operation/actions/runs.go accepts max_bytes and tail_lines parameters without bounds. A caller can request multi-GB log payloads or unreasonable line counts, which will exhaust memory in the MCP server process before any response is returned.
Suggested direction
Add explicit caps in the tool handler:
max_bytes ≤ ~10 MB (configurable via flag if larger is ever needed)
tail_lines ≤ 10_000
Reject negatives with a clear error
Pair with the broader pagination work in the per_page issue.
## Problem
`operation/actions/runs.go` accepts `max_bytes` and `tail_lines` parameters without bounds. A caller can request multi-GB log payloads or unreasonable line counts, which will exhaust memory in the MCP server process before any response is returned.
## Suggested direction
Add explicit caps in the tool handler:
- `max_bytes` ≤ ~10 MB (configurable via flag if larger is ever needed)
- `tail_lines` ≤ 10_000
- Reject negatives with a clear error
Pair with the broader pagination work in the per_page issue.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
operation/actions/runs.goacceptsmax_bytesandtail_linesparameters without bounds. A caller can request multi-GB log payloads or unreasonable line counts, which will exhaust memory in the MCP server process before any response is returned.Suggested direction
Add explicit caps in the tool handler:
max_bytes≤ ~10 MB (configurable via flag if larger is ever needed)tail_lines≤ 10_000Pair with the broader pagination work in the per_page issue.