feat(tools): classify-refs — NVD reference URL classifier with 89 tests

[manus-use]

Summary

New tool and CLI subcommand that fetches NVD reference URLs for a CVE and classifies each into actionable categories for triage workflows.

Motivation

During vulnerability triage, analysts need to quickly identify which NVD references contain actionable patch information vs. background reading. Currently this requires manually inspecting each URL. This tool automates the classification using a multi-tier heuristic system.

Features

CLI Subcommand: classify-refs

# Text output with Rich formatting
manus-agent classify-refs CVE-2024-3094

# JSON for piping
manus-agent classify-refs CVE-2024-3094 --output json | jq .actionable

# Filter by category
manus-agent classify-refs CVE-2024-3094 --category patch

Strands Tool: classify_references

Available as an agentic tool for automated workflows — accepts a CVE ID and returns structured classification data.

Categories

Category	Description
patch	Fix commit, PR, or release containing the fix
advisory	Vendor or coordinator security advisory (GHSA, DSA, USN, etc.)
exploit	Public exploit or PoC code
mailing_list	Security mailing list post (oss-security, fulldisclosure, etc.)
issue_tracker	Bug tracker issue or pull request discussion
vendor_notice	Vendor blog, changelog, or release notes
media	News article, blog post, or analysis
other	Uncategorized reference

Classification Priority

1. Path patterns (high confidence) — GitHub commits/PRs/releases, GitLab commits, GHSA, Bugzilla, JIRA, Debian DSA/DLA
2. Domain heuristics (high confidence) — exploit-db, seclists, cert.org, CISA, Red Hat, etc.
3. NVD tags (medium confidence) — Patch, Exploit, Third Party Advisory, etc.
4. Fallback keywords (low confidence) — /commit/, /advisory/, /issues/ in path

Output includes

• Confidence level per reference (high/medium/low)
• Summary counts per category
• Actionable references extracted (high/medium confidence patches + advisories)

Tests

89 new tests covering:

• URL classification logic (path patterns, domain rules, NVD tags, fallbacks)
• CVE reference pipeline integration (mocked NVD API)
• Strands tool interface (valid/invalid input, error handling)
• CLI subcommand (parser, text/json output, category filtering, error paths)
• Edge cases (empty refs, unicode, very long URLs, query params, ports)

All tests 100% mocked — no real HTTP calls.

Files Changed

• src/manus_agent/tools/classify_references.py — new tool module
• src/manus_agent/cli.py — classify-refs subcommand dispatch + _run_classify_refs
• tests/test_classify_references.py — 89 tests