What causes "Response too large: exceeded {max_size} bytes" in PrefectHQ/fastmcp?

Raise max_size to fit the legitimate response (e.g. max_size=131072).

PrefectHQ/fastmcp · error · SSRFFetchError

Response too large: exceeded {max_size} bytes

Error message

Response too large: exceeded {max_size} bytes

What it means

Even without a Content-Length header, ssrf_safe_fetch_response counts bytes as they stream in and raises SSRFFetchError if the accumulated total exceeds max_size (default 5120). This enforces the size cap against servers that omit or lie about Content-Length, and partial content is discarded.

Source

Thrown at fastmcp_slim/fastmcp/server/auth/ssrf.py:517

                if content_length:
                    try:
                        size = int(content_length)
                        if size > max_size:
                            raise SSRFFetchError(
                                f"Response too large: {size} bytes (max {max_size})"
                            )
                    except ValueError:
                        pass

                # Stream the response and enforce size limit during download
                chunks = []
                total = 0
                async for chunk in response.aiter_bytes():
                    if time.monotonic() - start_time > overall_timeout:
                        raise SSRFFetchError(f"Overall timeout exceeded: {url}")
                    total += len(chunk)
                    if total > max_size:
                        raise SSRFFetchError(
                            f"Response too large: exceeded {max_size} bytes"
                        )
                    chunks.append(chunk)

                return SSRFFetchResponse(
                    content=b"".join(chunks),
                    status_code=response.status_code,
                    headers=dict(response.headers),
                )

        except httpx2.TimeoutException as e:
            last_error = e
            continue
        except httpx2.RequestError as e:
            last_error = e
            continue

    if last_error is not None:

View on GitHub (pinned to 1f02114297)

Solutions

Raise max_size to fit the legitimate response (e.g. max_size=131072).
Verify the endpoint returns the intended compact document, not an error/HTML page.
Check whether a proxy is inflating or wrapping the response body.
Catch SSRFFetchError and surface the size-limit mismatch in application logs.

Example fix

// before
resp = await ssrf_safe_fetch_response(url)  # streamed 8KB body > 5120 default
// after
resp = await ssrf_safe_fetch_response(url, max_size=128 * 1024)

Defensive patterns

Strategy: validation

Try / catch

try:
    resp = await ssrf_safe_fetch_response(url, max_size=131072)
except SSRFFetchError as e:
    if "too large" in str(e):
        logger.warning("%s exceeded size cap", url)
        return None
    raise

Prevention

Raise max_size only to a justified bound for the document format
Remember the cap applies to actual streamed bytes, not just Content-Length
Log the total when the cap trips to tune the limit

When it happens

Trigger: Server sends chunked transfer-encoding (no Content-Length) and the body exceeds max_size while aiter_bytes() iterates; server lies with a small Content-Length while sending more data.

Common situations: Fetching a large JSON/HTML document with the 5 KB default cap; a hostile endpoint deliberately streaming oversized bodies; misconfigured endpoint returning an error page larger than the limit.

Related errors

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/a37c21d78cf7ea8e. Report an issue: GitHub.