MCP result boundaries

Apply limits.mcpReadResponseMaxBytes to the compact UTF-8 JSON encoding of every complete redacted application read result. Enforce the strict 64 KiB through 8 MiB range with a 1 MiB default. Measure only after recursive secret redaction, and refuse an oversized read as one whole result. For a native binary attachment result, derive a conservative raw-byte ceiling from the same limit before fetch, reserving both the fixed MCP envelope and base64 expansion, then apply the ordinary whole-result measurement to the encoded tool or resource response. Never truncate structured or binary data, return a preview, report the actual size, emit a digest of withheld data, compress around the policy, spill to a file, create a snapshot or result cache, or issue a follow-up token that bypasses the same boundary.

Tool refusals must be schema-valid fixed content-free errors containing only a fixed code, fixed recovery guidance, the configured limit, and an above-limit marker. Resource and prompt refusals must be bounded InvalidParams protocol errors with no URI-specific evidence, identifiers, arguments, values, or measured byte count. Apply the same boundary to input_required results because no mutation has occurred yet.

Never replace, truncate, or reject the final result or error of a mutation-capable tool based on this read budget. Discord may already have changed, so preserving its complete final outcome takes priority over the configured read boundary. Protocol initialization, discovery and list responses, list-change events, and notifications are separate control surfaces; bound them through toolset selection, progressive discovery, and existing catalog rules rather than treating them as application read results.

Keep community activity analysis transient and metadata-only. Resolve only exact permitted channels, ignore every message-content field, and return only aggregate participant, reply, timing, sample-composition, and pagination evidence. Exact author and reply-target IDs may exist only inside one calculation and must not enter the result, activity state, operation receipts, cache, telemetry, database, error detail, or local file. Omit usernames, channel names, profiles, roles, content, attachments, URLs, per-message evidence, and per-user rankings. Treat a bounded sample and a short or empty Discord page as limited observations, never as complete history, whole-community behavior, sentiment, intent, or causal evidence.

Canonical source: SECURITY.md