Skip to content

v0.2.2: MCP Production Hardening & Oversized Response Stream Safety

Choose a tag to compare

@HakashiKatake HakashiKatake released this 13 Sep 09:32
· 7 commits to main since this release

🛡️ MCP Production Hardening & Global Safety Guard

  • Configurable Hard Ceiling: Configured default 60,000-character ceiling (~15,000 tokens) on all tool responses via formatToolResponse. Added support for DOCORBIT_MAX_TOOL_OUTPUT_CHARS with safe bounds (clamped between 500 and 120,000 chars).
  • JSON Payload Safety: Oversized JSON responses automatically drop bulky data fields, preserve scalar metadata (query, task, count, etc.), set truncated: true, and clamp inner markdown to guarantee valid JSON under the ceiling.
  • Audited Tool-Level Limits: Bounded content in find_pitfall (≤ 1,500 chars), get_implementation_context (≤ 500 chars), ingest_doc (code ≤ 2,000 chars, pitfalls ≤ 1,500 chars), get_doc (page content ≤ 30,000 chars, chunk ≤ 10,000 chars), find_example (code ≤ 3,000 chars), and search_docs (JSON chunk content ≤ 2,000 chars).
  • Stream & Transport Resilience: Guarded StdioServerTransport.send() with synchronous try/catch, asynchronous write callbacks, and stream error listeners on output, input, and readline to prevent process crashes.
  • Ingestion & Normalizer Hardening: Stopped embedding raw multi-megabyte JSON specs into documentation pages during ingestion; replaced with clean endpoint summaries.
  • Self-Healing Database Migration: Added automatic startup migration in DocOrbitDb.migrate() to purge legacy bloated OpenAPI dump records.
  • Version Alignment: Unified canonical version 0.2.2 across CLI, McpServer, HTTP transport, and package metadata.

🧪 Comprehensive Regression Suite

  • 159 / 159 tests passing (100%).
  • Added end-to-end stdio lifecycle tests verifying 1 MB, 10 MB, and 50 MB payloads, process survival, and subsequent tool call success.
  • Added synchronous/asynchronous stream failure resilience tests.
  • Added 15-tool safety audit in both Markdown and JSON modes.