vinkius-labs/mcp-fusion

Security

• HTTP body size limit — DoS/OOM prevention (Bug #149) — The HTTP transport handler now enforces a configurable maxBodyBytes limit (default: 4MB). Requests exceeding the limit are rejected with HTTP 413 via dual-layer protection: Content-Length pre-flight check and streaming byte counter. Prevents attackers from sending multi-GB payloads that crash the server.

• Prompt injection via markdown code fence escape (Bug #150) — buildInputFirewallPrompt() and buildFirewallPrompt() now sanitize backticks in user-controlled data before embedding in markdown code fences. Previously, arguments containing triple backticks could escape the code block and inject arbitrary instructions into the LLM judge prompt, bypassing the security firewall.

• Greedy JSON extraction replaced (Bug #150) — parseJudgePass() and extractDetailedRejections() now use a new extractLastJson() function that scans backward from the last } with brace-depth counting, replacing the greedy regex that could capture non-JSON prose.

Added

• maxBodyBytes option in StartServerOptions for configurable HTTP body size limit
• extractLastJson() utility for robust JSON extraction from LLM responses (internal)

Test Suite

• 198 new adversarial security tests across 6 test files covering backtick injection, fence escape patterns, unicode bypasses, multi-byte character attacks, Content-Length manipulation, streaming guard attacks, compound attack payloads, and realistic LLM response parsing.