TL;DR. golang.org/x/net/idna.Lookup.ToASCII runs UTS-46 NFKC mapping 0-9. A pre-IDNA net.ParseIP check rejects the NO_PROXY lists, TLS-SNI routers, and cookie-domain validators that TrimRight + ParseAddr golang.org/x/net/http/httpproxy, the canonical safe pattern, and two I ran into this one while writing a Go HTTP client for a private project. I idna.Lookup.ToASCII canonicalising the host The sha
The Dangerous Bugs Are the Ones That Don't Crash: Building Input Validation for My MCP Server I was building an MCP server for an event platform that automates speaker communications (confirmations, reminders, calendar invites, follow-ups). An agent created a session confirmation for "Monday March 8th." March 8th was a Sunday. I caught it. But catching it was just the beginning. The confirmation