Skip to content

Raise the WebMCP invoke input limit to 4 MiB #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rgarcia merged 1 commit into from
Nov 2, 2026
+26 −11
Merged

Raise the WebMCP invoke input limit to 4 MiB #500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions server/cmd/api/api/webmcp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ import (
const (
defaultWebMCPInvocationTimeout = 60 * time.Second
maxWebMCPInvocationTimeoutSec = 120
maxWebMCPInputBytes = 1 << 20
maxWebMCPInputBytes = 4 << 20
maxWebMCPRequestBytes = maxWebMCPInputBytes + (4 << 10)
)

Expand Down Expand Up @@ -117,7 +117,7 @@ func (s *ApiService) InvokeWebMCPTool(ctx context.Context, request oapi.InvokeWe
}
inputJSON, err := json.Marshal(request.Body.Input)
if err != nil || len(inputJSON) > maxWebMCPInputBytes {
return oapi.InvokeWebMCPTool400JSONResponse{BadRequestErrorJSONResponse: oapi.BadRequestErrorJSONResponse{Message: "input must be valid JSON no larger than 1 MiB"}}, nil
return oapi.InvokeWebMCPTool400JSONResponse{BadRequestErrorJSONResponse: oapi.BadRequestErrorJSONResponse{Message: "input must be valid JSON no larger than 4 MiB"}}, nil
}
timeout := defaultWebMCPInvocationTimeout
if request.Body.TimeoutSec != nil {
Expand Down
15 changes: 15 additions & 0 deletions server/cmd/api/api/webmcp_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,6 +352,21 @@ func TestInvokeWebMCPToolRejectsOversizedInput(t *testing.T) {
require.Empty(t, client.toolRef)
}

func TestInvokeWebMCPToolAcceptsInputAboveOneMiB(t *testing.T) {
client := &fakeWebMCPClient{result: webmcpclient.InvocationResult{InvocationID: "invocation-1", Status: "Completed"}}
service := &ApiService{webmcp: client}
response, err := service.InvokeWebMCPTool(context.Background(), oapi.InvokeWebMCPToolRequestObject{
Body: &oapi.WebMCPInvokeRequest{
ToolRef: "wmcp_test",
Input: map[string]any{"value": strings.Repeat("a", 2<<20)},
},
})
require.NoError(t, err)
_, ok := response.(oapi.InvokeWebMCPTool200JSONResponse)
require.True(t, ok)
require.Equal(t, "wmcp_test", client.toolRef)
}

func TestInvokeWebMCPToolRejectsUnexpectedClientError(t *testing.T) {
service := &ApiService{webmcp: &fakeWebMCPClient{invokeErr: errors.New("CDP failed")}}
response, err := service.InvokeWebMCPTool(context.Background(), oapi.InvokeWebMCPToolRequestObject{
Expand Down
14 changes: 7 additions & 7 deletions server/lib/oapi/oapi.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions server/openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1428,7 +1428,7 @@ paths:
operationId: invokeWebMCPTool
x-telemetry-category: control
requestBody:
description: The raw JSON request body is limited to 1 MiB plus 4 KiB of envelope overhead before decoding.
description: The raw JSON request body is limited to 4 MiB plus 4 KiB of envelope overhead before decoding.
required: true
content:
application/json:
Expand Down Expand Up @@ -7114,7 +7114,7 @@ components:
maxLength: 128
input:
type: object
description: Tool input, limited to 1 MiB after JSON serialization.
description: Tool input, limited to 4 MiB after JSON serialization.
additionalProperties: true
timeout_sec:
type: integer
Expand Down
Loading