Skip to content

fix(mcp): enforce request body limit on actual bytes - #385

Merged
vamgan merged 1 commit into
mainfrom
fix/mcp-request-body-limit
Jul 25, 2026
Merged

fix(mcp): enforce request body limit on actual bytes#385
vamgan merged 1 commit into
mainfrom
fix/mcp-request-body-limit

Conversation

@vamgan

@vamgan vamgan commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • preserve the existing early Content-Length rejection for obviously oversized requests
  • verify actual streamed request-body bytes before handing accepted requests to the MCP transport
  • create the verification branch before authorization so authorize() can consume the original body and return parsedBody
  • cancel both branches of the Fetch tee on overflow or authorization rejection so streaming uploads actually stop
  • reject bodies with missing, invalid, or falsely small Content-Length values once they exceed the configured limit
  • preserve maxRequestBodyBytes: false
  • document declared-length versus streamed-byte validation ordering

Closes #371.

Tests

  • npm run build
  • npm test
  • npm test -w @askable-ui/mcp -- --run src/__tests__/index.test.ts

Full validation passed with 1,115 tests, including streamed cancellation, authorization body consumption, UTF-8 byte counting, missing/false content length, and exact-boundary acceptance.

@vercel

vercel Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
askable Ready Ready Preview, Comment Jul 25, 2026 6:58pm

@pkg-pr-new

pkg-pr-new Bot commented Jul 25, 2026

Copy link
Copy Markdown

Open in StackBlitz

@askable-ui/angular

npm i https://pkg.pr.new/@askable-ui/angular@385

@askable-ui/context

npm i https://pkg.pr.new/@askable-ui/context@385

@askable-ui/core

npm i https://pkg.pr.new/@askable-ui/core@385

@askable-ui/create-app

npm i https://pkg.pr.new/@askable-ui/create-app@385

@askable-ui/mcp

npm i https://pkg.pr.new/@askable-ui/mcp@385

@askable-ui/qwik

npm i https://pkg.pr.new/@askable-ui/qwik@385

@askable-ui/react

npm i https://pkg.pr.new/@askable-ui/react@385

@askable-ui/react-native

npm i https://pkg.pr.new/@askable-ui/react-native@385

@askable-ui/solid

npm i https://pkg.pr.new/@askable-ui/solid@385

@askable-ui/svelte

npm i https://pkg.pr.new/@askable-ui/svelte@385

@askable-ui/vue

npm i https://pkg.pr.new/@askable-ui/vue@385

@askable-ui/web-component

npm i https://pkg.pr.new/@askable-ui/web-component@385

commit: 3f3a9bc

@vamgan
vamgan force-pushed the fix/mcp-request-body-limit branch from 3f3a9bc to a0c884b Compare July 25, 2026 18:57
@vamgan
vamgan merged commit 70c19aa into main Jul 25, 2026
6 of 8 checks passed
@vamgan
vamgan deleted the fix/mcp-request-body-limit branch July 25, 2026 18:58

This branch was successfully deployed

1 active deployment
Preview — a0c884bb Deployed Jul 25, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

security(mcp): enforce request-body limits on actual streamed bytes

1 participant

@vamgan