cve-source-check

# CVE Source Check Audits CVE/vulnerability source coverage for a technology stack. Given an inventory of components and (optionally) the feeds you currently monitor, it maps each component to authoritative CVE sources, flags gaps, and emits audit-ready reports. ## Scope | In scope | Out of scope | |---|---| | Mapping components → authoritative feeds via a versioned registry | Running vulnerability scanners (Trivy/Snyk/etc.) | | Reporting coverage and gaps in JSON + Markdown | Fetching CVE content or ranking by severity | | Optional HEAD-check for source URL reachability | Integrating with private/commercial vuln databases | | Audit-ready output (deterministic, reproducible) | Live LLM research per run | ## Inputs | Flag | Purpose | |---|---| | `--inventory <file>` | JSON inventory: `[{name, version?, type?}, ...]` or `{components: [...]}`. | | `--inline "name@ver,name,..."` | Quick comma-separated list. Mutually exclusive with `--inventory`. | | `--current-sources <file>` | Optional. One URL per line. Blank lines and `#` comments skipped. | | `--service <name>` | Free-form name used in report header and filenames. | | `--check-urls` | HEAD-check every source URL (5s timeout, graceful degradation). | | `--registry <path>` | Override default `tech-source-registry.json`. | | `--out-dir <path>` | Output directory (default: cwd). | JSON inventory format only. YAML is not supported — stdlib does not ship a YAML parser. ## Outputs | File | Format | |---|---| | `cve-source-r...