Skip to content

Cap maximum limit parameter in Qdrant search #77

@sre-helmcode

Description

@sre-helmcode

Context

The RAG MCP server search_knowledge tool accepts a limit parameter passed directly to Qdrant. A large limit value could cause excessive memory usage or slow responses.

Required Change

Add a maximum cap to the limit parameter:

const maxSearchLimit = 20
if limit > maxSearchLimit {
    limit = maxSearchLimit
}

Apply in both:

  • cmd/rag-mcp/main.go (MCP server search tool)
  • internal/rag/qdrant.go (Qdrant client Search method)

Security Context

Identified during security audit of the RAG feature (MED-3). Prevents abuse via excessively large search requests.

Acceptance Criteria

  • Search limit capped at reasonable maximum (e.g., 20)
  • Values above the cap are silently reduced
  • Default limit remains 5 when not specified

Metadata

Metadata

Assignees

Labels

backendBackend relatedenhancementNew feature or request

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions