Fix MCP transport, path boundary, and rate-limit hardening issues - #3855

Merged

Widthdom merged 10 commits into

mainfrom

fix-issue3815-3756-3829-3780-3752-3753-3789

Jun 20, 2026

Commits on Jun 20, 2026

Fix URI-decoded MCP and DB path boundaries (#3789)
Widthdom
committed
3374dbe
Centralize MCP path boundary checks (#3753)
Widthdom
committed
b597bca
Expose MCP string-list bounds (#3752)
Widthdom
committed
1910847
Fail closed on invalid MCP tool denylists (#3829)
Widthdom
committed
cdaed1f
Cap MCP rate limiter bucket cardinality (#3780)
Widthdom
committed
31f982d
Harden HTTP MCP health and SSE paths (#3815)
Widthdom
committed
75f9787
Reject ambiguous HTTP MCP Authorization headers (#3756)
Widthdom
committed
935fc73
Merge origin/main into issue fix branch
Widthdom
committed
93d1b04
Fix MCP rate-limit status contract docs (#3780)
Widthdom
committed
268213e
Merge remote-tracking branch 'origin/main' into fix-issue3815-3756-3829-3780-3752-3753-3789
Widthdom
committed
48215bb