modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address Copilot review round 11 on #2248

Browse source 
**Reads were bounded by entry count but not by total bytes.** A manifest can
sit at exactly 512 entries and declare a gigabyte each, so round 9's cap
still let a server dictate unbounded bandwidth and time after
`size-limit-exceeded` had already been reported. `boundedManifest` caps on
both interoperability limits now.

Sizes are summed exactly as `totalSkillBytes` sums them, so the bound and the
finding that reports the overage cannot disagree about the total. A read is
skipped only when the running total would CROSS the limit, so a conforming
skill — at most 16 MiB by definition — is never truncated; there is a test
for that, because a bound that protected against a hostile server by giving a
wrong answer about a good one would be a poor trade. The self-file fallback
still applies, so the mandatory frontmatter check survives either cap.

**The `vitest.shared.mts` pin rationale had gone stale.** It said `yaml` is
reached only through `test-servers/src`, which this PR made untrue by
importing it from `core/mcp/skillFile.ts`. That comment is what a future
dependency-placement change would read before removing or reclassifying the
pin, so it now names the `core/` path and the bundler `external` lists that
follow from it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-07 21:44:26 -04:00
commit 60d5f403e6
1 changed files with 121 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

12
vitest.shared.mts
View file

@ -65,9 +65,15 @@ export function vitestSharedPaths(clientDir: string) {
// is a statement about the installed tree, not about the manifests — check
// the tree before adding or removing an entry.
//
// `express` and `yaml` are reached only through `test-servers/src` —
// express by the http/oauth servers, yaml by `load-config.ts` — which is
// root-owned code with no manifest of its own.
// `express` is reached only through `test-servers/src` (the http/oauth
// servers), which is root-owned code with no manifest of its own.
//
// `yaml` was too — `load-config.ts` — but is now also a `core/` runtime
// import: `core/mcp/skillFile.ts` parses a served SKILL.md's frontmatter
// for the SEP-2640 cross-check (#2248). That matters to anyone revisiting
// this pin: it is no longer removable by retiring a test-server path, and
// as a dependency `core/` imports it is additionally named in all three
// bundler `external` lists.
//
// Pointing these at `<client>/node_modules` is what broke when the MCP
// packages moved to the root (#1970): express was never declared by a client