Align request-body limit with the MCP SDK default

The middleware default was an arbitrary 10 MiB, above the 4 MiB the SDK
already enforces, so it never changed which requests were accepted.
Alias mcp.DefaultMaxRequestBodyBytes instead, making the earlier
enforcement point behaviour-preserving by construction.

Also pass the effective limit to StreamableHTTPOptions. Previously the
SDK kept its own 4 MiB default, so a larger configured
MaxRequestBodyBytes was silently capped; both layers now agree.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/http/handler.go

@@ -132,8 +132,7 @@ func NewHTTPMcpHandler(
 
 func (h *Handler) RegisterMiddleware(r chi.Router) {
 	r.Use(
-		// Must run first: bounds the request body before any other
-		// middleware (or the MCP SDK) reads or buffers it.
+		// Must run first: bounds the body before anything downstream reads it.
 		middleware.WithMaxBodySize(h.maxRequestBodyBytes()),
 		middleware.ExtractUserToken(h.oauthCfg),
 		middleware.WithRequestConfig,
@@ -146,8 +145,8 @@ func (h *Handler) RegisterMiddleware(r chi.Router) {
 	}
 }
 
-// maxRequestBodyBytes returns the configured request-body size limit, or
-// middleware.DefaultMaxRequestBodyBytes if none was configured.
+// maxRequestBodyBytes returns the effective request-body size limit, applied
+// both by the early middleware and by the MCP SDK handler.
 func (h *Handler) maxRequestBodyBytes() int64 {
 	if h.config != nil && h.config.MaxRequestBodyBytes > 0 {
 		return h.config.MaxRequestBodyBytes
@@ -251,6 +250,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return ghServer
 	}, &mcp.StreamableHTTPOptions{
 		Stateless: true,
+		// Keep the SDK's own guard in step with the middleware, otherwise its
+		// default would silently cap a larger configured limit.
+		MaxRequestBodyBytes: h.maxRequestBodyBytes(),
 	})
 
 	mcpHandler.ServeHTTP(w, r)

pkg/http/handler_test.go

@@ -3,6 +3,7 @@ package http
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
@@ -1288,11 +1289,23 @@ func TestUIMetaStrippedWhenClientLacksCapability(t *testing.T) {
 	require.NotNil(t, unknown[0].Tool.Meta["ui"], "_meta.ui should be preserved when capability is unknown and FF is on")
 }
 
-// TestRegisterMiddleware_MaxRequestBodySize verifies that RegisterMiddleware
-// wires the body-size limit ahead of the body-consuming middleware, so an
-// oversized request never reaches the MCP server, and that requests within
-// the configured limit (including exactly at the boundary) still succeed.
-func TestRegisterMiddleware_MaxRequestBodySize(t *testing.T) {
+// TestMaxRequestBodyBytes checks the effective limit tracks the MCP SDK
+// default and honours an operator override.
+func TestMaxRequestBodyBytes(t *testing.T) {
+	t.Run("defaults to the MCP SDK limit", func(t *testing.T) {
+		h := &Handler{config: &ServerConfig{}}
+		assert.Equal(t, int64(mcp.DefaultMaxRequestBodyBytes), h.maxRequestBodyBytes())
+	})
+
+	t.Run("configured value overrides the default", func(t *testing.T) {
+		h := &Handler{config: &ServerConfig{MaxRequestBodyBytes: 1234}}
+		assert.Equal(t, int64(1234), h.maxRequestBodyBytes())
+	})
+}
+
+// TestMaxRequestBodySizeEnforcement exercises both layers the limit is applied
+// at: the early middleware, and the MCP SDK handler the request is delegated to.
+func TestMaxRequestBodySizeEnforcement(t *testing.T) {
 	const limit = 256
 
 	apiHost, err := utils.NewAPIHost("https://api.github.com")
@@ -1307,9 +1320,9 @@ func TestRegisterMiddleware_MaxRequestBodySize(t *testing.T) {
 		return strings.Replace(payload, "PADDING", "PADDING"+pad, 1)
 	}
 
-	newHandler := func(t *testing.T, mcpServerFactoryCalled *bool) http.Handler {
+	newHandler := func(t *testing.T, mcpServerFactoryCalled *bool) *Handler {
 		t.Helper()
-		handler := NewHTTPMcpHandler(
+		return NewHTTPMcpHandler(
 			context.Background(),
 			&ServerConfig{Version: "test", MaxRequestBodyBytes: limit},
 			nil,
@@ -1327,47 +1340,63 @@ func TestRegisterMiddleware_MaxRequestBodySize(t *testing.T) {
 			}),
 			WithScopeFetcher(allScopesFetcher{}),
 		)
+	}
 
+	newRouter := func(h *Handler) http.Handler {
 		r := chi.NewRouter()
-		handler.RegisterMiddleware(r)
-		handler.RegisterRoutes(r)
+		h.RegisterMiddleware(r)
+		h.RegisterRoutes(r)
 		return r
 	}
 
-	t.Run("oversized request is rejected before reaching the MCP server", func(t *testing.T) {
+	newRequest := func(body string) *http.Request {
+		req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		req.Header.Set(headers.ContentTypeHeader, headers.ContentTypeJSON)
+		req.Header.Set(headers.AcceptHeader, strings.Join([]string{headers.ContentTypeJSON, headers.ContentTypeEventStream}, ", "))
+		req.Header.Set(headers.AuthorizationHeader, strings.Join([]string{"ghs", "test-token"}, "_"))
+		return req
+	}
+
+	t.Run("middleware rejects an oversized request before the MCP server is built", func(t *testing.T) {
 		var mcpServerFactoryCalled bool
-		r := newHandler(t, &mcpServerFactoryCalled)
+		r := newRouter(newHandler(t, &mcpServerFactoryCalled))
 
 		body := buildBody(limit + 1)
 		require.Greater(t, len(body), limit)
 
-		req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
-		req.Header.Set(headers.AuthorizationHeader, strings.Join([]string{"ghs", "test-token"}, "_"))
-
 		rr := httptest.NewRecorder()
-		r.ServeHTTP(rr, req)
+		r.ServeHTTP(rr, newRequest(body))
 
 		assert.Equal(t, http.StatusRequestEntityTooLarge, rr.Code)
 		assert.Contains(t, rr.Body.String(), "request body too large")
 		assert.False(t, mcpServerFactoryCalled, "the MCP server should never be constructed for an oversized request")
 	})
 
-	t.Run("boundary-size request at the configured limit succeeds", func(t *testing.T) {
+	t.Run("request at the configured limit succeeds", func(t *testing.T) {
 		var mcpServerFactoryCalled bool
-		r := newHandler(t, &mcpServerFactoryCalled)
+		r := newRouter(newHandler(t, &mcpServerFactoryCalled))
 
 		body := buildBody(limit)
 		require.Len(t, body, limit)
 
-		req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
-		req.Header.Set(headers.ContentTypeHeader, headers.ContentTypeJSON)
-		req.Header.Set(headers.AcceptHeader, strings.Join([]string{headers.ContentTypeJSON, headers.ContentTypeEventStream}, ", "))
-		req.Header.Set(headers.AuthorizationHeader, strings.Join([]string{"ghs", "test-token"}, "_"))
-
 		rr := httptest.NewRecorder()
-		r.ServeHTTP(rr, req)
+		r.ServeHTTP(rr, newRequest(body))
 
