runtime: add execution concurrency limits

apps/mcp-server/src/app.rs

@@ -128,11 +128,12 @@ pub fn build_app(
     refresh_interval: Duration,
     public_base_url: Option<String>,
     secret_crypto: SecretCrypto,
+    runtime: RuntimeExecutor,
 ) -> Router {
     let state = Arc::new(AppState {
         registry: registry.clone(),
         catalog: PublishedToolCatalog::new(registry, refresh_interval),
-        runtime: RuntimeExecutor::new(),
+        runtime,
         secret_crypto,
         sessions: SessionStore::new(),
         allowed_origins: AllowedOrigins::new(public_base_url),
@@ -2047,6 +2048,7 @@ fn runtime_error_code(error: &RuntimeError) -> &'static str {
         RuntimeError::SoapAdapter(_) => "adapter_execution_error",
         RuntimeError::WebsocketAdapter(_) => "adapter_execution_error",
         RuntimeError::UnsupportedProtocol { .. } => "unsupported_protocol",
+        RuntimeError::ConcurrencyLimitExceeded { .. } => "runtime_overloaded",
         RuntimeError::MissingStreamingConfig { .. } => "streaming_config_error",
         RuntimeError::UnsupportedExecutionMode { .. } => "streaming_mode_error",
         RuntimeError::InvalidPreparedRequest { .. } => "runtime_error",
@@ -2098,6 +2100,10 @@ fn runtime_error_context(error: &RuntimeError) -> Option<Value> {
         RuntimeError::UnsupportedProtocol { protocol } => Some(json!({
             "protocol": protocol,
         })),
+        RuntimeError::ConcurrencyLimitExceeded { kind, limit } => Some(json!({
+            "kind": kind,
+            "limit": limit,
+        })),
         _ => None,
     }
 }
@@ -2506,6 +2512,23 @@ mod tests {
         );
     }
 
+    #[test]
+    fn runtime_error_context_includes_runtime_overload_details() {
+        let context = runtime_error_context(&RuntimeError::ConcurrencyLimitExceeded {
+            kind: "async_job",
+            limit: 8,
+        })
+        .unwrap();
+
+        assert_eq!(
+            context,
+            json!({
+                "kind": "async_job",
+                "limit": 8
+            })
+        );
+    }
+
     #[tokio::test]
     async fn tool_error_response_includes_structured_context() {
         let response = tool_error_response(

apps/mcp-server/src/main.rs

@@ -6,7 +6,7 @@ mod session;
 use std::{env, net::SocketAddr, time::Duration};
 
 use crank_registry::{PostgresPoolConfig, PostgresRegistry};
-use crank_runtime::SecretCrypto;
+use crank_runtime::{RuntimeExecutor, RuntimeLimits, SecretCrypto};
 use sqlx::postgres::PgConnectOptions;
 use tokio::net::TcpListener;
 use tracing::info;
@@ -31,16 +31,22 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .unwrap_or_else(|| Duration::from_secs(5));
     let socket_addr: SocketAddr = bind_addr.parse()?;
     let pool_config = PostgresPoolConfig::from_env()?;
+    let runtime_limits = RuntimeLimits::from_env()?;
     let registry = PostgresRegistry::connect_with_options_and_pool_config(
         database_options_from_env()?,
         pool_config,
     )
     .await?;
     let secret_crypto = SecretCrypto::new(&env::var("CRANK_MASTER_KEY")?)?;
-    let app = build_app(registry, refresh_interval, base_url, secret_crypto);
+    let runtime = RuntimeExecutor::with_limits(runtime_limits);
+    let app = build_app(registry, refresh_interval, base_url, secret_crypto, runtime);
     let listener = TcpListener::bind(socket_addr).await?;
 
     info!(
+        runtime_max_concurrent_unary = runtime_limits.max_concurrent_unary,
+        runtime_max_concurrent_window = runtime_limits.max_concurrent_window,
+        runtime_max_concurrent_sessions = runtime_limits.max_concurrent_sessions,
+        runtime_max_concurrent_jobs = runtime_limits.max_concurrent_jobs,
         max_connections = pool_config.max_connections,
         min_connections = pool_config.min_connections,
         acquire_timeout_ms = pool_config.acquire_timeout_ms,
@@ -106,7 +112,7 @@ mod tests {
         CreateAgentRequest, CreatePlatformApiKeyRequest, ListInvocationLogsQuery, PostgresRegistry,
         PublishAgentRequest, PublishRequest,
     };
-    use crank_runtime::SecretCrypto;
+    use crank_runtime::{RuntimeExecutor, SecretCrypto};
     use crank_schema::{Schema, SchemaKind};
     use futures_util::stream;
     use serde_json::{Value, json};
@@ -173,6 +179,7 @@ mod tests {
             refresh_interval,
             public_base_url,
             SecretCrypto::new("test-master-key").unwrap(),
+            RuntimeExecutor::new(),
         )
     }