@farming-labs/docs 0.2.124 → 0.2.125

package/dist/mcp.d.mts

@@ -254,6 +254,8 @@ interface DocsMcpResolvedSecurityConfig {
   authenticate?: DocsMcpAuthenticate;
   protectedResource?: DocsMcpResolvedProtectedResourceConfig;
   maxBodyBytes: number;
+  /** Optional for manually constructed resolved configs from older releases. */
+  maxToolInputElements?: number;
   cors: DocsMcpResolvedCorsConfig;
 }
 interface DocsMcpResolvedProtectedResourceConfig {
@@ -364,6 +366,7 @@ declare const DOCS_MCP_CONTENT_CHANGES_CURRENT_URI = "docs://changes/current";
 declare const DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE = "docs://changes/{generation}";
 declare const DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS = 30000;
 declare const DEFAULT_DOCS_MCP_MAX_BODY_BYTES: number;
+declare const DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS = 10000;
 declare const DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS = 600;
 declare const DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS: readonly string[];
 declare const DEFAULT_DOCS_MCP_CORS_EXPOSED_HEADERS: readonly string[];
@@ -385,4 +388,4 @@ declare function getDocsConfigSchema(filters?: {
 }): DocsMcpConfigSchema;
 declare function buildDocsMcpContext(options: DocsMcpContextOptions): Promise<DocsMcpContextResult>;
 //#endregion
-export { CreateDocsMcpServerOptions, DEFAULT_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS, DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS, DEFAULT_DOCS_MCP_CORS_EXPOSED_HEADERS, DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS, DEFAULT_DOCS_MCP_MAX_BODY_BYTES, DOCS_CONFIG_SCHEMA_OPTIONS, DOCS_CONTENT_CHANGE_HYDRATION_FORMAT, DOCS_MCP_CONTENT_CHANGES_CURRENT_URI, DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE, type DocsContentChangeHydrationBudget, type DocsContentChangeHydrationContent, type DocsContentChangeHydrationResponse, type DocsContentChangeHydrationSection, type DocsContentChangeHydrationTombstone, DocsMcpAgentContractSummary, DocsMcpApiReferenceSource, DocsMcpCodeExample, DocsMcpConfigSchema, DocsMcpConfigSchemaOption, DocsMcpContextOptions, DocsMcpContextResult, DocsMcpContextSource, DocsMcpDocsList, DocsMcpDocsPageSummary, DocsMcpDocsSection, DocsMcpFolderNode, DocsMcpHttpHandlers, DocsMcpNavigationNode, DocsMcpNavigationTree, DocsMcpPage, DocsMcpPageNode, DocsMcpPageSectionIndex, DocsMcpPageSectionList, DocsMcpPaginatedDocsList, DocsMcpPagination, DocsMcpRequestContext, DocsMcpResolvedConfig, DocsMcpResolvedCorsConfig, DocsMcpResolvedPromptsConfig, DocsMcpResolvedProtectedResourceConfig, DocsMcpResolvedSecurityConfig, DocsMcpSource, DocsMcpTaskSummary, type HydrateDocsContentChangesOptions, MAX_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, MIN_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, buildDocsMcpContext, createDocsMcpHttpHandler, createDocsMcpServer, createFilesystemDocsMcpSource, getDocsConfigSchema, hydrateDocsContentChanges, normalizeDocsMcpRoute, resolveDocsMcpConfig, resolveDocsMcpPromptsConfig, runDocsMcpStdio };
+export { CreateDocsMcpServerOptions, DEFAULT_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS, DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS, DEFAULT_DOCS_MCP_CORS_EXPOSED_HEADERS, DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS, DEFAULT_DOCS_MCP_MAX_BODY_BYTES, DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS, DOCS_CONFIG_SCHEMA_OPTIONS, DOCS_CONTENT_CHANGE_HYDRATION_FORMAT, DOCS_MCP_CONTENT_CHANGES_CURRENT_URI, DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE, type DocsContentChangeHydrationBudget, type DocsContentChangeHydrationContent, type DocsContentChangeHydrationResponse, type DocsContentChangeHydrationSection, type DocsContentChangeHydrationTombstone, DocsMcpAgentContractSummary, DocsMcpApiReferenceSource, DocsMcpCodeExample, DocsMcpConfigSchema, DocsMcpConfigSchemaOption, DocsMcpContextOptions, DocsMcpContextResult, DocsMcpContextSource, DocsMcpDocsList, DocsMcpDocsPageSummary, DocsMcpDocsSection, DocsMcpFolderNode, DocsMcpHttpHandlers, DocsMcpNavigationNode, DocsMcpNavigationTree, DocsMcpPage, DocsMcpPageNode, DocsMcpPageSectionIndex, DocsMcpPageSectionList, DocsMcpPaginatedDocsList, DocsMcpPagination, DocsMcpRequestContext, DocsMcpResolvedConfig, DocsMcpResolvedCorsConfig, DocsMcpResolvedPromptsConfig, DocsMcpResolvedProtectedResourceConfig, DocsMcpResolvedSecurityConfig, DocsMcpSource, DocsMcpTaskSummary, type HydrateDocsContentChangesOptions, MAX_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, MIN_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, buildDocsMcpContext, createDocsMcpHttpHandler, createDocsMcpServer, createFilesystemDocsMcpSource, getDocsConfigSchema, hydrateDocsContentChanges, normalizeDocsMcpRoute, resolveDocsMcpConfig, resolveDocsMcpPromptsConfig, runDocsMcpStdio };

