fix(nginx): MCP rate limit per-api_key + IP safety net - #269
Open
MoltyCel wants to merge 1 commit into
Open
Conversation
… runbook) The /mcp per-IP limit collapsed ~38 Smithery-gateway users (behind ~2 Cloudflare Worker egress IPs) into 2 buckets → 84% false 429 from 2026-07-15. real_ip won't help: api.moltrust.ch is DNS-direct (no CF-Connecting-IP), the CF IPs are Smithery's egress, and no per-user IP header is verified to arrive. The only reliable per-user id is api_key. Change (location /mcp): key on $arg_api_key (60r/min burst 30), keyless → source IP fallback, plus a per-IP safety net (600r/min burst 100) for random-key floods. Two limit_req directives apply cumulatively. nginx is not repo-managed → this is the staged infra-as-code runbook + exact diffs; live apply is human-gated (nginx -t + reload need interactive sudo). Also flagged (separate item, not fixed): error_log leaks api_key in cleartext (15,404 occurrences) — the access-log mask doesn't cover error_log. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per-api_key rate limit for /mcp (60r/min burst 30) + per-IP safety net (600r/min burst 100), replacing the per-IP 7r/min that collapsed ~38 Smithery-gateway users into 2 CF-egress buckets (84% false 429). real_ip disproven (see runbook). Infra-as-code runbook only — live nginx apply is human-gated. Flags a separate error_log api_key-cleartext leak (15,404 occ).