modelcontextprotocol/example-remote-server
Watch
1
0
Fork
You've already forked example-remote-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #40 from modelcontextprotocol/guro/increase-rate-limits

Browse source 
Increase rate limits across server endpoints
This commit is contained in:
Jerome 2026-03-17 15:45:28 +00:00 • committed by GitHub
commit 51091fe1f2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/index.ts
View file

@ -44,6 +44,10 @@ async function main() {
const app = express(); const app = express();
// Trust proxy headers (X-Forwarded-For, etc.) when behind reverse proxy (Cloudflare, etc.)
// This is required for rate limiting to work correctly with real client IPs
app.set('trust proxy', true);
// Basic middleware // Basic middleware
// Intentionally permissive CORS for public MCP reference server // Intentionally permissive CORS for public MCP reference server
// This allows any MCP client to test against this reference implementation // This allows any MCP client to test against this reference implementation
@ -188,7 +192,7 @@ async function main() {
// Rate limiter for splash page (moderate limit) // Rate limiter for splash page (moderate limit)
const splashPageLimiter = rateLimit({ const splashPageLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute windowMs: 60 * 1000, // 1 minute
max: 50, // 50 requests per minute max: 200, // 200 requests per minute
message: 'Too many requests to splash page', message: 'Too many requests to splash page',
standardHeaders: true, standardHeaders: true,
legacyHeaders: false, legacyHeaders: false,

8
src/modules/auth/index.ts
View file

@ -77,7 +77,7 @@ export class AuthModule {
// Rate limiters for different route types // Rate limiters for different route types
const authLimiter = rateLimit({ const authLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute windowMs: 60 * 1000, // 1 minute
max: 20, // 20 requests per minute for auth endpoints max: 200, // 200 requests per minute for auth endpoints
message: 'Too many authentication attempts', message: 'Too many authentication attempts',
standardHeaders: true, standardHeaders: true,
legacyHeaders: false, legacyHeaders: false,
@ -85,7 +85,7 @@ export class AuthModule {
const staticAssetLimiter = rateLimit({ const staticAssetLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute windowMs: 60 * 1000, // 1 minute
max: 100, // 100 requests per minute for static assets max: 500, // 500 requests per minute for static assets
message: 'Too many requests for static assets', message: 'Too many requests for static assets',
standardHeaders: true, standardHeaders: true,
legacyHeaders: false, legacyHeaders: false,
@ -96,10 +96,10 @@ export class AuthModule {
provider: this.provider, provider: this.provider,
issuerUrl: new URL(this.config.authServerUrl || this.config.baseUri), issuerUrl: new URL(this.config.authServerUrl || this.config.baseUri),
tokenOptions: { tokenOptions: {
rateLimit: { windowMs: 5000, limit: 100 } rateLimit: { windowMs: 5000, limit: 300 } // 300 requests per 5 seconds
}, },
clientRegistrationOptions: { clientRegistrationOptions: {
rateLimit: { windowMs: 60000, limit: 10 } rateLimit: { windowMs: 60000, limit: 60 } // 60 requests per minute
} }
})); }));

2
src/modules/mcp/index.ts
View file

@ -51,7 +51,7 @@ export class MCPModule {
// Rate limiter for static assets // Rate limiter for static assets
const staticAssetLimiter = rateLimit({ const staticAssetLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute windowMs: 60 * 1000, // 1 minute
max: 100, // 100 requests per minute for static assets max: 500, // 500 requests per minute for static assets
message: 'Too many requests for static assets', message: 'Too many requests for static assets',
standardHeaders: true, standardHeaders: true,
legacyHeaders: false, legacyHeaders: false,