From 152e1b69627a59eec63ac4bb30472358eba03e66 Mon Sep 17 00:00:00 2001
From: Aditya Gaurav <aditya-ai-architect@users.noreply.github.com>
Date: Fri, 6 Feb 2026 04:14:53 +0530
Subject: [PATCH 1/2] feat(express): add limit option for JSON body parser

Add a `limit` option to `CreateMcpExpressAppOptions` that is passed
through to `express.json({ limit })`, allowing users to override the
default 100kb request body size limit.

Closes #1354
---
 packages/middleware/express/src/express.ts       | 13 +++++++++++--
 packages/middleware/express/test/express.test.ts | 10 ++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/packages/middleware/express/src/express.ts b/packages/middleware/express/src/express.ts
index ff23cde85..d27c6a2bc 100644
--- a/packages/middleware/express/src/express.ts
+++ b/packages/middleware/express/src/express.ts
@@ -22,6 +22,15 @@ export interface CreateMcpExpressAppOptions {
      * to restrict which hostnames are allowed.
      */
     allowedHosts?: string[];
+
+    /**
+     * Controls the maximum request body size for the JSON body parser.
+     * Passed directly to `express.json({ limit })`.
+     * Defaults to Express's built-in default of '100kb' when not specified.
+     *
+     * @example '10mb'
+     */
+    limit?: string | number;
 }
 
 /**
@@ -48,10 +57,10 @@ export interface CreateMcpExpressAppOptions {
  * ```
  */
 export function createMcpExpressApp(options: CreateMcpExpressAppOptions = {}): Express {
-    const { host = '127.0.0.1', allowedHosts } = options;
+    const { host = '127.0.0.1', allowedHosts, limit } = options;
 
     const app = express();
-    app.use(express.json());
+    app.use(express.json(limit !== undefined ? { limit } : undefined));
 
     // If allowedHosts is explicitly provided, use that for validation
     if (allowedHosts) {
diff --git a/packages/middleware/express/test/express.test.ts b/packages/middleware/express/test/express.test.ts
index 64cf533bc..904281064 100644
--- a/packages/middleware/express/test/express.test.ts
+++ b/packages/middleware/express/test/express.test.ts
@@ -167,6 +167,16 @@ describe('@modelcontextprotocol/express', () => {
             warn.mockRestore();
         });
 
+        test('should accept limit option for JSON body parser', () => {
+            const app = createMcpExpressApp({ limit: '10mb' });
+            expect(app).toBeDefined();
+        });
+
+        test('should accept numeric limit option for JSON body parser', () => {
+            const app = createMcpExpressApp({ limit: 1048576 });
+            expect(app).toBeDefined();
+        });
+
         test('should not apply host validation for non-localhost hosts without allowedHosts', () => {
             const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
 

From 57274765bc712264078db89b662cb456811b947f Mon Sep 17 00:00:00 2001
From: Aditya Gaurav <aditya-ai-architect@users.noreply.github.com>
Date: Fri, 6 Feb 2026 04:18:23 +0530
Subject: [PATCH 2/2] chore: add changeset for express JSON limit option

---
 .changeset/express-json-limit.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/express-json-limit.md

diff --git a/.changeset/express-json-limit.md b/.changeset/express-json-limit.md
new file mode 100644
index 000000000..3c49fe4d3
--- /dev/null
+++ b/.changeset/express-json-limit.md
@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/express': minor
+---
+
+Add `limit` option to `createMcpExpressApp()` to allow overriding the default 100kb JSON body parser size limit.