{"record":{"id":"6d846f9185ce6f12","repo":"different-ai/openwork","slug":"the-mcp-discovery-response-exceeded-the-1-mib-limi","errorCode":null,"errorMessage":"The MCP discovery response exceeded the 1 MiB limit.","messagePattern":"The MCP discovery response exceeded the 1 MiB limit\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-client/src/requirements-discovery.ts","lineNumber":52,"sourceCode":"  if (\n    input.requirements.authentication.kind !== \"oauth\"\n    || input.requirements.authentication.authorizationServers.length !== 1\n    || input.requirements.warnings.some((warning) => warning.code === \"oauth_issuer_mismatch\")\n  ) return undefined\n\n  const canonicalIssuer = input.requirements.authentication.authorizationServers[0]?.issuer\n  if (!canonicalIssuer || canonicalIssuer === input.selectedIssuer) return undefined\n  if (isEquivalentOAuthDiscoveryAlias(input.selectedIssuer, canonicalIssuer)) return canonicalIssuer\n  return isEquivalentOAuthDiscoveryAlias(input.selectedIssuer, input.requirements.authentication.resource)\n    ? canonicalIssuer\n    : undefined\n}\n\nfunction boundedResponse(response: Response): Response {\n  const advertisedLength = Number(response.headers.get(\"content-length\"))\n  if (Number.isFinite(advertisedLength) && advertisedLength > MAX_RESPONSE_BYTES) {\n    void response.body?.cancel()\n    throw new Error(\"The MCP discovery response exceeded the 1 MiB limit.\")\n  }\n  if (!response.body) return response\n\n  const reader = response.body.getReader()\n  let bytesRead = 0\n  const body = new ReadableStream<Uint8Array>({\n    async pull(controller) {\n      const result = await reader.read()\n      if (result.done) {\n        controller.close()\n        return\n      }\n      bytesRead += result.value.byteLength\n      if (bytesRead > MAX_RESPONSE_BYTES) {\n        await reader.cancel()\n        controller.error(new Error(\"The MCP discovery response exceeded the 1 MiB limit.\"))\n        return\n      }","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-client/src/requirements-discovery.ts#L34-L70","documentation":"boundedResponse guards discovery HTTP responses: if the advertised content-length exceeds MAX_RESPONSE_BYTES (1 MiB) it cancels the body and throws; the streamed copy also enforces the cap while reading. Discovery documents are expected to be small metadata JSON, so an oversized response is treated as hostile or misconfigured rather than parsed. It surfaces as a plain Error, not a contract error.","triggerScenarios":"Any discovery fetch (response() → boundedResponse) where content-length > 1 MiB, or where the streamed body grows past 1 MiB before completion.","commonSituations":"A proxy/HTML error page returned instead of the discovery document; pointing the client at a non-MCP URL that serves large content; a misbehaving or malicious server sending huge payloads.","solutions":["Verify the server URL points at the real MCP discovery endpoint returning small JSON metadata.","Check intervening proxies/gateways that may substitute large error pages; fix their routing.","If a legitimate deployment needs bigger documents, raise the limit in the library (rebuild/patch MAX_RESPONSE_BYTES) — otherwise reduce the document size server-side."],"exampleFix":"// before — URL that returns a full HTML app shell\nserverUrl: \"https://example.com/\"\n// after — the MCP discovery endpoint\nserverUrl: \"https://example.com/mcp\"","handlingStrategy":"validation","validationCode":"// Check advertised size before fetching the discovery document\nconst head = await fetch(url, { method: \"HEAD\" })\nconst len = Number(head.headers.get(\"content-length\"))\nconst tooBig = Number.isFinite(len) && len > 1024 * 1024","typeGuard":null,"tryCatchPattern":"try { const reqs = await discoverConnectionRequirements(input) }\ncatch (e) {\n  if (e.message.includes(\"1 MiB limit\")) {\n    throw new Error(`Discovery endpoint at ${input.serverUrl} returned an oversized response; verify the URL points at the MCP discovery document`)\n  }\n  throw e\n}","preventionTips":["Point discovery at the exact MCP metadata endpoint, not the site root or a proxy","Check proxies/gateways for substituted large HTML error pages","Keep server discovery documents small and JSON-only"],"tags":["http","discovery","limits","payload-size","security"],"backgroundTag":"response-size-limit-exceeded","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}