@@ -36,12 +36,16 @@ The markdown of an HTML page opens with the page's title as a `#` heading (its `
 
 ### Errors
 
-- A failed fetch (a robots.txt refusal, an unreachable page, an HTTP error status, a refused private address, an unusable proxy setting) and arguments that do not match the tool's schema are returned as a tool result with `isError: true`, whose text starts `Error executing tool fetch:` and says what went wrong, so the model can read it and decide what to do.
+- A failed fetch (a robots.txt refusal, an unreachable page, an HTTP error status, a refused private address, an unusable proxy setting, a response body over the [size limit](#response-size)) and arguments that do not match the tool's schema are returned as a tool result with `isError: true`, whose text starts `Error executing tool fetch:` and says what went wrong, so the model can read it and decide what to do.
 - Calling a tool the server does not have is a JSON-RPC protocol error, `-32602` (`Unknown tool: <name>`), as the specification requires. So is getting a prompt it does not have (`Unknown prompt: <name>`), or the `fetch` prompt without its `url` (`URL is required`) or with a `url` that is not a valid URL (`Invalid URL '<url>': <reason>`).
 - When the `fetch` prompt's fetch fails, the prompt still returns: its message holds the reason the fetch failed.
 
 The server is built on the MCP Python SDK's high-level `MCPServer`: the tool and the prompt are decorated functions, and their type hints and field descriptions are the input schema and the prompt's arguments.
 
+### Response size
+
+The server reads at most 5 MiB (5,242,880 bytes) of a response body, so a very large or endless response cannot exhaust its memory. The limit is fixed and counts the body after its content encoding is decoded, and decoding itself stops at the limit, so a small compressed body that expands enormously is stopped without being expanded. The server asks for, and decodes, only `gzip` and `deflate` (`Accept-Encoding: gzip, deflate`); a response in any other content encoding (`br`, `zstd`, or more than one encoding applied in turn) is refused with an error. A page whose `Content-Length` is over it is refused before any of the body is read; a page that streams past it is refused once it does. Either way the tool returns an error saying so (and the `fetch` prompt returns that message), rather than part of the page. A robots.txt over the limit is not refused: its rules are read from the first 5 MiB. Each redirect is followed without reading the redirect response's own body. `max_length` and `start_index` page through what was read, so they are not affected by this limit and do not raise it.
+
 ### Content negotiation
 
 The tool and the prompt ask for markdown first, with the request header `Accept: text/markdown, text/html;q=0.9, */*;q=0.8`. A site that serves markdown through content negotiation sends it directly, and a `text/markdown` response is returned as-is: it is not simplified and carries no raw-content notice. A site that ignores the header sends what it always did, and HTML is simplified to markdown as before. A `raw` fetch keeps the default `Accept: */*`, so it gets whatever the site serves by default (for a web page, its HTML), unsimplified; a markdown response it receives anyway is returned as-is too.
 
@@ -2,7 +2,8 @@
 # URL and convert HTML to Markdown for a model. The network policy lives here
 # beside the handlers because every request path (tool, prompt and robots.txt
 # check) must go through it: the private-address guard on each request and
-# redirect hop, robots.txt for autonomous fetches, and proxy normalization.
+# redirect hop, robots.txt for autonomous fetches, the cap on how much of a
+# response body is read (#5370), and proxy normalization.
 #
 # Built on the MCP Python SDK's high-level `MCPServer` (#5174), as the example
 # to follow: the tool and the prompt are plain decorated functions, whose type
@@ -25,7 +26,9 @@
 import ipaddress
 import os
 import socket
-from collections.abc import Awaitable, Callable, Mapping, Sequence
+import zlib
+from collections.abc import AsyncIterator, Awaitable, Callable, Mapping, Sequence
+from contextlib import asynccontextmanager
 from typing import Annotated, Any, Tuple
 from importlib.metadata import version
 from urllib.parse import urlparse, urlunparse
@@ -397,7 +400,179 @@ def make_client(proxy_url: str | None) -> httpx.AsyncClient:
         )
 
