fix[backend](socai/mcp): fixed create/update rule schemas

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Refactored MCP tool inputs to use 'any' for flexible JSON schema generation; logic remains contained within the MCP module layer.

No findings.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Refactored MCP tool inputs to use 'any' for flexible JSON schema generation with safe marshaling.

No findings.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Introduction of arbitrary JSON input handling in MCP tools without schema validation, creating potential injection risks in downstream processing.

• medium backend/modules/mcp/tools_eventprocessing.go:197 — The use of 'any' for DSL fields (Definition, Correlation, etc.) bypasses type safety and validation. If the downstream usecase expects specific structures, this could lead to injection or logic flaws. Ensure strict schema validation is applied to these fields before processing.
• medium backend/modules/mcp/tools_small.go:318 — Changing 'Alert' to 'any' allows arbitrary JSON structures to be passed to the SOC AI service. Without validation, this may lead to SSRF or injection vulnerabilities if the external service interprets the payload unsafely.

🟢 go-deps — up to date

No pending Go dependency updates.

[AlexSanchez-bit]

v is always the result of json.Unmarshal into any — it can only be nil, bool, float64, string, []any, or map[string]any