MCP Ruby SDK Unbounded JSON-RPC Body Read (StreamableHTTPTransport DoS)

Technical Analysis

MCP::Server::Transports::StreamableHTTPTransport parses incoming JSON-RPC POST bodies fully before validation, with no configured maximum payload size or streaming size check. An attacker with network access to the endpoint can send arbitrarily large request bodies repeatedly, causing the Ruby process to allocate excessive memory and eventually crash or become unresponsive (OOM). Because MCP servers often mediate tool access for multiple downstream agents, taking down the transport layer causes a cascading availability failure across all connected agent clients. No authentication is required to trigger the condition, making this exploitable directly over the network wherever the transport is exposed.

Affected Systems

mcp (Ruby gem), MCP Ruby SDK; protocols: MCP

Detection Signatures

• Unusually large Content-Length headers on JSON-RPC POST requests to MCP endpoints
• Spikes in server memory usage correlated with inbound HTTP POST traffic
• Repeated large POST bodies from a single source IP without corresponding valid JSON-RPC responses
• Process restarts/OOM kills on mcp gem-based servers coinciding with unusual traffic patterns

Remediation Steps

1. 1

   Upgrade the mcp gem

   Update to mcp Ruby SDK version 0.23.0 or later, which enforces request body size limits.

2. 2

   Add reverse proxy limits

   Configure a front-end proxy (nginx, Envoy, etc.) to enforce maximum request body size before traffic reaches the MCP server.

3. 3

   Rate limit and authenticate

   Require authentication for MCP endpoints and apply rate limiting/connection throttling to reduce exposure to unauthenticated flood attacks.

4. 4

   Monitor resource usage

   Add memory and request-size monitoring/alerting for MCP server processes to detect exhaustion attempts early.