Skip to content

jaegermcp: enforce MaxSpanDetailsPerRequest in get_span_details#8174

Open
jkowall wants to merge 2 commits intojaegertracing:mainfrom
jkowall:codex/upstream-get-span-details-limit-dco
Open

jaegermcp: enforce MaxSpanDetailsPerRequest in get_span_details#8174
jkowall wants to merge 2 commits intojaegertracing:mainfrom
jkowall:codex/upstream-get-span-details-limit-dco

Conversation

@jkowall
Copy link
Contributor

@jkowall jkowall commented Mar 14, 2026

Motivation

  • get_span_details accepted unbounded span_ids lists even though the MCP config already exposed MaxSpanDetailsPerRequest.
  • That made the configured guard ineffective and let callers drive unnecessary memory and CPU work.
  • Per review feedback, the handler should trust validated config rather than carrying its own fallback.

Description

  • Pass MaxSpanDetailsPerRequest into the get_span_details handler from the server.
  • Reject requests whose span_ids exceed the configured limit.
  • Validate MaxSpanDetailsPerRequest in Config.Validate() so the handler can rely on it.
  • Remove the redundant handler-side defaulting and update tests to construct handlers with an explicit configured limit.
  • Add coverage for the invalid low-end config case and the oversized span_ids request case.

Testing

  • Ran the repo-equivalent format/lint steps successfully (make fmt/make lint had to be executed manually because this Windows + WSL environment cannot execute the repo shebang scripts directly).
  • Ran go test -race ./cmd/jaeger/internal/extension/jaegermcp/....
  • Ran make test; it still fails in this environment due unrelated existing failures in cmd/anonymizer/app/uiconv and internal/uimodel/converter/v1/json.

Signed-off-by: Jonah Kowall <jkowall@kowall.net>
@jkowall jkowall requested a review from a team as a code owner March 14, 2026 16:44
Copilot AI review requested due to automatic review settings March 14, 2026 16:44
@jkowall jkowall added the changelog:refactoring Internal code refactoring without functional changes label Mar 14, 2026
@jkowall
Copy link
Contributor Author

jkowall commented Mar 14, 2026

Porting over Yuri's review note from the fork PR for context:

"Redundant, config value should be validated by config struct's Validate method."

Addressed in this PR by:

  • removing the handler-side fallback/defaulting in get_span_details
  • validating MaxSpanDetailsPerRequest in Config.Validate()
  • keeping the request-size enforcement in the handler, with tests using an explicit configured limit

My reply: updated accordingly. The handler now relies on validated config instead of carrying its own backup default.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR makes the get_span_details MCP tool respect the existing MaxSpanDetailsPerRequest configuration, preventing unbounded span ID requests from driving excessive CPU/memory work.

Changes:

  • Pass MaxSpanDetailsPerRequest from the MCP server into the get_span_details handler.
  • Enforce the max span ID count in get_span_details request validation.
  • Strengthen config validation and expand unit test coverage for invalid config and oversized requests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
cmd/jaeger/internal/extension/jaegermcp/server.go Wires MaxSpanDetailsPerRequest into the get_span_details handler constructor.
cmd/jaeger/internal/extension/jaegermcp/internal/handlers/get_span_details.go Adds a per-request span_ids length guard based on configured max.
cmd/jaeger/internal/extension/jaegermcp/internal/handlers/get_span_details_test.go Updates handler construction in tests and adds coverage for oversized span_ids.
cmd/jaeger/internal/extension/jaegermcp/config.go Adds an explicit low-end validation for MaxSpanDetailsPerRequest.
cmd/jaeger/internal/extension/jaegermcp/config_test.go Adds a test case for too-low MaxSpanDetailsPerRequest.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Jonah Kowall <jkowall@kowall.net>
@jkowall jkowall force-pushed the codex/upstream-get-span-details-limit-dco branch from bae483a to c47b392 Compare March 14, 2026 16:49

if len(input.SpanIDs) > h.maxSpanDetailsPerRequest {
return querysvc.GetTraceParams{}, fmt.Errorf(
"span_ids must not exceed %d items",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"span_ids must not exceed %d items",
"Number of input Span IDs must not exceed %d items",

ServerVersion string `mapstructure:"server_version" valid:"required"`

// MaxSpanDetailsPerRequest limits the number of spans that can be fetched in a single request.
MaxSpanDetailsPerRequest int `mapstructure:"max_span_details_per_request" valid:"range(1|100)"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why remove validation?

if cfg.MaxSpanDetailsPerRequest < 1 {
return fmt.Errorf("max_span_details_per_request must be at least 1")
}
if cfg.MaxSpanDetailsPerRequest > 100 {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do this manually instead of via govalidator.ValidateStruct ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog:refactoring Internal code refactoring without functional changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants