tPjqbUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z mZddlmZddlmZmZmZmZddlZddlmZmZddlmZmZddlmZdd lm Z dd l!m"Z"m#Z#m$Z$m%Z%dd l&m'Z'dd l(m)Z)dd l*m+Z,ddl-m.Z.m/Z/ddl0m1Z1m2Z2ddl3m4Z4ddl5m6Z6m7Z7ddl8m9Z9m:Z:m;Z;ddlm?Z?m@Z@mAZAmBZBddlCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNddlOmPZPmQZQmRZRddlSmTZTddlUmVZVmWZWddlXmYZYmZZZddl[m\Z\m]Z]ddl^m_Z_m`Z`ddlambZbmcZcmdZder ddlemfZgddlhmiZiiZjeekelememfelemdzenffeod<d Zpeeod!<d"Zqeeod#<d$Zreeod%<d&Zseeod'<d"Zteeod(<d)Zueeod*<d+emd,emd-dfd.Zvd+emd,emd/emdzd-dfd0Zwd1Zxeyeod2< ddlzZzdd3l{m|Z|m}Z}dd4l~mZdd5lmZddlemfZgdd6lmZmZmZmZmZezjZd7eod8<ejd;d<Zeejd=eod><d:aej Zeeod?<d@ekememfdzd-emdzfdAZdBemd-eyfdCZdDed-ekememfdzfdEZdFekememfdzd-efdGZdHed-dfdIZdJe$d-dfdKZdDed-efdLZdMed-efdNZdHed-dfdOZdPePd-efdQZex rdd4l~mZddRlmZmZddSlmZddTlmZ ddUlmZddVlmZmZmZmZddWlmZddXlmZddYlmZmZmZmZmZmZddZlmZmZmZmZmZmZdd[lmZmZmZdd\lmZdd]lmZdd^lCmZmZmZmZmZdd_lXmZmZGd`daeZdbed-eefdcZ dddedzdeekemekemeffdzd-efdfZeeEeFgZeeeodh<ejeeΫe_ediZeeeodj<eedd:d1kZeeodl<eedd:d:kZeeodm<iZeekemefeodn<iZeekemenfeodo<iZeekememfeodp<iZeekemej feodq<iZeekemefeodr<GdsdteZGdudveZd-efdwZdxemd-dfdyZeZeeodz<eedd:d1kZeeod{<dadadadaejdzeod|< d d}endzd-dfd~Zdemd-eyfdZd dZdZdZejd-e dfdZeΐjd dZd-e dzfdZ ddemdekemefdeRd@e ememfdzdemdzd-e,dzf dZ d demdekemefdzdeRdzdemdzdeemdzdemdzdekemekememffdzdekememfdzd@ekememfdzd-edzfdZeΐjdemdekemefdzd-efdZeΐjd-eefdZeΐjdemdekememfdzd-efdZeΐjd-ee}fdZeΐjd-eefdZeΐjded-eefdZdeemdzdee]d-ee]fdZdemdeemde]d-eyfdZdeede]d-eefdZdeede]d-eefdZd-emdzfdZ d deRdzdeemdzdemdzd-ee]fdZdhe]dekemekememffdzd-eyfdZdhe]dekememfdzdekemekememffdzd-eyfdZ d dhe]deRdzddd-ekememfdzfdZdeRdzd-ekemdffdZ ddhe]dekemekememffdzdemdzdekememfdzd@ekememfdzdeRdzdee]dzd-elekememfemzdzekememfdzffdZdee]d-emdzfdZej d deRdzdeemdzdemdzdeyd-e df dZdhe]d-emfdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzdeydemdzdemdzdeemdzdemdzd-efdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-eefdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-ee}fdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-eefdZ deed,emdeRdzd-eefdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzdeydemdzdemdzd-efdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-eefdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-ee}fdZ ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-eefdZdemdee]d-emfdZde]deRdzd-emdzfdZde]deRdzd-dfdZ ddemdekemefdee]dedeRdzdemdzdekemekememffdzdekememfdzd@ekememfdzde dzded-efdÄZdede,dzdeRdzde emefd-ef dDŽZehdȣZeeod< dde,dedededeRdzde emefdzd-efd̄Zec ddemdekemefdzdeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzded-efd̈́Z ddemdekemefdzdeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-efd΄Z ddedeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzd-e|fdτZ d demdekemefdemdzdxemdzd-e`f dфZ ddemdemdekemefdeRdzdemdzdekemekememffdzdekememfdzd@ekememfdzde,dzde dzd-efd҄Zdemdekemefd-efdӄZdemd-eemdzfdՄZdքZdJe$d-emdzfdׄZ ddeRdzdekememfdzdemdzd-emfd؄Z dِe!d-eyfdڄZ"de#d-elee"e!ffd܄Z#dJe$de#de%ddd-eyf dZ$deRdemd-eRfdZ% d dJe$deemdzdekememfdzdekemekememffdzdeRdzdemdzde&emdzd-dfdZ'dJe$d-emdzfdZ(dJe$d-eyfdZ)dJe$d-emdzfdZ*dhe]d-eyfdZ+ ddemdemdend-eleemdzffdZ,dJe$deRdzdeemdzdemdzd-df dZ-dJe$de#de%d-dfdZ.dJe$de#de%d-dfdZ/eeEeDeFeZ0e0jcddd-ekemeyffdZ2e0jgde.e0jgde.e0jgde.e0jgde/e0jie ddedeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzdemdzd-dfdZ5 ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzdemdzd-efdZ6 ddeRdzdemdzdeemdzdekemekememffdzdekememfdzd@ekememfdzdemdzdxemdzdeydeyd-efdZ7 d de%dedemde emgdfdzd-e%f dZ8d-eleRdzemdzeemdzekemekememffdzekememfdzekememfdzemdzffdZ9dZ:dZ;d-edzfdZd-edzfdZ?yeZ0y#e$r1Ze'jd9ed:ZxdZdZdZdZ|dZ}dZdZdZYdZ[ dZ[wwxYw#e$rdZY wxYw(z LiteLLM MCP Server Routes N) AsyncIteratorCallableMappingSequence)datetime) TYPE_CHECKINGAnyFinalProtocol)FastAPI HTTPException)AnyUrl ConfigDict)Request JSONResponse)MessageReceiveScopeSend)verbose_logger)MAXIMUM_TRACEBACK_LINES_TO_LOG)Logging)get_async_httpx_clienthttpxSpecialProvider)MCPRequestHandler_is_mcp_admitted_user_subject)get_request_base_url)MCPToolResultErrorMCPUpstreamAuthError)_mcp_active_toolset_id$_mcp_gateway_initialize_instructions_mcp_gateway_server_name)MCPDebug)_redact_mcp_resource_url get_passthrough_www_authenticateget_route_relative_request_pathwell_known_root_suffix) LITELLM_MCP_SERVER_DESCRIPTIONLITELLM_MCP_SERVER_NAMELITELLM_MCP_SERVER_VERSIONMCPMissingUserEnvVarsErroradd_server_prefix_to_namebuild_synthetic_mcp_request%extract_mcp_tool_result_error_messageget_server_prefixiter_known_server_prefixeslogging_safe_mcp_headersmatch_known_tool_name)ProxyExceptionSpecialMCPServerNamesUserAPIKeyAuth)IPAddressUtils)LiteLLMProxyRequestSetupget_chain_id_from_headers)MCPAuthMCPSpecVersion)MCPInfo MCPServer) CallTypesStandardLoggingMCPToolCall)Rulesclientfunction_setup) ServerSession)OAuthCredentialPayload_byok_cred_cache<_BYOK_CRED_CACHE_TTLi_BYOK_CRED_CACHE_MAX_SIZEi&_STATEFUL_SESSION_IDLE_TIMEOUT_SECONDSd _MAX_STATEFUL_SESSIONS_PER_OWNER_MCP_ROUTING_PEEK_MAX_BYTESlitellm_otel_transport_span_MCP_TRANSPORT_SPAN_SCOPE_KEYuser_id server_idreturnc4tj||fdy)zRemove a (user_id, server_id) entry from the BYOK credential cache. Call this after storing or deleting a credential so subsequent calls see the fresh value rather than a stale cached result. N)rEpop)rOrPs r/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/_experimental/mcp_server/server.py_invalidate_byok_cred_cacherUss '9-t4 credentialctttk\rtj|t j ft||f<y)zKWrite a credential value to the cache, evicting all entries if at capacity.N)lenrErHcleartime monotonic)rOrPrWs rT_write_byok_cred_cacher]|s9  99 .8$..:J-Kgy)*rVT MCP_AVAILABLE)ReadResourceResultResource)Server)ReadResourceContents)BlobResourceContentsGetPromptResultResourceTemplateTextResourceContentsToolz7weakref.WeakKeyDictionary[object, MCPAuthenticatedUser]_session_obj_auth_storagezMCP module not found: %sFactive_mcp_sessiondefaultz_McpServerSession | Noneactive_mcp_session_var_INITIALIZATION_LOCK raw_headersc|sy|jD]1\}}t|ts|jdk(s+|xsdcSy)zThe ``mcp-session-id`` of a stateful MCP session, read case-insensitively from the request headers. ``None`` for stateless calls (no such header).Nzmcp-session-id)items isinstancestrlower)rnkeyvalues rT_mcp_session_id_from_headersrvsM !'')! U c3 CIIK3C$C=D ! rVtextcd}d}d}g}d}d}g}|D]}|rE|rd}n?|dk(rd}n7|dk(rd}|r.|dk(r)dj|dk(ry|r|j|J|dk(rd}|xr |dk\xr|d }g}d}f|d k(s|d k(r|dz }|j|d k(|d k(}|d k(s|d k(r!|r|j|dz}|dkryd}|dk(rt|xr|d }|dk(sd}y)aWhether a (possibly truncated) JSON-RPC envelope has a ``method`` key at the root object's top level. Used to tell a request/notification (carries ``method``) apart from a response (carries ``result``/``error`` and no top-level ``method``). A response payload can itself nest a ``method`` field, so only keys at the root object's depth are inspected rather than searching the whole string. Returns ``True`` only when a top-level ``method`` key is positively found; truncation that hides it yields ``False``. rF\T"method{[}],:)joinappendrSbool) rwdepth in_stringescaped in_object reading_key expect_key key_charschs rT"_jsonrpc_text_has_top_level_methodrsK EIG#%IKJI  ts! 5A:"'')2D2P  $  9I$E!E " KIJ 3Y") QJE   R3Y 'sJ 3Y")  QJEz  J 3Yi:Yr]J 3YJA B rVreq_ctxct|dd}t|dd}t|tsydDcic](}t|j|ts#|||*}}|xsdScc}w)uThe W3C trace context (``traceparent``/``tracestate``) the MCP client propagated in the request's ``params._meta`` (SEP-414), or ``None``. When present, the MCP span records this propagated context as a span *link*, never the parent — a remote parent would root the span in a trace whose root never reaches the gateway's tracing backend. The span itself nests under the transport span of the request carrying this specific message, so a streamable-HTTP session that multiplexes many messages still does not glue every message under the session's first request; see ``resolve_mcp_span_context``. The client's W3C Baggage is deliberately excluded: it is caller-controlled, and the otel baggage processor stamps allowlisted baggage keys (``litellm.team.id``, ``litellm.metadata.*``, ...) onto the span, so honoring remote baggage would let a client spoof a span's identity attribution. metaN model_extra) traceparent tracestate)getattrrqdictgetrr)rrextrartcarriers rT_mcp_meta_trace_carrierrsp '640D45E eT "1Nr#R\]b]f]fgj]kmpRqc5:orGr ?dss $A%A%rc> ddlm}||S#t$rYywxYw)zStash ``carrier`` for the otel_v2 MCP span and return a reset token, or ``None`` when otel_v2 is unavailable. Lazily imported so opentelemetry stays an optional dependency.r)set_mcp_message_trace_carrierN)*litellm.integrations.otel.plumbing.contextr ImportError)rrs rT_otel_set_mcp_trace_carrierr s+ -W55 s  tokencF|y ddlm}||y#t$rYywxYw)zClear the per-message trace carrier so it never leaks to the next message on the same session task. Paired with ``_otel_set_mcp_trace_carrier``.Nr)reset_mcp_message_trace_carrier)rrr)rrs rT_otel_reset_mcp_trace_carrierrs2 }  (.    scopecV ddlm}|}| ||t<yy#t$rYywxYw)uRecord this request's tracing span on its own ASGI scope. Resolved on the ASGI request task, where the proxy's server span is anchored, and read back by the MCP message handler through ``req_ctx.request`` — the ``Request`` the transport attaches to each message. A stateful streamable-HTTP session handles every message on the task spawned by its ``initialize`` POST, so the handler's own task cannot see later requests' spans. The scope, not the shared session auth context: a JSON-RPC *response* POST deliberately skips the per-session lock (it can arrive while the tool call that awaits it is still in flight), so a field on that shared object would be overwritten mid-call and the tool call would attribute itself to the response's request. A scope belongs to exactly one request and dies with it, which also keeps a finished span from being retained by an idle session. The live span, not just its context: a failed tool call stamps ``error.*`` on it, which needs a span still open for writes. Lazily imported so opentelemetry stays an optional dependency; a no-op when otel_v2 is unavailable or no request span is anchored.r)request_root_spanN)rrrrN)rrspans rT%_otel_publish_transport_span_on_scoper*sB( () /3+, s  ((ct|dd}t|dd}t|tsy|jtS)axThe tracing span of the HTTP request that carried this MCP message. Read off that request's ASGI scope, reached through the ``Request`` the streamable-HTTP transport attaches to each message, so it is this message's transport and not whichever request happens to have touched the session last. Returns whatever the scope holds; the otel plumbing validates it.requestNr)rrqrrrN)rrrs rT!_otel_transport_span_from_messagerJs=Wi6G7GT2E eW % 992 33rVrcD|y ddlm}||S#t$rYywxYw)zPublish the current message's transport span, which the otel_v2 MCP span attaches to and a failed tool call stamps its error on. Returns a reset token, or ``None`` when otel_v2 is unavailable.Nr)set_mcp_message_transport_span)rrr)rrs rT_otel_set_mcp_transport_spanrXs5 | .d33 s  cF|y ddlm}||y#t$rYywxYw)z-Paired with ``_otel_set_mcp_transport_span``.Nr) reset_mcp_message_transport_span)rrr)rrs rT_otel_reset_mcp_transport_spanrhs0 }  )/ rexcc t|j}t ||j |j xsdS#ttf$rd}Y9wxYw)uBMap a ``ProxyException`` to an ``HTTPException`` that preserves its real status code and headers. ``user_api_key_auth`` raises ``ProxyException`` (not ``HTTPException``) on auth failures. The MCP ASGI handlers re-raise ``HTTPException`` to keep the status and any ``WWW-Authenticate`` challenge, but a ``ProxyException`` would otherwise fall through to their generic handler and be flattened to a 500 — dropping the 401 + challenge an OAuth client needs to re-authenticate, so the tool call surfaces as a cancelled/terminated session instead. iN status_codedetailheaders)intcode TypeError ValueErrorr messager)rrs rT"_proxy_exception_to_http_exceptionrvsT#((m  {{ #t  z " s=AA)AuthContextMiddlewareauth_context_var)NotificationOptions)InitializationOptions)StreamableHTTPSessionManager)CallToolResultListToolsResultPrompt TextContentrg)MCPAuthenticatedUser)SERVER_OUTCOMES_META_KEYAggregateToolListing ServerListOk ServerOutcomeclassify_list_exceptionoutcome_wire_value)MCPServerManager_caller_authorization_fans_out'_client_forwarded_authorization_headers_resolve_openapi_tool_auth"_should_strip_caller_authorizationglobal_mcp_server_manager)_request_auth_header_request_extra_headers_request_resolved_auth_headers)SseServerTransport)global_mcp_tool_registry)MCP_TOOL_PREFIX_SEPARATORis_tool_name_prefixednormalize_server_namesplit_server_prefix_from_namestrip_known_server_prefix)DEFAULT_CREDENTIAL_HEADERwithout_headerc8eZdZUdZdZedzed<edZy)!ListMCPToolsRestAPIResponseObjectzD Object returned by the /tools/list REST API route. Nmcp_infoT)arbitrary_types_allowed) __name__ __module__ __qualname____doc__rr<__annotations__r model_configrVrTrrs! $('D.'