Repository navigation
MCP response caps: streaming byte limit, JSON depth, manifest size #107
Description
Question
Fix the hardening half of audit finding #4 (high): the daemon downloads each configured MCP response fully into memory, parses it, recursively copies/sorts it, then persists it — with a timeout and concurrency cap but no response-size, JSON-depth, or manifest-size limit — while holding the commit lock (evidence: crates/agenticd/src/mcp.rs:108).
Scope:
- Enforce a small streaming byte limit before parsing; cap JSON depth and total manifest size.
- Regression tests: oversized response rejected before full read; over-deep JSON rejected.
- The HTTPS/allowlist URL-policy half of finding Chunk D (part 1): trigger-based streamer + delta-sized snapshots #4 is deliberately NOT here — it has its own decision ticket.
Resolution records: PR link, chosen limits and where they're configured, test names.
Activity
tonibergholm commentedon Jul 9, 2026
Resolution
Shipped as PR #117 (pending Toni's review/merge per the map's PR gate).
What landed:
McpLimitsenforced infingerprint_one— 1 MiB response cap (Content-Length refusal up front + mid-stream abort for servers that omit/lie about length), JSON depth cap 32 checked post-parse/pre-canonicalise (serde_json's own 128-level recursion limit bounds the parse and the depth walk underneath), 1 MiB cap on the canonical manifest we hash and persist, and 512-byte truncation of error-body excerpts quoted into anyhow chains.fingerprint_one_with_limitsexposes the knobs for tests.Tests: four rejection tests against a local fake server with tiny limits (declared-oversize, undeclared-oversize mid-stream, over-deep, over-large manifest) plus a
json_depthunit test; existing MCP parallelism suite unchanged. Workspace tests, clippy-D warnings, fmt green.Scope note honored: the HTTPS/allowlist URL-policy half of audit finding #4 is untouched — it belongs to the "Decide the MCP URL policy" ticket. Fact for that ticket: limits live in
McpLimitsincrates/agenticd/src/mcp.rs; if the URL policy wants config-surface knobs, extendingMcpLimitsconstruction atDaemonState::openis the natural seam.Cap MCP response size, JSON depth, and manifest size in the fingerpri…