mcp sdk has no request size validation either, right? just response size

hit this yesterday - client sent tool call with 8mb of base64 encoded image data in a param and sdk just accepted it and passed to the tool. no size limit on request params at all?? seems like same validation gap as response size (#637, #621) but on the input side. anyone else hit this or did i misconfigure something