feat(tools): export_sarif — SARIF v2.1.0 vulnerability report exporter + CLI subcommand

[manus-use]

Summary

Add export_sarif — a tool and CLI subcommand that exports vulnerability findings as SARIF v2.1.0 (Static Analysis Results Interchange Format) JSON, the industry standard for security tool output.

What it does

Converts manus-agent vulnerability findings into spec-compliant SARIF that integrates directly with:

• GitHub Code Scanning (upload via gh api)
• VS Code SARIF Viewer extension
• Azure DevOps Advanced Security
• Any SARIF-compatible security dashboard or CI/CD pipeline

CLI usage

# Pipe analysis results into SARIF export
manus-agent analyze CVE-2024-3094 --format json | manus-agent export-sarif -o report.sarif

# From a file of findings
manus-agent export-sarif --input findings.json --output report.sarif

# Compact output for CI
manus-agent export-sarif --input findings.json --compact

Python API

from manus_agent.tools.export_sarif import findings_to_sarif

findings = [
    {"cve_id": "CVE-2024-3094", "severity": "CRITICAL", "affected_component": "xz-utils",
     "fix_version": "5.6.2", "cvss_score": 10.0, "in_kev": True}
]
sarif_log = findings_to_sarif(findings)

SARIF features

• Rule definitions with security-severity scores (maps CVSS → GitHub severity)
• Result levels mapped from CVSS severity (CRITICAL/HIGH → error, MEDIUM → warning, LOW → note)
• Physical locations when file paths are provided (e.g. from lockfile/SBOM scans)
• Logical locations for component-based findings (package names)
• Fix information with upgrade instructions
• Related locations from reference URLs
• Properties: CVSS score, EPSS score, CWE tags, CISA KEV membership
• Deduplication by CVE ID (case-insensitive)
• Invocation metadata with timestamps

Test coverage

86 new tests covering:

• TOOL_SPEC contract (5 tests)
• Input validation (5 tests)
• SARIF schema compliance (10 tests)
• Rule generation (16 tests)
• Result generation (15 tests)
• Deduplication (4 tests)
• Tool function integration (6 tests)
• CLI subcommand (12 tests)
• Edge cases (8 tests)
• findings_to_sarif direct unit tests (3 tests)

All tests are 100% mocked — no real HTTP calls, no filesystem side effects beyond tmp_path.

Test results: 1244 passed (baseline 1158 + 86 new), 0 failures.

Why this matters

The project produces excellent vulnerability intelligence but has no machine-readable export format compatible with the broader security tooling ecosystem. SARIF bridges that gap — users can now upload manus-agent results to GitHub Code Scanning, integrate with IDE security extensions, and feed findings into dashboards alongside results from other tools (Snyk, Trivy, CodeQL, etc.).

Open PRs checked (no overlap)

Reviewed all 50 open PRs (#133–#182). None implement SARIF export or any standardised output format. Closest PRs are:

• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (cve-enrich) — multi-source data aggregation, not export formatting
• feat(cli): add manus-agent sbom-scan subcommand for SBOM vulnerability scanning (+66 tests) #133 (sbom-scan) — scans SBOMs for vulns, doesn't export SARIF
• feat(tools): classify-refs — NVD reference URL classifier with 89 tests #166 (classify-refs) — classifies NVD reference URLs, different purpose

No merged PR covers SARIF either (checked #39–#102).

Files changed

• src/manus_agent/tools/export_sarif.py (new — tool + CLI helper)
• src/manus_agent/cli.py (add export-sarif to _SUBCOMMANDS + dispatch)
• tests/test_export_sarif.py (new — 86 tests)