mcp-web-engine 1.0.4 → 1.2.0

package/src/mcp_web_engine/main.py

@@ -0,0 +1,281 @@
+"""
+Main FastAPI Application Gateway & MCP Protocol Handler (SSE & STDIO Modes)
+"""
+import asyncio
+import json
+import os
+import sys
+import time
+from typing import Optional
+
+from fastapi import Depends, FastAPI, Header, HTTPException, Request, Response, status
+from pydantic import ValidationError
+from sse_starlette.sse import EventSourceResponse
+
+from . import __version__
+from . import security as security_module
+from .config import settings
+from .logging_obs import metrics
+from .mcp_protocol import (
+    INTERNAL_ERROR,
+    INVALID_REQUEST,
+    MCP_PROTOCOL_VERSION_2026,
+    MCP_PROTOCOL_VERSION_LEGACY,
+    PARSE_ERROR,
+    is_rpc_notification,
+    make_jsonrpc_error,
+    process_mcp_2025_legacy_stateful,
+    process_mcp_2026_stateless,
+    validate_2026_mcp_headers,
+    validate_rpc_envelope,
+)
+from .mcp_tools import (
+    MCP_TOOL_DEFINITIONS,
+    ExtractMarkdownInput,
+    WebSearchInput,
+    handle_mcp_tool_call,
+)
+from .resource_limits import RequestSizeLimitMiddleware
+from .security import check_rate_limit, verify_api_key, verify_master_api_key
+from .state_store import StateUnavailable
+
+app = FastAPI(
+    title="MCP Web Engine & Search Gateway",
+    description="Self-hostable search, public-page fetch and Markdown extraction. Stdio and HTTP transports.",
+    version=__version__
+)
+
+app.add_middleware(RequestSizeLimitMiddleware)
+
+def _reject_non_finite(value):
+    raise ValueError("Non-finite JSON number")
+
+
+def _load_json(value):
+    return json.loads(value, parse_constant=_reject_non_finite)
+
+@app.get("/health")
+async def health_check():
+    return {
+        "status": "ok",
+        "environment": settings.ENV,
+
+        "mcp_version": MCP_PROTOCOL_VERSION_2026
+    }
+
+@app.get("/v1/metrics")
+async def get_metrics(api_key: str = Depends(verify_master_api_key)):
+    check_rate_limit(api_key)
+    return metrics.get_summary()
+
+@app.get("/v1/beta/telemetry")
+async def get_beta_telemetry(api_key: str = Depends(verify_master_api_key)):
+    check_rate_limit(api_key)
+    if not os.path.exists(security_module.BETA_KEYS_FILE):
+        return {"users_count": 0, "telemetry": {}}
+    try:
+        with open(security_module.BETA_KEYS_FILE, "r", encoding="utf-8") as f:
+            keys = json.load(f)
+        
+        summary = {}
+        for k, v in keys.items():
+            beta_id = v.get("id", "Unknown")
+            usage = metrics.get_beta_telemetry(k)
+            baseline = v.get("telemetry", {}).get("requests", 0)
+            if type(baseline) is not int or baseline < 0:
+                raise ValueError("Invalid legacy usage baseline")
+            usage["admissions"] = usage["requests"] = max(baseline, usage["admissions"])
+            summary[beta_id] = {
+                "id": beta_id,
+                "status": v.get("status"),
+                "limit": v.get("limit"),
+                "telemetry": usage
+            }
+        return {"users_count": len(summary), "telemetry": summary}
+    except (OSError, ValueError, TypeError, AttributeError, StateUnavailable):
+        raise HTTPException(status_code=503, detail={"error": "TELEMETRY_UNAVAILABLE"}) from None
+
+# Custom stateless HTTP compatibility endpoint (POST /v1/mcp).
+@app.post("/v1/mcp")
+async def mcp_2026_stateless_endpoint(
+    request: Request,
+    api_key: str = Depends(verify_api_key),
+    mcp_protocol_version: Optional[str] = Header(None, alias="MCP-Protocol-Version"),
+    mcp_method: Optional[str] = Header(None, alias="Mcp-Method"),
+    mcp_name: Optional[str] = Header(None, alias="Mcp-Name")
+):
+    check_rate_limit(api_key)
+    try:
+        payload = _load_json(await request.body())
+    except Exception:
+        return Response(content=json.dumps(make_jsonrpc_error(None, PARSE_ERROR, "Invalid JSON.")), status_code=400, media_type="application/json")
+
+    if is_rpc_notification(payload):
+        return Response(status_code=202)
+    validate_2026_mcp_headers(mcp_protocol_version, mcp_method, mcp_name, payload)
+
+    res_body, http_status = await process_mcp_2026_stateless(payload, api_key=api_key)
+    
+    headers = {
+        "MCP-Protocol-Version": MCP_PROTOCOL_VERSION_2026,
+        "Mcp-Method": mcp_method,
+        "Content-Type": "application/json"
+    }
+    if mcp_name:
+        headers["Mcp-Name"] = mcp_name
+    
+    return Response(
+        content=json.dumps(res_body, ensure_ascii=False) if res_body else "",
+        status_code=http_status,
+        headers=headers
+    )
+
+# UNCHANGED LEGACY 2025-11-25 STATEFUL ENDPOINT (POST /v1/mcp/legacy)
+@app.post("/v1/mcp/legacy")
+async def mcp_2025_legacy_endpoint(
+    request: Request,
+    api_key: str = Depends(verify_api_key),
+    mcp_session_id: Optional[str] = Header(None, alias="Mcp-Session-Id")
+):
+    check_rate_limit(api_key)
+    try:
+        payload = _load_json(await request.body())
+    except Exception:
+        return Response(content=json.dumps(make_jsonrpc_error(None, PARSE_ERROR, "Invalid JSON.")), status_code=400, media_type="application/json")
+
+    res_body, http_status, out_session_id = await process_mcp_2025_legacy_stateful(payload, mcp_session_id, api_key=api_key)
+    
+    headers = {
+        "MCP-Protocol-Version": MCP_PROTOCOL_VERSION_LEGACY,
+        "Mcp-Session-Id": out_session_id,
+        "Content-Type": "application/json"
+    }
+    
+    return Response(