 
-def decode_page(response: httpx.Response) -> str:
+# The most body bytes the server reads from one response (#5370). A body is
+# streamed and the read stops at this cap, so a very large or endless response
+# cannot make the server buffer all of it. `max_length` cannot do this: it
+# limits what is returned, after the whole page has been read and converted.
+# The cap counts decoded bytes, so a small compressed body that expands
+# enormously is stopped too, and decoding itself is bounded by it (see
+# `read_capped`).
+MAX_RESPONSE_BYTES = 5 * 1024 * 1024
+
+# The content codings the server asks for, and the only ones it decodes. They
+# are named explicitly because httpx would also offer br and zstd whenever
+# their packages happen to be installed, and decode them with no output limit.
+ACCEPT_ENCODING = "gzip, deflate"
+
+
+class BoundedInflater:
+    """Incremental gzip or deflate decoding whose output per call is bounded.
+
+    httpx's decoders inflate each network chunk whole, so one small chunk of a
+    compression bomb could allocate far past the cap before any check saw it
+    (#5370). zlib's ``max_length`` stops each call at the room left instead,
+    and keeps the input it did not get to in ``unconsumed_tail``.
+    """
+
+    def __init__(self, coding: str) -> None:
+        self._gzip = coding in ("gzip", "x-gzip")
+        self._first = True
+        self._z = zlib.decompressobj(
+            zlib.MAX_WBITS | 16 if self._gzip else zlib.MAX_WBITS
+        )
+
+    @property
+    def unconsumed_tail(self) -> bytes:
+        return self._z.unconsumed_tail
+
+    @property
+    def eof(self) -> bool:
+        """Whether the compressed stream has ended."""
+        return self._z.eof
+
+    def decompress(self, data: bytes, max_length: int) -> bytes:
+        try:
+            out = self._z.decompress(data, max_length)
+        except zlib.error as e:
+            if self._first and not self._gzip:
+                # Servers often send deflate raw, without zlib's wrapper; httpx
+                # retries the same way.
+                self._first = False
+                self._z = zlib.decompressobj(-zlib.MAX_WBITS)
+                return self.decompress(data, max_length)
+            raise httpx.DecodingError(f"Error decoding the response body: {e}")
+        self._first = False
+        return out
+
+    def flush(self) -> bytes:
+        return self._z.flush()
+
+
+def inflater_for(response: httpx.Response) -> BoundedInflater | None:
+    """The decoder a response's Content-Encoding needs, or None for none.
+
+    Only a single gzip or deflate coding is decoded. Any other (br, zstd, a
+    chain of codings) is refused rather than handed over undecoded or decoded
+    without a bound.
+    """
+    codings = [
+        coding.strip().lower()
+        for coding in response.headers.get("content-encoding", "").split(",")
+    ]
+    codings = [coding for coding in codings if coding not in ("", "identity")]
+    if not codings:
+        return None
+    if len(codings) == 1 and codings[0] in ("gzip", "x-gzip", "deflate"):
+        return BoundedInflater(codings[0])
+    raise httpx.DecodingError(
+        f"Unsupported content encoding {', '.join(codings)}: this server "
+        f"decodes only {ACCEPT_ENCODING}"
+    )
+
+
+@asynccontextmanager
+async def stream_get(
+    client: httpx.AsyncClient, url: str, user_agent: str, **kwargs: Any
+) -> AsyncIterator[httpx.Response]:
+    """GET ``url`` with redirects followed, yielding the final response unread.
+
+    httpx's own redirect handling reads each redirect's body whole before it
+    follows it, so a redirect with an endless body would get round the cap.
+    Here each hop is closed unread instead. The request hooks still run before
+    every hop, since they run on each ``send``. ``kwargs`` go to
+    ``build_request`` (the timeout).
+    """
+    request = client.build_request(
+        "GET",
+        url,
+        headers={"User-Agent": user_agent, "Accept-Encoding": ACCEPT_ENCODING},
+        **kwargs,
+    )
+    response = await client.send(request, stream=True, follow_redirects=False)
+    try:
+        hops = 0
+        while response.next_request is not None:
+            hops += 1
+            if hops > client.max_redirects:
+                raise httpx.TooManyRedirects(
+                    "Exceeded maximum allowed redirects.",
+                    request=response.next_request,
+                )
+            next_request = response.next_request
+            await response.aclose()
+            response = await client.send(
+                next_request, stream=True, follow_redirects=False
+            )
+        yield response
+    finally:
+        await response.aclose()
+
+
+async def read_capped(response: httpx.Response, limit: int) -> tuple[bytes, bool]:
+    """Read a streamed response's body, stopping once it passes ``limit`` bytes.
+
+    Returns the body, at most ``limit`` bytes of it, and whether it was cut
+    short. Whatever the server has not sent yet is never read: closing the
+    response (leaving `stream_get`) closes the connection. The raw bytes are
+    decoded here rather than by httpx, so no single step produces more than
+    one byte past the room left under ``limit`` (see `BoundedInflater`).
+    """
+    inflater = inflater_for(response)
+    body = bytearray()
+    async for raw in response.aiter_raw():
+        pending = raw
+        while pending:
+            room = limit - len(body)
+            if inflater is None:
+                out, pending = pending[: room + 1], b""
+            else:
+                out = inflater.decompress(pending, room + 1)
+                pending = inflater.unconsumed_tail
+            body += out
+            if len(body) > limit:
+                return bytes(body[:limit]), True
+            if inflater is not None and inflater.eof:
+                # The compressed stream is complete. Whatever follows it is not
+                # part of the body (httpx's decoders drop it too), and zlib
+                # would keep all of it in `unused_data`, so reading stops here.
+                return bytes(body), False
+    if inflater is not None:
+        # All input is consumed by now, so zlib has at most a few bytes left.
+        body += inflater.flush()
+    if len(body) > limit:
+        return bytes(body[:limit]), True
+    return bytes(body), False
+
+
+def declared_length(response: httpx.Response) -> int | None:
+    """The body size a response's Content-Length declares, or None without one."""
+    try:
+        return int(response.headers["content-length"])
+    except (KeyError, ValueError):
+        return None
+
+
+def decode_text(response: httpx.Response, content: bytes) -> str:
+    """Decode ``content`` as httpx's ``response.text`` would.
+
+    The header's charset when Python knows it, UTF-8 otherwise, with undecodable
+    bytes replaced. A streamed response has no ``.text`` until its whole body is
+    read through httpx, which is the read the cap exists to avoid.
+    """
+    return content.decode(response.encoding or "utf-8", errors="replace")
+
+
+def decode_page(response: httpx.Response, content: bytes) -> str:
     """Decode a fetched body, honoring a charset the HTML declares (#5199).
 
