From 2ecfdb11c966a7bf6c23f762b5133d121a3434d1 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Mon, 2 Nov 2026 16:11:40 +0000
Subject: [PATCH] Raise the WebMCP invoke input limit to 4 MiB

---
 server/cmd/api/api/webmcp.go      |  4 ++--
 server/cmd/api/api/webmcp_test.go | 15 +++++++++++++++
 server/lib/oapi/oapi.go           | 14 +++++++-------
 server/openapi.yaml               |  4 ++--
 4 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/server/cmd/api/api/webmcp.go b/server/cmd/api/api/webmcp.go
index a59705fa..d63d5deb 100644
--- a/server/cmd/api/api/webmcp.go
+++ b/server/cmd/api/api/webmcp.go
@@ -16,7 +16,7 @@ import (
 const (
 	defaultWebMCPInvocationTimeout = 60 * time.Second
 	maxWebMCPInvocationTimeoutSec  = 120
-	maxWebMCPInputBytes            = 1 << 20
+	maxWebMCPInputBytes            = 4 << 20
 	maxWebMCPRequestBytes          = maxWebMCPInputBytes + (4 << 10)
 )
 
@@ -117,7 +117,7 @@ func (s *ApiService) InvokeWebMCPTool(ctx context.Context, request oapi.InvokeWe
 	}
 	inputJSON, err := json.Marshal(request.Body.Input)
 	if err != nil || len(inputJSON) > maxWebMCPInputBytes {
-		return oapi.InvokeWebMCPTool400JSONResponse{BadRequestErrorJSONResponse: oapi.BadRequestErrorJSONResponse{Message: "input must be valid JSON no larger than 1 MiB"}}, nil
+		return oapi.InvokeWebMCPTool400JSONResponse{BadRequestErrorJSONResponse: oapi.BadRequestErrorJSONResponse{Message: "input must be valid JSON no larger than 4 MiB"}}, nil
 	}
 	timeout := defaultWebMCPInvocationTimeout
 	if request.Body.TimeoutSec != nil {
diff --git a/server/cmd/api/api/webmcp_test.go b/server/cmd/api/api/webmcp_test.go
index be83459b..1ab338b0 100644
--- a/server/cmd/api/api/webmcp_test.go
+++ b/server/cmd/api/api/webmcp_test.go
@@ -352,6 +352,21 @@ func TestInvokeWebMCPToolRejectsOversizedInput(t *testing.T) {
 	require.Empty(t, client.toolRef)
 }
 
+func TestInvokeWebMCPToolAcceptsInputAboveOneMiB(t *testing.T) {
+	client := &fakeWebMCPClient{result: webmcpclient.InvocationResult{InvocationID: "invocation-1", Status: "Completed"}}
+	service := &ApiService{webmcp: client}
+	response, err := service.InvokeWebMCPTool(context.Background(), oapi.InvokeWebMCPToolRequestObject{
+		Body: &oapi.WebMCPInvokeRequest{
+			ToolRef: "wmcp_test",
+			Input:   map[string]any{"value": strings.Repeat("a", 2<<20)},
+		},
+	})
+	require.NoError(t, err)
+	_, ok := response.(oapi.InvokeWebMCPTool200JSONResponse)
+	require.True(t, ok)
+	require.Equal(t, "wmcp_test", client.toolRef)
+}
+
 func TestInvokeWebMCPToolRejectsUnexpectedClientError(t *testing.T) {
 	service := &ApiService{webmcp: &fakeWebMCPClient{invokeErr: errors.New("CDP failed")}}
 	response, err := service.InvokeWebMCPTool(context.Background(), oapi.InvokeWebMCPToolRequestObject{
diff --git a/server/lib/oapi/oapi.go b/server/lib/oapi/oapi.go
index 69d08bd9..ffb0085b 100644
--- a/server/lib/oapi/oapi.go
+++ b/server/lib/oapi/oapi.go
@@ -7148,7 +7148,7 @@ type WebMCPInvocationResultStatus string
 
