pkg/params exposes pagination helpers (page, per_page) but doesn't cap per_page at a sane ceiling. Callers can request arbitrarily large pages, which (a) puts unnecessary load on the upstream Gitea instance and (b) can blow up the MCP response if a tool returns 1000+ records into a single message.
Negative / zero values are also accepted in some paths instead of falling back to a default.
Suggested direction
Add a single ValidatePagination(page, perPage) helper in pkg/params
Return a clear MCP error if a caller exceeds the cap, rather than silently truncating
Unit-test the boundary cases
## Problem
`pkg/params` exposes pagination helpers (`page`, `per_page`) but doesn't cap `per_page` at a sane ceiling. Callers can request arbitrarily large pages, which (a) puts unnecessary load on the upstream Gitea instance and (b) can blow up the MCP response if a tool returns 1000+ records into a single message.
Negative / zero values are also accepted in some paths instead of falling back to a default.
## Suggested direction
- Add a single `ValidatePagination(page, perPage)` helper in `pkg/params`
- Enforce `1 <= page` and `1 <= perPage <= 100` (Gitea's typical max)
- Return a clear MCP error if a caller exceeds the cap, rather than silently truncating
- Unit-test the boundary cases
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
pkg/paramsexposes pagination helpers (page,per_page) but doesn't capper_pageat a sane ceiling. Callers can request arbitrarily large pages, which (a) puts unnecessary load on the upstream Gitea instance and (b) can blow up the MCP response if a tool returns 1000+ records into a single message.Negative / zero values are also accepted in some paths instead of falling back to a default.
Suggested direction
ValidatePagination(page, perPage)helper inpkg/params1 <= pageand1 <= perPage <= 100(Gitea's typical max)