!$? rVrcontentscg}|D]}t|dd}|@t|dr4|j}|jd}||jd}t |t r2|j t|j|j|t |ts|j t|j|j||S)zRNormalize ResourceContents to ReadResourceContents, preserving meta (MCP 1.26.0+).rN model_dump_meta)content mime_typer) rhasattrrrrqrfrrbrwmimeTypercblob)r normalizedrrds rT_normalize_resource_contentsrs8:  G7FD1D| >&&(uuV}<55>D'#78!!( ' ")"2"2!G%9:!!( ' ")"2"2!! .rVnotification_optionsexperimental_capabilitiesctj|||xsi}i}tj}|||d<t j}|||d<|r|j |S|S)N)rr instructions server_nameupdate)racreate_initialization_optionsr"rr# model_copy)selfrroptsupdatesmergedscoped_server_names rT&_gateway_create_initialization_optionsr s~ :: !5&?&E2  *,<@@B  &,GN #$<$@$@$B  )%7GM "29tg.CtCrVnameversionserverz/mcp/sse/messagessse)app event_store json_response statelesssession_manager_statelesssession_manager_stateful_stateful_session_auth_contexts(_stateful_session_auth_context_last_seen_stateful_session_owners_stateful_session_locks'_stateful_session_active_request_countsceZdZddZy)_TerminableTransportNc KywNr)rs rT terminatez_TerminableTransport.terminate-ssrQN)rrrrrrVrTrr,s.rVrc0eZdZdedefdZdeddddfdZy)_TransportRegistry session_idrQcyrr)rr"s rT __contains__z_TransportRegistry.__contains__0rVrkNz_TerminableTransport | Nonecyrr)rr"rks rTrSz_TransportRegistry.pop2r%rV)rrrobjectrr$rrrSrrVrTr!r!/s"B6BB^#^^02%M%S%S%U 7 !J 6:::qIAMY"HHJ^nLn#**:6  7 . :J 7:::qIAM ),,Z>I$))+++ -j 9! :$GH >J!@@1*= >,sA)D,ADD+D2DownercKtdttffd }|}t|tkryt |dD]l}t|tkrnSt j|ddkDr6j|d}||jd{t|nt|tkS7(w)a) Bound the number of concurrent stateful sessions a single caller holds before routing a new ``initialize`` to the stateful manager. Evicts the caller's *own* oldest idle sessions (no in-flight requests) to make room, so a busy-but-legitimate client keeps its newest sessions and other callers are never affected. Returns ``True`` if the new session may proceed, or ``False`` when the caller is already at the cap with every session in flight (the new ``initialize`` should be rejected). rQcptjDcgc]\}}|k(r|vr|c}}Scc}}wr)rrp)r" session_ownerr8r3s rT_owned_live_session_idszH_enforce_stateful_session_cap_for_owner.._owned_live_session_idssC2J1O1O1Q-J  E)jz9_enforce_stateful_session_cap_for_owner..sDHHcRrV)rtrN) r*r2rrrYrKsortedrrrSrr,)r8r<ownedr"r6r3s` @rT'_enforce_stateful_session_cap_for_ownerrBrs#="> c /0 u:8 8 R :J*,-0PP6:::qIAM(,,Z>I$))+++ -j 9 :*,-0PPP,sB$C(C))CcK tjtd{ td{577#t$r }t j d|Yd}~)d}~wwxYww)Nz3Error cleaning up expired MCP stateful sessions: %s)asynciosleeprIr7 Exceptionr exceptiones rT/_cleanup_expired_stateful_session_auth_contextsrJs`-- FG G G cCEEE GE c(()^`abb cs@A)9A) =;=A)= A&A!A)!A&&A)cpKt4d{tr dddd{ytjdtj atj atj a t jd{tjd{tjd{tjtadatjddddd{y7777l7R7#1d{7swYyxYww)zFInitialize the session managers. Can be called from main app lifespan.Nz$Initializing MCP session managers...Tz@MCP Server started with StreamableHTTP and SSE session managers!)rm_SESSION_MANAGERS_INITIALIZEDrinforrun_session_manager_cmr_session_manager_stateful_cmr._sse_session_manager_cm __aenter__rD create_taskrJr/rrVrTinitialize_session_managersrTs( d d, d d d    F G#<"?"?"A +C+G+G+I (&9&=&=&? #&002 2 2.99; ; ;)446 6 6292E2EFuFw2x /,0 )    b c% d d d d 3 ; 6 d d d ds D6DD6D! D6DD6A(D!DD!.D/D! D 8D! D6DD6D6D!D!D!D6!D3'D* (D3/D6c`Ktrtjd trNtj t j tj5td{dddtrtjdddd{trtjdddd{trtjdddd{da da da dadayy7#1swYxYw7h7E7"#t$r }tjd|Yd}~Dd}~wwxYww)zShutdown the session managers.z%Shutting down MCP session managers...Nz)Error during session manager shutdown: %sF)rLrrMr/cancel contextlibsuppressrDCancelledErrorrO __aexit__rPrQrFrGrHs rTshutdown_session_managersr[s )    G H Y67>>@#,,W-C-CDBAAAB&-77dDIII/6@@tTRRR*1;;D$MMM#' +/ (&* #26 /,1 )+ )BBBJRM Y(()TVWXX YsD.=D C0&C.'C0+(DC<$D8C>9$DDD" D..C00C95D>DD D+ D&!D.&D++D.cKtd{ dtd{y77#td{7wxYww)z%Application lifespan context manager.N)rTr[)rs rTlifespanr]s@*+++ . +- - - , .+- - -s<A .A 2 A 0A A AAAA c LKddlm}|jd}d}|rtj |j }d}d} t t|}tt|}td{\}}}}} } } tjd|tjd|tjd|rt|jndtt|dddd r_dd lm} dd lm} | Dcgc]}| j(|c}t+|t-||tj/|SStjd t1||||| | d dd{}tj2dt5|j6|j8s:|j6t+|t-||tj/|SSt:|j8j=Dcic]\}}|t?|c}}i}tAj(|j6|dt+|t-||tj/|SS7 cc}w7 cc}}w#tB$rP}tjDd|gcYd}~t+|t-||tj/|SSd}~wwxYw#t+|t-||tj/|wwxYww)a List all available tools, with each server's listing outcome attached to the result's ``_meta`` (SERVER_OUTCOMES_META_KEY) so a broken upstream is distinguishable from a healthy server with no tools. Returning a ListToolsResult (rather than a bare list) makes the MCP SDK pass the result through unwrapped, which is what lets the ``_meta`` survive to the client. Also captures the active session for propagation to callbacks. r request_ctxNz3MCP list_tools - User API Key Auth from context: %sz-MCP list_tools - MCP servers from context: %sz,MCP list_tools - MCP server auth headers: %sobject_permissionmcp_tool_search_enabledFr)get_virtual_tool_definitionsz(MCP list_tools - Calling _list_mcp_toolsT mcp_protocol)user_api_key_authmcp_auth_header mcp_serversmcp_server_auth_headersoauth2_headersrnlog_list_tools_to_spendlogslist_tools_log_sourcez/MCP list_tools - Successfully returned %s tools)toolsrz Error in list_tools endpoint: %s)#mcp.server.lowlevel.serverr`rrlsetsessionrrrrget_or_extract_auth_contextrdebugr2keysr mcp.typesrg2litellm.proxy._experimental.mcp_server.tool_searchrcmodel_validaterrreset_list_mcp_toolsrMrYrloutcomesrrprrrFrG)r`r_session_reset_token _trace_token_transport_tokenrerfrgrhrirn _client_iprgrcrlistingrtoutcome outcome_metarIs rThandle_list_toolsrs ;$.# #9#=#=goo#N  > C67Nw7WXL;<]^e8O,1134UY )+>E) +9U8VW1+++A.W: ++; < ), 7#/&,,-AB09  !K L#2"3 /'(?