Skip to content

Add proto2mcp project - #16052

Closed
brucearctor wants to merge 1 commit into
google:masterfrom
brucearctor:add-proto2mcp
Closed

brucearctor wants to merge 1 commit into
google:masterfrom
brucearctor:add-proto2mcp

Conversation

@brucearctor

Copy link
Copy Markdown

New Project: proto2mcp

Project URL: https://github.com/protocgen/proto2mcp
Language: Go
Contact: brucearctor@users.noreply.github.com

What is proto2mcp?

A protoc plugin that generates type-safe MCP tool servers from protobuf service definitions. Used to bridge LLM agents with existing gRPC/ConnectRPC backends.

Fuzz Targets (4)

Target What it covers
FuzzSanitizeErrorMessage Error message scrubbing — ensures no path/IP leakage, length bounded
FuzzTruncateUTF8 UTF-8 safe truncation — already found a real bug (v0.12.3)
FuzzUnmarshalToolInput Protojson unmarshal of arbitrary agent input — no panics
FuzzResourceKeyExtraction JSON key extraction from untrusted agent arguments

Why fuzz?

proto2mcp sits between untrusted LLM agent input and backend services. The fuzz targets cover the exact parsing boundary where malformed input enters the system. Fuzzing already found one bug: truncateUTF8 produced invalid UTF-8 from lone lead bytes (fixed in v0.12.3).

Build verification

Tested locally with:

python3 infra/helper.py build_fuzzers proto2mcp
python3 infra/helper.py check_build proto2mcp

proto2mcp generates MCP (Model Context Protocol) tool servers from
protobuf service definitions. 4 fuzz targets cover security-sensitive
parsing: error message sanitization, UTF-8 truncation, protojson
unmarshal, and JSON key extraction.
@github-actions

Copy link
Copy Markdown

brucearctor is integrating a new project:
- Main repo: https://github.com/protocgen/proto2mcp
- Criticality score: 0.19759

@DavidKorczynski DavidKorczynski left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @brucearctor -- I don't think the project is mature enough for OSS-Fuzz. We target projects that already have a wide user base.

I suggest taking a look at ClusterFuzzLite : https://github.com/google/clusterfuzzlite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants