rate-limiter

name	rate-limiter
description	Adds rate limiting to API endpoints with Redis or in-memory storage
argument-hint	["endpoint-pattern"]
user-invocable	true
allowed-tools	Read Glob Edit
effort	low

Add Rate Limiting

Endpoint: $1 (or all routes if not specified)

1. Check existing rate limiting:

cat package.json | grep -E '"express-rate-limit"|"@fastify/rate-limit"|"rate-limiter-flexible"|"upstash"'
grep -rn "rateLimit\|rateLimiter" src/ --include="*.ts" | head -5

2. Check if Redis is available (preferred for distributed deployments):

cat package.json | grep -E '"ioredis"|"redis"|"@upstash/redis"'

3. Implement appropriate rate limiter:

Tiered limits by endpoint sensitivity:

// Auth endpoints - strict
authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 5 })

// API endpoints - moderate
apiLimiter = rateLimit({ windowMs: 60 * 1000, max: 100 })

// Public read endpoints - loose
publicLimiter = rateLimit({ windowMs: 60 * 1000, max: 300 })

4. Include:

   • Proper Retry-After header in 429 responses
   • Different limits for authenticated vs anonymous users
   • Whitelist for trusted IPs/service accounts
   • Graceful degradation if Redis is down (fall back to in-memory)

5. Apply to the specified endpoint or globally.