+        content=json.dumps(res_body, ensure_ascii=False) if res_body else "",
+        status_code=http_status,
+        headers=headers
+    )
+
+# SSE Event Endpoint
+@app.get("/v1/mcp")
+async def mcp_sse_endpoint(
+    request: Request,
+    api_key: str = Depends(verify_api_key)
+):
+    check_rate_limit(api_key)
+
+    async def event_generator():
+        yield {
+            "event": "endpoint",
+            "data": "/v1/mcp"
+        }
+
+    return EventSourceResponse(event_generator())
+
+# Legacy REST Tool Listing Endpoint (Compatibility)
+@app.post("/v1/mcp/tools")
+async def list_mcp_tools(api_key: str = Depends(verify_api_key)):
+    check_rate_limit(api_key)
+    return {"tools": MCP_TOOL_DEFINITIONS}
+
+# Legacy REST Tool Invocation Endpoint (Compatibility)
+@app.post("/v1/mcp/invoke")
+async def invoke_mcp_tool(payload: dict, api_key: str = Depends(verify_api_key)):
+    check_rate_limit(api_key)
+    tool_name = payload.get("tool")
+    arguments = payload.get("arguments", {})
+
+    if not isinstance(tool_name, str) or tool_name not in {tool['name'] for tool in MCP_TOOL_DEFINITIONS} or not isinstance(arguments, dict):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail={"error": "MISSING_TOOL", "message": "Payload must include 'tool' parameter."}
+        )
+
+    start_t = time.time()
+    try:
+        res = await handle_mcp_tool_call(tool_name, arguments)
+        lat = round((time.time() - start_t) * 1000, 2)
+        metrics.record(tool_name, lat, success=True, api_key=api_key)
+        return {"tool": tool_name, "status": "success", "result": res}
+    except ValidationError:
+        lat = round((time.time() - start_t) * 1000, 2)
+        metrics.record(tool_name, lat, success=False, api_key=api_key)
+        raise HTTPException(400, detail={"error": "INVALID_TOOL_ARGUMENTS"}) from None
+    except HTTPException as e:
+        lat = round((time.time() - start_t) * 1000, 2)
+        metrics.record(tool_name, lat, success=False, api_key=api_key)
+        raise e
+    except Exception:
+        lat = round((time.time() - start_t) * 1000, 2)
+        metrics.record(tool_name, lat, success=False, api_key=api_key)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail={"error": "TOOL_EXECUTION_ERROR", "message": "Tool execution failed."}
+        )
+
+# Direct REST Endpoints
+@app.post("/v1/search")
+async def search_endpoint(body: WebSearchInput, api_key: str = Depends(verify_api_key)):
+    result = await invoke_mcp_tool({"tool": "web_search", "arguments": body.model_dump()}, api_key)
+    return result["result"]
+
+@app.post("/v1/extract")
+async def extract_endpoint(body: ExtractMarkdownInput, api_key: str = Depends(verify_api_key)):
+    result = await invoke_mcp_tool({"tool": "extract_markdown", "arguments": body.model_dump()}, api_key)
+    return result["result"]
+
+async def run_mcp_stdio_server():
+    """Bounded JSON-lines transport. Stdout contains protocol messages only."""
+    session_id = None
+    while True:
+        line = await asyncio.to_thread(sys.stdin.readline, settings.MAX_PAYLOAD_BYTES + 1)
+        if not line:
+            break
+        if len(line.encode("utf-8", errors="surrogatepass")) > settings.MAX_PAYLOAD_BYTES:
+            while line and not line.endswith("\n"):
+                line = await asyncio.to_thread(sys.stdin.readline, settings.MAX_PAYLOAD_BYTES + 1)
+            result = make_jsonrpc_error(None, INVALID_REQUEST, "Message exceeds MAX_PAYLOAD_BYTES.")
+        elif not line.strip():
+            continue
+        else:
+            try:
+                payload = _load_json(line)
+            except (ValueError, RecursionError):
+                result = make_jsonrpc_error(None, PARSE_ERROR, "Invalid JSON.")
+            else:
+                if is_rpc_notification(payload):
+                    continue
+                result = validate_rpc_envelope(payload)
+                if result is None:
+                    # Tools are requests, never notifications. Ignore notifications
+                    # before dispatch so they cannot cause unacknowledged I/O.
+                    if "id" not in payload:
+                        continue
+                    try:
+                        if payload["method"] == "server/discover":
+                            result, _ = await process_mcp_2026_stateless(payload, api_key="local-stdio")
+                        else:
+                            result, _, session_id = await process_mcp_2025_legacy_stateful(payload, session_id, api_key="local-stdio")
+                    except Exception:
+                        result = make_jsonrpc_error(payload.get("id"), INTERNAL_ERROR, "Internal error.")
+        if result:
+            sys.stdout.write(json.dumps(result, ensure_ascii=True) + "\n")
+            sys.stdout.flush()
+
+def cli_entrypoint():
+    """
+    Console script entrypoint for PyPI / uvx (mcp-web-engine).
+    Runs Stdio MCP mode by default; runs FastAPI HTTP server if --serve is passed.
+    """
+    is_serve = "--serve" in sys.argv or "--sse" in sys.argv
+    if is_serve:
+        if len(settings.API_KEY.strip()) < 32:
+            raise SystemExit("HTTP mode requires an operator-generated API_KEY of at least 32 characters.")
+        import uvicorn
+        uvicorn.run("mcp_web_engine.main:app", host=settings.HOST, port=settings.PORT, reload=False)
+    else:
+        asyncio.run(run_mcp_stdio_server())
+
+if __name__ == "__main__":
+    cli_entrypoint()

