Limit HTTP request bodies before MCP middleware parsing

[SamMorrowDrums]

Summary

Adds an application-level HTTP request-body size limit that is enforced before any middleware or the MCP SDK reads or buffers the body.

Previously WithMCPParse and the WithScopeChallenge fallback path called io.ReadAll(r.Body) on an unbounded body with no size guard anywhere in the HTTP stack. A large or malicious payload would be fully buffered in memory by those middlewares (and again by the SDK's own servePOST) before any downstream size enforcement had a chance to apply.

Changes

• New middleware.WithMaxBodySize(maxBytes) (pkg/http/middleware/body_limit.go): wraps the request body with http.MaxBytesReader, rejecting immediately via a known Content-Length fast path, or erroring on read once the limit is hit for chunked/unknown-length bodies. Registered as the first middleware in Handler.RegisterMiddleware, ahead of ExtractUserToken, WithMCPParse, WithPATScopes, and WithScopeChallenge.
• WithMCPParse and WithScopeChallenge now detect the resulting *http.MaxBytesError and return a clear 413 Request Entity Too Large ("request body too large") response, following the existing http.Error(w, ..., statusCode) convention used elsewhere in this package, instead of silently falling through.
• ServerConfig.MaxRequestBodyBytes (new, optional) lets operators override the default; defaults to middleware.DefaultMaxRequestBodyBytes (10 MiB) when unset.
• Request-body replay for downstream handlers (including the MCP SDK) is preserved for all requests within the limit.

Tests

• pkg/http/middleware/body_limit_test.go: allowed request, boundary size (exact limit), oversized with known Content-Length (rejected before next runs), oversized with unknown length (rejected on downstream read).
• pkg/http/middleware/mcp_parse_test.go: composition of WithMaxBodySize + WithMCPParse — oversized body never reaches parsing/next handler; boundary-size body still parses and preserves the body.
• pkg/http/middleware/scope_challenge_test.go: composition of WithMaxBodySize + WithScopeChallenge's fallback body-read path.
• pkg/http/handler_test.go: end-to-end test through RegisterMiddleware/RegisterRoutes verifying an oversized request never constructs the MCP server, and a boundary-size request succeeds.

Verification

• script/lint — 0 issues
• script/test — full suite passes
• No MCP tool schema changes — no toolsnap or docs regeneration needed.

Fixes #3102

[Copilot]

Pull request overview

Adds an early, configurable HTTP request-body limit to prevent unbounded buffering.

Changes:

• Adds WithMaxBodySize with a 10 MiB default.
• Returns HTTP 413 for oversized bodies during middleware parsing.
• Adds unit and integration coverage for size limits and body replay.

Show a summary per file

File	Description
pkg/http/server.go	Adds request-size configuration.
pkg/http/handler.go	Registers the limiter first.
pkg/http/handler_test.go	Tests handler-level enforcement.
pkg/http/middleware/body_limit.go	Implements bounded request bodies.
pkg/http/middleware/body_limit_test.go	Tests limit boundaries and lengths.
pkg/http/middleware/mcp_parse.go	Handles limit errors with 413.
pkg/http/middleware/mcp_parse_test.go	Tests parser composition.
pkg/http/middleware/scope_challenge.go	Handles limit errors in fallback parsing.
pkg/http/middleware/scope_challenge_test.go	Tests scope fallback composition.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 9/9 changed files
• Comments generated: 2
• Review effort level: Balanced