[DawnofGenX]

Pull Request

🔗 Related Issue

Closes #7261

---

📝 Summary

Adds MCP_MAX_REQUEST_BODY_SIZE_BYTES to configure the hard inbound request-body limit for the Python Streamable HTTP transport. The value passes to the MCP SDK's StreamableHTTPSessionManager(max_request_body_size=...). The default stays 4194304 (4 MiB) when the variable is unset. The setting validates > 0.

MCP_BODY_PEEK_MAX_BYTES remains a soft body-inspection threshold. It does not change this hard limit.

The mcpgateway/translate.py construction sites stay on the SDK default: they serve the standalone python -m mcpgateway.translate --stdio bridge CLI, not the gateway's Python Streamable HTTP transport that this issue targets.

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Lint suite	make ruff scoped to the changed files	Pass
Unit tests (affected)	pytest tests/unit/mcpgateway/transports/ tests/unit/mcpgateway/test_config.py -q	1139 passed, 1 skipped (pre-existing)
Unit tests (new)	pytest ...::test_session_manager_wrapper_* ...::test_streamable_http_rejects_bodies_over_configured_limit	3 passed
Formatting	ruff format --check (pinned 0.15.20)	Clean
Full make test / make coverage	not run locally (see Note)	Not run

Commands run:

# New tests (3 passed)
pytest tests/unit/mcpgateway/transports/test_streamablehttp_transport.py -k "max_request_body_size or rejects_bodies_over_configured_limit" -q

# Prove the wiring test bites: revert only mcpgateway/transports/streamablehttp_transport.py, keep the tests
# -> 3 failed (missing max_request_body_size kwarg; 406 instead of 413)
# Restore the transport change -> 3 passed

# Affected subset
pytest tests/unit/mcpgateway/transports/ tests/unit/mcpgateway/test_config.py -q

# Linters over changed files (Makefile pins: ruff 0.15.20, black 26.3.1)
make ruff TARGET="mcpgateway/config.py mcpgateway/transports/streamablehttp_transport.py tests/unit/mcpgateway/transports/test_streamablehttp_transport.py"
uv tool run ruff==0.15.20 format --check mcpgateway/config.py mcpgateway/transports/streamablehttp_transport.py

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes (optional)

• Only the affected test subset and scoped linters were run here; the full make test / make coverage diff-cover gate was not executed in this environment, so the coverage row is left as not run rather than claimed.

• New setting mcp_max_request_body_size_bytes in mcpgateway/config.py (Field(default=4 * 1024 * 1024, ge=1, ...)), env var MCP_MAX_REQUEST_BODY_SIZE_BYTES.

• Wired at the SessionManagerWrapper construction site in mcpgateway/transports/streamablehttp_transport.py.

• Documented in .env.example next to MCP_BODY_PEEK_MAX_BYTES, with the soft-vs-hard distinction.

• Behavioural test drives the real SDK session manager over ASGI: a body of limit + 1 bytes returns HTTP 413, a body of limit - 1 bytes is accepted.