-',0&4 $ G    QSVW^WdWdSe f##}} ++; < ), 7#/&,,-AB0)IPIYIYI_I_Ia+9EgC+G44+#L #11GMMT`2ab ++; < ), 7#/&,,-AB0c4$X +    $ $%G KI *+; < ), 7#/&,,-AB0  ++; < ), 7#/&,,-AB0s?L$5J7J8BJJ'J)/L$+JJ AJ/L$7"JJ/&J/L$JJJ K.K)5K.6K1:/L$)K..K110L!!L$c |j}|rt |dr |j syt |j ddt |dr |jsy|jdtdtdzffd }tjd tdd |S#t$r }tjd|Yd}~yd}~wwxYw) zReturn a progress-forwarding callback bound to the host MCP session. Returns ``None`` when the host did not supply a progress token. z+Could not capture host progress context: %sNr progressTokenroprogresstotalcK j||d{tjd||y7#t$r }tjd|Yd}~yd}~wwxYww)z8Forward progress notifications from external MCP to Host)progress_tokenrrNz Forwarded progress %s/%s to Hostz&Failed to forward progress to Host: %s)send_progress_notificationrrqrFerror)rrrI host_session host_tokens rTforward_progressz9_capture_host_progress_callback..forward_progressPsu R"==#-%> $$%GSXY   R$$%MqQQ Rs7A';9;A'; A$AA'A$$A'z"Host progressToken captured: %s...) request_contextrFrwarningrrrrofloatrqrr) host_serverhost_ctxrIrrrs @@rT_capture_host_progress_callbackr>s  )99H WXv68==#HMM?DI  gh &BxGWGW&..  RU R54< R A3z?SUTUCVW1   " "#PRS T s B## C ,CC r  argumentsre client_ipcKddlm}ddlm}m}m}t d||} |||dj| ||tjj||d {\} } | S7 w) zRun the pre-call pipeline (guardrails + logging setup) for a virtual mcp_tool_call so the SSE path spend-logs like the REST path.r)ProxyBaseLLMRequestProcessing)general_settings proxy_configproxy_logging_obj/mcp/tools/callpathrnrr r)data)ruser_api_key_dictr route_typerrN) 'litellm.proxy.common_request_processingrlitellm.proxy.proxy_serverrrrr. common_processing_pre_call_logicr> call_mcp_toolru) r rrernrrrrrr_virtual_logging_objs rT_build_virtual_call_logging_objr_s   5"#  (EY7( * */% ..44/- +  "  #" " sAA)A' A)rgrfrhric Kddlm} m} m} m} m} m}m}m}|| vrytt|ddddsttdd|d  gd S|xsi}|| k(r?||jd d| |jdd||||||| d{S|J|| k(rD|t|jd d| |jd| | |d{St|||||d{}||jdd|jdxsi|||||||| d{S77[7E7 w)zHandle the mcp_tool_search / mcp_tool_call virtual tools. Returns a CallToolResult when ``name`` is a virtual tool, else ``None`` so the caller falls through to normal tool routing. r)AGENT_SEARCH_TOOL_NAMEDEFAULT_AGENT_SEARCH_TOP_KMCP_TOOL_SEARCH_TOOL_NAMEVIRTUAL_TOOL_NAMES coerce_top_khandle_agent_searchhandle_mcp_tool_callhandle_mcp_tool_searchNrarbFrwzTool z, requires mcp_tool_search_enabled on the key)typerwTrisErrorqueryr|top_k) rrrrrgrfrhrirnrj)rrr)r rrernr tool_namer) rrrrrgrfrhrirnlitellm_logging_obj)rtrrrrrrrrrrrrrrr)r rrerrgrfrhrirnrrrrrrrrargsrs rT_dispatch_virtual_mcp_toolrs  ) ) %':D A %  "#$TF*VW   o2 , ,/hhw+"488GQ#78"3#' /(?-'   !,,, ) ),$((7B/0"488G5O#PZtu"3  ,K/# , & *hh{B/hh{+1r/#+$;)# 3   5  &   sIBED=A E#D?$E;E<   !`bs ts 4N'&7( +$3,C#1 + 4 .#'2.P ++; < ), 7#/&,,-AB0Q1PPV0W&,0y#I ";K"H4I23!<* +(" %0!<& '1B0\0\-1+&2"D"%D(5 )&7$3 +,C#1 ++A ) ) #D *+; < ), 7#/&,,-AB0E4 .P+& #. ##aKKII &(c!f6BC h ++; < ), 7#/&,,-AB0e) $$%QSTU%##H!L!' !\ ++; < ), 7#/&,,-AB0O, $$%TVWX%(0MaS.QX^_` F ++; < ), 7#/&,,-AB0C! $$%I1M%(z.BPQ : ++; < ), 7#/&,,-AB07(  ##$UWXWdWde%##QRSR_R_Q``a!b!' !$ ++; < ), 7#/&,,-AB0 (()OQRS%(sm&IJ  ++; < ), 7#/&,,-AB0  ++; < ), 7#/&,,-AB0sTAS(5R5GAR5G*.G"/G*6/S(%AG*>G$ ? G* G& G**G(+G*/R50/S(R5"G*$G*&G*(G** R23A I0<R2=R5/S(0R28.K&R2'R5+/S(R2".MR2R5/S( R28N<R2 R5 /S(< R2AP? R2 R5/S(? R2 .R-9R2:R5>/S(-R22R550S%%S(c Kddlm}|jd}d}|rtj |j } t d{\}}}}}}} tjd|tjd|tjd|rt|jndtjdt||||||d{} tjd t| | |tj|SS77?#t$r:} tj d | gcYd} ~ |tj|SSd} ~ wwxYw#|tj|wwxYww) z, List all available prompts rr_Nz5MCP list_prompts - User API Key Auth from context: %sz/MCP list_prompts - MCP servers from context: %sz.MCP list_prompts - MCP server auth headers: %sz(MCP list_prompts - Calling _list_promptsrerfrgrhrirnz3MCP list_prompts - Successfully returned %s promptsz"Error in list_prompts endpoint: %s)rmr`rrlrnrorprrqr2rr_list_mcp_promptsrMrYrvrFrG) r`rryrerfrgrhrirnr|promptsrIs rT list_promptsrs ;$.# #9#=#=goo#N $ C233 !'  !XZk l  !RT_ `  @8O,1134UY   !K L#4"3 /'(?-' $G    UWZ[bWc d$/&,,-AB034   $ $%I1 MI#/&,,-AB0   $/&,,-AB0sk;F D D BD D$D FD D E#)EE#E&FE##E&&FFc Kddlm}|jd}d}|rtj |j } t d{\}}}}} } } tjd|t||||||| | d{|tj|SS7U7#|tj|wwxYww)a# Get a specific prompt with the provided arguments Args: name (str): Name of the prompt to get arguments (Dict[str, Any] | None): Arguments to pass to the prompt Returns: GetPromptResult: Getting prompt execution results rr_Nr)r rrerfrgrhrirn) rmr`rrlrnrorprrqmcp_get_promptrv) r rr`rryrerfrgrhrirnr|s rT get_promptrs ;$.# #9#=#=goo#N  C233 !'  !`bs t'#"3 /'(?-'  $/&,,-AB04 $/&,,-AB0s@;C B% B! 8B%B#B%C!B%#B%%B??CcKddlm}|jd}d}|rtj |j } t d{\}}}}}}} tjd|tjd|tjd|rt|jndt||||||d{} tjdt| | |tj|SS77?#t$r:} tj d | gcYd} ~ |tj|SSd} ~ wwxYw#|tj|wwxYww) zList all available resources.rr_Nz7MCP list_resources - User API Key Auth from context: %sz1MCP list_resources - MCP servers from context: %sz0MCP list_resources - MCP server auth headers: %srz7MCP list_resources - Successfully returned %s resourcesz$Error in list_resources endpoint: %s)rmr`rrlrnrorprrqr2rr_list_mcp_resourcesrMrYrvrFrG) r`rryrerfrgrhrirnr| resourcesrIs rTlist_resourcesrss ;$.# #9#=#=goo#N  C233 !'  !Z\m n  !TVa b  B8O,1134UY  &9"3 /'(?-' & I    Y[^_h[i j $/&,,-AB0-4    $ $%KQ OI#/&,,-AB0  $/&,,-AB0k;E. D D A=D D  $D .E.D D EE +E,E0E. EEE++E.cKddlm}|jd}d}|rtj |j } t d{\}}}}}}} tjd|tjd|tjd|rt|jndt||||||d{} tjdt| | |tj|SS77?#t$r:} tj d | gcYd} ~ |tj|SSd} ~ wwxYw#|tj|wwxYww) z&List all available resource templates.rr_Nz@MCP list_resource_templates - User API Key Auth from context: %sz:MCP list_resource_templates - MCP servers from context: %sz9MCP list_resource_templates - MCP server auth headers: %srzIMCP list_resource_templates - Successfully returned %s resource templatesz-Error in list_resource_templates endpoint: %s)rmr`rrlrnrorprrqr2rr_list_mcp_resource_templatesrMrYrvrFrG) r`rryrerfrgrhrirnr|resource_templatesrIs rTlist_resource_templatesrsz ;$.# #9#=#=goo#N " C233 !'  !cev w  !]_j k  K8O,1134UY  /K"3 /'(?-' /)    []`as]t & $/&,,-AB014)   $ $%TVW XI#/&,,-AB0  $/&,,-AB0rurlc Kddlm}|jd}d}|rtj |j } t d{\}}}}}} } t||||||| d{} t| j|tj|SS7S73#|tj|wwxYww)Nrr_)rrerfrgrhrirn) rmr`rrlrnrorpmcp_read_resourcerrrv) rr`rryrerfrgrhrirnr|read_resource_results rT read_resourcer>s:$.# #9#=#=goo#N  C233 !'1B"3 /'(?