diff --git a/packages/app/server/claude-proxy.ts b/packages/app/server/claude-proxy.ts
index 49f373f1..9fcb3a65 100644
--- a/packages/app/server/claude-proxy.ts
+++ b/packages/app/server/claude-proxy.ts
@@ -293,9 +293,20 @@ const server = createServer((req, res) => {
   if (!validateDevAuth(req, res)) return
   if (!checkRateLimit(req, res, true)) return
 
+  const MAX_BODY_SIZE = 1 * 1024 * 1024 // 1 MB
   let body = ''
-  req.on('data', (chunk) => { body += chunk })
+  let aborted = false
+  req.on('data', (chunk) => {
+    body += chunk
+    if (body.length > MAX_BODY_SIZE) {
+      aborted = true
+      res.writeHead(413, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'Request body too large (max 1MB)' }))
+      req.destroy()
+    }
+  })
   req.on('end', () => {
+    if (aborted) return
     if (req.url === '/v1/openrouter') {
       console.log('[proxy] → OpenRouter proxy')
       streamOpenRouterProxy(body, res)