtain_cves (main)	13	NVD+GitHub merge, deduplication, NVD priority, no-results path, exception handling, JSON payload structure, 100-chunk filtering, date range in output, toolUseId propagation, GitHub-only results, filter exceptions, EPSS rate calculation
Module structure	4	Clean imports, callable check, type validation

Why this matters

obtain_cves is the core CVE discovery tool in the vulnerability analysis pipeline — it's called by the VulnerabilityDiscoveryAgent to find new high/critical CVEs from NVD and GitHub, filter by EPSS scores, and return structured results. Previously only the NVD retry delegation path had dedicated tests (in test_nvd_retry.py). The main function's orchestration logic (merging sources, deduplication, chunked EPSS filtering, error handling) and the GitHub/EPSS/KEV helper functions had zero dedicated coverage.

Testing approach

• 100% mocked — no real HTTP calls
• Tests validate behavior at each layer independently
• Boundary conditions tested (exact EPSS/percentile thresholds)
• Error paths verified (network errors, API timeouts, malformed data)

Open PRs checked (no overlap)

• test(tools): comprehensive test suite for search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, obtain_cves #90 (exploit_search/packetstorm/threat_feeds/obtain_cves — that PR covers search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, and only lightly touches obtain_cves via integration patterns, NOT the comprehensive unit tests here)
• test(core-tools): comprehensive test suite for check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details #89 (check_cisa_kev/get_nvd_data/get_cwe_details/get_otx — different modules)
• test(tools): comprehensive test suite for code_execute module (+45 tests) #141 (code_execute tests)
• test(tools): comprehensive test suite for http_request truncation wrapper (+36 tests) #140 (http_request tests)
• test(tools): comprehensive test suite for track_vendor_response (+67 tests) #137 (track_vendor_response tests)
• test(tools): comprehensive test suite for verify_exploit tool function (+49 tests) #145 (verify_exploit tests)
• test(sandbox): comprehensive test suite for exploit_sandbox module (+76 tests) #144 (exploit_sandbox tests)
• test(sandbox): comprehensive test suite for docker_sandbox module (+69 tests) #143 (docker_sandbox tests)
• test(utils): comprehensive test suite for docker_client module (+84 tests) #142 (docker_client tests)

None of these PRs provide comprehensive unit tests for the obtain_cves module's helper functions or main orchestration logic.

Test results

1207 passed, 3 deselected, 3 warnings in 25.61s

(Baseline 1158 + 49 new tests, 0 failures)