From 1fe9eda4a712a5f3a3ba11561e723ec7e6cf5a5b Mon Sep 17 00:00:00 2001
From: Ramesh Reddy Adutla
 <134313151+rameshreddy-adutla@users.noreply.github.com>
Date: Thu, 5 Mar 2026 06:57:40 +0000
Subject: [PATCH] Add jsonLimit option to createMcpExpressApp (#1625)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
---
 .changeset/twelve-dodos-taste.md                 |  5 +++++
 packages/middleware/express/src/express.ts       | 13 +++++++++++--
 packages/middleware/express/test/express.test.ts | 10 ++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/twelve-dodos-taste.md

diff --git a/.changeset/twelve-dodos-taste.md b/.changeset/twelve-dodos-taste.md
new file mode 100644
index 00000000..1b0fdc19
--- /dev/null
+++ b/.changeset/twelve-dodos-taste.md
@@ -0,0 +1,5 @@
+---
+"@modelcontextprotocol/express": patch
+---
+
+Add jsonLimit option to createMcpExpressApp
diff --git a/packages/middleware/express/src/express.ts b/packages/middleware/express/src/express.ts
index af156a22..25250295 100644
--- a/packages/middleware/express/src/express.ts
+++ b/packages/middleware/express/src/express.ts
@@ -22,6 +22,15 @@ export interface CreateMcpExpressAppOptions {
      * to restrict which hostnames are allowed.
      */
     allowedHosts?: string[];
+
+    /**
+     * Controls the maximum request body size for the JSON body parser.
+     * Passed directly to Express's `express.json({ limit })` option.
+     * Defaults to Express's built-in default of `'100kb'`.
+     *
+     * @example '1mb', '500kb', '10mb'
+     */
+    jsonLimit?: string;
 }
 
 /**
@@ -51,10 +60,10 @@ export interface CreateMcpExpressAppOptions {
  * ```
  */
 export function createMcpExpressApp(options: CreateMcpExpressAppOptions = {}): Express {
-    const { host = '127.0.0.1', allowedHosts } = options;
+    const { host = '127.0.0.1', allowedHosts, jsonLimit } = options;
 
     const app = express();
-    app.use(express.json());
+    app.use(express.json(jsonLimit ? { limit: jsonLimit } : undefined));
 
     // If allowedHosts is explicitly provided, use that for validation
     if (allowedHosts) {
diff --git a/packages/middleware/express/test/express.test.ts b/packages/middleware/express/test/express.test.ts
index 64cf533b..f4be9f99 100644
--- a/packages/middleware/express/test/express.test.ts
+++ b/packages/middleware/express/test/express.test.ts
@@ -178,5 +178,15 @@ describe('@modelcontextprotocol/express', () => {
 
             warn.mockRestore();
         });
+
+        test('should accept jsonLimit option', () => {
+            const app = createMcpExpressApp({ jsonLimit: '10mb' });
+            expect(app).toBeDefined();
+        });
+
+        test('should work without jsonLimit option', () => {
+            const app = createMcpExpressApp();
+            expect(app).toBeDefined();
+        });
     });
 });