Summary
McpToolHandlers.TryGetValidatedMaxLineWidth and adjacent input handlers (McpToolHandlers.cs:124-150) validate numeric bounds on individual fields but do not enforce a top-level payload size cap, nor a maximum JSON nesting depth, nor a maximum array length on collection fields. A malicious or buggy client can send a 100 MB JSON payload, a 100-level-deep nested object, or a 10M-element string array, and System.Text.Json parses the lot before the per-field validator rejects anything. The blast radius is process-wide memory pressure.
Where
src/CodeIndex/Mcp/McpToolHandlers.cs:124-150 (per-field validators)src/CodeIndex/Mcp/McpServer.cs (request entry — no global size guard)
Suggested approach
(1) Set JsonReaderOptions.MaxDepth = 32 (or a configured value) on the deserializer so deep recursion is rejected at parse time. (2) Cap the request line length at CDIDX_MCP_MAX_REQUEST_BYTES=1048576 (1 MiB) by default; reject longer lines with -32700 Parse Error before deserialization. (3) For each tool whose schema allows arrays, declare an explicit maxItems and validate post-parse with -32602 Invalid Params on overflow. (4) Surface the configured limits in status --json under mcp.limits. (5) Cover with regression tests that send a 10 MiB request, a 100-level-deep request, and a 1M-array request, and assert all three are rejected with a clear error rather than OOM-ing.
Summary
McpToolHandlers.TryGetValidatedMaxLineWidthand adjacent input handlers (McpToolHandlers.cs:124-150) validate numeric bounds on individual fields but do not enforce a top-level payload size cap, nor a maximum JSON nesting depth, nor a maximum array length on collection fields. A malicious or buggy client can send a 100 MB JSON payload, a 100-level-deep nested object, or a 10M-element string array, andSystem.Text.Jsonparses the lot before the per-field validator rejects anything. The blast radius is process-wide memory pressure.Where
src/CodeIndex/Mcp/McpToolHandlers.cs:124-150(per-field validators)src/CodeIndex/Mcp/McpServer.cs(request entry — no global size guard)Suggested approach
(1) Set
JsonReaderOptions.MaxDepth = 32(or a configured value) on the deserializer so deep recursion is rejected at parse time. (2) Cap the request line length atCDIDX_MCP_MAX_REQUEST_BYTES=1048576(1 MiB) by default; reject longer lines with-32700 Parse Errorbefore deserialization. (3) For each tool whose schema allows arrays, declare an explicitmaxItemsand validate post-parse with-32602 Invalid Paramson overflow. (4) Surface the configured limits instatus --jsonundermcp.limits. (5) Cover with regression tests that send a 10 MiB request, a 100-level-deep request, and a 1M-array request, and assert all three are rejected with a clear error rather than OOM-ing.