test: add security fuzz regression suite

[P4ST4S]

Summary

• add fuzz targets for MCP inspection, bounded message decoding, Integrity v2 round trips, proxy JSON-RPC handling, and HTTP allowlist normalization
• document repeatable fuzz campaigns and run checked-in seeds during ordinary tests
• retain four minimized regression inputs found during active fuzzing
• reject malformed IPv6/bracket syntax and repeated trailing dots in HTTP Origin and Host allowlists

Approach

The HTTP normalization target enforces idempotence. Active fuzzing exposed accepted inputs that changed meaning when normalized a second time; the validator now rejects those malformed values and the minimized inputs are committed as regression corpus.

Test plan

• GOCACHE=/tmp/mcp-audit-go-cache go test -race ./...
• GOCACHE=/tmp/mcp-audit-go-cache go test -tags=integration ./tests/integration/...
• active fuzzing of all five targets for short local campaigns
• FuzzHTTPAccessListNormalization: 840726 executions before the first fix cycle, then 840726-plus additional executions across correction cycles, with the final ten-second campaign passing
• GOCACHE=/tmp/mcp-audit-go-cache go build ./...
• GOCACHE=/tmp/mcp-audit-go-cache go vet ./...

Stability impact

Malformed HTTP allowlist values that were previously accepted are now rejected during startup. Valid Origin and Host values are unchanged.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!