Osm Tagging Schema MCP

🚀 OSS-Fuzz Integration

This project aims to integrate with OSS-Fuzz, Google's continuous fuzzing service for open - source projects. The directory contains configuration files for a potential future integration.

🚀 Quick Start

The project is on the way to integrating with OSS - Fuzz. Here's a quick overview of the current status and how you can get involved in fuzz testing.

✨ Features

Current Status

• Active Fuzzing: ✅ Property - based testing with fast - check (GitHub Actions)
• OSS - Fuzz Submission: 🔄 Prepared but not yet submitted

Current Fuzzing Approach

The project uses property - based testing with the [fast - check](https://github.com/dubzzz/fast - check) library, recognized by the OpenSSF Scorecard as a fuzzing approach.

Fuzz Targets

• Tag Parser (tests/fuzz/tag - parser.fuzz.test.ts): Tests various input scenarios including random strings, JSON parsing edge cases, key - value format, unicode, special characters, and very long inputs.
• Tag Validation (tests/fuzz/validate - tag.fuzz.test.ts): Tests random key - value pairs, OSM - like tag patterns, empty and whitespace inputs, deprecated tag handling, and common OSM tag patterns.
• Schema Loader (tests/fuzz/schema - loader.fuzz.test.ts): Tests translation method lookups, preset name resolution, field label resolution, and unicode and special characters.

Benefits of OSS - Fuzz

• Continuous Fuzzing: 24/7 fuzzing on Google infrastructure
• ClusterFuzz Integration: Advanced corpus management
• Bug Reporting: Private bug reports with 90 - day disclosure timeline
• Coverage Tracking: Detailed code coverage reports
• Sanitizers: Address, undefined, memory sanitizers

📦 Installation

Not applicable as this section is about OSS - Fuzz integration and fuzz testing rather than installation of the project itself.

💻 Usage Examples

Running Fuzz Tests

# Run all fuzz tests locally
npm run test:fuzz

# Run with coverage
npm run test:coverage:fuzz

# Fuzz tests also run automatically in CI:
# - On every PR (5 - minute fast fuzzing)
# - On every push to master (30 - minute extended fuzzing)
# - Weekly schedule (Monday 2 AM UTC)

📚 Documentation

OSS - Fuzz Submission (Future)

Prerequisites

• Project Requirements:
  • ✅ Open source with permissive license (GPL - 3.0)
  • ✅ Significant user base or security relevance
  • ✅ Actively maintained
  • ✅ Fuzz targets implemented
• Maintainer Requirements:
  • Security contact email
  • Commitment to fix bugs found by fuzzing
  • Review and triage fuzzing findings

Submission Process

1. Prepare Configuration:

• Update project.yaml with actual contact emails
• Test build locally with OSS - Fuzz tooling
• Ensure fuzz targets compile and run

2. Create OSS - Fuzz PR:

# Fork https://github.com/google/oss - fuzz
# Create projects/osm - tagging - schema - mcp/ directory
# Copy .ossfuzz/* files to that directory
# Submit PR to google/oss - fuzz

3. Integration Steps:

• OSS - Fuzz team reviews PR
• Initial fuzzing run to verify setup
• Continuous fuzzing starts after approval

Configuration Files

• project.yaml: OSS - Fuzz project configuration
• Dockerfile: Docker image for building fuzz targets
• build.sh: Build script for compiling fuzz targets
• README.md: This documentation

Resources

• [OSS - Fuzz Documentation](https://google.github.io/oss - fuzz/)
• [New Project Guide](https://google.github.io/oss - fuzz/getting - started/new - project - guide/)
• [fast - check Documentation](https://github.com/dubzzz/fast - check)
• [Property - Based Testing Guide](https://github.com/dubzzz/fast - check/blob/main/documentation/HowItWorks.md)

Scorecard Impact

The current implementation with fast - check property - based testing is recognized by OpenSSF Scorecard as fuzzing infrastructure. This should improve the project's fuzzing score from 0 to a higher value.

• Scorecard checks for:
  • ✅ fast - check library usage (JavaScript/TypeScript property - based testing)
  • ✅ Fuzz test files in repository
  • ✅ CI/CD integration for regular fuzzing

📄 License

The project is licensed under GPL - 3.0.

🤝 Contact

For questions about fuzzing or security issues, please contact:

• GitHub Issues: https://github.com/gander - tools/osm - tagging - schema - mcp/issues
• Security: See SECURITY.md for responsible disclosure process