diff --git a/hive-screen-mcp/src/main.rs b/hive-screen-mcp/src/main.rs
index 8fb7a0ff..09bab287 100644
--- a/hive-screen-mcp/src/main.rs
+++ b/hive-screen-mcp/src/main.rs
@@ -147,6 +147,11 @@ async fn rfb_handshake(stream: &mut TcpStream) -> Result<(), String> {
         .read_u32()
         .await
         .map_err(|e| format!("VNC: read name-len: {e}"))?;
+    if name_len > 256 {
+        return Err(format!(
+            "VNC: server-init name length {name_len} exceeds cap (256)"
+        ));
+    }
     let mut name = vec![0u8; name_len as usize];
     stream
         .read_exact(&mut name)
@@ -283,9 +288,14 @@ impl ScreenMcp {
             return "mouse_click: x and y must be in range 0–65535".to_owned();
         };
         let btn_mask: u8 = match args.button.as_deref().unwrap_or("left") {
+            "left" => 0b0000_0001,
             "right" => 0b0000_0100,
             "middle" => 0b0000_0010,
-            _ => 0b0000_0001, // left
+            other => {
+                return format!(
+                    "mouse_click: unknown button {other:?} — use \"left\", \"right\", or \"middle\""
+                )
+            }
         };
         // Move to position, press, release — all in one VNC connection.
         let events = [(0, x, y), (btn_mask, x, y), (0, x, y)];