Fix/payload size

[bogdanfazakas]

Fixes #19 .

Changes proposed in this PR:

Fixes upload_persistent_storage_file failing with 413 Payload Too Large for files over ~70KB on the hosted MCP: the HTTP transport's JSON body limit is raised from Express's 100KB default to 8MB, and uploads are now streamed to the node in 1MiB P2P frames instead of a single frame (which ocean-node capped at 4MiB). Agents can now upload ~6MB of raw file bytes per call — roughly 80× more than before — and larger files need only a handful of chunked calls instead of hundreds, cutting wasted requests and token spend.

Summary by CodeRabbit

• Bug Fixes

  • Improved persistent file uploads by processing large files in smaller chunks for more reliable transfers.
  • Updated server request handling to support JSON request bodies up to 8 MB.

• Improvements

  • Enhanced compatibility and stability for HTTP-based server connections and file uploads.

[coderabbitai]

📝 Walkthrough

Walkthrough

The SSE server now uses Express with an 8MB JSON body limit, and persistent storage uploads stream file data in 1MB Uint8Array chunks instead of a single buffer.

Changes

Large Upload Handling

Layer / File(s)	Summary
HTTP request parsing src/index.ts	The SSE server creates a direct Express app and enables JSON parsing with an 8MB request limit.
Persistent storage upload chunking src/clients/nodeClient.ts	Persistent storage uploads use a 1MB chunk generator to pass multiple Uint8Array slices to the P2P upload call.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: alexcos20

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is too vague and doesn't clearly describe the payload limit and upload chunking fix.	Rename it to something specific, like fixing hosted MCP upload payload limits or large file uploads.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The changes raise the JSON body limit and chunk uploads, which matches the issue's large-file upload payload fix.
Out of Scope Changes check	✅ Passed	The edits stay focused on request sizing and upload framing, with no clear unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/payload-size

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/index.ts`:
- Around line 3-5: Add host-header validation to the Express transport created
in src/index.ts, before exposing the /mcp route, to preserve the MCP SDK
helper’s DNS-rebinding protection. Reuse the SDK’s equivalent validation
mechanism or enforce the same allowed-host behavior in the Express middleware
without changing unrelated routes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1b3ee9ae-5ffe-4a55-98c8-b7a20a159033

📥 Commits

Reviewing files that changed from the base of the PR and between 28bf0b9 and 8376a31.

📒 Files selected for processing (2)

• src/clients/nodeClient.ts
• src/index.ts

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '== files ==\n'
git ls-files src/index.ts
printf '\n== outline ==\n'
ast-grep outline src/index.ts --view expanded || true
printf '\n== contents ==\n'
cat -n src/index.ts

printf '\n== search for MCP helpers/host validation ==\n'
rg -n "createMcpExpressApp|host-header|DNS-rebinding|rebind|validate.*host|allowedHosts|express\(\)" src . || true

Repository: oceanprotocol/on-mcp

Length of output: 9582

---

Preserve MCP host-header validation on the Express transport. express() removes the DNS-rebinding protection that the SDK helper provided, so add equivalent host-header checks before exposing /mcp over HTTP.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/index.ts` around lines 3 - 5, Add host-header validation to the Express
transport created in src/index.ts, before exposing the /mcp route, to preserve
the MCP SDK helper’s DNS-rebinding protection. Reuse the SDK’s equivalent
validation mechanism or enforce the same allowed-host behavior in the Express
middleware without changing unrelated routes.

Source: MCP tools