# streamable HTTP

Published articles for streamable HTTP.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Patching This Site's MCP Endpoint and Limiting What It Can Do

DevFeed: [Patching This Site's MCP Endpoint and Limiting What It Can Do](<https://devfeed.tech/articles/patching-this-site-s-mcp-endpoint-and-limiting-what-it-can-do-30870.md>)

Original publisher: [Read original article](<https://brent.leekley.me/blog/mcp-patch-and-limits/>)

Author: Brent Leekley

Published: 2026-09-08T00:00:00Z

Content type: tutorial

Language: en

Sources: [brent.leekley.me blog](<https://devfeed.tech/sources/brent-leekley-me-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [API](<https://devfeed.tech/topics/api.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [aeo](<https://devfeed.tech/tags/aeo.md>), [agent-ready-website](<https://devfeed.tech/tags/agent-ready-website.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [api](<https://devfeed.tech/tags/api.md>), [api-security](<https://devfeed.tech/tags/api-security.md>), [clients](<https://devfeed.tech/tags/clients.md>), [json-rpc](<https://devfeed.tech/tags/json-rpc.md>), [logs](<https://devfeed.tech/tags/logs.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [retry](<https://devfeed.tech/tags/retry.md>), [server](<https://devfeed.tech/tags/server.md>), [streamable-http](<https://devfeed.tech/tags/streamable-http.md>), [webmcp](<https://devfeed.tech/tags/webmcp.md>)

### AI overview

This article explains how to patch a website's public, unauthenticated MCP endpoint. It covers updating to the current protocol revision while retaining compatibility with older clients, and applying limits including read-only tools, per-IP rate limiting, request-size caps, Origin checks, POST-only access, non-reflected strings, and privacy-preserving logs.

### Source excerpt

An MCP server on your website is a public, unauthenticated API. Bringing one to the current protocol revision while keeping older clients working, and the seven limits that bound it: read-only tools, a per-IP rate limit that always sends Retry-After, hard caps on body and argument size, an https-only Origin check, POST only, no reflected strings, and logs that store a salted hash instead of an address.