# Provider capabilities, licenses and disclosure

The `licensed` switch is an administrator assertion after reviewing an agreement; software cannot prove a license exists. A working API key or a successful connection test is not permission to operate a public commercial scanner. Remote adapters remain disabled unless explicitly configured and enabled.

| Adapter | Actual operations | Required access | Data sent | Important limit |
|---|---|---|---|---|
| ClamAV | clamscan/libclamav file scan | Installed binary + fresh official DB | Local private file only | No URL fetching; subprocess/resource/archive bounds |
| YARA | Compiled rule evaluation | Installed yara/yarac + reviewed rules | Local private file only | Initial rules are deliberately small; no-match is not safety |
| VirusTotal | File upload, URL submission, analysis polling, SHA-256 report lookup | API v3 key and an agreement permitting this deployment | Full sample or URL with consent; hash on lookup | Public API is not permitted in commercial products/services; account quotas apply |
| MetaDefender Cloud | Binary file upload, report polling, SHA-256 lookup | API v4 key and suitable license | Full sample with consent, or hash | Community API is for personal/demo use; public sharing can apply |
| MalwareBazaar | `get_info` SHA-256 lookup only | Auth-Key + permitted usage | SHA-256 only | Community fair-use; commercial/for-profit use may require a paid agreement |

External response fixtures in tests validate the implemented parsing and failure behavior. They do not establish that a live account has paid features enabled, that every vendor field is present, or that a license permits resale. No real paid account was used during this build.

Requests go only to fixed HTTPS provider origins:

- `https://www.virustotal.com/api/v3/`
- `https://api.metadefender.com/v4/`
- `https://mb-api.abuse.ch/api/v1/`

HTTP redirects are disabled. API keys are in headers. There is no administrator-supplied arbitrary API endpoint and no target-URL fetch on this server. Provider keys are never returned in user reports; provider errors store a code/status/duration rather than raw response bodies or authorization headers.

## Verdicts and dates

Individual provider engine results are preserved as separate rows. Unrecognized categories map to `error`. Not found, unsupported, timeouts and failed providers are distinct from undetected. A provider record can be older than the current request. `analysis_date` is the provider's scan time when supplied (or actual local evaluation time); `scanned_at` is when MultiScan recorded the response. Definition update dates and engine versions are retained only when supplied. MalwareBazaar supplies intelligence evidence, not a fresh engine scan date.

Default provider quotas are placeholders that the operator must lower to actual account limits before enabling a provider. Both initial submissions and polls consume the application request counters. Priority determines dispatch order, not a guarantee that every request completes ahead of a lower-priority job under concurrency. Account sharing outside MultiScan can exhaust a provider quota even if this app's counter has room.

## Sources checked for this build

- VirusTotal commercial/public policy: https://docs.virustotal.com/reference/public-vs-premium-api
- VirusTotal file upload/size behavior: https://docs.virustotal.com/reference/files-scan
- VirusTotal URL submission: https://docs.virustotal.com/reference/scan-url
- VirusTotal analysis polling: https://docs.virustotal.com/reference/analysis
- OPSWAT API v4: https://www.opswat.com/docs/mdcloud/metadefender-cloud-api-v4
- OPSWAT public API access: https://www.opswat.com/docs/mdcloud/v-4/integrations/public-apis
- OPSWAT submission sharing/private processing: https://www.opswat.com/docs/mdcloud/operation/private-scanning-with-metadefender-cloud-apis
- MalwareBazaar Community API/auth/fair use: https://bazaar.abuse.ch/api/
- ClamAV actual binary behavior: https://docs.clamav.net/manual/Usage/Scanning.html
- Stripe raw-body signatures: https://docs.stripe.com/webhooks

Review current account terms directly before enabling services. API credentials, signature feeds, service subscriptions and commercial rights are not included in this ZIP.