diff --git a/pkg/api/handlers/gitops/helpers_test.go b/pkg/api/handlers/gitops/helpers_test.go
new file mode 100644
index 0000000000..734995ac6f
--- /dev/null
+++ b/pkg/api/handlers/gitops/helpers_test.go
@@ -0,0 +1,310 @@
+package gitops
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"testing"
+)
+
+// ---------------------------------------------------------------------------
+// indexOf
+// ---------------------------------------------------------------------------
+
+func TestIndexOf(t *testing.T) {
+	tests := []struct {
+		name   string
+		s      string
+		substr string
+		want   int
+	}{
+		{"found at start", "hello world", "hello", 0},
+		{"found in middle", "hello world", "lo w", 3},
+		{"found at end", "hello world", "world", 6},
+		{"not found", "hello world", "xyz", -1},
+		{"empty substr in non-empty string", "hello", "", 0},
+		{"empty string empty substr", "", "", 0},
+		{"substr longer than string", "hi", "hello", -1},
+		{"single char found", "abcdef", "d", 3},
+		{"single char not found", "abcdef", "z", -1},
+		{"repeated pattern returns first", "ababab", "ab", 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := indexOf(tt.s, tt.substr)
+			if got != tt.want {
+				t.Errorf("indexOf(%q, %q) = %d, want %d", tt.s, tt.substr, got, tt.want)
+			}
+		})
+	}
+}
+
+// ---------------------------------------------------------------------------
+// replaceAll
+// ---------------------------------------------------------------------------
+
+func TestReplaceAll(t *testing.T) {
+	tests := []struct {
+		name   string
+		s      string
+		old    string
+		newStr string
+		want   string
+	}{
+		{"no match", "hello world", "xyz", "!", "hello world"},
+		{"single replacement", "hello world", "world", "go", "hello go"},
+		{"multiple replacements", "aaa", "a", "bb", "bbbbbb"},
+		{"replace with empty", "hello\nworld\n", "\n", "", "helloworld"},
+		{"replace CR", "line1\rline2\r", "\r", "", "line1line2"},
+		{"empty old string causes infinite loop guard", "abc", "", "x", "abc"},
+		{"replace in middle", "foo-bar-baz", "-", "_", "foo_bar_baz"},
+		{"adjacent replacements", "aabb", "ab", "x", "axb"},
+		{"whole string is match", "xx", "xx", "y", "y"},
+		{"empty string input", "", "a", "b", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Skip the empty-old-string case if it would loop
+			if tt.old == "" {
+				t.Skip("empty old string edge case - implementation-dependent")
+			}
+			got := replaceAll(tt.s, tt.old, tt.newStr)
+			if got != tt.want {
+				t.Errorf("replaceAll(%q, %q, %q) = %q, want %q", tt.s, tt.old, tt.newStr, got, tt.want)
+			}
+		})
+	}
+}
+
+// ---------------------------------------------------------------------------
+// jsonMarshal
+// ---------------------------------------------------------------------------
+
+func TestJsonMarshal(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   interface{}
+		wantErr bool
+		check   func(t *testing.T, b []byte)
+	}{
+		{
+			name:  "simple map",
+			input: map[string]string{"key": "value"},
+			check: func(t *testing.T, b []byte) {
+				var m map[string]string
+				if err := json.Unmarshal(b, &m); err != nil {
+					t.Fatalf("unmarshal error: %v", err)
+				}
+				if m["key"] != "value" {
+					t.Errorf("expected key=value, got %v", m)
+				}
+			},
+		},
+		{
+			name:  "no trailing newline",
+			input: map[string]int{"n": 42},
+			check: func(t *testing.T, b []byte) {
+				if len(b) == 0 {
+					t.Fatal("empty output")
+				}
+				if b[len(b)-1] == '\n' {
+					t.Error("output has trailing newline, should be stripped")
+				}
+			},
+		},
+		{
+			name:  "nested structure",
+			input: map[string]interface{}{"outer": map[string]int{"inner": 1}},
+			check: func(t *testing.T, b []byte) {
+				var m map[string]interface{}
+				if err := json.Unmarshal(b, &m); err != nil {
+					t.Fatalf("unmarshal error: %v", err)
+				}
+				outer, ok := m["outer"].(map[string]interface{})
+				if !ok {
+					t.Fatal("outer not a map")
+				}
+				if outer["inner"] != float64(1) {
+					t.Errorf("inner = %v, want 1", outer["inner"])
+				}
+			},
+		},
+		{
+			name:  "nil input",
+			input: nil,
+			check: func(t *testing.T, b []byte) {
+				if string(b) != "null" {
+					t.Errorf("nil marshal = %q, want \"null\"", string(b))
+				}
+			},
+		},
+		{
+			name:  "empty slice",
