Follow-up to the MCP stdio transport shipped in v1.3.0.
Problem
The two MCP transports disagree about whether an MCP server is trusted with gateway memory.
- HTTP treats it as an untrusted-content boundary and enforces a 10 MiB cap (
internal/mcp/client.go, documented at the top of the file).
- stdio delegates to
bufio.Reader.ReadString('\n') with no limit (internal/mcp/stdio.go), then JSON round-trips the result twice on the way back — roughly 3× peak memory of the payload.
So a local MCP server returning an oversized tool result can exhaust gateway memory, on a path where the identical threat is already defended one file over. A local MCP server is at least as untrusted as a remote one — it is arbitrary local code.
Fix
Apply an equivalent bound to the stdio read path. Match the existing 10 MiB convention, and consider making it configurable per server rather than hard-coded, since legitimately large results (file contents, query dumps) are plausible for local servers.
Release shape
Patch-eligible, with direct precedent: v1.1.19 — a patch — added the 50 MiB cap on upstream provider responses for the same reason. This closes an asymmetry rather than adding a feature.
Note that it will make previously-working oversized results start failing. That is the intended behaviour, but it should be called out in the changelog.
Follow-up to the MCP stdio transport shipped in v1.3.0.
Problem
The two MCP transports disagree about whether an MCP server is trusted with gateway memory.
internal/mcp/client.go, documented at the top of the file).bufio.Reader.ReadString('\n')with no limit (internal/mcp/stdio.go), then JSON round-trips the result twice on the way back — roughly 3× peak memory of the payload.So a local MCP server returning an oversized tool result can exhaust gateway memory, on a path where the identical threat is already defended one file over. A local MCP server is at least as untrusted as a remote one — it is arbitrary local code.
Fix
Apply an equivalent bound to the stdio read path. Match the existing 10 MiB convention, and consider making it configurable per server rather than hard-coded, since legitimately large results (file contents, query dumps) are plausible for local servers.
Release shape
Patch-eligible, with direct precedent: v1.1.19 — a patch — added the 50 MiB cap on upstream provider responses for the same reason. This closes an asymmetry rather than adding a feature.
Note that it will make previously-working oversized results start failing. That is the intended behaviour, but it should be called out in the changelog.