Skip to content

fix: Accept request bodies up to 9 MB in the dev server - #1611

Merged
DaveHanns merged 1 commit into
masterfrom
fix/http-json-body-limit
Oct 16, 2026
Merged

DaveHanns merged 1 commit into
masterfrom
fix/http-json-body-limit

Conversation

@DaveHanns

Copy link
Copy Markdown
Contributor

Why

Fixes #1610. The dev server parsed request bodies with express.json() and its 100 KB default, so any larger MCP request got HTTP 413 before it reached a tool. The source tools in the open PRs #1453 and #1454 send up to 3 MiB of files, about 4 MiB as base64 JSON. The hosted server needs the same change: apify/apify-mcp-server-internal#842.

What changed

Before: a request body over 100 KB got 413.
Now: the limit is 9 MiB, the Apify API's own payload limit (MAX_PAYLOAD_SIZE_BYTES in @apify/consts), because a larger body could not reach the API anyway. This repo does not depend on @apify/consts directly, so the value is a constant in src/const.ts.

Notes for reviewers (human-written)

Proof it works

The dev server (pnpm exec tsx src/dev_server.ts) on a local port, sent a 150 KiB stateless ping with curl:

  • On master: HTTP 413, PayloadTooLargeError: request entity too large.
  • On this branch: HTTP 401, "Apify API token is missing", so the body was parsed and the request reached the MCP auth check. The probe sent no token, so it made no Apify API call.

A unit test sends a 4 MiB tools/call and gets 200; it fails with a 1 MiB limit. Another sends a body over 9 MiB and gets 413.

AI disclosure: implemented with Claude Code; awaiting human review.

🤖 Generated with Claude Code

express.json() used its 100 KB default, so a larger MCP request got
HTTP 413 before reaching any tool. Raise the limit to the Apify API's
own payload limit (MAX_PAYLOAD_SIZE_BYTES in @apify/consts, 9 MiB).
A larger body could not reach the API anyway.

Fixes #1610.
@DaveHanns DaveHanns self-assigned this Oct 16, 2026
@DaveHanns
DaveHanns requested a review from jirispilka October 16, 2026 10:34
@DaveHanns DaveHanns added the adhoc Ad-hoc unplanned task added during the sprint. label Oct 16, 2026
@DaveHanns
DaveHanns marked this pull request as ready for review October 16, 2026 10:34
@apify-service-account apify-service-account added tested Temporary label used only programatically for some analytics. t-builders Issues owned by the Builders team. labels Oct 16, 2026
@DaveHanns
DaveHanns merged commit b06cc11 into master Oct 16, 2026
27 of 28 checks passed
@DaveHanns
DaveHanns deleted the fix/http-json-body-limit branch October 16, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

adhoc Ad-hoc unplanned task added during the sprint. t-builders Issues owned by the Builders team. tested Temporary label used only programatically for some analytics.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HTTP servers refuse request bodies over 100 KB

3 participants