Clawpatch finding
- Severity: medium
- Category: performance
- Confidence: high
- Feature:
feat_custom_apis_anthropic_classifier_misc
- Finding ID:
fnd_sig-feat-custom-apis-anthropic-c_32a38b334e
- Run ID:
20260831T083634-03cffd
- Reviewer model:
gpt-5.6-sol via the local Codex provider at xhigh
- Prior overlap: No matching GitHub issue or finding in the immediately preceding GPT-5.6 review was found.
Evidence
apis/src/mcp_client/mod.rs:227-243 (list_tools)apis/src/mcp_client/mod.rs:315-356 (paginate_tools)
Description
The configured timeout separately bounds the MCP handshake and each tools/list page. paginate_tools permits up to 100 pages, so a server can delay every page until just below the timeout and retain one request task for approximately 100 times the advertised timeout, plus the handshake. With the default dispatch timeout of tens of seconds, a malicious or degraded MCP server can consume a worker for many minutes despite the configured bound.
Reproduction
Run an MCP server that returns an empty tools page with a new next_cursor after sleeping slightly less than the configured timeout. list_tools continues for up to 100 successful delayed pages rather than terminating after one timeout interval.
Recommendation
Create one deadline at the start of list_tools and wrap the complete handshake-plus-pagination future in that deadline, or calculate remaining time before every network operation. Keep the per-operation timeout only if it is capped by the remaining overall budget.
Reported from a Clawpatch review of apis/src at commit 543259683b9ff9a3f42772703a6d9ca134948475.
Clawpatch finding
feat_custom_apis_anthropic_classifier_miscfnd_sig-feat-custom-apis-anthropic-c_32a38b334e20260831T083634-03cffdgpt-5.6-solvia the local Codex provider atxhighEvidence
apis/src/mcp_client/mod.rs:227-243(list_tools)apis/src/mcp_client/mod.rs:315-356(paginate_tools)Description
The configured timeout separately bounds the MCP handshake and each tools/list page. paginate_tools permits up to 100 pages, so a server can delay every page until just below the timeout and retain one request task for approximately 100 times the advertised timeout, plus the handshake. With the default dispatch timeout of tens of seconds, a malicious or degraded MCP server can consume a worker for many minutes despite the configured bound.
Reproduction
Run an MCP server that returns an empty tools page with a new next_cursor after sleeping slightly less than the configured timeout. list_tools continues for up to 100 successful delayed pages rather than terminating after one timeout interval.
Recommendation
Create one deadline at the start of list_tools and wrap the complete handshake-plus-pagination future in that deadline, or calculate remaining time before every network operation. Keep the per-operation timeout only if it is capped by the remaining overall budget.
Reported from a Clawpatch review of
apis/srcat commit543259683b9ff9a3f42772703a6d9ca134948475.