---
summary: "HTTP transport hardening: configurable request body limit (413 guard) and auth-gated landing page inventory by default"
breaking: false
security: true
agent-notes: |
  Skills updated this release: api-config SKILL.md 1.4 → 1.5, api-canvas (spillover recipe), polish-docs-meta SKILL.md 2.3 → 2.4 (bundling config-gen commands inlined into references/readme.md).
  Phase A skill sync picks these up.
  MCP_HTTP_MAX_BODY_BYTES is a new config key (default 1 MiB). Downstream servers can expose it in their .env.example if they anticipate large payloads.
  Landing page inventory is now gated behind auth by default when MCP_AUTH_MODE is jwt or oauth. Restore with landing.requireAuth: false for public-catalog deployments.
---

# 0.9.13 — 2026-05-28

## Added

- **`MCP_HTTP_MAX_BODY_BYTES`** — configurable inbound request-body cap on the HTTP MCP endpoint. Oversized requests are rejected with `413` before the per-request `McpServer`/transport are allocated and before the SDK parses the body. `Content-Length` over the cap is rejected with zero buffering; missing/under-declared length is caught by a cached read of the actual body. Default 1 MiB; set to `0` to disable and defer to the runtime/reverse proxy. Does not cap canvas upstream fetches or response sizes. ([#157](https://github.com/cyanheads/mcp-ts-core/issues/157))

## Changed

- **`landing.requireAuth` default** — landing page inventory (tool/resource/prompt listings, scope chips, invocation snippets) is now gated behind authentication by default when `MCP_AUTH_MODE` is `jwt` or `oauth`. Unauthenticated callers receive the reduced body. Set `landing.requireAuth: false` explicitly to serve the full inventory on an authenticated deployment (public catalog). `MCP_AUTH_MODE=none` continues to serve the full inventory by default. ([#156](https://github.com/cyanheads/mcp-ts-core/issues/156))
- **`skills/api-config/SKILL.md`** v1.4 → v1.5 — `MCP_HTTP_MAX_BODY_BYTES` added to the core config reference table.
- **`skills/polish-docs-meta/SKILL.md`** v2.3 → v2.4 — cross-reference to the templates Bundling section replaced with inline note pointing to `references/readme.md`.
- **`skills/polish-docs-meta/references/readme.md`** — `base64` / `encodeURIComponent` config-generation commands inlined (previously lived in `templates/CLAUDE.md` Bundling section).
- **`scripts/check-docs-sync.ts`** — extended to also verify the `templates/CLAUDE.md` ↔ `templates/AGENTS.md` pair; framework-only pair silently skips in downstream server projects.
- **`templates/CLAUDE.md` + `templates/AGENTS.md`** — Bundling/install-badge section removed; replaced with one-line pointer to the `polish-docs-meta` skill. `JsonRpcErrorCode` import added to the typed error contract example. `audit:refresh` description updated to clarify Bun's sticky transitive resolution behavior.

## Docs

- **`skills/api-canvas/SKILL.md`** — minimum-viable spillover server recipe added as the default starting point for canvas consumers; domain-specific brapi example stays but moves below the generic recipe. ([#138](https://github.com/cyanheads/mcp-ts-core/issues/138))

## Dependencies

- `@cloudflare/workers-types` ^4.20260528.1 → ^4.20260529.1