 // WebMCPInvokeRequest defines model for WebMCPInvokeRequest.
 type WebMCPInvokeRequest struct {
-	// Input Tool input, limited to 1 MiB after JSON serialization.
+	// Input Tool input, limited to 4 MiB after JSON serialization.
 	Input      map[string]interface{} `json:"input"`
 	TimeoutSec *int                   `json:"timeout_sec,omitempty"`
 	ToolRef    string                 `json:"tool_ref"`
@@ -28361,7 +28361,7 @@ var swaggerSpec = []string{
 	"CSxDa6jNP4PvfFGFpjeGjBMZtTgkdM580SF0cXXxN0pVKYzRZhS4yQ1WRK5QTRK/M4Wl+mYzMciNBuVU",
 	"qHEZSkpZKkbojOCofQb9knZCOclBrQLxywnmNPCupN7jtmgQCLGgK9QDscXEG5e88MSZ0mrAC6fxJ8dS",
 	"kWTckPCI9k7MFatzEChBRiwcyhfU2j86yucsBKKT+0fFIwz3sddvmsX2EJb6Lsclbj70ixumhcSdbO/T",
-	"dO0Dn6AT6NPDjx6Ej6GcpPdpxOezFUZCxHl8wGwPOqwUwi211dttH0iQ+K74tZoE9vGTP++WBDbC6ft9",
+	"dO0Dn6AT6NPDjx6ET6GcpPdpxOezFUZCxHl8wGwPOqwUwi211dttH0iQ+K74tZoE9vGTP++WBDbC6ft9",
 	"ad9z2IQdt7rb+70EX3m9+8G69XsrHEf9xsrOtHikToVBYRsMQ4B6F/QIkOCmzxNH+ciMmEnr/FsUfPMm",
 	"ApgiUOIllGMLCZFsvLJYRWcSvHvR6oSlVNMO7+zyMODPXlSAbD6U50pph/PcNYwCepecaSLm/FJqTLiA",
 	"Zq5oCvvH2xcnDKYUDL9ErD/vhRLTYHjOfL3q3GinE50NpT6oNT94cvjk68Hjx4MnXx+Q3uUAYNr/Dv/u",
@@ -28588,15 +28588,15 @@ var swaggerSpec = []string{
 	"YzWwqA+TC4EJzfwOlLR1rjAVoSWLkEUVbVkMr3CJXohRoS6UvlIRLMz0Uambo+yMlHSIiviiDIwnxc9V",
 	"uerYmaUyRfL1gURBLYW/kTqRcDRtnBidKl3hhQoDkz+SqErs5RShEdXpwFSHYYXrcM5V1HT5ZRqhUmGE",
 	"oSqVwj+c/IzCZF20zUOvc1XzsQ+lP928rCZqhWP/OThFK+cAE+wwp0lAaJLXiUZqfOyeFGBvX5zQYBtC",
-	"f/B25FdsNQQIPUIq8T+PMUgnzwrLniIe62np0AAvKDQX+/igGBjU+8RqN79i6r4hNido3qMzBemFy2tK",
+	"f/B25FdsNQQIPUIq8T9PMUgnzwrLniIe62np0AAvKDQX+/igGBjU+8RqN79i6r4hNido3qMzBemFy2tK",
 	"pUxIJMySo9Azv8Ki0IlAm7LY5RrnGH4Gp9DH97ejG4pXlI0gIypXffRPaWIxVKEn8BVCmNAu8Iogt+F3",
 	"C+6tBHOeMoz/o+o7Dca0Cg02aKlINz1Gyhx3GQBtCSHflS9i7xPGurlYDBtNbQi+LZ/jTa5y6PX0t3Om",
 	"Eqt1eu0UXCp+Y3zxET1Bfpre+eH4rMAi3XAqMLdVDNnphOrhLMg8GY+B7iK9uejUTRXOYw1tYLCVwWxV",
 	"Pz5Zeq0UWqBAg4G30pKJxUSkePV5XAl2JzfXFnUdZOl6T9ci2eU91+8HDxQfTrzQSjpt1sofQ0IJHC9U",
-	"4CVznhFBuD9X0TBGclMoxAXD90M3+ipMmIX5QlfhC3UhCHQbWitmA8pAfONVCmaWtz2fMG1K2GQ0xmlW",
-	"NhEomAqjYVSml22EBYmRiuOi35jX9/nSO6ic5f8qRBRcCW4UaikCukX2XdH69s8VGrXLqH8QFj3bpG3q",
-	"UxEyaBaVwk3r8oHjKZUjg8rA5fy0L6ke6k+v1lRviXOqqxM3+ve8usbtqWn7/XFsqB4mqNeIejWXEENS",
-	"7VRD7K5vvc6GmqYC+J/zsffSM6s69/Dvlh0LWX78+P8fALdLJIbZCQQA",
+	"4CVznhFBuD9X0TBGclMoxAXD90M3+ipMmIX5QlfhC3UhCHQbWitmA8pAfONVCmaWtz2fAFuOsMlojNOs",
+	"bCJQMBVGw6hML9sICxIjFcdFvzGv7/Old1A5y/9ViCi4Etwo1FIEdIvsu6L17Z8rNGqXUf8gLHq2SdvU",
+	"pyJk0CwqhZvW5QPHUypHBpWBy/lpX1I91J9eraneEudUVydu9O95dY3bU9P2++PYUD1MUK8R9WouIYak",
+	"2qmG2F3fep0NNU0F8D/nY++lZ1Z17uHfLTsWsvz48f8/APIPzU/ZCQQA",
 }
 
 // GetSwagger returns the content of the embedded swagger specification file
diff --git a/server/openapi.yaml b/server/openapi.yaml
index 186ca585..810d4f2d 100644
--- a/server/openapi.yaml
+++ b/server/openapi.yaml
@@ -1428,7 +1428,7 @@ paths:
       operationId: invokeWebMCPTool
       x-telemetry-category: control
       requestBody:
-        description: The raw JSON request body is limited to 1 MiB plus 4 KiB of envelope overhead before decoding.
+        description: The raw JSON request body is limited to 4 MiB plus 4 KiB of envelope overhead before decoding.
         required: true
         content:
           application/json:
@@ -7114,7 +7114,7 @@ components:
           maxLength: 128
         input:
           type: object
-          description: Tool input, limited to 1 MiB after JSON serialization.
+          description: Tool input, limited to 4 MiB after JSON serialization.
           additionalProperties: true
         timeout_sec:
           type: integer