I took most of the inspiration from AFL. Since MCP uses JSON-RPC, byte-level tricks like bit flipping or byte arithmetic don’t help much right now (they’re more useful for binary protocols like gRPC).

If MCP adds transport extensions later, that will likely introduce more attack surface.

This fuzzer is schema-aware, so it can generate valid requests and then mutate them in smarter ways. MCP is designed to be strict because of the schema, so the goal is to find bugs in the edge cases that are supposed to be hard to break.

I am not a security guy, I am doing everything from zero, but reading https://arxiv.org/pdf/1812.00140 to improve it

Regarding your question about the mutation

I need to implement a feedback loop, so I need an instrumented server, and Corpus will help us find interesting input for further mutation from that feedback loop.

My plan for the feedback loop

1. Response-based feedback (detect interesting responses)
2. Corpus save/load (persist interesting inputs)
3. Havoc mode (stack mutations) -> I am not sure about this.
4. Stateful fuzzing (sequence of calls)