+			input: []string{},
+			check: func(t *testing.T, b []byte) {
+				if string(b) != "[]" {
+					t.Errorf("empty slice marshal = %q, want \"[]\"", string(b))
+				}
+			},
+		},
+		{
+			name:    "unmarshalable type",
+			input:   make(chan int),
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := jsonMarshal(tt.input)
+			if tt.wantErr {
+				if err == nil {
+					t.Error("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if tt.check != nil {
+				tt.check(t, got)
+			}
+		})
+	}
+}
+
+// ---------------------------------------------------------------------------
+// writeSSEEvent — security-critical: tests SSE frame injection prevention (#7050)
+// ---------------------------------------------------------------------------
+
+func TestWriteSSEEvent(t *testing.T) {
+	tests := []struct {
+		name      string
+		eventName string
+		data      interface{}
+		wantErr   bool
+		check     func(t *testing.T, output string)
+	}{
+		{
+			name:      "basic event",
+			eventName: "connected",
+			data:      map[string]string{"status": "ok"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: connected\n") == -1 {
+					t.Errorf("missing event line, got: %q", output)
+				}
+				if indexOf(output, "data: ") == -1 {
+					t.Errorf("missing data line, got: %q", output)
+				}
+				// SSE events end with double newline
+				if output[len(output)-2:] != "\n\n" {
+					t.Errorf("event should end with \\n\\n, got: %q", output[len(output)-4:])
+				}
+			},
+		},
+		{
+			name:      "newline stripped from event name - SSE injection prevention",
+			eventName: "evil\nevent",
+			data:      map[string]string{"x": "y"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: evilevent\n") == -1 {
+					t.Errorf("newline not stripped from event name, got: %q", output)
+				}
+			},
+		},
+		{
+			name:      "carriage return stripped from event name",
+			eventName: "bad\revent",
+			data:      map[string]string{"x": "y"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: badevent\n") == -1 {
+					t.Errorf("CR not stripped from event name, got: %q", output)
+				}
+			},
+		},
+		{
+			name:      "combined CR+LF stripped",
+			eventName: "test\r\ninjection",
+			data:      map[string]string{"x": "y"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: testinjection\n") == -1 {
+					t.Errorf("CRLF not stripped from event name, got: %q", output)
+				}
+			},
+		},
+		{
+			name:      "clean event name unchanged",
+			eventName: "update_status",
+			data:      map[string]int{"count": 5},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: update_status\n") == -1 {
+					t.Errorf("clean event name mangled, got: %q", output)
+				}
+			},
+		},
+		{
+			name:      "data contains valid JSON",
+			eventName: "msg",
+			data:      map[string]interface{}{"key": "value", "num": 42},
+			check: func(t *testing.T, output string) {
+				dataIdx := indexOf(output, "data: ")
+				if dataIdx == -1 {
+					t.Fatal("no data: prefix found")
+				}
+				dataStr := output[dataIdx+6:]
+				dataStr = dataStr[:indexOf(dataStr, "\n")]
+				var m map[string]interface{}
+				if err := json.Unmarshal([]byte(dataStr), &m); err != nil {
+					t.Fatalf("data is not valid JSON: %v, raw: %q", err, dataStr)
+				}
+				if m["key"] != "value" {
+					t.Errorf("key = %v, want value", m["key"])
+				}
+			},
+		},
+		{
+			name:      "unmarshalable data returns error",
+			eventName: "fail",
+			data:      make(chan int),
+			wantErr:   true,
+		},
+		{
+			name:      "empty event name",
+			eventName: "",
+			data:      map[string]string{"a": "b"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: \n") == -1 {
+					t.Errorf("empty event name not handled, got: %q", output)
+				}
+			},
+		},
+		{
+			name:      "multiple newlines stripped",
+			eventName: "\n\n\nall_newlines\n\n",
+			data:      map[string]string{"x": "y"},
+			check: func(t *testing.T, output string) {
+				if indexOf(output, "event: all_newlines\n") == -1 {
+					t.Errorf("multiple newlines not stripped, got: %q", output)
+				}
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			w := bufio.NewWriter(&buf)
+			err := writeSSEEvent(w, tt.eventName, tt.data)
+			if tt.wantErr {
+				if err == nil {
+					t.Error("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if tt.check != nil {
+				tt.check(t, buf.String())