package/{manage_beta_keys.py → src/mcp_web_engine/manage_beta_keys.py}

@@ -3,14 +3,21 @@
 Beta Keys & Telemetry Management CLI for MCP Web Engine
 Genera 20 keys independientes (Beta_001 .. Beta_020), lista y gestiona telemetría por usuario en beta_keys.json.
 """
-import sys
-import os
+import argparse
+import hashlib
 import json
+import os
 import secrets
+import tempfile
 import time
-import argparse
+from pathlib import Path
 
-KEYS_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), "beta_keys.json")
+try:
+    from .state_store import beta_keys_path, read_usage
+except ImportError:  # Direct script execution
+    from state_store import beta_keys_path, read_usage
+
+KEYS_FILE = str(beta_keys_path())
 
 def load_keys():
     if not os.path.exists(KEYS_FILE):
@@ -18,12 +25,24 @@ def load_keys():
     try:
         with open(KEYS_FILE, "r", encoding="utf-8") as f:
             return json.load(f)
-    except Exception:
-        return {}
+    except (OSError, ValueError) as exc:
+        raise RuntimeError("Cannot read operator key store") from exc
 
 def save_keys(keys):
-    with open(KEYS_FILE, "w", encoding="utf-8") as f:
-        json.dump(keys, f, indent=2)
+    target = Path(KEYS_FILE)
+    target.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    temporary = None
+    try:
+        with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=target.parent,
+                                         prefix=".beta-keys-", delete=False) as stream:
+            temporary = stream.name
+            json.dump(keys, stream, indent=2)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, target)
+    finally:
+        if temporary and os.path.exists(temporary):
+            os.unlink(temporary)
 
