feat(tools): get_poc_freshness — PoC freshness checker + CLI subcommand (+69 tests)

[manus-use]

Summary

Implements the poc-freshness CLI subcommand and get_poc_freshness Strands tool — both documented in the README but previously unimplemented (zero code, zero tests).

What it does: Measures how recently PoC (Proof-of-Concept) activity occurred for a given CVE by querying multiple sources and producing a freshness score (0–100) indicating ongoing attacker interest.

Sources Checked

1. GitHub repos — recently pushed repositories mentioning the CVE (sorted by update time)
2. GitHub stars — community interest proxy via aggregate stargazer count
3. NVD exploit references — exploit-tagged URLs from the NVD record
4. Trickest/cve index — known PoC links from the continuously-updated index
5. Exploit-DB — entries referencing the CVE (via GitHub code search on the mirror)

Freshness Score Classification

Score	Classification	Meaning
80–100	very_fresh	Active PoC development in the last 7 days
50–79	fresh	PoC activity in the last 30 days
20–49	aging	PoC activity in the last 90 days
0–19	stale	No recent PoC activity detected

Usage

manus-agent poc-freshness CVE-2024-3094
manus-agent poc-freshness CVE-2024-3094 --output json | jq .freshness_score

Files Changed

• src/manus_agent/tools/get_poc_freshness.py — new tool implementation
• src/manus_agent/cli.py — CLI dispatch + parser + _SUBCOMMANDS entry
• tests/test_get_poc_freshness.py — 69 new tests (100% mocked, no real HTTP)

Design Decisions

• Zero new dependencies (uses requests already in the project)
• Retry/back-off on all HTTP calls (429 handling + exponential backoff)
• GITHUB_TOKEN/GH_TOKEN support for higher rate limits
• NVD_API_KEY support for NVD requests
• Graceful degradation: if any source fails, the others still contribute
• Strands TOOL_SPEC interface for agent integration
• Weighted composite scoring with configurable weights
• Time-decay function for recency-based scoring

Test Results

1227 passed (baseline 1158 + 69 new), 0 failures.

Duplicate Check

Checked all 50 open PRs (#145–#194) and 30 most recent merged PRs. No existing open or merged PR covers PoC freshness measurement. Closest related work:

• feat: multi-source PoC aggregator (search_poc_sources) #62 (merged) search_poc_sources — aggregates PoC links but does not score freshness/recency
• PR test(tools): comprehensive test suites for search_exploit_db, search_packetstorm, and get_cwe_details (+125 tests) #173 (open) — test suites for exploit search tools, not a freshness scorer
• The poc-freshness subcommand was documented in README with usage examples but had zero implementation