     httpx's ``response.text`` uses the Content-Type header's charset, and
@@ -413,13 +588,15 @@ def decode_page(response: httpx.Response) -> str:
     unrelated attribute (``data-charset``) is not mistaken for a declaration.
     A declaration Python does not know, or one that names a codec that is not
     a web text encoding, is ignored, and the body is decoded as before.
+
+    ``content`` is the body as read by `read_capped`; the response supplies
+    the headers.
     """
     # Imported here so the helper stays one self-contained block of this file.
     import codecs
     import re
     from html.parser import HTMLParser
 
-    content = response.content
     media_type = (
         response.headers.get("content-type", "").split(";", 1)[0].strip().lower()
     )
@@ -430,7 +607,7 @@ def decode_page(response: httpx.Response) -> str:
             (codecs.BOM_UTF8, codecs.BOM_UTF16_LE, codecs.BOM_UTF16_BE)
         )
     ):
-        return response.text
+        return decode_text(response, content)
 
     class MetaCharset(HTMLParser):
         declared: str | None = None
@@ -458,7 +635,7 @@ def handle_starttag(
     scan = MetaCharset()
     scan.feed(content[:1024].decode("latin-1"))
     if scan.declared is None:
-        return response.text
+        return decode_text(response, content)
     try:
         name = codecs.lookup(scan.declared).name
         # A UTF-16/32 declaration in an ASCII-compatible document cannot be
@@ -468,20 +645,20 @@ def handle_starttag(
         # Python codecs that are not web text encodings: decoding a page with
         # them would mangle it rather than fix it.
         if name in ("idna", "punycode", "unicode-escape", "raw-unicode-escape"):
-            return response.text
+            return decode_text(response, content)
         # A declaration found in ASCII bytes is only believable for an
         # ASCII-compatible encoding. UTF-7, HZ and the EBCDIC code pages
         # (cp037, cp500, …) would rewrite the markup itself, so they fail this
         # probe (by a different result or a decode error) and are ignored.
         probe = b"\t\n\r" + bytes(range(0x20, 0x7F))
         if probe.decode(name) != probe.decode("ascii"):
-            return response.text
+            return decode_text(response, content)
         return content.decode(name, errors="replace")
     except (LookupError, ValueError):  # UnicodeError is a ValueError
         # An unknown charset, a name Python refuses outright (one holding a
         # NUL), a non-text codec (base64, rot13, …), one that refuses to
         # decode at all (``undefined``), or one the probe cannot decode.
-        return response.text
+        return decode_text(response, content)
 
