feat(mcp-server): per-user/business/tool rate limiting (MCP Prompt 18)

[gilgardosh]

Summary

Implements Prompt 18 – Rate limiting middleware (see
docs/mcp/spec.md §11.4). Adds an in-memory
limiter enforced before any upstream call.

Stacked PR: targets claude/mcp-prompt-17-error-taxonomy (Prompt 17, #4021).
Review/merge Prompts 09→17 first; this diff shows only the Prompt 18 changes.

Changes

• src/rate-limit/limiter.ts — RateLimiter, a fixed-window counter with an injectable clock (deterministic tests). rateLimitKey scopes buckets to userId + sorted business scope + tool (spec §11.4). parseRateLimitConfig reads MCP_RATE_LIMIT_CONFIG (JSON) with safe defaults ({ windowMs: 60000, max: 60 }).
• src/rate-limit/default-limiter.ts — lazily-memoized, env-backed process limiter.
• src/tools/execute.ts — an optional limiter is enforced after authorization and before the handler (so it's ahead of the upstream call). Over-limit returns a RATE_LIMIT_ERROR via the unified taxonomy with retryAfterMs.
• src/mcp/handler.ts — the dispatch path passes the process limiter (built lazily, only when a real tool runs).
• Tests — burst-then-deny, per-key isolation, window reset, denied-doesn't-consume, config parsing, and end-to-end limiting through executeRegisteredTool (incl. business-scope keying). 202 tests total.

Validation

• yarn workspace @accounter/mcp-server test → 202 passed
• yarn workspace @accounter/mcp-server lint / typecheck / build → pass

Notes / open decisions

• In-memory, per-process (spec allows this for phase 1). For a multi-instance deployment this should move to a shared store (Redis); the RateLimiter interface is small enough to swap.
• limiter is optional on executeRegisteredTool so the existing tool unit tests run without touching env; the live dispatch path always supplies it.
• Fixed-window (not token-bucket) for simplicity and determinism; conservative default (60/min per user·scope·tool) to be tuned after observing production traffic.

🤖 Generated with Claude Code

---

Generated by Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Pull request overview

Adds Prompt 18 rate limiting to the MCP server by introducing an in-memory fixed-window limiter, wiring it into tool execution/dispatch, and documenting + testing the behavior end-to-end.

Changes:

• Introduced RateLimiter + rateLimitKey and env-driven config parsing (MCP_RATE_LIMIT_CONFIG).
• Enforced rate limiting in executeRegisteredTool (after authz, before handler/upstream call) and plumbed the process limiter from the MCP request handler.
• Added unit + integration-style tests for limiter behavior and tool-execution limiting; documented the new behavior in the package README.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/mcp-server/src/tools/execute.ts	Adds optional limiter enforcement and RATE_LIMIT_ERROR mapping before handler execution.
packages/mcp-server/src/tools/tests/rate-limit.execute.test.ts	Validates end-to-end limiting through executeRegisteredTool, including scope-based keying.
packages/mcp-server/src/rate-limit/limiter.ts	Introduces in-memory fixed-window limiter, keying helper, and env config parsing.
packages/mcp-server/src/rate-limit/default-limiter.ts	Adds lazy, memoized process-wide limiter configured from env.
packages/mcp-server/src/rate-limit/tests/limiter.test.ts	Covers limiter behavior (burst, isolation, reset, denied-doesn’t-consume) and config parsing.
packages/mcp-server/src/mcp/handler.ts	Passes the default process limiter into tool execution on tools/call.
packages/mcp-server/README.md	Documents rate limiting behavior, error code, and configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.