{"record":{"id":"79c1a2890206c0fc","repo":"paperclipai/paperclip","slug":"request-body-too-large","errorCode":null,"errorMessage":"Request body too large.","messagePattern":"Request body too large\\.","errorType":"http","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/google-sheets-mcp-server/src/http.ts","lineNumber":44,"sourceCode":"    \"content-type\": \"application/json\",\n    \"content-length\": Buffer.byteLength(payload),\n  });\n  res.end(payload);\n}\n\nfunction presentedToken(req: IncomingMessage): string | null {\n  const header = req.headers.authorization;\n  if (header?.startsWith(\"Bearer \")) return header.slice(\"Bearer \".length).trim();\n  return null;\n}\n\nasync function readJsonBody(req: IncomingMessage): Promise<unknown> {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of req) {\n    const buffer = chunk as Buffer;\n    size += buffer.length;\n    if (size > 1_000_000) throw new Error(\"Request body too large.\");\n    chunks.push(buffer);\n  }\n  if (chunks.length === 0) return undefined;\n  const raw = Buffer.concat(chunks).toString(\"utf8\").trim();\n  if (!raw) return undefined;\n  return JSON.parse(raw);\n}\n\nasync function handleMcp(\n  req: IncomingMessage,\n  res: ServerResponse,\n  config: GoogleSheetsMcpConfig,\n  client: GoogleSheetsClient,\n): Promise<void> {\n  let parsedBody: unknown;\n  try {\n    parsedBody = req.method === \"POST\" ? await readJsonBody(req) : undefined;\n  } catch (error) {","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/packages/google-sheets-mcp-server/src/http.ts#L26-L62","documentation":"The google-sheets MCP server reads the JSON body off the incoming HTTP request in readJsonBody and enforces a hard 1,000,000-byte (1 MiB) cap. As soon as the running sum of streamed chunk sizes crosses the limit it throws synchronously inside the async iterator, aborting the request before JSON.parse ever runs. This is a request-size DoS guard applied before any token validation or parsing.","triggerScenarios":"A client POSTs an MCP tools/call request to the google-sheets MCP HTTP endpoint whose body exceeds 1 MiB — e.g. a values_batch_update payload embedding a very large range or a tools/call with an oversized inline argument. The check fires per-chunk during the for-await loop over the IncomingMessage stream.","commonSituations":"Pushing a large spreadsheet range (many rows/columns) as inline values in a single tool call; an agent batching many writes into one request; a misconfigured client that serializes an entire sheet into one call.","solutions":["Split the payload into multiple smaller tool calls (paginate rows or batch ranges under 1 MiB).","If the legitimate workload truly needs larger bodies, fork the server and raise the 1_000_000 literal in readJsonBody (there is no env override).","Inspect the actual request size being sent by the client and trim redundant fields before sending."],"exampleFix":"// before: one huge call\nawait tools.call('update_values', { range: 'A1:Z100000', values: giantMatrix });\n// after: chunked calls\nfor (const chunk of chunkMatrix(giantMatrix, 5000)) {\n  await tools.call('update_values', { range: chunk.range, values: chunk.values });\n}","handlingStrategy":"validation","validationCode":"function estimateJsonBytes(payload: unknown): number {\n  return Buffer.byteLength(JSON.stringify(payload), 'utf8');\n}\n// before sending\nif (estimateJsonBytes(args) > 1_000_000) throw new Error('payload would exceed 1MiB server cap');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Estimate serialized body size client-side and chunk before sending.","Keep any single values update under a few thousand cells.","Treat the 1 MiB cap as a hard contract — there is no env override."],"tags":["http","request-size-limit","dos-guard","google-sheets-mcp"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}