-'1+ 00D0M0MN#/&,,-AB04+$/&,,-AB0s@;C B# B !B#-B!.B#CB#!B##B==Callowed_mcp_serverscJKi}||D]}d}|D]S}|st|Dcgc]}|s|j}}|j|vsB|||j<d}n|r` tj|gd{}|D](} |D]!}| |jk(s|||j<#*|rt|jS|t jd|gS|Scc}w7o#t $r"} t jd|| Yd} ~ d} ~ wwxYww)a Get the filtered MCP servers from the MCP server names. Fails closed when ``mcp_servers`` is explicitly provided (path- or header-derived) but none of the names resolve to a server alias or access group the caller can access. The previous behavior returned the full ``allowed_mcp_servers`` set, which silently widened scope when a client targeted ``/mcp//`` and made URL/header namespacing appear to work when it did not. NFTz*Could not resolve '%s' as access group: %szcMCP scope filter resolved to no servers for requested names %s; returning empty list (fail-closed).) r1rsrPr#_get_mcp_servers_from_access_groupsrFrrqr2values) rgrfiltered_serverserver_or_groupserver_name_matchedr s match_listaccess_group_server_idsrPrIs rT._get_allowed_mcp_servers_from_mcp_server_namesrisk8:  "#. o&+#1"F9STZ9[%aA_`aggi%a %a*002j@@FOF,<,<=26/!"+ o8I8m8m,-93/*AOI*=O#,0@0@#@HNOF4D4D$EOO% o2 ..01 1  "  u I""C&b3%o&,,-Y[jlmnnosaD# D#C.C.D#D#*C5C3C5"C55>D#3C55 D >DD#D  D#r filter_list mcp_serverc8t||}t|||duS)ak Check if a tool name matches any name in the filter list. Reads the same owner the server-level permission checks use, so discovery hides exactly what dispatch refuses. ``mcp_server`` is required: guessing the boundary at the first separator mismatches every tool on a server whose prefix contains the separator. N)rr3)rrr bare_names rT_tool_name_matchesrs%5Y K $Y KHPTTTrVrlc0ddlm}|}||r?|jsgS|Dcgc]&}t|j|j|s%|(}}|j r0|Dcgc]%}t|j|j |s|'}}|Scc}wcc}w)a Filter tools by allowed/disallowed tools configuration. If allowed_tools is set, only tools in that list are returned. If disallowed_tools is set, tools in that list are excluded. Tool names are matched with and without server prefixes for flexibility. Args: tools: List of tools to filter mcp_server: Server configuration with allowed_tools/disallowed_tools Returns: Filtered list of tools r)server_applies_tool_allowlist),litellm.proxy._experimental.mcp_server.utilsr allowed_toolsrr disallowed_tools)rlrrtools_to_returntools rTfilter_tools_by_allowed_toolsrs$   ) 4++ !&*  ? rVc tj}|rt|tr |jSy#t $rYywxYw)z Extract client_ip from auth context. Returns None if context not set (caller should handle this as "no IP filtering"). N)rrrqrrrF auth_users rT_get_client_ip_from_contextr sJ  /335IZ 3GH ***   s15 AAcK|!t}|tjdtj|d{}tj ||\}}tjd|||dkDrtjd||g}|D]@}tj |}|tj|}|j|B|t||d{}|S77w)aReturn allowed MCP servers for a request after applying filters. Args: user_api_key_auth: The authenticated user's API key info. mcp_servers: Optional list of server names to filter to. client_ip: Client IP for IP-based access control. If None, falls back to auth context. Pass explicitly from request handlers for safety. Note: If client_ip is None and auth context is not set, IP filtering is skipped. This is intentional for internal callers but may indicate a bug if called from a request handler without proper context setup. NzMCP _get_allowed_mcp_servers called without client_ip and no auth context. IP filtering will be skipped. This is expected for internal calls.z2MCP IP filter: client_ip=%s, allowed_server_ids=%sraMCP IP filtering: %d server(s) are not accessible from client IP %s because they are restricted to internal networks. No tools from those servers will be returned. To expose a server externally, set 'available_on_public_internet: true' in its configuration.rgr) r rrqrget_allowed_mcp_servers!filter_server_ids_by_ip_with_infoget_mcp_server_by_idrresolve_oauth2_flow_for_requestrr)rergrallowed_mcp_server_ids _ip_blockedrallowed_mcp_server_idrs rT_get_allowed_mcp_serversrs""  35I $$Y (A'X'XYj'k!k & G GH^`i j "  @  " ?  (  02%; 7 !2GGH]^J%-MMjY #**:6  7  "(V'$7)#  #"E"l:#s(z5_client_has_per_server_auth_header..Ts+fQSz"c*Lrxxz_/LLfs/1) rrrrrqrrrstriprany)r rhrserver_headerss rT"_client_has_per_server_auth_headerr":sl' !B #6<`` style header (surfaced via ``mcp_server_auth_headers``). Either form skips the pre-emptive 401. rT)rsr")r rirhks rT%_client_has_passthrough_authorizationr%Ws7 # 779/ 2&:QRRrVprefetched_credsz-Mapping[str, "OAuthCredentialPayload"] | NonecK|jtjk7s|yddlm}|t |dd||d{}|rdd|iSdS7w)aStored OAuth2 token for (user, server) as an ``Authorization: Bearer`` header, or None. Thin wrapper over ``resolve_user_oauth_access_token`` (Redis cache, else DB + refresh); ``prefetched_creds`` skips the per-server Redis/DB lookups for the batch path. Nr)resolve_user_oauth_access_tokenrO AuthorizationzBearer ) auth_typer:oauth2)litellm.proxy._experimental.mcp_server.dbr(r)r rer&r(rs rT%_get_user_oauth_extra_headers_from_dbr-jsk   w~~ -1B1J = %y$ 7AQ  8=75'!23F$F s?AAArDcK|r t|ddnd}|siS ddlm}ddlm}|d}|||d{}|Dcic] }d|vs|d|c}S7cc}w#t $r#}t jd||icYd}~Sd}~wwxYww) zFetch all OAuth2 credentials for the user in one DB query. Returns a dict keyed by server_id to avoid N+1 queries in asyncio.gather loops. rONr)list_user_oauth_credentials)get_prisma_client_or_throwzCDatabase not connected. Connect a database to use OAuth2 MCP tools.rPzB_prefetch_oauth_creds_for_user: failed to prefetch for user=%s: %s)rr,r/litellm.proxy.utilsr0rFrr)rerOr/r0 prisma_clientcredscrIs rT_prefetch_oauth_creds_for_userr5sUfW-> 4%PkoI   G#=U$M"=]G!TTE/4I! q8HAkNA%I IUI   " "#giprs tI s\B  AAA A AAB AA B 'B?B B B  B  scope_serverscPd}|r%ddlm}|||j|j}d} |j} | xr t ||} |j tjk(rD|jrd} nH|r|jnd} | r2t|||r$t| t} n| r| st||||} |jr|r| i} |j!D cic]0\} } t#| t$st%| j'| 2}} } t|||}|jD]R}t#|t$s|j'dk(r|s| r,|j)|j'}|N|| |<T| t+| dk(rd} ||}|| fScc} } w)uBuild auth and extra headers for a server. ``scope_servers`` is the full server list a fan-out handler iterates. Passing it lets the client-forwarded token modes withhold the caller's request-wide ``Authorization`` when another server in the scope would also receive it (``_caller_authorization_fans_out``); explicitly-addressed operations leave it None. Per-server ``x-mcp-{alias}-authorization`` headers are unaffected — they bind one token to one server and are the multi-server shape. Nrrr)rrnre)rrirnrer)rrrris_client_forwarded_tokenrr*r:r+has_client_credentialscopyrrrr extra_headersrprqrrrsrrY)r rhrfrirnrer6server_auth_headerrr;is_client_forwarded_mode withhold_forwarded_authorizationr$vnormalized_raw_headersstrip_caller_authorizationheader header_values rT_prepare_mcp_server_headersrDs";? " "C'll".."  