 def generate_20_beta_keys():
     keys = {}
@@ -74,7 +93,9 @@ def list_beta_telemetry():
     total_errs = 0
     
     for k, info in keys.items():
-        t = info.get("telemetry", {})
+        usage = read_usage(hashlib.sha256(k.encode("utf-8")).hexdigest())
+        t = {**info.get("telemetry", {}), **usage}
+        t["requests"] = max(info.get("telemetry", {}).get("requests", 0), usage.get("admissions", 0))
         reqs = t.get("requests", 0)
         errs = t.get("errors", 0)
         total_reqs += reqs

package/src/mcp_web_engine/mcp_protocol.py

@@ -0,0 +1,166 @@
+"""JSON-RPC handlers. The custom stateless API is retained for compatibility;
+its extensions are not claimed to be a certified official MCP implementation.
+"""
+import hashlib
+import json
+import secrets
+import time
+from typing import NoReturn, Optional
+
+from fastapi import HTTPException
+from pydantic import ValidationError
+
+from . import __version__
+from .logging_obs import logger, metrics
+from .mcp_tools import MCP_TOOL_DEFINITIONS, handle_mcp_tool_call
+
+MCP_PROTOCOL_VERSION_2026 = '2026-07-28'
+MCP_PROTOCOL_VERSION_LEGACY = '2025-11-25'
+REGISTERED_TOOL_NAMES = {t['name'] for t in MCP_TOOL_DEFINITIONS}
+VALID_2026_METHODS = {'server/discover', 'tools/list', 'tools/call', 'ping'}
+legacy_sessions = {}
+PARSE_ERROR, INVALID_REQUEST, METHOD_NOT_FOUND, INVALID_PARAMS, INTERNAL_ERROR = -32700, -32600, -32601, -32602, -32603
+
+
+def make_jsonrpc_response(request_id, result):
+    return {'jsonrpc': '2.0', 'id': request_id, 'result': result}
+
+
+def make_jsonrpc_error(request_id, code, message, data=None):
+    error = {'code': code, 'message': message}
+    if data is not None:
+        error['data'] = data
+    return {'jsonrpc': '2.0', 'id': request_id, 'error': error}
+
+
+def validate_rpc_envelope(payload):
+    if not isinstance(payload, dict) or payload.get('jsonrpc') != '2.0':
+        return make_jsonrpc_error(None, INVALID_REQUEST, 'Invalid JSON-RPC 2.0 request.')
+    request_id = payload.get('id')
+    if request_id is not None and (isinstance(request_id, bool) or not isinstance(request_id, (str, int))):
+        return make_jsonrpc_error(None, INVALID_REQUEST, 'Invalid request id.')
+    if not isinstance(payload.get('method'), str) or not payload['method']:
+        return make_jsonrpc_error(None, INVALID_REQUEST, 'Missing or invalid method.')
+    if not isinstance(payload.get('params', {}), dict):
+        return make_jsonrpc_error(request_id, INVALID_PARAMS, 'Params must be an object.')
+    if payload['method'] == 'tools/call':
+        params = payload.get('params', {})
+        if not isinstance(params.get('name'), str) or not params['name'] or not isinstance(params.get('arguments', {}), dict):
+            return make_jsonrpc_error(request_id, INVALID_PARAMS, 'A tool name and object arguments are required.')
+    return None
+
+
+def validate_2026_mcp_headers(header_mcp_version: Optional[str], header_mcp_method: Optional[str], header_mcp_name: Optional[str], payload):
+    error = validate_rpc_envelope(payload)
+    if error:
+        raise HTTPException(400, detail=error['error'])
+
+    def fail(code, message) -> NoReturn:
+        raise HTTPException(400, detail={'error': code, 'message': message})
+
+    if header_mcp_version and header_mcp_version != MCP_PROTOCOL_VERSION_2026:
+        fail('INVALID_PROTOCOL_VERSION', 'Unsupported protocol version.')
+    if not header_mcp_method:
+        fail('MISSING_MCP_METHOD', "Header 'Mcp-Method' is required.")
+    method = header_mcp_method.strip()
+    if method not in VALID_2026_METHODS:
+        fail('INVALID_MCP_METHOD', 'Unsupported method header.')
+    if method != payload['method']:
+        fail('MISMATCHED_MCP_METHOD', 'Method header does not match body.')
+    if method == 'tools/call':
+        if not header_mcp_name:
+            fail('MISSING_MCP_NAME', "Header 'Mcp-Name' is required for tools/call.")
+        if header_mcp_name.strip() not in REGISTERED_TOOL_NAMES:
+            fail('INVALID_MCP_NAME', 'Tool is not registered.')
+        if header_mcp_name.strip() != payload['params']['name']:
+            fail('MISMATCHED_MCP_NAME', 'Tool header does not match body.')
+
+
+async def _tool_result(request_id, params, api_key):
+    name = params['name']
+    if name not in REGISTERED_TOOL_NAMES:
+        return make_jsonrpc_error(request_id, INVALID_PARAMS, 'Unknown tool.'), 400
+    start = time.monotonic()
+    success = False
+    try:
