{"record":{"id":"3ce5ebd3ecfb3e4b","repo":"modelcontextprotocol/servers","slug":"content-length-for-url-exceeds-max-of-maxbyte","errorCode":null,"errorMessage":"Content-Length for ${url} exceeds max of ${maxBytes}: ${contentLength}","messagePattern":"Content-Length for (.+?) exceeds max of (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/everything/tools/gzip-file-as-resource.ts","lineNumber":206,"sourceCode":"        `Fetching ${url} took more than ${timeoutMillis} ms and was aborted.`\n      ),\n    timeoutMillis\n  );\n\n  try {\n    // Fetch the data\n    const response = await fetch(url, { signal: controller.signal });\n    if (!response.body) {\n      throw new Error(\"No response body\");\n    }\n\n    // Note: we can't trust the Content-Length header: a malicious or clumsy server could return much more data than advertised.\n    // We check it here for early bail-out, but we still need to monitor actual bytes read below.\n    const contentLengthHeader = response.headers.get(\"content-length\");\n    if (contentLengthHeader != null) {\n      const contentLength = parseInt(contentLengthHeader, 10);\n      if (contentLength > maxBytes) {\n        throw new Error(\n          `Content-Length for ${url} exceeds max of ${maxBytes}: ${contentLength}`\n        );\n      }\n    }\n\n    // Read the fetched data from the response body\n    const reader = response.body.getReader();\n    const chunks = [];\n    let totalSize = 0;\n\n    // Read chunks until done\n    try {\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n\n        totalSize += value.length;\n","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/modelcontextprotocol/servers/blob/76d64c822f5125032f89eb71dbdb94e42b434821/src/everything/tools/gzip-file-as-resource.ts#L188-L224","documentation":"Thrown by `fetchSafely` as an early bail-out when the response's `Content-Length` header, if present, already exceeds `GZIP_MAX_FETCH_SIZE` (default 10 MB, env-configurable). This avoids downloading an obviously-too-large file. The code explicitly notes Content-Length is not trusted as the sole source of truth (see error 12 for the streaming guard).","triggerScenarios":"The remote URL advertises a `Content-Length` greater than `maxBytes`. `parseInt(contentLength, 10)` is compared against the cap; e.g. an 11 MB file with the default 10 MB cap.","commonSituations":"Fetching a file larger than the default 10 MB cap, or an operator who lowered `GZIP_MAX_FETCH_SIZE` for testing/safety. Note a malicious server could under-report Content-Length — the streaming guard (error 12) catches that.","solutions":["Fetch a smaller file that fits under the cap.","Raise the cap via `GZIP_MAX_FETCH_SIZE` env var (bytes), e.g. `GZIP_MAX_FETCH_SIZE=50000000`.","Pre-check the remote size with a HEAD request and skip/warn before calling the tool."],"exampleFix":"# before (default 10MB cap, file is 50MB)\n# after\nGZIP_MAX_FETCH_SIZE=50000000 node ...","handlingStrategy":"validation","validationCode":"const MAX = Number(process.env.GZIP_MAX_FETCH_SIZE ?? 10*1024*1024);\nasync function sizeOk(url: string): Promise<boolean> {\n  const h = await fetch(url, { method: 'HEAD' });\n  const len = Number(h.headers.get('content-length') ?? 0);\n  return len <= MAX;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await callGzipTool({ data: url });\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Content-Length')) {\n    // raise GZIP_MAX_FETCH_SIZE or pick a smaller file\n  }\n}","preventionTips":["Pre-check Content-Length with a HEAD request for large files.","Raise GZIP_MAX_FETCH_SIZE (bytes) for legitimate large files.","Recognize this is an early bail-out; the streaming guard (error 12) is authoritative."],"tags":["mcp","typescript","everything-server","network","limits","configuration","env"],"backgroundTag":null,"analyzedSha":"76d64c822f5125032f89eb71dbdb94e42b434821","analyzedAt":"2026-08-12T10:02:41.718Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}