mcp: throttle transport read requests

2026-05-02 08:33:07 +00:00
parent fdad20a8d1
commit c597557a5e
3 changed files with 77 additions and 7 deletions
@@ -947,6 +947,52 @@ mod tests {
        assert_eq!(response.status(), reqwest::StatusCode::NOT_FOUND);
    }

+    #[tokio::test]
+    async fn rejects_rapid_transport_get_requests_with_429() {
+        let registry = test_registry().await;
+        publish_agent_with_bindings(&registry, "sales-get-rate-limit", vec![]).await;
+        let api_key = create_platform_api_key(
+            &registry,
+            "mcp-get-rate-limit",
+            &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+        )
+        .await;
+        let base_url = spawn_mcp_server(build_test_app_with_rate_limit(
+            registry,
+            Duration::from_millis(0),
+            Some("https://crank.example.com".to_owned()),
+            RequestRateLimitConfig::new(1, 2).unwrap(),
+        ))
+        .await;
+        let client = reqwest::Client::new();
+        let mcp_url = agent_mcp_url(&base_url, "sales-get-rate-limit");
+        let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
+
+        let first_response = client
+            .get(&mcp_url)
+            .header(header::ACCEPT, "text/event-stream")
+            .header(header::AUTHORIZATION, format!("Bearer {api_key}"))
+            .header("MCP-Session-Id", &initialized_session)
+            .header("MCP-Protocol-Version", "2025-11-25")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(first_response.status(), reqwest::StatusCode::OK);
+
+        let second_response = client
+            .get(&mcp_url)
+            .header(header::ACCEPT, "text/event-stream")
+            .header(header::AUTHORIZATION, format!("Bearer {api_key}"))
+            .header("MCP-Session-Id", &initialized_session)
+            .header("MCP-Protocol-Version", "2025-11-25")
+            .send()
+            .await
+            .unwrap();
+
+        assert_eq!(second_response.status(), reqwest::StatusCode::TOO_MANY_REQUESTS);
+        assert!(second_response.headers().get(header::RETRY_AFTER).is_some());
+    }
+
    #[tokio::test]
    async fn get_requires_session_header() {
        let registry = test_registry().await;