package/dist/mcp.mjs

@@ -62,6 +62,7 @@ const DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE = "docs://changes/{generation}";
 const DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS = 3e4;
 const UTF8_ENCODER = new TextEncoder();
 const DEFAULT_DOCS_MCP_MAX_BODY_BYTES = 1024 * 1024;
+const DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS = 1e4;
 const DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS = 600;
 const DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS = Object.freeze([
 	"Accept",
@@ -1767,6 +1768,13 @@ const DOCS_CONFIG_SCHEMA_OPTIONS_TEMPLATE = [
 						default: DEFAULT_DOCS_MCP_MAX_BODY_BYTES,
 						description: "Maximum accepted Streamable HTTP POST body size in bytes."
 					},
+					{
+						path: "mcp.security.maxToolInputElements",
+						name: "maxToolInputElements",
+						type: "number",
+						default: DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS,
+						description: "Maximum total array items and object keys in Streamable HTTP tool arguments, checked before schema validation. Does not affect stdio."
+					},
 					{
 						path: "mcp.security.cors",
 						name: "cors",
@@ -2962,11 +2970,14 @@ function normalizeDocsMcpPromptSelectorList(value, configPath) {
 function resolveDocsMcpSecurityConfig(security) {
 	const configuredMaxBodyBytes = security?.maxBodyBytes;
 	const maxBodyBytes = typeof configuredMaxBodyBytes === "number" && Number.isFinite(configuredMaxBodyBytes) && configuredMaxBodyBytes > 0 ? Math.floor(configuredMaxBodyBytes) : DEFAULT_DOCS_MCP_MAX_BODY_BYTES;
+	const configuredMaxToolInputElements = security?.maxToolInputElements;
+	const maxToolInputElements = typeof configuredMaxToolInputElements === "number" && Number.isSafeInteger(Math.floor(configuredMaxToolInputElements)) && configuredMaxToolInputElements >= 1 ? Math.floor(configuredMaxToolInputElements) : DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS;
 	return {
 		allowedOrigins: security?.allowedOrigins ?? "same-origin",
 		authenticate: security?.authenticate,
 		protectedResource: resolveDocsMcpProtectedResourceConfig(security?.protectedResource),
 		maxBodyBytes,
+		maxToolInputElements,
 		cors: resolveDocsMcpCorsConfig(security?.cors)
 	};
 }
@@ -3387,32 +3398,35 @@ async function createDocsMcpServer(options) {
 	const server = new McpServer({
 		name: resolved.name,
 		version: resolved.version
-	}, { cacheHints: {
-		"server/discover": {
-			ttlMs: DOCS_MCP_DISCOVERY_CACHE_TTL_MS,
-			cacheScope
-		},
-		"tools/list": {
-			ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
-			cacheScope
-		},
-		"prompts/list": {
-			ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
-			cacheScope
-		},
-		"resources/list": {
-			ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
-			cacheScope
-		},
-		"resources/templates/list": {
-			ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
-			cacheScope
-		},
-		"resources/read": {
-			ttlMs: DOCS_MCP_RESOURCE_CACHE_TTL_MS,
-			cacheScope
+	}, {
+		...options.requestContext?.transport === "http" ? { maxToolInputElements: resolved.security?.maxToolInputElements ?? DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS } : {},
+		cacheHints: {
+			"server/discover": {
+				ttlMs: DOCS_MCP_DISCOVERY_CACHE_TTL_MS,
+				cacheScope
+			},
+			"tools/list": {
+				ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
+				cacheScope
+			},
+			"prompts/list": {
+				ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
+				cacheScope
+			},
+			"resources/list": {
+				ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
+				cacheScope
+			},
+			"resources/templates/list": {
+				ttlMs: DOCS_MCP_LIST_CACHE_TTL_MS,
+				cacheScope
+			},
+			"resources/read": {
+				ttlMs: DOCS_MCP_RESOURCE_CACHE_TTL_MS,
+				cacheScope
+			}
 		}
-	} });
+	});
 	installDocsMcpSdkRegistrationPagination(server, protocolScope);
 	if (contentChangesEnabled) server.server.registerCapabilities({ resources: { subscribe: true } });
 	const registerResource = (name, uri, metadata, callback) => {
@@ -7149,4 +7163,4 @@ function toPageResourceUri(url) {
 }
 
