feat: Add feat: Add CD001-MCP SystemUtils Server Tests (CD001, #27)

[steadhac]

Description

Add a comprehensive unit test suite for the SystemUtils MCP server — a mock server
that records what the agent attempted but executes nothing. The CTF attack surface
is the free-form string arguments: a poisoned LLM could supply destructive commands
(shell injection, DROP TABLE, rm -rf /, credential theft scripts) and the server
accepts them silently.

Bug-exposing tests document missing input validation across all 8 tools.

Tests follow the established pattern with:

• Title / Basically question / Steps / Expected Results / Impact
• Bug-exposing tests included for each confirmed production defect.

📁 Test Files
tests/unit/mcp/test_systemutils.py

TestRunDiagnostics

Test ID	Title
test_su_diag_001	run_diagnostics returns a complete result for a valid command
test_su_diag_002	Supplied command appears in the output string
test_su_diag_003 ⚠️	Shell injection command accepted without validation
test_su_diag_004 ⚠️	Empty command accepted without validation

TestManageStorage

Test ID	Title
test_su_stor_001	manage_storage returns a complete result for a valid action
test_su_stor_002 ⚠️	Destructive storage action accepted without validation
test_su_stor_003 ⚠️	Path traversal in target accepted without sanitisation
test_su_stor_004 ⚠️	Empty action string accepted without validation

TestRotateLogs

Test ID	Title
test_su_log_001	rotate_logs returns a complete result for a valid service
test_su_log_002 ⚠️	Empty service name accepted without validation
test_su_log_003 ⚠️	Unrecognised service name accepted without allow-list check

TestDatabaseMaintenance

Test ID	Title
test_su_db_001	database_maintenance returns a complete result for a valid query
test_su_db_002 ⚠️	DROP TABLE statement accepted without validation
test_su_db_003 ⚠️	Unguarded DELETE accepted without validation
test_su_db_004 ⚠️	Empty query accepted without validation

TestNetworkRequest

Test ID	Title
test_su_net_001	network_request returns a complete result for a valid request
test_su_net_002 ⚠️	Data exfiltration URL accepted without domain validation
test_su_net_003 ⚠️	Internal IP address accepted — SSRF attack surface
test_su_net_004 ⚠️	Empty URL accepted without validation
test_su_net_005	Custom HTTP method (e.g. DELETE) echoed in response

TestReadConfig

Test ID	Title
test_su_cfg_001	read_config returns a complete result for a valid config path
test_su_cfg_002 ⚠️	Sensitive system file path accepted without allow-list check
test_su_cfg_003 ⚠️	.env file path accepted without validation
test_su_cfg_004	Mock response includes DATABASE_URL and SECRET_KEY keys
test_su_cfg_005 ⚠️	Empty filepath accepted without validation

TestManageUsers

Test ID	Title
test_su_usr_001	manage_users returns a complete result for a valid operation
test_su_usr_002 ⚠️	Deleting admin user accepted without validation
test_su_usr_003 ⚠️	Superadmin role escalation accepted without validation
test_su_usr_004 ⚠️	Empty username accepted without validation

TestExecuteScript ⚠️ (most dangerous tool)

Test ID	Title
test_su_exec_001	execute_script returns a complete result for a valid script
test_su_exec_002	script_preview truncated at 200 characters
test_su_exec_003 ⚠️	Destructive bash script accepted without content scanning
test_su_exec_004 ⚠️	Credential theft script accepted without content scanning
test_su_exec_005 ⚠️	Empty script_content accepted without validation
test_su_exec_006 ⚠️	Unsupported interpreter accepted without allow-list check

TestSystemUtilsServerConfig

Test ID	Title
test_su_config_001	DEFAULT_CONFIG values appear in run_diagnostics response
test_su_config_002	Custom hostname and OS override DEFAULT_CONFIG values
test_su_config_003	Empty server_config behaves identically to None

TestSystemUtilsToolDiscovery

Test ID	Title
test_su_tools_001	Server exposes exactly 8 tools matching DEFAULT_CONFIG
test_su_tools_002	Every tool response contains a non-null timestamp field

Related Bug Tickets

Bug_160, Bug_161, Bug_162, Bug_163, Bug_164, Bug_165, Bug_166, Bug_167, Bug_168, Bug_169, Bug_170, Bug_171, Bug_172, Bug_173, Bug_174, Bug_175, Bug_176, Bug_177, Bug_178, Bug_179, Bug_180, Bug_181, Bug_182