feat: add vulnerability management platform service adapter

services/bin/octobus-tentacles.js

@@ -513,6 +513,10 @@ const services = {
     entryFile: "../thehive__cortex/bin/cortex.js",
     serviceModule: "../thehive__cortex/src/service.js",
   },
+  "vulnplatform-vuln": {
+    entryFile: "../vulnplatform__vulnerability-management_v3-2-0/bin/vulnplatform-vuln.js",
+    serviceModule: "../vulnplatform__vulnerability-management_v3-2-0/src/service.js",
+  },
   "opencti": {
     entryFile: "../filigran__opencti/bin/opencti.js",
     serviceModule: "../filigran__opencti/src/service.js",

services/bin/vulnplatform-vuln.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+import { fileURLToPath } from "node:url";
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../vulnplatform__vulnerability-management_v3-2-0/src/service.js";
+
+runServiceMain(service, {
+  entryFile: fileURLToPath(new URL("../vulnplatform__vulnerability-management_v3-2-0/bin/vulnplatform-vuln.js", import.meta.url)),
+});

services/package.json

@@ -12,6 +12,7 @@
     "octobus-tentacles": "bin/octobus-tentacles.js",
     "dbappsecurity-mingyu-waf": "bin/dbappsecurity-mingyu-waf.js",
     "misp": "bin/misp.js",
+    "vulnplatform-vuln": "bin/vulnplatform-vuln.js",
     "epp-360": "bin/360-epp.js",
     "ailpha-platform": "bin/ailpha-platform.js",
     "aliyun-waf3": "bin/aliyun-waf3.js",
@@ -161,6 +162,8 @@
     "bin/dbappsecurity-mingyu-waf.js",
     "misp__misp",
     "bin/misp.js",
+    "vulnplatform__vulnerability-management_v3-2-0",
+    "bin/vulnplatform-vuln.js",
     "360__360-epp_v10-0-0-08331",
     "bin/360-epp.js",
     "bin/ailpha-platform.js",

services/vulnplatform__vulnerability-management_v3-2-0/README.md

@@ -0,0 +1,30 @@
+# Vulnerability Management Platform 3.2.0
+
+OctoBus integration for the vendor Vulnerability Management Platform. It exposes 16 RPCs covering vulnerability lifecycle operations, asset inventory, and standard-vulnerability intelligence.
+
+## Configuration
+
+```json
+{"apiBaseUrl":"https://vuln-platform.example.com","timeoutMs":10000,"skipTlsVerify":false}
+```
+
+Provide a platform-issued bearer token:
+
+```json
+{"apiToken":"your-platform-token"}
+```
+
+The adapter intentionally does not execute the vendor JAR or accept appId/key/account credentials; this avoids exposing vendor secrets through process arguments. A configured bearer token is used directly and is not copied into a process-wide cache.
+
+`apiBaseUrl` must use HTTPS so the bearer token is never sent over plaintext networks. Plain HTTP is accepted only for the literal loopback addresses `127.0.0.1` and `[::1]` used by local tests; hostnames such as `localhost` are rejected because their resolution is environment-dependent. Embedded URL credentials are always rejected. `skipTlsVerify` defaults to false. If a trusted private installation requires a self-signed certificate, the service uses a local undici dispatcher and does not weaken Node’s process-wide TLS policy.
+
+## Import and validation
+
+```bash
+octobus service import --id vulnplatform-vuln ./services/vulnplatform__vulnerability-management_v3-2-0
+cd services
+npm run validate -- --service-dir vulnplatform__vulnerability-management_v3-2-0
+npm test -- --service-dir vulnplatform__vulnerability-management_v3-2-0 --coverage
+```
+
+All RPC handlers use the current single-context SDK ABI (`handler({request, config, secret})`). HTTP 401/403/404 map to authentication, authorization, and not-found gRPC errors; other 4xx map to failed precondition; network and 5xx failures map to unavailable; timeout maps to deadline exceeded. Upstream response bodies are never included in error messages.

services/vulnplatform__vulnerability-management_v3-2-0/bin/vulnplatform-vuln.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+import { runServiceMain } from "@chaitin-ai/octobus-sdk";
+
+import { service } from "../src/service.js";
+
+runServiceMain(service);

services/vulnplatform__vulnerability-management_v3-2-0/config.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["apiBaseUrl"],
+  "properties": {
+    "apiBaseUrl": {
+      "type": "string",
+      "format": "uri",
+      "pattern": "^(?:[Hh][Tt][Tt][Pp][Ss]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/@\\s:?#]+)(?::[0-9]+)?(?:[/?#][^\\s]*)?|[Hh][Tt][Tt][Pp]://(?:127\\.0\\.0\\.1|\\[(?:::0{0,3}1|(?:0{1,4}:){0,6}:0{0,3}1|(?:0{1,4}:){7}0{0,3}1)\\])(?::[0-9]+)?(?:[/?#][^\\s]*)?)$",
+      "description": "Vulnerability Management Platform URL. Runtime validation requires HTTPS, except for literal 127.0.0.1 and [::1] HTTP test endpoints, and rejects embedded credentials."
+    },
+    "timeoutMs": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 120000,
+      "default": 10000,
+      "description": "Per-request upstream timeout in milliseconds."
+    },
+    "skipTlsVerify": {
+      "type": "boolean",
+      "default": false,
+      "description": "Use only for a trusted private deployment with a self-signed certificate. TLS relaxation is isolated to this service."
+    }
+  }
+}

services/vulnplatform__vulnerability-management_v3-2-0/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "vulnplatform-vuln",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "bin": { "vulnplatform-vuln": "bin/vulnplatform-vuln.js" },
+  "dependencies": {
+    "@chaitin-ai/octobus-sdk": "^0.6.0",
+    "undici": "^7.16.0"
+  }
+}