Summary
Several endpoints have undocumented server-side --limit caps. Agents read no max in --help, pass --limit 1000, and get INVALID_REQUEST rejections.
| Endpoint |
Cap |
Observed misuse |
| project-defi-metrics |
100 |
12 hits, used up to 1000 |
| news-feed |
50 |
3 hits |
| market-ranking |
100 |
several |
| onchain-yield-ranking |
100 |
several |
| project-defi-ranking |
100 |
several |
| project-detail |
100 |
several |
| social-user-posts |
100 |
several |
Suggested fix
Surface the cap in --help:
--limit int Result limit (default 50, max 100)
And/or auto-clip server-side with a warning so agents don't re-query:
Warning: --limit clipped from 1000 to 100 (max).
Source
cyberconnecthq/research-eval → reviews/surf_cli_vulns.md section F1/F2.
Summary
Several endpoints have undocumented server-side
--limitcaps. Agents read no max in--help, pass--limit 1000, and getINVALID_REQUESTrejections.Suggested fix
Surface the cap in
--help:And/or auto-clip server-side with a warning so agents don't re-query:
Source
cyberconnecthq/research-eval→reviews/surf_cli_vulns.mdsection F1/F2.