 //#endregion
-export { DEFAULT_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS, DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS, DEFAULT_DOCS_MCP_CORS_EXPOSED_HEADERS, DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS, DEFAULT_DOCS_MCP_MAX_BODY_BYTES, DOCS_CONFIG_SCHEMA_OPTIONS, DOCS_CONTENT_CHANGE_HYDRATION_FORMAT, DOCS_MCP_CONTENT_CHANGES_CURRENT_URI, DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE, MAX_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, MIN_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, buildDocsMcpContext, createDocsMcpHttpHandler, createDocsMcpServer, createFilesystemDocsMcpSource, getDocsConfigSchema, hydrateDocsContentChanges, normalizeDocsMcpRoute, resolveDocsMcpConfig, resolveDocsMcpPromptsConfig, runDocsMcpStdio };
+export { DEFAULT_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, DEFAULT_DOCS_MCP_CONTENT_CHANGE_POLL_INTERVAL_MS, DEFAULT_DOCS_MCP_CORS_ALLOWED_HEADERS, DEFAULT_DOCS_MCP_CORS_EXPOSED_HEADERS, DEFAULT_DOCS_MCP_CORS_MAX_AGE_SECONDS, DEFAULT_DOCS_MCP_MAX_BODY_BYTES, DEFAULT_DOCS_MCP_MAX_TOOL_INPUT_ELEMENTS, DOCS_CONFIG_SCHEMA_OPTIONS, DOCS_CONTENT_CHANGE_HYDRATION_FORMAT, DOCS_MCP_CONTENT_CHANGES_CURRENT_URI, DOCS_MCP_CONTENT_CHANGES_URI_TEMPLATE, MAX_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, MIN_DOCS_CONTENT_CHANGE_HYDRATION_TOKEN_BUDGET, buildDocsMcpContext, createDocsMcpHttpHandler, createDocsMcpServer, createFilesystemDocsMcpSource, getDocsConfigSchema, hydrateDocsContentChanges, normalizeDocsMcpRoute, resolveDocsMcpConfig, resolveDocsMcpPromptsConfig, runDocsMcpStdio };

package/dist/types.d.mts

@@ -1403,6 +1403,8 @@ interface DocsMcpSecurityConfig {
   protectedResource?: DocsMcpProtectedResourceConfig;
   /** Maximum POST body size in bytes. Defaults to 1 MiB. */
   maxBodyBytes?: number;
+  /** Maximum total array items and object keys in HTTP tool arguments. Defaults to 10,000. */
+  maxToolInputElements?: number;
   /**
    * CORS responses for accepted browser Origins. Defaults to enabled with exact-Origin responses;
    * set `false` to suppress CORS headers or use an object for credential/header controls.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farming-labs/docs",
-  "version": "0.2.124",
+  "version": "0.2.125",
   "description": "Modern, flexible MDX-based docs framework — core types, config, and CLI",
   "keywords": [
     "docs",
@@ -97,7 +97,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server": "2.3.0",
     "@scalar/core": "^0.4.3",
     "github-slugger": "^2.0.0",
     "gray-matter": "^4.0.3",