+        raw = await handle_mcp_tool_call(name, params.get('arguments', {}))
+        success = not (isinstance(raw, dict) and raw.get('error'))
+        result = {'content': [{'type': 'text', 'text': json.dumps(raw, ensure_ascii=False)}], 'isError': not success}
+        return make_jsonrpc_response(request_id, result), 200
+    except ValidationError:
+        return make_jsonrpc_error(request_id, INVALID_PARAMS, 'Invalid tool arguments.'), 400
+    except Exception as exc:
+        text = 'Tool execution failed.'
+        if isinstance(exc, HTTPException) and isinstance(exc.detail, dict):
+            code = exc.detail.get('error')
+            if isinstance(code, str) and code.isupper() and code.replace('_', '').isalpha() and len(code) <= 64:
+                text += ' ' + code
+        logger.error('MCP tool execution failed', extra={'extra_data': {'tool': name, 'exception_type': type(exc).__name__}})
+        return make_jsonrpc_response(request_id, {'content': [{'type': 'text', 'text': text}], 'isError': True}), 200
+    finally:
+        metrics.record(name, round((time.monotonic() - start) * 1000, 2), success=success, api_key=api_key)
+
+
+def is_rpc_notification(payload):
+    return (isinstance(payload, dict) and payload.get('jsonrpc') == '2.0'
+            and isinstance(payload.get('method'), str) and bool(payload['method'])
+            and 'id' not in payload)
+
+
+async def process_mcp_2026_stateless(payload, api_key: Optional[str] = None):
+    if is_rpc_notification(payload):
+        return {}, 202
+    error = validate_rpc_envelope(payload)
+    if error:
+        return error, 400
+    if 'id' not in payload:
+        return {}, 202
+    request_id, method = payload.get('id'), payload['method']
+    if method == 'ping':
+        return make_jsonrpc_response(request_id, {}), 200
+    if method == 'server/discover':
+        return make_jsonrpc_response(request_id, {'protocolVersion': MCP_PROTOCOL_VERSION_2026, 'server': {'name': 'mcp-web-engine', 'version': __version__}, 'capabilities': {'tools': True}}), 200
+    if method == 'tools/list':
+        return make_jsonrpc_response(request_id, {'tools': MCP_TOOL_DEFINITIONS, 'cacheScope': 'global', 'ttlMs': 3600000, 'listChanged': False}), 200
+    if method == 'tools/call':
+        return await _tool_result(request_id, payload['params'], api_key)
+    return make_jsonrpc_error(request_id, METHOD_NOT_FOUND, 'Method not found.'), 404
+
+
+async def process_mcp_2025_legacy_stateful(payload, session_id: Optional[str] = None, api_key: Optional[str] = None):
+    if is_rpc_notification(payload):
+        return {}, 202, ''
+    error = validate_rpc_envelope(payload)
+    if error:
+        return error, 400, ''
+    if 'id' not in payload:
+        return {}, 202, ''
+    now = time.monotonic()
+    owner = hashlib.sha256((api_key or 'local-stdio').encode()).hexdigest()
+    for key in list(legacy_sessions):
+        if now - legacy_sessions[key]['created'] >= 3600:
+            del legacy_sessions[key]
+    session = legacy_sessions.get(session_id)
+    if session is None or session['owner'] != owner:
+        session_id = ''
+    request_id, method = payload.get('id'), payload['method']
+    params = payload.get('params', {})
+    if method == 'initialize':
+        if not session_id:
+            if len(legacy_sessions) >= 1024:
+                del legacy_sessions[next(iter(legacy_sessions))]
+            session_id = 'mcp_sess_legacy_' + secrets.token_hex(16)
+            legacy_sessions[session_id] = {'created': now, 'owner': owner}
+        supported = {'2024-11-05', '2025-03-26', '2025-06-18', MCP_PROTOCOL_VERSION_LEGACY}
+        version = params.get('protocolVersion')
+        version = version if isinstance(version, str) and version in supported else MCP_PROTOCOL_VERSION_LEGACY
+        result = {'protocolVersion': version, 'capabilities': {'tools': {'listChanged': False}}, 'serverInfo': {'name': 'mcp-web-engine', 'version': __version__}}
+        return make_jsonrpc_response(request_id, result), 200, session_id
+    if method == 'ping':
+        return make_jsonrpc_response(request_id, {}), 200, session_id
+    if method == 'tools/list':
+        return make_jsonrpc_response(request_id, {'tools': MCP_TOOL_DEFINITIONS}), 200, session_id
+    if method == 'tools/call':
+        result, http_status = await _tool_result(request_id, params, api_key)
+        return result, http_status, session_id
+    return make_jsonrpc_error(request_id, METHOD_NOT_FOUND, 'Method not found.'), 404, session_id

