From 67ffeb0b9393472b2e87519dd9632aeb48d922c1 Mon Sep 17 00:00:00 2001
From: guro <guro@anthropic.com>
Date: Tue, 17 Mar 2026 14:52:21 +0000
Subject: [PATCH] Increase rate limits across server endpoints

Raise request limits to better accommodate legitimate traffic patterns:
- Splash page: 50 -> 200 req/min
- Auth endpoints: 20 -> 200 req/min
- Static assets (auth & mcp): 100 -> 500 req/min
- OAuth metadata: 100 -> 300 req/5s
- Client registration: 10 -> 60 req/min
---
 src/index.ts              | 2 +-
 src/modules/auth/index.ts | 8 ++++----
 src/modules/mcp/index.ts  | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index f37ed02..d587065 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -192,7 +192,7 @@ async function main() {
   // Rate limiter for splash page (moderate limit)
   const splashPageLimiter = rateLimit({
     windowMs: 60 * 1000, // 1 minute
-    max: 50, // 50 requests per minute
+    max: 200, // 200 requests per minute
     message: 'Too many requests to splash page',
     standardHeaders: true,
     legacyHeaders: false,
diff --git a/src/modules/auth/index.ts b/src/modules/auth/index.ts
index 15758a1..140705d 100644
--- a/src/modules/auth/index.ts
+++ b/src/modules/auth/index.ts
@@ -77,7 +77,7 @@ export class AuthModule {
     // Rate limiters for different route types
     const authLimiter = rateLimit({
       windowMs: 60 * 1000, // 1 minute
-      max: 20, // 20 requests per minute for auth endpoints
+      max: 200, // 200 requests per minute for auth endpoints
       message: 'Too many authentication attempts',
       standardHeaders: true,
       legacyHeaders: false,
@@ -85,7 +85,7 @@ export class AuthModule {
 
     const staticAssetLimiter = rateLimit({
       windowMs: 60 * 1000, // 1 minute
-      max: 100, // 100 requests per minute for static assets
+      max: 500, // 500 requests per minute for static assets
       message: 'Too many requests for static assets',
       standardHeaders: true,
       legacyHeaders: false,
@@ -96,10 +96,10 @@ export class AuthModule {
       provider: this.provider,
       issuerUrl: new URL(this.config.authServerUrl || this.config.baseUri),
       tokenOptions: {
-        rateLimit: { windowMs: 5000, limit: 100 }
+        rateLimit: { windowMs: 5000, limit: 300 } // 300 requests per 5 seconds
       },
       clientRegistrationOptions: {
-        rateLimit: { windowMs: 60000, limit: 10 }
+        rateLimit: { windowMs: 60000, limit: 60 } // 60 requests per minute
       }
     }));
 
diff --git a/src/modules/mcp/index.ts b/src/modules/mcp/index.ts
index 647588a..325b2e8 100644
--- a/src/modules/mcp/index.ts
+++ b/src/modules/mcp/index.ts
@@ -51,7 +51,7 @@ export class MCPModule {
     // Rate limiter for static assets
     const staticAssetLimiter = rateLimit({
       windowMs: 60 * 1000, // 1 minute
-      max: 100, // 100 requests per minute for static assets
+      max: 500, // 500 requests per minute for static assets
       message: 'Too many requests for static assets',
       standardHeaders: true,
       legacyHeaders: false,