04 *0*J*J 3K3 Om MP (   w~~ -,, $ :H 3 3 5T !%G% +&7& %3=B[$\M %3 G%#1 +&7 !    K$ " KVK\K\K^,u41ablmnpsbtSV\\^Q->,u ",u 1S!'"31 & !.. 5!&#.<<>_4.2R599&,,.I '(4 f% 5  $]);q)@ M  %!0 !=00?-vs !F":F"cj|syg}|D]}|jxs,|jxs|jxs|jxsd}|jrF|jj r,|j ||jj f|jrtjj|j}|s|j s|j ||j f|syt|dk(r|ddSdjd|DS)zhYAML/DB override, else upstream text (prefetch on init, or list_tools / health_check / call_tool cache).Nmcpr{rz --- c32K|]\}}d|d|yw)rz] Nr)rlbltxts rTrz9_merge_gateway_initialize_instructions..s!!JSAcU#cU"3!Js) rrr rPrrr spec_pathr._upstream_initialize_instructions_by_server_idrrYr)rtextsr labelcacheds rT&_merge_gateway_initialize_instructionsrOs #.0) 6FLLbF$6$6b&++bIYIYb]bE""v':':'@'@'B eV%8%8%>%>%@AB.]]aabhbrbrsF&,,. eV\\^45 6 u:?8A; !!!JE!JJJrVscoped_server_endpointcKt|||d{}|r@tj|Dcgc]}|tj|c}ddid{t |}d}|rIt |dk(r;|d}|jxs(|jxs|jxs |j}tj|} tj|} dtj| tj| y7cc}w7#tj| tj| wxYww)Nrergrreturn_exceptionsT)rr{r)rrDgatherr/_ensure_upstream_initialize_instructions_cachedrOrYrrr rPr"rnr#rv) rergrrPallowedrrr scoped_serverinstructions_tokenserver_name_tokens rT._gateway_initialize_instructions_request_scoperZsF 8/#   ..%}.]]^_` #'   ?SZ[! !c'la&7#*1:M##q}'@'@qMDVDVqZgZqZq %I$L$LV$T#;#?#?@R#S >  0 6 67I J $ * *+< ==  ( 1 6 67I J $ * *+< =sEEDED EDBED$,EE,EEc t|xsdS)anThe client-visible key for a server in listing outcomes and spend metadata: the same display prefix (alias, or the short prefix when that mode is enabled) the caller already sees on the tool names. Canonical internal server names never key a caller-readable surface; when the display naming deliberately hides them, the outcome keys must too.unknown)r0r s rT_aggregate_server_keyr^@s !(5I5rVrjrkr request_tagsc 2 )*Kts tgiStj} d} i} |rt }t t j}|xs t}ddi}t|t r||d<t|tr||d<dtjj|||td| rd | inid d|d d gd } ;tj | dt#ddxs t#dd}|r|| d< t%d,d|| d| \} }| r&tjj| _d| _ t1|| d{*t3d*D}|rt5d{ni)dt6ddf)*fd }*Dcgc] }|| }}t9j:|d{}|Dcgc]\}}|D]}|}}}}t=*|Dcic]\}\}}| t?||}}}}| r=t=*|Dcic]\}\}}|t?|tA|!} }}}| jBjEd}!t|!tFry|!jEd}"t|"tFsi}"|"|!d<tA*|"d<tA||"d<| |"d<|jID#cic]\}#}|#tK|c}}#|"d <tj}$ | jM|Dcgc]&}t|tNr|jQd!"n|(c}| |$#d{t-jTd%tA|t||S#t*$r#}t-j.d|d} Yd}~bd}~wwxYw7X74cc}w7cc}}}wcc}}}wcc}}}wcc}}#wcc}w7#t*$r }%t-jRd$|%Yd}%~%d}%~%wwxYw#t*$ru}&|rmk d&d'l+m,}'|'r=t[j\t^(}(|'ja| xsi|&d)|(*d{7#t*$rt-j.d+YwxYwd}&~&wwxYww)-ay Helper method to fetch tools from MCP servers based on server filtering criteria. Args: user_api_key_auth: User authentication info for access control mcp_auth_header: Optional auth header for MCP server (deprecated) mcp_servers: Optional list of server names/aliases to filter by mcp_server_auth_headers: Optional dict of server-specific auth headers oauth2_headers: Optional dict of oauth2 headers Returns: AggregateToolListing: Combined tools from filtered servers plus each server's classified listing outcome rlrxN mcp_operation list_toolssourcerequested_mcp_serverszMCP: list_tools)spend_logs_metadatartagssystem)rbre)roler)model call_typelitellm_call_idrmetadatainputrm)rr_metadata_variable_name end_user_idrOuserlist_mcp_tools)original_function rules_obj start_timez3Failed to initialize logging for MCP list_tools: %srRc3XK|]"}t|ddtjk($yw)r*N)rr:r+)rrs rTrz._get_tools_from_mcp_servers..s#$rYZWQ T%Bgnn%T$rs(*r rQz#tuple[list[MCPTool], ServerOutcome]c ^K|gtdfSt|  \}}ddlm}||du}|sG|jt j k(r*t|ddrt| d{}|r:|}n7|s5|3|jt j k(rt| d{}|jr3|jt j k7r|t|d{} tj|||d  d{}t||}t||j d{}t!||}t#j$d t'||j(t'||tt'|fS7(7777d#t*$r7}t#j$d |j(gt-|fcYd}~Sd}~wt.$r8}t#j0d|j(|gt-|fcYd}~Sd}~wwxYww)zFetch and filter tools from a single server, classifying any failure into that server's outcome so the aggregate can keep serving the healthy subset without a broken server masquerading as an empty one.Nr) tool_countr rhrfrirnrer6)to_server_specneeds_user_oauth_tokenF)r&T)r rfr; add_prefixrnreri)rlrPrez@Successfully fetched %s tools from server %s, %s after filteringz3MCP list_tools: omitting %s; it needs upstream authz&Error getting tools from server %s: %s)rrDClitellm.proxy._experimental.mcp_server.outbound_credentials.adapterrzr*r:r+rr-is_byok_get_byok_credentialr_get_tools_from_serverr$filter_tools_by_key_team_permissionsrPrrrqrYr r rrFrG)r r<r;rzmigrated_to_v2 db_headersrlfiltered_toolsrI_prefetched_oauth_credsrrfrhrirnres rT_fetch_and_filter_server_toolszC_get_tools_from_mcp_servers.._fetch_and_filter_server_toolssB >|q9994O!,C$3#1 +&7"551"M)7v(>d(J&((GNN:(@%H)5.S))@/)J "(2 (M,AfFVFVZaZhZhFh*O))@+%M >>f&6&6'..&HM_Mg/CFL]/^)^&(:)B)Y)Y%(:&3#'$/*;'5*$E&C5&%QN+O,"("2"2*;,&N&:.&%QN"((ZE  N+  *<3~CV+WWW_)%*_$&",:#(()^`f`k`kl6q999 :",,-UW]WbWbdef6q999:sA5H-8F 9;H-4F#5>H-3F%4H-9F+F'+F+F)AF+H-#H-%H-'F+)F++ H*4,G& H*!H-& H*2-H%H* H-%H**H-rfallowed_server_counttool_count_totalper_server_tool_countsper_server_list_outcomesjson)moderesultruend_timez6MCP list_tools success logging failed (continuing): %sz8Successfully fetched %s tools total from all MCP serversrrlimitz/mcp/list_tools request_dataoriginal_exceptionrroute traceback_strz?Failed to log MCP list_tools failure via post_call_failure_hookr)1r^rrr0r@rruuiduuid4r9rqr2r>rrrur2r8)add_user_api_key_auth_to_request_metadatarrBrkrjrFrrqrr r5r=rDrTzipr^rYmodel_call_detailsrrrprasync_success_handlerMCPToolrrrMrr traceback format_excrpost_call_failure_hook)+rerfrgrhrirnrjrkrr_rlist_tools_start_timerlist_tools_request_datartlist_tools_call_ideffective_litellm_trace_idrfuser_identifierr logging_error_has_oauth2_serverrr tasksresultsrlr all_toolsr~server_outcomes server_toolsr metadata_dict spend_metartrlog_excrIrrrrs+`` ``` @@rT_get_tools_from_mcp_serversrGs\6'b2> >'/||~8<57 &$wI(+DJJL(9 0@0jD]^iDj &= /50E#H-+t,?J#$;<+&55;;#5$>+>7 D2> -2!)-95@$' #.!,(RR0&7,6 *11BMSW)X*\c%y$]#6E+F3 +)7*&6'4*. *&#Q '4=4L4L4R4R'10A'- u /G"3'#0* "%$r^q$r!r K]45FGGGce $_ :!_ :6_ :_ :DReev:6BeEe#*>>5#99GEL.^.^qX].^PTt.^t.^I.