Guard MCP bounty search oversized numeric query

app/main.py

@@ -123,10 +123,11 @@ def _preserve_forwarded_https_redirect(request: Request, response: Response) ->
 def _issue_number_search_value(query: str) -> int | None:
     if not query.isdigit():
         return None
-    issue_number = int(query)
-    if issue_number > SQLITE_INTEGER_MAX:
+    try:
+        issue_number = int(query)
+    except ValueError:
         return None
-    return issue_number
+    return issue_number if issue_number <= SQLITE_INTEGER_MAX else None
 
 
 def bounty_to_dict(bounty: Bounty) -> dict[str, Any]:
@@ -1716,8 +1717,11 @@ def optional_clean_str_arg(field: str) -> str | None:
     def mcp_issue_number_search_value(query_text: str) -> int | None:
         if not query_text.isdigit():
             return None
-        issue_number = int(query_text)
-        return issue_number if issue_number <= 2**63 - 1 else None
+        try:
+            issue_number = int(query_text)
+        except ValueError:
+            return None
+        return issue_number if issue_number <= SQLITE_INTEGER_MAX else None
 
     def list_limit_arg(default: int = 25) -> int:
         if "limit" not in args or args.get("limit") is None:

tests/test_api_mcp.py

@@ -551,6 +551,21 @@ def test_mcp_list_bounties_filters_status_query_and_limit(sqlite_url: str) -> No
     oversized_payload = json.loads(oversized_result["result"]["content"][0]["text"])
     assert oversized_payload == []
 
+    digit_limit_result = client.post(
+        "/mcp",
+        json={
+            "jsonrpc": "2.0",
+            "id": 5,
+            "method": "tools/call",
+            "params": {
+                "name": "list_bounties",
+                "arguments": {"q": "9" * 5000},
+            },
+        },
+    ).json()
+    digit_limit_payload = json.loads(digit_limit_result["result"]["content"][0]["text"])
+    assert digit_limit_payload == []
+
 
 @pytest.mark.parametrize(
     ("arguments", "request_id"),

tests/test_bounty_pages.py

@@ -123,6 +123,10 @@ def test_bounties_page_and_api_search_by_text_and_issue_number(sqlite_url: str)
     assert oversized_issue_search.status_code == 200
     assert oversized_issue_search.json() == []
 
+    digit_limit_issue_search = client.get("/api/v1/bounties", params={"q": "9" * 5000})
+    assert digit_limit_issue_search.status_code == 200
+    assert digit_limit_issue_search.json() == []
+
     oversized_issue_page = client.get("/bounties", params={"q": "9" * 40})
     assert oversized_issue_page.status_code == 200
     assert "No bounties yet." in oversized_issue_page.text