Add Streamable HTTP request body limits - #3095
Merged
Merged
Claude / Claude Code Review
completed
Jul 15, 2026 in 9m 39s
Code review found 2 important issues
Found 5 candidates, confirmed 3. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 1 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟣 Pre-existing | src/mcp/server/streamable_http_manager.py:374-375 |
SSE transport POST endpoint still has no request-body size limit (pre-existing) |
Annotations
Check notice on line 375 in src/mcp/server/streamable_http_manager.py
claude / Claude Code Review
SSE transport POST endpoint still has no request-body size limit (pre-existing)
Pre-existing issue, not introduced by this PR: the legacy SSE transport's POST endpoint (`SseServerTransport.handle_post_message`, `src/mcp/server/sse.py:243`) still buffers the entire request body unbounded via `await request.body()` — the same DoS vector this PR closes for Streamable HTTP. Since the new `RequestBodyLimitMiddleware` is a generic ASGI wrapper, applying it to the SSE message endpoint would be a natural one-line follow-up (or the docs could note explicitly that the limit covers St
Loading