{"record":{"id":"4637d7227c010cb8","repo":"conductor-oss/conductor","slug":"mcp-response-exceeds-the-10-mib-payload-limit","errorCode":null,"errorMessage":"MCP response exceeds the 10 MiB payload limit","messagePattern":"MCP response exceeds the 10 MiB payload limit","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java","lineNumber":443,"sourceCode":"                || request.header(\"Proxy-Authorization\") != null;\n    }\n\n    private boolean isSameOrigin(String firstUrl, String secondUrl) {\n        okhttp3.HttpUrl first = okhttp3.HttpUrl.parse(firstUrl);\n        okhttp3.HttpUrl second = okhttp3.HttpUrl.parse(secondUrl);\n        return first != null\n                && second != null\n                && first.scheme().equalsIgnoreCase(second.scheme())\n                && first.host().equalsIgnoreCase(second.host())\n                && first.port() == second.port();\n    }\n\n    private String readBoundedBody(ResponseBody body) throws Exception {\n        if (body == null) {\n            return \"\";\n        }\n        if (body.contentLength() > ExternalDataLimits.MAX_PAYLOAD_BYTES) {\n            throw new RuntimeException(\"MCP response exceeds the 10 MiB payload limit\");\n        }\n        try (body) {\n            okio.Buffer buffer = new okio.Buffer();\n            long total = 0;\n            long read;\n            while ((read = body.source().read(buffer, 8192)) != -1) {\n                total += read;\n                if (total > ExternalDataLimits.MAX_PAYLOAD_BYTES) {\n                    buffer.clear();\n                    throw new RuntimeException(\"MCP response exceeds the 10 MiB payload limit\");\n                }\n            }\n            return buffer.readUtf8();\n        }\n    }\n\n    private record ResponsePayload(int statusCode, String contentType, String body) {}\n","sourceCodeStart":425,"sourceCodeEnd":461,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java#L425-L461","documentation":"Thrown by readBoundedBody when the response body's declared Content-Length exceeds ExternalDataLimits.MAX_PAYLOAD_BYTES (10 MiB). This is the pre-read size guard: it checks the server-advertised length before streaming, so an oversized response is rejected without being downloaded. Protects against memory/exhaustion attacks from a malicious or buggy MCP server.","triggerScenarios":"Server sets Content-Length to a value > 10 MiB on the JSON-RPC response (e.g. a tools/list returning an enormous tool catalog, or a tool result with a huge embedded blob). The check fires before any bytes are buffered.","commonSituations":"MCP server returning very large tool descriptions or tool results; a server streaming a file/blob through a text content item; an adversarial server attempting resource exhaustion.","solutions":["Reduce the size of what the server returns (paginate tools, trim descriptions, avoid embedding large blobs in tool results).","If a larger limit is genuinely required and trusted, raise ExternalDataLimits.MAX_PAYLOAD_BYTES (weigh memory/exhaustion risk first).","Confirm the server isn't accidentally returning a binary payload as text.","For large tool outputs, have the tool return a reference/URL instead of inline content."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// There is no pre-call API to know response size; the guard runs server-side.\n// Mitigate by ensuring the server does not return >10MiB (paginate tools, trim descriptions).","typeGuard":null,"tryCatchPattern":"try {\n    mcpService.listTools(serverUrl, headers);\n} catch (RuntimeException e) {\n    if (e.getMessage().contains(\"payload limit\")) {\n        // server response too large; reduce tool count/description size server-side\n    }\n    throw e;\n}","preventionTips":["Paginate or trim large tool catalogs/results on the server.","Return references/URLs for large blobs instead of inline content.","Only raise MAX_PAYLOAD_BYTES on a trusted server after assessing memory risk."],"tags":["mcp","security","payload-limit","resource-exhaustion","denial-of-service"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}