feat(tools): get_exposure_window — CVE exposure window calculator + CLI subcommand (+102 tests)

[manus-use]

Summary

New tool and CLI subcommand that computes the vulnerability exposure window for a CVE — the elapsed time between CVE disclosure and patch availability. Gives security teams concrete metrics for SLA compliance, risk reporting, and remediation prioritisation.

Motivation

During vulnerability management, teams need to answer: "How long were systems vulnerable?" and "Is the exposure window still open?" Currently, this requires manually correlating dates from NVD, CISA KEV, GHSA, and EPSS. This tool automates that correlation and produces actionable timing metrics.

How it differs from existing tools

Tool	Purpose
cve-timeline (#53)	Reconstructs chronological event sequence
vendor-response (#149)	Classifies patch status (6 states)
temporal-priority (#186)	Urgency score (0-100)
exposure-window (new)	Computes concrete duration metrics (days exposed, KEV→patch gap, open/closed status) with contextual risk labelling

This fills a gap where the project can detect patches and score urgency but cannot answer the quantitative question: "How many days was the exposure window open?"

Features

CLI Subcommand: exposure-window

manus-agent exposure-window CVE-2021-44228
manus-agent exposure-window CVE-2021-44228 --output json

Tool: get_exposure_window

Strands TOOL_SPEC-compliant module-based tool for agent integration.

Data Sources

1. NVD — CVE publish date, modification date, Patch-tagged reference URLs
2. EPSS (FIRST.org) — Current exploitation probability
3. CISA KEV — Date added to Known Exploited Vulnerabilities catalog
4. GitHub Advisory Database — Advisory publication timestamps

Output Metrics

• disclosure_date — When the CVE was first published
• patch_date — Earliest detected patch availability (NVD refs + GHSA)
• exposure_days — Days between disclosure and patch (or days since disclosure if unpatched)
• status — patched | unpatched
• kev_date — When CISA added to KEV (if applicable)
• kev_exposure_days — Days from KEV addition until patch
• current_epss — Current EPSS score
• risk_label — Contextual exposure risk (critical/high/moderate/low)

Risk Label Logic

• KEV + unpatched → automatic critical
• Unpatched + high EPSS (≥0.5) → critical
• Patched with 90+ day window + high EPSS → critical
• Graduated thresholds based on exposure duration × EPSS

Tests

102 new tests covering:

• TOOL_SPEC contract (4 tests)
• Input validation (6 tests)
• Date parsing (9 tests)
• days_between helper (5 tests)
• Patch date extraction from NVD references (5 tests)
• Risk label computation (13 tests)
• NVD data fetcher (3 tests)
• EPSS fetcher (3 tests)
• CISA KEV fetcher (4 tests)
• GHSA patch date fetcher (5 tests)
• HTTP retry helper (5 tests)
• Core computation integration (9 tests)
• Text formatting (6 tests)
• JSON formatting (2 tests)
• Strands tool handler (5 tests)
• CLI subcommand (5 tests)
• Edge cases (5 tests)
• NVD API key headers (3 tests)
• GitHub headers (3 tests)

Full suite: 1260 passed (baseline 1158 + 102 new), 3 deselected, 3 warnings, 0 failures.

No external dependencies added

Uses only requests (already a project dependency) and the strands SDK @tool decorator.

Open PRs checked for overlap (no duplicates)

Checked all 100+ open PRs (#79–#189). Closest PRs:

• feat(tools): cve_timeline — CVE lifecycle event timeline reconstructor + CLI subcommand (+79 tests) #53 cve-timeline — event sequence reconstruction (no duration metrics)
• feat(cli): add manus-agent vendor-response subcommand for vendor patch status tracking #149 vendor-response — patch status classification (no timing computation)
• feat(tools): get_temporal_priority — 0-100 CVE urgency scorer + CLI subcommand #186 temporal-priority — urgency score (no exposure duration)
• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 cve-enrich — multi-source enrichment dump (no timing analysis)
• feat(tools): predict_exploitation — CVE exploitation likelihood predictor + CLI subcommand (+110 tests) #189 predict-exploitation — exploitation probability (no exposure window)

None compute concrete exposure window duration metrics or produce the open/closed window status with KEV-to-patch gap analysis.