 		assert.Equal(t, http.StatusOK, rr.Code, "response body: %s", rr.Body.String())
 		assert.True(t, mcpServerFactoryCalled, "the MCP server should be constructed for an allowed request")
 	})
+
+	t.Run("SDK handler enforces the configured limit when the middleware is bypassed", func(t *testing.T) {
+		h := newHandler(t, nil)
+
+		body := buildBody(limit + 1)
+		require.Greater(t, len(body), limit)
+
+		rr := httptest.NewRecorder()
+		h.ServeHTTP(rr, newRequest(body))
+
+		assert.Equal(t, http.StatusRequestEntityTooLarge, rr.Code)
+		assert.Contains(t, rr.Body.String(), fmt.Sprintf("request body exceeds %d bytes", limit),
+			"the SDK should report the configured limit, not its own default")
+	})
 }

pkg/http/middleware/body_limit.go

@@ -3,24 +3,22 @@ package middleware
 import (
 	"errors"
 	"net/http"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
-// DefaultMaxRequestBodyBytes bounds the size of HTTP request bodies accepted
-// by the MCP endpoints when no explicit limit is configured.
-const DefaultMaxRequestBodyBytes int64 = 10 << 20 // 10 MiB
+// DefaultMaxRequestBodyBytes tracks the MCP SDK's own request-body limit, so
+// enforcing it earlier in the chain does not change which requests are accepted.
+const DefaultMaxRequestBodyBytes int64 = mcp.DefaultMaxRequestBodyBytes
 
-// WithMaxBodySize returns middleware that bounds the size of the request
-// body. It must be registered before any middleware that reads or buffers
-// the body (e.g. WithMCPParse, WithScopeChallenge) so that an oversized
-// payload is rejected before it is ever fully buffered in memory, rather than
-// relying on a size guard applied later by the MCP SDK or a downstream
-// handler.
+// WithMaxBodySize bounds the size of the request body. It must be registered
+// before any middleware that reads or buffers the body (WithMCPParse,
+// WithScopeChallenge), so an oversized payload is rejected before it is
+// buffered in memory rather than by a later guard in the MCP SDK.
 //
-// When Content-Length is known and already exceeds maxBytes, the request is
-// rejected immediately without touching the body. Otherwise the body is
-// wrapped with http.MaxBytesReader, so any subsequent read (including
-// chunked or unknown-length bodies) fails with a *http.MaxBytesError once
-// maxBytes have been consumed.
+// A body of unknown length (chunked, HTTP/2) cannot be rejected upfront, so
+// the limit is instead enforced on read and surfaces as a *http.MaxBytesError
+// to whichever middleware reads the body first.
 func WithMaxBodySize(maxBytes int64) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -38,16 +36,10 @@ func WithMaxBodySize(maxBytes int64) func(http.Handler) http.Handler {
 	}
 }
 
-// writeRequestTooLarge writes the standard "request body too large" response.
-// Every middleware that reads the request body should use this so oversized
-// requests get a consistent, clear response regardless of which layer
-// detects the overflow.
 func writeRequestTooLarge(w http.ResponseWriter) {
 	http.Error(w, "request body too large", http.StatusRequestEntityTooLarge)
 }
 
-// isMaxBytesError reports whether err resulted from a body exceeding the
-// limit applied by WithMaxBodySize, as opposed to some other read failure.
 func isMaxBytesError(err error) bool {
 	var maxBytesErr *http.MaxBytesError
 	return errors.As(err, &maxBytesErr)

pkg/http/middleware/body_limit_test.go

@@ -11,9 +11,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// unknownLengthBody wraps a reader without exposing a Len method, so
-// httptest.NewRequest cannot infer Content-Length from it. This mirrors a
-// chunked-transfer-encoded request, where the body size is unknown upfront.
+// unknownLengthBody hides Len from httptest.NewRequest so ContentLength is -1,
+// as it is for a chunked or HTTP/2 request.
 func unknownLengthBody(s string) io.Reader {
 	return io.NopCloser(strings.NewReader(s))
 }

pkg/http/middleware/mcp_parse_test.go

@@ -190,11 +190,8 @@ func TestWithMCPParse_BodyRestoration(t *testing.T) {
 	assert.Equal(t, originalBody, capturedBody, "body should be restored for downstream handlers")
 }
 
