Expensive operations have resource limits

A read_file tool with no size limit will attempt to load a 5GB log file into Node.js heap, causing an out-of-memory crash that takes down every tool in the server simultaneously. A database query tool with no LIMIT clause can return millions of rows, exhausting memory and making the response unparseable. CWE-400 (uncontrolled resource consumption) and CWE-770 (allocation of resources without limits) are the mechanisms. These are not theoretical edge cases — agentic AI workflows routinely hit large files and broad queries when exploring unfamiliar codebases or databases.

Add explicit size checks before loading data and document the limits in the tool description.

// src/tools/read-file.ts — bounded file read
const MAX_FILE_SIZE = 10 * 1024 * 1024  // 10 MB

server.tool('read_file', 'Read a file (max 10 MB). For larger files, use read_file_range.', ...,
  async ({ path }) => {
    const stat = await fs.stat(path)
    if (stat.size > MAX_FILE_SIZE) {
      return {
        content: [{ type: 'text', text:
          `File is ${(stat.size / 1024 / 1024).toFixed(1)} MB — exceeds 10 MB limit. ` +
          `Use read_file_range to read specific byte ranges.`
        }],
        isError: true,
      }
    }
    return { content: [{ type: 'text', text: await fs.readFile(path, 'utf-8') }] }
  }
)