fix: throttle writes, bound mcp inputs, harden oauth consent

[FrkAk]

Summary

Task Reference: none (security-review hardening; no associated Mymir task)

Addresses the high/medium findings from the security review that map to hosted-cost abuse and OAuth client spoofing. Dynamic client registration stays open (the standard MCP onboarding pattern); the fixes target what rides along with it rather than registration itself.

Cost / abuse (hosted):

• Throttle the web write path with per-action budgets on the mutation wrappers (generous for humans, tight for scripts), since server-action POSTs bypass the /api/* middleware limiter.
• Cap MCP tool inputs: an explicit request body-size limit on /api/mcp (MCP_MAX_BODY_BYTES) plus generous per-field/array ceilings — anti-abuse, not content policy; long unabridged plans still pass.
• Per-project task cap (MAX_TASKS_PER_PROJECT, default 50k) as a growth backstop.
• Throttle open OAuth client registration via the strict auth binding; nightly purge of abandoned dynamically-registered clients.

OAuth consent spoofing:

• Gate brand-name normalization on a server-side verified client_id allowlist (empty by default), so an unverified dynamically-registered client renders its raw registered name and cannot impersonate a trusted brand.

Agent prompt-injection defense-in-depth:

• Untrusted-content framing notice prepended to the agent and review context bundles.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)

Notes for reviewer

DB-backed test suites and bun run dev were not run in the sandbox (no Docker/Postgres available); affected golden snapshots were updated by hand and a regression test added for the register rate-limit rule. Tunable env knobs: MCP_MAX_BODY_BYTES, MAX_TASKS_PER_PROJECT, MYMIR_VERIFIED_OAUTH_CLIENT_IDS.

[FrkAk]

Superseded by #118, which carries the identical commit on a branch without the claude/ prefix. Closing this one.

---

Generated by Claude Code