tiny-http-mcp-server: maxConcurrentToolCalls defaults to unbounded (v2-M9 HTTP side, needs executed re-audit)

[kamilio]

Found during the safe-bash deep pentest (v3) as an adjacent-scope spot check (MCP transport perimeter carries the risk since packages/safe-bash-mcp was deleted). Code-inspection only, NOT execution-verified — flagged for re-audit.

Severity: Medium (provisional) — threat (d): unbounded concurrent tool calls per HTTP MCP session

Summary

v2 finding M9 (unbounded concurrency) is partially fixed: the stdio transport now caps pending messages (maxPendingStdioMessages ?? 128, server.ts:130/:796), but the HTTP transport's maxConcurrentToolCalls still defaults to undefined (http-transport.ts:181-185) — unbounded concurrent tool calls per session. Also not found: the stdio line-length cap (v1 #10). Related v2 findings verified fixed by inspection: M8 (maxSessions ?? 128, maxSessionsPerSubject ?? 16, sessionTtlMs ?? 15min, http-transport.ts:167-171) and H18 (StdioOutput with maxStdioOutputBytes ?? 1 MiB, server.ts:129, stdio-output.ts:17).

Location

• packages/tiny-http-mcp-server/src/http-transport.ts:181-185 — maxConcurrentToolCalls defaults to undefined

Suggested fix

Default maxConcurrentToolCalls to a finite value (e.g. 8–16) consistent with the stdio cap; add the stdio line-length cap. Then execution-verify with a concurrent-calls PoC.

Status: v2-M9 STILL OPEN (HTTP side), inspection-only — needs executed re-audit

[kamilio]

Validated the normal HTTP factory already bounds active tool calls (4) and its queue; that default is unchanged. Fixed the confirmed stdio subclaim: maxStdioLineBytes now admits input before readline buffering (configurable, default 1 MiB), with cleanup and compatibility controls. Reproduced 13 failing regression cases before the fix; all 749 stdio package tests pass afterward. Normal build, full maintained workspace unit route, full lint/package checks, and affected checks after integrating incoming main changes pass. Delivered to main in 34a025d; closing immediately after remote verification. Publication is monitored separately. No OOM or hard heap-bound claim is made.