[mcp] fix: reject ambiguous content length

[Wangmerlyn]

Summary

• validate parser-normalized Content-Length with headers.get_all() before reading request bodies
• reject duplicate headers, signed values, underscores, and other non-digit forms with existing REST/JSON-RPC error shapes
• add REST plus / and /rpc regression coverage proving invalid lengths do not create sessions or dispatch JSON-RPC methods

Verification

• baseline PYTHONPATH=src pytest tests/mcp/test_http_api.py tests/mcp/test_server.py -q -> 270 passed
• RED duplicate/loose Content-Length tests failed before implementation
• PYTHONPATH=src pytest tests/mcp/test_http_api.py::test_http_post_rejects_duplicate_content_length tests/mcp/test_http_api.py::test_http_post_rejects_loose_content_length_syntax -q -> 9 passed
• PYTHONPATH=src pytest tests/mcp/test_http_api.py tests/mcp/test_server.py -q -> 279 passed
• PYTHONPATH=src pytest tests -q -> 931 passed, 11 skipped
• mkdocs build --strict
• pre-commit run --all-files --show-diff-on-failure
• local subagent review: no critical/important findings; coverage nits resolved

README/Zenodo badge untouched.

Summary by CodeRabbit

• Bug Fixes

  • Tightened HTTP request validation so Content-Length must be a single, plain non-negative decimal value.
  • Requests with duplicate, signed, underscored, or otherwise malformed Content-Length values now fail immediately with the appropriate error response.
  • Improved JSON-RPC and REST error handling for invalid request bodies.

• Documentation

  • Added guidance describing the accepted Content-Length format and expected rejection behavior for invalid headers.

[coderabbitai]

Warning

Review limit reached

@Wangmerlyn, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f2777395-36f1-4579-98f6-5b15bfff8633

📥 Commits

Reviewing files that changed from the base of the PR and between 87af0bf and f2af82b.

📒 Files selected for processing (4)

• AGENTS.md
• docs/plans/http-content-length-validation.md
• src/keep_gpu/mcp/server.py
• tests/mcp/test_http_api.py

📝 Walkthrough

Walkthrough

Content-Length header parsing in the MCP HTTP server's _read_json_body is tightened to require exactly one header value validated as a strict non-negative decimal, replacing the prior try/except-based conversion. Supporting documentation and expanded tests cover duplicate headers and loose numeric syntax rejection.

Changes

Content-Length validation

Layer / File(s)	Summary
Validation implementation src/keep_gpu/mcp/server.py	_read_json_body requires exactly one content-length header via get_all, validates it with isdecimal(), and removes the prior try/except conversion and explicit negative-length check.
Tests for header edge cases tests/mcp/test_http_api.py	Adds _raw_post_with_content_length_headers helper and new tests for duplicate Content-Length headers and loose syntax (e.g., "+2", "0_2"), updating existing non-integer test assertions to cover both "/" and "/rpc".
Guideline and design documentation AGENTS.md, docs/plans/http-content-length-validation.md	Updates agent guidelines and adds a new plan document specifying strict single-header, canonical decimal validation rules and rollout scope.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• Wangmerlyn/KeepGPU#122: Also modifies do_POST/_read_json_body error handling to produce consistent JSON-RPC -32700 parse-error envelopes for malformed input.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: rejecting ambiguous Content-Length values in MCP HTTP handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/http-content-length-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces stricter validation for the Content-Length header in the HTTP JSON body reader, rejecting duplicate headers and loose integer representations (such as signs or underscores). It also updates documentation and adds comprehensive test coverage for these scenarios. The review feedback highlights two important improvements: first, ensuring that Content-Length only accepts ASCII digits to prevent potential HTTP request smuggling vulnerabilities caused by Unicode decimal digits; second, correcting a test assertion condition to ensure consistent JSON-RPC validation coverage across both / and /rpc endpoints.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/keep_gpu/mcp/server.py`:
- Around line 1172-1181: The Content-Length parsing in the request handler still
accepts Unicode decimal digits because `isdecimal()` and `int()` are too
permissive here. Update the validation in the header parsing logic around
`self.headers.get_all("content-length")` to enforce ASCII-only digits before
converting, and keep the existing single-header and non-negative checks intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0161c207-f94c-4225-8c36-8e77fabf2eaf

📥 Commits

Reviewing files that changed from the base of the PR and between 1e7cc52 and 87af0bf.

📒 Files selected for processing (4)

• AGENTS.md
• docs/plans/http-content-length-validation.md
• src/keep_gpu/mcp/server.py
• tests/mcp/test_http_api.py