Claude Code warns when an MCP tool result passes 10,000 tokens, limits output to 25,000 tokens by default, and saves very large text results to a file instead of the conversation. Tool calls also have timeouts. For security queries, that means big finding lists may be truncated or filed away, so ask for counts first and page deliberately.
What the documentation says
Anthropic's Claude Code MCP reference lists these limits. The MAX_MCP_OUTPUT_TOKENS setting defaults to 25,000 tokens, with a warning above 10,000. Successful text results over 50,000 characters are saved to a file instead of entering context, unless the tool declares a higher limit. HTTP and SSE responses are capped at 16 MiB. Timeouts include a startup timeout, a tool timeout and a per server timeout in milliseconds, with idle timeouts of five minutes for HTTP and 30 minutes for stdio. Tool calls in the main conversation that run longer than two minutes move to background tasks.
Defaults can change between versions, so check the current page before you rely on a number.
Why this matters for security data
A vulnerability platform can return thousands of rows. The limits above protect the conversation from being swamped, which is good, but they create a quiet accuracy risk. If a result is cut, filed or paged, the assistant may summarize what it saw as if it were everything.
| Situation | What happens | Risk |
|---|---|---|
| Result over the warning level | Warning appears | You may not notice it |
| Result over the output limit | Output is limited | Summary of part of the data |
| Very large text result | Saved to a file | The model may read only some of it |
| Slow tool call | Timeout or background task | The answer may arrive late or incomplete |
A worked example
This is illustrative. An engineer asks for all high severity findings across a large portfolio. The tool returns a long list. The assistant writes a tidy summary of the first few dozen findings and states a count that is lower than the product shows.
The engineer rephrases. First question: how many high severity findings exist in the portfolio, by project? The answer is a small table. Second: list the high findings for the project with the most, ten at a time. Third: for each of those, which have a fix version listed? Each answer stays well inside the limits, and the engineer can check the totals against the product.
Step by step: shape a large query
- Ask for a count or a table by project before asking for a list.
- Ask for one project at a time.
- Ask for a small page and say how many remain.
- Ask the assistant to state the total it expects and the number it actually read.
- Compare against the product for the first run.
- Ask the vendor whether tools can filter by severity, status or date to shrink results at the source.
- Keep a note of queries that routinely hit limits, and move them to a report in the product.
Tuning the limits
You can raise the output limit, but think twice. Larger outputs fill the model's working space, which can crowd out reasoning, and they increase the amount of data that moves to the model provider. For security data that is a cost, not just a convenience. A better fix is a narrower query.
For timeouts, longer waits may help a slow but valid tool. They also hide a tool that is stuck. Set values per server rather than globally, and note the reason in your configuration comments.
What to ask the vendor
Does each list tool support filters and paging, and does it say clearly when more results remain? Does the tool declare its own result size? Which tools are slow, and is there an asynchronous option? The vendor's answers decide whether your team will fight limits daily.
Checks for reviewers
When someone shares a chat answer in a ticket, ask for the underlying counts. A reviewer who asks how many rows were read, and how many exist, catches truncation quickly.
A short team guide
Write a one page guide for people who query security data in chat. Say that counts come first, lists come in pages, and any number quoted outside the team is checked in the product. Say that a long wait is a signal to narrow the question, not to retry five times. Put the guide beside the connector register so new joiners find it on day one.
What a good answer looks like
A trustworthy answer to a large question names its scope, its total, how many rows were read, and when the data was fetched. If an assistant gives a confident paragraph with none of these, treat it as a sketch. Ask a follow up that requests the missing facts, and compare them against the product before the answer goes into a ticket, a report or a message to a customer.
Where Safeguard fits
For checks that should run on a schedule rather than in conversation, Safeguard offers policies, gates and guardrails, and SBOM and dependency scanning. Try the free scan for a first look at results. The Safeguard CLI, installed with a curl or PowerShell installer, can also write code, and the download page lists a Local agent and a Cloud agent as available.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow the conversation and note how data arrives in small pieces rather than one large dump.
Quick check
Is a warning at 10,000 tokens an error?
No. The documentation describes it as a warning. The output limit is the point where results are limited.
Where does a very large result go?
The documentation says successful text results over 50,000 characters are saved to a file instead of entering context, unless the tool declares a higher limit.
Should I just raise the limit?
Usually not. Narrow the query first, since larger outputs move more data to the model provider and crowd out reasoning.
Sources
Last reviewed: 19 October 2026.
