Rate limiting per API key

[rjoydip]

Auto-created from TASKS.md

[rjoydip]

Issue Analysis: Rate Limiting per API Key

1. Issue Classification

• Type: Enhancement (existing infrastructure, needs completion)
• Priority: Medium
• Complexity: Simple (1-2 hours) - core implementation already exists

2. Implementation Status

The rate limiting infrastructure is already implemented:

Component	Status	Location
Rate limit store	✅ Done	src/lib/mcp/rate-limit.ts:32-37
Auth + rate limit check	✅ Done	src/lib/mcp/auth.ts:84-122
429 response factory	✅ Done	src/lib/mcp/auth.ts:130-151
Rate limit reset	✅ Done	src/lib/mcp/rate-limit.ts:42-44
Unit tests	✅ Done	test/lib/mcp/rate-limit.test.ts
Header injection	✅ Done	src/lib/mcp/rate-limit.ts:55-65

3. Remaining Work

Per the plan's blocker notes (knowledge/plans/phase-9-mcp-server-plan.md:456-458):

Middleware to enforce rateLimit/rateLimitDuration from schema

Potential gaps to verify:

1. Are all MCP endpoints consistently using validateMcpAuth?
2. Should rate limit headers be added to all responses, not just rate-limited ones?
3. Is there a need for a dedicated middleware at the MCP server/transport level vs. per-endpoint?

4. Recommended Actions

1. Verify endpoint coverage - ensure all MCP tool routes use validateMcpAuth
2. Add rate limit headers to successful responses (currently only added on 429)
3. Update plan status - mark item as partially implemented if appropriate

5. Related Resources

• Plan: knowledge/plans/phase-9-mcp-server-plan.md:446
• Core rate-limit: src/lib/mcp/rate-limit.ts
• Auth integration: src/lib/mcp/auth.ts
• Test reference: test/lib/mcp/rate-limit.test.ts

Clarification needed from reporter: What specific behavior is missing? The implementation appears complete. Are there endpoints not receiving rate limit enforcement, or is this tracking a future enhancement (e.g., per-endpoint rate limits, burst handling)?

opencode session  |  github run