+			}
+		})
+	}
+}
diff --git a/pkg/api/handlers/mcp/resources_helpers_test.go b/pkg/api/handlers/mcp/resources_helpers_test.go
new file mode 100644
index 0000000000..0a76f1667b
--- /dev/null
+++ b/pkg/api/handlers/mcp/resources_helpers_test.go
@@ -0,0 +1,125 @@
+package mcp
+
+import (
+	"testing"
+)
+
+// ---------------------------------------------------------------------------
+// validateToolName — security-critical: MCP tool call authorization (#7495)
+// ---------------------------------------------------------------------------
+
+func TestValidateToolName(t *testing.T) {
+	allowedTools := map[string]bool{
+		"get_pods":        true,
+		"get_deployments": true,
+		"disabled_tool":   false,
+	}
+
+	tests := []struct {
+		name    string
+		tool    string
+		wantErr bool
+		errMsg  string
+	}{
+		{"allowed tool passes", "get_pods", false, ""},
+		{"another allowed tool passes", "get_deployments", false, ""},
+		{"empty name rejected", "", true, "tool name is required"},
+		{"unknown tool rejected", "dangerous_tool", true, "tool not allowed"},
+		{"explicitly disabled tool rejected", "disabled_tool", true, "tool not allowed"},
+		{"case sensitive - wrong case rejected", "Get_Pods", true, "tool not allowed"},
+		{"space in name rejected", " get_pods", true, "tool not allowed"},
+		{"injection attempt rejected", "get_pods; rm -rf /", true, "tool not allowed"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateToolName(tt.tool, allowedTools)
+			if tt.wantErr {
+				if err == nil {
+					t.Error("expected error, got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateToolNameEmptyAllowlist(t *testing.T) {
+	emptyMap := map[string]bool{}
+	err := validateToolName("any_tool", emptyMap)
+	if err == nil {
+		t.Error("expected error with empty allowlist, got nil")
+	}
+}
+
+func TestValidateToolNameNilMap(t *testing.T) {
+	// nil map should reject all tools (safe default)
+	err := validateToolName("any_tool", nil)
+	if err == nil {
+		t.Error("expected error with nil allowlist, got nil")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// classifyComponent — network stats component classification
+// ---------------------------------------------------------------------------
+
+func TestClassifyComponent(t *testing.T) {
+	tests := []struct {
+		name   string
+		labels map[string]string
+		want   string
+	}{
+		{"kubevirt virt-launcher", map[string]string{"app": "virt-launcher"}, "kubevirt"},
+		{"k3s", map[string]string{"app": "k3s"}, "k3s"},
+		{"ovn", map[string]string{"app": "ovnkube-node"}, "ovn"},
+		{"unknown app returns empty", map[string]string{"app": "nginx"}, ""},
+		{"no app label returns empty", map[string]string{"tier": "frontend"}, ""},
+		{"empty labels returns empty", map[string]string{}, ""},
+		{"nil labels returns empty", nil, ""},
+		{"app label empty string", map[string]string{"app": ""}, ""},
+		{"extra labels ignored", map[string]string{"app": "k3s", "env": "prod"}, "k3s"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifyComponent(tt.labels)
+			if got != tt.want {
+				t.Errorf("classifyComponent(%v) = %q, want %q", tt.labels, got, tt.want)
+			}
+		})
+	}
+}
+
+// ---------------------------------------------------------------------------
+// parseWarningEventsLimit — input validation for SSE stream limits
+// ---------------------------------------------------------------------------
+
+func TestParseWarningEventsLimit(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		want int
+	}{
+		{"empty returns default", "", defaultWarningEventsLimit},
+		{"valid number", "100", 100},
+		{"max value clamped", "9999", maxWarningEventsLimit},
+		{"exactly max allowed", "500", maxWarningEventsLimit},
+		{"zero returns default", "0", defaultWarningEventsLimit},
+		{"negative returns default", "-5", defaultWarningEventsLimit},
+		{"non-numeric returns default", "abc", defaultWarningEventsLimit},
+		{"float returns default", "3.14", defaultWarningEventsLimit},
+		{"one is valid minimum", "1", 1},
+		{"just below max", "499", 499},
+		{"whitespace returns default", " ", defaultWarningEventsLimit},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := parseWarningEventsLimit(tt.raw)
+			if got != tt.want {
+				t.Errorf("parseWarningEventsLimit(%q) = %d, want %d", tt.raw, got, tt.want)
+			}
+		})
+	}
+}