^-00CW,M@@(FLQ%&f-w6@O@#699Lg5VAA1 1q)*&13|3DDA&A (;'M'M'Q'QR\'] mT2!.!2!23H!IJ%j$7%' ?I &;<9<=P9QJ5658^J12;QJ78M\MbMbMd>=IS'/88>J9:#+,,.-CClu dhJtW !#**P */@/L lL(/8/C/CJh/i /FF)@)FB/0.?"3*7 G !l"(()jk l # s?D R:N P"N:#&P N= P(O7PO PO,POP2$OB P!O7PO*"+O# O*O(O*+P R N7N2,R2N77R:P=PPP#O** P3P PPP RR$?Q*#Q&$Q*)R*R R R  RRRc KtsgSt||d{}g}|D]x}|t|||||||\} } tj|| | d|d{} |j | t jdt| |jzt jdt||S77d#t$r+} t jd|j| Yd} ~ d} ~ wwxYww) aB Helper method to fetch prompt from MCP servers based on server filtering criteria. Args: user_api_key_auth: User authentication info for access control mcp_auth_header: Optional auth header for MCP server (deprecated) mcp_servers: Optional list of server names/aliases to filter by mcp_server_auth_headers: Optional dict of server-specific auth headers oauth2_headers: Optional dict of oauth2 headers Returns: List[Prompt]: Combined list of prompts from filtered servers rergNryTr rfr;r|rnz.Successfully fetched %s prompts from server %sz(Error getting prompts from server %s: %sz:Successfully fetched %s prompts total from all MCP servers) r^rrDrget_prompts_from_serverextendrrqrYr rFrGrM) rerfrgrhrirnr all_promptsr r<r;rrIs rT_get_prompts_from_mcp_serversr`s#*I+C/#, &   ) eF~0K(? /-'"311 -   e 9 Q Q!$6"/# + !""7+$$%UWZ[bWcekepepq3 e< XZ]^iZjkO& , e(()SU[U`U`bcdd eKC;C#C;CC?C$C;C C8 !C3.C;3C88C;c KtsgSt||d{}g}|D]x}|t|||||||\} } tj|| | d|d{} |j | t jdt| |jzt jdt||S77d#t$r+} t jd|j| Yd} ~ d} ~ wwxYww) z)Fetch resources from allowed MCP servers.rNryTrz0Successfully fetched %s resources from server %sz*Error getting resources from server %s: %sz > ?#>"3 /'(?-',G&;# $ G  !Y[^_f_l_l[m nN  ?  $ $%WYZ ['b2> > ?sDBA A.A BA B)"B B BBBcKtsgSg} t||||||d{}tjdt ||S7%#t $r!}tj d|Yd}~|Sd}~wwxYww)a List all available MCP prompts. Args: user_api_key_auth: User authentication info for access control mcp_auth_header: Optional auth header for MCP server (deprecated) mcp_servers: Optional list of server names/aliases to filter by mcp_server_auth_headers: Optional dict of server-specific auth headers {server_alias: auth_value} Returns: List[Prompt]: Combined list of tools from all accessible servers rNz8Successfully fetched %s prompts from managed MCP serversr)r^rrrqrYrFrG)rerfrgrhrirnmanaged_promptsrIs rTrr\ s(I \$A"3 /'(?-' %O  ![]`ap]q r  \  $ $%WYZ [ [  \> A7A A#A A7A A4A/)A7/A44A7cKtsgSg} t||||||d{}tjdt ||S7%#t $r!}tj d|Yd}~|Sd}~wwxYww)z!List all available MCP resources.rNz:Successfully fetched %s resources from managed MCP serversz4Error getting resources from managed MCP servers: %s)r^rrrqrYrFrG)rerfrgrhrirnmanaged_resourcesrIs rTrr sI,. `&E"3 /'(?-' '!   !]_bct_u v! ! `  $ $%[]^ _ _   `rcKtsgSg} t||||||d{}tjdt ||S7%#t $r*}tj dt|Yd}~|Sd}~wwxYww)z*List all available MCP resource templates.rNzCSuccessfully fetched %s resource templates from managed MCP serversz=Error getting resource templates from managed MCP servers: %s)r^rrrqrYrFrGrr)rerfrgrhrirnmanaged_resource_templatesrIs rTrr sI=?" /W"3 /'(?-' 0* &  U./ *)%*   $ $OA   *)  s> BA A#A BA A=A82B8A==Bc|D]H}|jxsi}|jD]#\}}||k(s t|t|ccSJ|S)a|Translate a display-name override back to the original prefixed tool name. When a client received a customised display name from tools/list (e.g. "Get Pet") it will call tools/call with that same string. We need to reverse-map it to the original prefixed name (e.g. "petstore_mcp-getPetById") before any routing or permission logic runs. )rrpr-r0)r rr  display_mapunprefixed_name display_names rT!_resolve_display_name_to_originalr sg* aF ::@bK1<1B1B1D a-4'4_FWX^F_`` a a  rVctK|jsy|r |jndxsd}|sy||jf}tj |}|%|\}}t j |z tkr|Sddlm }ddl m }|y||||jd{}t||j||S7w)zRetrieve the stored BYOK credential for a user+server pair. Uses the shared _byok_cred_cache to avoid a DB round-trip on every tool call within the TTL window. Nr|rget_user_credentialr2r2rOrP) r~rOrPrErr[r\rGr,rrr2r]) rrerO cache_keyrNrWtsrr2s rTrr s!!7H+33dYWY#Z%9%9: (,,Y7  #NJ~~"$';;!!Q<  .' **  w (<(|}|rM| t%dd|d d d!l m!}t jD| |xsi%xs | j||| ||"d{}tG|tHr d#|vr|d#}tKjLd$|tO| ||||%\}}}t jP| |||||&d{\}}tSj |}tUj |} tWj |}! tY||d{}"tSjZ|tUjZ| tWjZ|!n| rt]%| |||||||| ' d{}"nt=j>| \t%fd(|Dd}#|#t%dd| d d d!l m!}t jD| |%|||#||"d{}d#|vr|d#}tY| |d{}"t_|"||| )d{Scc}w77.77f7#tSjZ|tUjZ| tWjZ|!wxYw777w7bw)*a Execute MCP tool. This function assumes permission checks have already been performed. Args: name: Tool name (may include server prefix) arguments: Tool arguments allowed_mcp_servers: Pre-validated list of servers the user can access start_time: Start time for logging user_api_key_auth: Optional user API key auth for logging mcp_auth_header: Optional MCP auth header mcp_server_auth_headers: Optional server-specific auth headers oauth2_headers: Optional OAuth2 headers raw_headers: Optional raw HTTP headers **kwargs: Additional arguments (e.g., litellm_logging_obj) Returns: CallToolResult: Tool execution result Nrequested_server_idc3BK|]}|jk(s|ywrrP)rrrs rTrz#execute_mcp_tool.. sVq1;;BU3UVF)known_server_prefixestool_server_mismatchTool 'z' belongs to MCP server 'z'' but request specified server_id for ''.)rrr)rr#User not allowed to call this tool.)r rrr"rmcp_tool_call_metadatazMCP: rjmcp_server_cost_inforrrrrrrrzMCP server for tool 'zk' is not available; refusing to dispatch without authorization checks. Retry once the server is registered.rr)r rrrerr rnrrz!Executing local registry tool: %s)rrfrhrnre)rrirnrfreforwarded_headers) rr rrerfrhrirnrrc3BK|]}|jk(s|ywrr )r candidaters rTrz#execute_mcp_tool..g se9y~~YdGdYer)rrrer)0rrrnextrrnr get_registryrr1addrrr _get_mcp_server_from_tool_namer-rrPr ris_tool_allowed#_get_standard_logging_mcp_tool_callrvrrjrr~rrrrget_toolrrpre_call_tool_checkrqrrrqrresolve_openapi_upstream_authrrr_handle_local_mcp_toolrv_handle_managed_mcp_tool_run_post_mcp_call_guardrails)&r rrrurerfrhrirnrrroriginal_tool_namerequested_servername_is_prefixedall_registry_prefixesregistry_server known_prefixrr standard_logging_mcp_tool_callr byok_cred local_toolr hook_resultauth_header_valueopenapi_forwarded_headersupstream_credentialresolved_auth_headersr _auth_token _extra_token_resolved_tokenr prefix_serverrrs& @@rTexecute_mcp_toolrQ sD(, 17$OSL)--.CL.QRS S 5TQfg   '0@ *J*//K!