425 pages for limits.

Authorization Model Context Protocol · in the page docs/draft/tools/inspector/authorization …the OS keychain when one is reachable. `MCP_INSPECTOR_PERSIST_TOKENS` limits which acquired tokens are kept: `all` (default), `access` (no refresh tokens), or `none` (re-authorize every run). See [Sec… Understanding Authorization in MCP Model Context Protocol · in the page docs/draft/tutorials/security/authorization …timeout = httpx2.Timeout(10.0, connect=5.0) limits = httpx2.Limits(max_connections=10, max_keepalive_connections=5) async with httpx2.AsyncClient(… Local Server Security Model Context Protocol · in the page docs/draft/tutorials/security/local-server-security …. **Going further**: harden the container itself — a seccomp profile limits the system calls it can make, and a Linux security module such as AppArmor or SELinux limits what it can reach, often by do… Skills Model Context Protocol · in the page extensions/skills/overview …ll**, including `SKILL.md`. Hosts **MUST** support skills up to these limits and **MAY** support larger skills. ### Security Considerations Hosts **MUST**: * Prevent skills with the same name from… The MCP Registry Model Context Protocol · in the page registry/about …HTTP challenges, preventing arbitrary spam submissions. * **Character limits and validation** — Free-form fields have strict character limits and regex validation to prevent abuse. * **Manual takedown… SEP-1330: Elicitation Enum Schema Improvements and Standards Compliance Model Context Protocol · in the page seps/1330-elicitation-enum-schema-improvements-and-standards …non-standard approach to adding titles to enumerated values. It also limits use of enums in Elicitation (and any other schema object that should adopt `EnumSchema` in the future) to a single selectio… SEP-1686: Tasks Model Context Protocol · in the page seps/1686-tasks …horter `keepAlive` durations. 1. Receivers **SHOULD**: 1. Enforce limits on concurrent tasks per requestor 2. Enforce maximum `keepAlive` durations to prevent indefinite resource retention 3… SEP-2106: Tools `inputSchema` & `outputSchema` Conform to JSON Schema 2020-12 Model Context Protocol · in the page seps/2106-json-schema-2020-12 …, link-local, and private network addresses), apply timeouts and size limits, and log dereferenced URIs. * Schemas that fail to validate due to an unresolved external `$ref` SHOULD be rejected rather… SEP-2243: HTTP Header Standardization for Streamable HTTP Transport Model Context Protocol · in the page seps/2243-http-standardization …uld require encoding in URLs (e.g., `/`, `?`, `#`) 5. **No URL length limits**: Very long values can be transmitted without hitting URL length restrictions **Advantages of Path-based Routing**: 1. *… SEP-2640: Skills Extension Model Context Protocol · in the page seps/2640-skills-extension …ls/blob/main/docs/archive/problem-statement.md)) * **Instruction size limits.** Server instructions are delivered as the `instructions` field of the `server/discover` result and are practically bounde… SEP-986: Specify Format for Tool Names Model Context Protocol · in the page seps/986-specify-format-for-tool-names …xisting tools that use disallowed characters or exceed the new length limits. To minimize disruption: * Existing non-conforming tool names SHOULD be supported as aliases for at least one major versio… Specification Model Context Protocol · in the page specification/2024-11-05/index …* What results the server can see * The protocol intentionally limits server visibility into prompts ### Implementation Guidelines While MCP itself cannot enforce these security principles at… Specification Model Context Protocol · in the page specification/2025-03-26/index …* What results the server can see * The protocol intentionally limits server visibility into prompts ### Implementation Guidelines While MCP itself cannot enforce these security principles at… Specification Model Context Protocol · in the page specification/2025-06-18/index …* What results the server can see * The protocol intentionally limits server visibility into prompts ### Implementation Guidelines While MCP itself cannot enforce these security principles at… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …a permanent authorization failure Clients **SHOULD** implement retry limits and **SHOULD** track scope upgrade attempts to avoid repeated failures for the same resource and operation combination. ##… Overview Model Context Protocol · in the page specification/2025-11-25/basic/index …sions, or excessive frames (e.g., in GIFs). * Consumers **MAY** set limits for image and content size. * Fetch icons without credentials. Do not send cookies, `Authorization` headers, or client cred… Tasks Model Context Protocol · in the page specification/2025-11-25/basic/utilities/tasks …cks. ### Resource Management 1. Receivers **SHOULD**: 1. Enforce limits on concurrent tasks per requestor 2. Enforce maximum `ttl` durations to prevent indefinite resource retention 3. Clea… Sampling Model Context Protocol · in the page specification/2025-11-25/client/sampling …o other content types) 7. Both parties **SHOULD** implement iteration limits for tool loops Specification Model Context Protocol · in the page specification/2025-11-25/index …* What results the server can see * The protocol intentionally limits server visibility into prompts ### Implementation Guidelines While MCP itself cannot enforce these security principles at… Authorization Model Context Protocol · in the page specification/2026-07-28/basic/authorization/index …a permanent authorization failure Clients **SHOULD** implement retry limits and **SHOULD** track scope upgrade attempts to avoid repeated failures for the same resource and operation combination. Se… Overview Model Context Protocol · in the page specification/2026-07-28/basic/index …k, link-local, and private network addresses, apply timeouts and size limits, and log dereferenced URIs. Schemas that fail to validate due to an unresolved external `$ref` **SHOULD** be rejected rath… Sampling Model Context Protocol · in the page specification/2026-07-28/client/sampling …o other content types) 7. Both parties **SHOULD** implement iteration limits for tool loops Authorization Model Context Protocol · in the page specification/draft/basic/authorization/index …a permanent authorization failure Clients **SHOULD** implement retry limits and **SHOULD** track scope upgrade attempts to avoid repeated failures for the same resource and operation combination. Se… Overview Model Context Protocol · in the page specification/draft/basic/index …k, link-local, and private network addresses, apply timeouts and size limits, and log dereferenced URIs. Schemas that fail to validate due to an unresolved external `$ref` **SHOULD** be rejected rath… Sampling Model Context Protocol · in the page specification/draft/client/sampling …o other content types) 7. Both parties **SHOULD** implement iteration limits for tool loops