server: add maxBodyBytes guard for streamable HTTP

[TheodorNEngoy]

WebStandardStreamableHTTPServerTransport currently parses POST bodies via await req.json(), which buffers the full request body in memory.

This PR adds a maxBodyBytes option (default: 1_000_000) and enforces it when parsing JSON bodies. Oversized payloads return 413.

• Adds maxBodyBytes to WebStandardStreamableHTTPServerTransportOptions (negative disables)
• Enforces the limit via streaming read + byte count (fast Content-Length reject when present)
• Returns 413 with JSON error response (-32_000, "Payload too large")
• Adds a focused test

Note: if callers pass parsedBody to handleRequest, they must enforce limits in their framework/body parser.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7ec9f3e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/express	Patch
@modelcontextprotocol/hono	Patch
@modelcontextprotocol/node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1498

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1498

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1498

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1498

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1498

commit: 7ec9f3e

[TheodorNEngoy]

Closing as a duplicate of #1496 (same maxBodyBytes guard for streamable HTTP). Consolidating to keep review surface small; #1496 now also documents parsedBody semantics.