fix: address independent review findings

tests/test_mcp_http.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import http.client
+import socket
 import tempfile
 import threading
 import unittest
@@ -24,7 +26,11 @@ class MCPHTTPTestCase(unittest.TestCase):
             {"bootstrap-secret-at-least-24": TokenIdentity("system", "system", "System")}
         )
         self.server = ProjectBusHTTPServer(
-            ("127.0.0.1", 0), MCPApplication(service), auth, {"https://chat.example"}
+            ("127.0.0.1", 0),
+            MCPApplication(service),
+            auth,
+            {"https://chat.example"},
+            request_read_timeout_seconds=0.2,
         )
         self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
         self.thread.start()
@@ -115,6 +121,60 @@ class MCPHTTPTestCase(unittest.TestCase):
         self.assertEqual(status, 403)
         self.assertEqual(response["error"], "origin_not_allowed")
 
+    def test_deeply_nested_json_returns_parse_error(self) -> None:
+        body = b"[" * 200_000 + b"]" * 200_000
+        connection = http.client.HTTPConnection(
+            "127.0.0.1", self.server.server_port, timeout=2
+        )
+        connection.request(
+            "POST",
+            "/mcp",
+            body=body,
+            headers={"Content-Type": "application/json"},
+        )
+        response = connection.getresponse()
+        payload = json.loads(response.read())
+        connection.close()
+
+        self.assertEqual(response.status, 200)
+        self.assertEqual(payload["error"]["code"], -32700)
+
+    def test_brackets_inside_json_string_do_not_count_as_nesting(self) -> None:
+        status, response = self.request(
+            {
+                "jsonrpc": "2.0",
+                "id": 1,
+                "method": "initialize",
+                "params": {"text": "[{" * 500 + "}]" * 500},
+            }
+        )
+        self.assertEqual(status, 200)
+        self.assertIn("result", response)
+
+    def test_incomplete_body_times_out(self) -> None:
+        connection = socket.create_connection(
+            ("127.0.0.1", self.server.server_port), timeout=2
+        )
+        connection.settimeout(2)
+        connection.sendall(
+            b"POST /mcp HTTP/1.1\r\n"
+            b"Host: 127.0.0.1\r\n"
+            b"Content-Type: application/json\r\n"
+            b"Content-Length: 100\r\n"
+            b"Connection: close\r\n\r\n"
+            b'{"jsonrpc":'
+        )
+        response = b""
+        while True:
+            chunk = connection.recv(4_096)
+            if not chunk:
+                break
+            response += chunk
+        connection.close()
+
+        self.assertIn(b"HTTP/1.1 408 Request Timeout", response)
+        self.assertIn(b'"error":"request_body_timeout"', response)
+
 
 if __name__ == "__main__":
     unittest.main()