Cap request body size and set maxToolInputElements on MCP servers
Upgrade to the patched SDK, then set the element cap and a smaller body limit to reduce the crash risk.
- Upgrade packagesSDK 1.32.0 or server 2.3.0
- Set maxToolInputElementsCaps elements and keys validated
- Lower maxRequestBodySizeBelow the 4 MiB default
- Test with big payloadsWatch memory stay flat
Why it matters
A single HTTP request can exhaust a server's memory and abort the process (advisory (opens external site)). That is the memory exhaustion bug (opens external site) in the MCP TypeScript SDK. The request fit under the default 4 MiB body limit, so the danger was the number of array elements and object keys validated, not the byte size.
Steps
- Upgrade @modelcontextprotocol/sdk to 1.32.0 or @modelcontextprotocol/server to 2.3.0. The patched versions add the maxToolInputElements option.
- Set maxToolInputElements on your McpServer. It caps how many array elements and object keys get validated. Pick the largest value a legitimate tool call needs, nothing more.
- Lower maxRequestBodySize below the 4 MiB default. That is the maximum size of an incoming request body. Choose a value that fits your real payloads.
- Test with one request that has a long array and an object with many keys. Watch memory use stay flat.
Common mistakes
- Only lowering maxRequestBodySize does not add the element cap. You need the patched version.
- Setting maxToolInputElements but leaving the body limit at 4 MiB ignores the advisory's second recommendation. Lower it too.
- Object keys count too. The validation iterated keys, not just array items.
Checklist
0 of 6 done