package/{mcp_tools.py → src/mcp_web_engine/mcp_tools.py}

@@ -2,20 +2,23 @@
 MCP Tools Definition & Schema Handlers (web_search, fetch_url, extract_markdown)
 """
 from typing import Optional
+
 from pydantic import BaseModel, Field
-from web_engine import execute_web_search, execute_fetch_url, execute_extract_markdown
+
+from .web_engine import execute_extract_markdown, execute_fetch_url, execute_web_search
+
 
 class WebSearchInput(BaseModel):
-    query: str = Field(..., description="The search query keywords", min_length=2)
-    limit: Optional[int] = Field(default=10, description="Max results to return (1-25)", ge=1, le=25)
+    query: str = Field(..., description="The search query keywords", min_length=2, max_length=4096)
+    limit: int = Field(default=10, description="Max results to return (1-25)", ge=1, le=25)
 
 class FetchUrlInput(BaseModel):
-    url: str = Field(..., description="Target URL to fetch content from")
-    max_bytes: Optional[int] = Field(default=None, description="Max bytes payload limit")
+    url: str = Field(..., description="Target public HTTP(S) URL", min_length=1, max_length=8192)
+    max_bytes: Optional[int] = Field(default=None, description="Response byte limit, capped by operator MAX_PAYLOAD_BYTES", ge=1, le=16 * 1024 * 1024)
 
 class ExtractMarkdownInput(BaseModel):
-    url: str = Field(..., description="Target URL to convert to clean Markdown")
-    max_bytes: Optional[int] = Field(default=None, description="Max bytes payload limit")
+    url: str = Field(..., description="Target public HTTP(S) URL", min_length=1, max_length=8192)
+    max_bytes: Optional[int] = Field(default=None, description="Response byte limit, capped by operator MAX_PAYLOAD_BYTES", ge=1, le=16 * 1024 * 1024)
 
 # MCP Protocol Tool Definitions
 MCP_TOOL_DEFINITIONS = [

package/src/mcp_web_engine/resource_limits.py

@@ -0,0 +1,45 @@
+"""Bound HTTP request buffering independently of endpoint/auth parsing."""
+from starlette.responses import JSONResponse
+
+from .config import settings
+
+
+class RequestSizeLimitMiddleware:
+    def __init__(self, app):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        if scope['type'] != 'http':
+            return await self.app(scope, receive, send)
+        limit = settings.MAX_PAYLOAD_BYTES
+        length = next((value for name, value in scope.get('headers', []) if name.lower() == b'content-length'), None)
+        if length is not None:
+            try:
+                size = int(length)
+                if size < 0:
+                    raise ValueError
+            except ValueError:
+                return await JSONResponse({'error': 'INVALID_CONTENT_LENGTH'}, 400)(scope, receive, send)
+            if size > limit:
+                return await JSONResponse({'error': 'PAYLOAD_TOO_LARGE'}, 413)(scope, receive, send)
+        body = bytearray()
+        while True:
+            message = await receive()
+            if message['type'] == 'http.disconnect':
+                return
+            chunk = message.get('body', b'')
+            if len(body) + len(chunk) > limit:
+                return await JSONResponse({'error': 'PAYLOAD_TOO_LARGE'}, 413)(scope, receive, send)
+            body.extend(chunk)
+            if not message.get('more_body', False):
+                break
+        delivered = False
+
+        async def bounded_receive():
+            nonlocal delivered
+            if not delivered:
+                delivered = True
+                return {'type': 'http.request', 'body': bytes(body), 'more_body': False}
+            return await receive()
+
+        return await self.app(scope, bounded_receive, send)