[RIP-SEC] MCP client does not cap the HTTP/SSE response body on the default (Legacy) request, allowing a malicious MCP server to exhaust client memory

Start in codex-rs/rmcp-client/src/http_client_adapter.rs with the maximum_response_bytes selector and collect_body, then read the cap constant in codex-rs/rmcp-client/src/local_stdio_transport.rs. Verify that the default/Legacy HTTP/SSE path enforces the intended cap and that an oversized body produces ResponseTooLarge rather than being fully collected.

Summary

The rmcp HTTP transport applies its 8 MiB response cap (MAX_MCP_STDIO_LINE_BYTES) only when the
request is the capability Discover method or carries the modern protocol-version header
(2026-07-28). For the default/Legacy request the limit is None, and the body collector appends
every chunk with no ceiling. A malicious or MITM'd MCP server can return an arbitrarily large
HTTP/SSE body and exhaust the client's memory. The stdio transport caps at 8 MiB and enforces it,
showing the bound is intended.

Where

codex-rs/rmcp-client/src/http_client_adapter.rs:

let maximum_response_bytes = (mcp_method.as_deref() == Some(DiscoverRequestMethod::VALUE)
    || headers.get(HEADER_MCP_PROTOCOL_VERSION).and_then(|v| v.to_str().ok())
        == Some(ProtocolVersion::V_2026_07_28.as_str()))
    .then_some(MAX_MCP_STDIO_LINE_BYTES);   // None on the default/Legacy path

collect_body (same file) skips the size check entirely when maximum_bytes is None. Cap constant:
codex-rs/rmcp-client/src/local_stdio_transport.rs. Present on current main.

Reproduction

Exercising the exact cap selector and collect_body logic: for a Legacy request the computed limit is
None; collect_body(16 MiB, None) returns the full 16 MiB (unbounded) while
collect_body(16 MiB, Some(8 MiB)) returns ResponseTooLarge. In production the stream length is
attacker-controlled and unbounded.

Impact

Memory-exhaustion denial of service against a Codex client that connects to a malicious/MITM MCP
server over the default HTTP transport. DoS only — no code execution or data exposure.

Suggested fix

Apply the cap on all HTTP/SSE MCP responses (default maximum_response_bytes to the cap and widen it
deliberately), rather than defaulting to None for Legacy requests.

Found with the rust-in-peace pipeline
(AI-assisted Rust vulnerability research).