-// TestWithMCPParse_WithMaxBodySize composes the body-size limit with
-// WithMCPParse, mirroring the production middleware ordering where
-// WithMaxBodySize runs first. It verifies that an oversized body is rejected
-// with a clear 413 before parsing runs, while requests within the limit
-// (including exactly at the boundary) still parse and preserve the body.
+// TestWithMCPParse_WithMaxBodySize mirrors the production middleware ordering,
+// where WithMaxBodySize runs ahead of WithMCPParse.
 func TestWithMCPParse_WithMaxBodySize(t *testing.T) {
 	const limit = 128
 
@@ -203,7 +200,6 @@ func TestWithMCPParse_WithMaxBodySize(t *testing.T) {
 		if len(payload) >= size {
 			return payload
 		}
-		// Pad the JSON with a longer string value so we can hit an exact byte size.
 		pad := strings.Repeat("x", size-len(payload))
 		return strings.Replace(payload, "PADDING", "PADDING"+pad, 1)
 	}
@@ -219,11 +215,8 @@ func TestWithMCPParse_WithMaxBodySize(t *testing.T) {
 
 		handler := WithMaxBodySize(limit)(WithMCPParse()(nextHandler))
 
-		// Use an unknown-length body so WithMaxBodySize can't reject the
-		// request via its known-Content-Length fast path (already covered by
-		// body_limit_test.go). This forces the request through to
-		// WithMCPParse's own io.ReadAll call, exercising its *http.MaxBytesError
-		// handling.
+		// An unknown length skips WithMaxBodySize's Content-Length fast path,
+		// so the overflow surfaces from WithMCPParse's own read.
 		req := httptest.NewRequest(http.MethodPost, "/mcp", unknownLengthBody(body))
 		require.Equal(t, int64(-1), req.ContentLength, "test setup: Content-Length should be unknown")
 

pkg/http/middleware/scope_challenge_test.go

@@ -14,11 +14,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestWithScopeChallenge_MaxBodySize verifies the fallback body-parsing path
-// (used when WithMCPParse has not already populated MCPMethodInfo in
-// context) respects the request-body size limit and returns a clear 413
-// instead of silently continuing, when composed with WithMaxBodySize as it
-// is in production.
+// TestWithScopeChallenge_MaxBodySize covers the fallback body-parsing path,
+// used when WithMCPParse has not already populated MCPMethodInfo in context.
 func TestWithScopeChallenge_MaxBodySize(t *testing.T) {
 	const limit = 64
 	oauthCfg := &oauth.Config{}
@@ -48,11 +45,8 @@ func TestWithScopeChallenge_MaxBodySize(t *testing.T) {
 
 		handler := WithMaxBodySize(limit)(WithScopeChallenge(oauthCfg, fetcher)(next))
 
-		// Use an unknown-length body so WithMaxBodySize can't reject the
-		// request via its known-Content-Length fast path (already covered by
-		// body_limit_test.go). This forces the request through to
-		// WithScopeChallenge's fallback io.ReadAll call, exercising its
-		// *http.MaxBytesError handling.
+		// An unknown length skips WithMaxBodySize's Content-Length fast path,
+		// so the overflow surfaces from the fallback read.
 		req := newRequestWithBody(unknownLengthBody(body))
 		require.Equal(t, int64(-1), req.ContentLength, "test setup: Content-Length should be unknown")
 

pkg/http/server.go

@@ -109,8 +109,7 @@ type ServerConfig struct {
 	MRTRStateKey string
 
 	// MaxRequestBodyBytes bounds the size of HTTP request bodies accepted by
-	// the MCP endpoints, enforced before any middleware reads or buffers the
-	// body. When zero, middleware.DefaultMaxRequestBodyBytes is used.
+	// the MCP endpoints. When zero, middleware.DefaultMaxRequestBodyBytes is used.
 	MaxRequestBodyBytes int64
 
 	disableDeleteRepository bool