[Elon-Jiang]

Summary

Normalize mixed-case MCP risk codes before selecting SARIF rule metadata and computing alert fingerprints. An input such as mcp05: Command Injection currently produces a separate mcp05 rule alongside the built-in MCP05; the same finding then has a different rule ID and fingerprint solely because of casing. Bare mcp05 already resolves to MCP05.

The change extends the existing normalization to MCP-prefixed numeric codes, preserving the original handling of other identifiers. Regression tests compare complete English and Chinese reports for lowercase/mixed-case prefixes, both colon forms, and surrounding whitespace, and verify that non-MCP/custom rule IDs retain their identity.

Type of change

• Bug fix

How was this tested?

• Original upstream 851e3f2: six new report regressions fail; eleven other tests in the same file pass.
• Fixed formatter tests: 17 passed.
• Full MCP suite, with no exclusions: 74 passed, 2 failed. Both failures also reproduce in an unchanged upstream checkout with the same Python 3.12.14 interpreter and dependencies: test_pre_scan_sanitizes_non_utf8_filename and test_build_repo_tree_sanitizes_non_utf8_filename mix a str temporary-directory path with a bytes filename and raise TypeError before exercising scanner behavior. Those tests are outside this patch.
• python main.py --help: passed.
• New tests pass Ruff lint and format checks. The formatter has the same existing UP012 diagnostic and pre-existing formatting differences as upstream; the changed block is formatted and git diff --check passes.
• GOMAXPROCS=2 GOMEMLIMIT=512MiB go build -p 2 ./...: passed with Go 1.23.2.

Related issue

N/A — reproduced directly against the current formatter; checked all open PR file lists, all-state SARIF/casing/risk-type searches, discussions and formatter history for overlap.

Checklist

• go build ./... succeeds locally (with -p 2)
• I followed the existing file/rule format conventions for this contribution type
• I have not introduced hardcoded secrets or credentials

Prepared with assistance from OpenAI Codex. Reproduction and validation were executed locally; the two unrelated upstream test failures are disclosed above.