 
 async def check_may_autonomously_fetch_url(
@@ -507,24 +684,25 @@ async def check_may_autonomously_fetch_url(
             hooks.append(_refuse_private_destination)
         client.event_hooks = {"request": hooks}
         try:
-            response = await client.get(
-                robot_txt_url,
-                follow_redirects=True,
-                headers={"User-Agent": user_agent},
-            )
+            async with stream_get(client, robot_txt_url, user_agent) as response:
+                # A 5xx robots.txt is "unreachable" (RFC 9309 section 2.3.1.4),
+                # which means complete disallow: the error page is never parsed
+                # as rules.
+                if response.status_code in (401, 403) or response.status_code >= 500:
+                    raise ToolError(
+                        f"When fetching robots.txt ({robot_txt_url}), received status {response.status_code} so assuming that autonomous fetching is not allowed, the user can try manually fetching by using the fetch prompt"
+                    )
+                elif 400 <= response.status_code < 500:
+                    return
+                # Read up to the same cap as a page (#5370). RFC 9309 section
+                # 2.5 lets a crawler stop parsing past a limit of at least
+                # 500 KiB, so the rules in the first part are used as they are.
+                content, _ = await read_capped(response, MAX_RESPONSE_BYTES)
         except HTTPError:
             raise ToolError(
                 f"Failed to fetch robots.txt {robot_txt_url} due to a connection issue"
             )
-        # A 5xx robots.txt is "unreachable" (RFC 9309 section 2.3.1.4), which
-        # means complete disallow: the error page is never parsed as rules.
-        if response.status_code in (401, 403) or response.status_code >= 500:
-            raise ToolError(
-                f"When fetching robots.txt ({robot_txt_url}), received status {response.status_code} so assuming that autonomous fetching is not allowed, the user can try manually fetching by using the fetch prompt"
-            )
-        elif 400 <= response.status_code < 500:
-            return
-        robot_txt = response.text
+        robot_txt = decode_text(response, content)
     processed_robot_txt = "\n".join(
         line for line in robot_txt.splitlines() if not line.strip().startswith("#")
     )
@@ -609,25 +787,34 @@ async def _check_redirect_robots_txt(request: httpx.Request) -> None:
         # default representation (a page's HTML), as before this negotiation.
         if not force_raw:
             client.headers["Accept"] = MARKDOWN_ACCEPT
+        too_large = (
+            f"Failed to fetch {url}: the response body is larger than the "
+            f"{MAX_RESPONSE_BYTES} byte limit this server reads"
+        )
         try:
-            response = await client.get(
-                url,
-                follow_redirects=True,
-                headers={"User-Agent": user_agent},
-                timeout=timeout_ms / 1000,
-            )
+            async with stream_get(
+                client, url, user_agent, timeout=timeout_ms / 1000
+            ) as response:
+                if response.status_code >= 400:
+                    raise ToolError(
+                        f"Failed to fetch {url} - status code {response.status_code}"
+                    )
+                # Refused before reading anything when the size is declared;
+                # otherwise the streamed read stops at the cap (#5370).
+                length = declared_length(response)
+                if length is not None and length > MAX_RESPONSE_BYTES:
+                    raise ToolError(f"{too_large} (it declares {length} bytes)")
+                content, truncated = await read_capped(response, MAX_RESPONSE_BYTES)
+                if truncated:
+                    raise ToolError(too_large)
         except httpx.TimeoutException as e:
             raise ToolError(
                 f"Failed to fetch {url}: timed out after {timeout_ms} ms: {e!r}"
             )
         except HTTPError as e:
             raise ToolError(f"Failed to fetch {url}: {e!r}")
-        if response.status_code >= 400:
-            raise ToolError(
-                f"Failed to fetch {url} - status code {response.status_code}"
-            )
 
-        page_raw = decode_page(response)
+        page_raw = decode_page(response, content)
 
     content_type = response.headers.get("content-type", "")
     # Markdown is already what this tool returns, so it is not simplified, and
 
@@ -66,10 +66,21 @@ def handle(self, request: httpx.Request) -> httpx.Response:
         self.requests.append(request)
         responder = self.routes.get(str(request.url))
         if responder is None:
-            return httpx.Response(404, content=b"no route in FakeWeb")
-        if isinstance(responder, httpx.Response):
-            return responder
-        return responder(request)
+            response = httpx.Response(404, content=b"no route in FakeWeb")
+        elif isinstance(responder, httpx.Response):
+            response = responder
+        else:
+            response = responder(request)
+        # Served unread, as from the network. `httpx.Response(content=...)`
+        # reads (and decodes) its body when it is built, which leaves nothing
+        # for the server's raw, capped read (#5370); its stream still holds the
+        # bytes as given, so a fresh response over that stream is the wire form.
+        return httpx.Response(
+            response.status_code,
+            headers=response.headers,
+            stream=response.stream,
+            extensions=response.extensions,
+        )
 
     def urls(self) -> list[str]:
         return [str(r.url) for r in self.requests]