% 3QQRVWJ!&6&B$>?O$PL 9 X X1$ E!I!,%.  %(oo %>tZ%P"+)j.B.BFVF`F`.`'$'%;"(/$$.OO#4522B2G2G1H!L   %!1J"2"7"7K)B4IY)Z& $44?R$SVV[[$S'$ #@ Mp##3K@ M & @FzzJ_ae?f Om  2 23K L*/v  %@EdVn  2 27 ;  2QQRVWJ FPFYFYF_]_EdEd&F *+A B#Sq#667OP!!/)=jJ[)\#\ $'$'%9)3)=)=+5+A+A+TZ__!a  /0r!#,##,Z9JKKK 5==dC !# #/v6?? E 9 M M'#/r'::??"3"3!'$7 ! K+t, 1K' 4  !Dd KQk% /(?'"3 Q M 8:M0MM%-' 3"3";  %!"6!9!9:K!LK"8"<"<=N"OL%C%G%GH]%^O F!7i!HH$**;7&,,\:.44_E 5''#"3 /(?-'$7'=  H,(001CDP(,e0Ce( !( ($'34F3GHCCI$=$Q$Q+' +&7&7( +(; %  +- +K 8I34F RRH2 3/    c%TD$](LD 8I$**;7&,,\:.44_E l S sDVBV8T# CV!T("AV=T+>A'V%T.&A%V T1 AVT7"T4#T7'AVU;A(V*U=+VU?VV V+V.V1V4T77AU88V=V?VVrrrcKddlm}||S|j|| |jn t ||d{S7w)aRun ``post_mcp_call`` guardrails over an executed tool result. Lives on ``execute_mcp_tool``'s return path rather than inside ``_fire_mcp_tool_call_logging`` so enforcement never depends on logging being configured, and so every dispatch route gets it: the MCP protocol handler, the REST endpoint, and tool search all funnel through here. A guardrail that rejects the result raises, matching ``pre_mcp_call``. rrN)rrr)rrpost_mcp_call_hookrr)rrrerrs rTrr sW A  $M&99:M:Y#66_cdp_q/ :    s9AAA>rnrirfrerh_MCP_CREDENTIAL_REQUEST_FIELDS logging_objrcKddlm}|j||j|j|||d{t j j|_t|}||j|||d{|S|jd|jd t|}|j|d |||j|d ||d{||S|rM|xsijD cic]\} } | t vs| | } } } |j#| ||d d{|S777^cc} } w7w) aFire post-call logging for an executed MCP tool call, returning the result to send. The returned result is what the caller must forward to the client: a ``post_mcp_call`` guardrail may rewrite the tool output (e.g. mask sensitive values) or reject it, in which case its exception propagates. Guardrails run before the success/failure logging so the masked text, not the raw one, is what gets logged. A result with ``isError=True`` is logged as a failure (``status="failure"`` payload, so OTel marks the span ERROR) while the HTTP wire behavior stays 200 + ``isError: true`` per the MCP spec. The error check runs after ``async_post_mcp_tool_call_hook`` because guardrails may flip the result to ``isError=True`` in that hook. Raised exceptions never reach here (the ``@client`` wrapper and ``call_mcp_tool``'s except path log those), so this cannot double-log a failure. ``request_data`` may carry credential-bearing fields (the REST path puts ``raw_headers``, ``mcp_auth_header``, ``mcp_server_auth_headers``, and ``oauth2_headers`` at the top level of its data dict), so those are stripped before the dict is handed to ``post_call_failure_hook`` callbacks. rr)original_response)r response_objrurNr sync_success) event_type async_successr|/mcp/call_tool)rrrr)rr post_callasync_post_mcp_tool_call_hookrr>rrurkr/rhas_run_loggingrfailure_handlerasync_failure_handlerrprr) rrrurrerr error_message tool_errorrtrusanitized_request_datas rT_fire_mcp_tool_call_loggingr, s< A77711! 8   !* 7 7 = = DVL  336jck3l l lM##~#>###?.}= ##JJI// B HUUU  $M .:.@b-G-G-I-)sESXvMvU - "-$::3#-"3& ;    ?  m V - sY;EEAEEA E&E'!EEEE9E :EEEEc zKtj} |jdd} | tddt j |d{} g} | D]@} t j | }|tj|}| j|Bt|| d{} | s tdd td||| | |||||d |d{}| r+t-| || tj||d{}|S77a77#t$rt$r}tjt }d d lm}| Etj}| j'||| || j)||| |d{7|r!|r|j+|||d|d{7d}~wwxYw7w)za Call a specific tool with the provided arguments (handles prefixed tool names). rNzRequest arguments are requiredr)rer rr) r rrrurerfrhrirnrrrr#r)rrrurrerr)rr0rr rr rrrrrrr rFrrrrrr'r(rr,)r rrerfrgrhrirnrrurrrrallowed_serverrrIrrrs rTrr s%LLN ?EzzJ_ae?fK  #<\]]3L2c2c"33- "46 )? ?%!:!O!OPe!f!-&6%U%UVd%eN'..~>  ?)W'$7)# '# #@ . #$7%"3 /(?-'   H` 8/%!"3# Hc-# $   #,#7#7>\#]M D#."*,,.#33A}jRZ[)??=R\^fggg %6'>>!''(&7*"/ ? 5 :s'F;(DD"D68D.D/+DDD(F;F9F;DDDF6&A!F1F "F1*F-+F11F66F;c. Kt||d{}|s tddt|\} t fd|Dd} | tddt | |||||\} } t j | | || | |d{S7|7w) z[ Fetch a specific MCP prompt, handling both prefixed and unprefixed names. rNrz$User not allowed to get this prompt.rc3BK|]}|jk(s|ywrr)rrrs rTrz!mcp_get_prompt..| sVA+@UaVrr rhrfrirnre)r  prompt_namerrfr;rn)rr rrrDrget_prompt_from_server)r rrerfrgrhrirnroriginal_prompt_namer r<r;rs @rTrra s,D/#, &  #=  -J$,O)kV)<VX\] >=  -H$;+)#/ - )M/EE,.'#    =& < s"BBA7B B BBcKt||d{}|s tddt|dk7r tdd|d }t|||||| \} } t j ||| | | d{S7i7w) z1Read resource contents from upstream MCP servers.rNrz'User not allowed to read this resource.rr{r.z]Multiple MCP servers configured; read_resource currently supports exactly one allowed server.rr2)r rrfr;rn)rr rYrDrread_resource_from_server) rrerfrgrhrirnrr r<r;s rTrr s,D/#, &  #@  " #q (s ,A.,G$;+)#/ - )M/HH.'#    =& < s"BA=A$B8A?9B?Brc  tj|}|r|d|n|}|r^|jxsi}t|||j d|j d|||j t |jSt||||S)N/rlogo_url)r rmcp_server_namemcp_server_logo_urlnamespaced_tool_namemcp_session_id mcp_auth_modemcp_server_resource)r rr=r>)rrrr?rr*r%r)r rrr"rr=rs rTrr s 6TTUYZ AL Qtf&=RV (117RH-# ( ] ;$,LL$<%9)(22$?P#i..Q DPDVDVWZD[0iq_`_f_f_h0i-0i%$EUDZDZ[^D_0mqcdcjcjcl0m-0m%$ 24:Y[k1l'*-@-F-Fq-I 1< -%$2B0B-$$G<*1j1ns"EEE E E%E%cKt|}|'tj|d{\}}}}}}|} n$tj|d{\}}} }}}||| |||fS7:7w)z Extracts mcp_servers from the path and processes the MCP request for auth context. Returns: (user_api_key_auth, mcp_auth_header, mcp_servers, mcp_server_auth_headers) N)rWrprocess_mcp_request) rrrOrerfrrhrirnrgs rTextract_mcp_auth_contextrZN s (@'E ,(;;EBB !'/K(;;EBB !'    #     CCs!&A'A#&A'A%A'%A'c|jdg}|D]i\}}t|tr|n|j}|j dk(s._bytes_for_hash s?}%%!34U|#%%||G,,rVapi_keyzkey:rOzuser:r)rzoauth:zip:re anonymous) r r]rhashlibsha256 hexdigestrrqrrr^) rerirrg key_material api_key_hash uid_material user_id_hashauthz authz_bytess rT_owner_fingerprint_forrs| s$8 3 54<   ("1':KYX\2]"^L&-nn\&B&L&L&N l^,,"1':KYX\2]"^L&-nn\&B&L&L&N |n-- )--o>e.BTBTUdBeE!0!7K{ ; E E GHII Is3 (8(8(ABLLNOP PrVbodyc|sy tj|}t|txr|j ddk(S#tj t f$rYywxYw)z Check if the request body is a JSON-RPC initialize method. Returns True if method is "initialize", False otherwise or on parse error. Fr} initialize)rloadsrqrrJSONDecodeErrorr)rtrs rT_is_initialize_requestry sZ  **T*DdD)Pdhhx.@L.P P$$i0  s:AAAreceivecKg}g}d} |d{}|j||jddk7rnp|jddxsd}|r:t|z }|dkDr,|j|d||tt ||z }|jddsn |tk\rn|dj |fS7w) u Read just enough of the request body to decide whether this is a JSON-RPC ``initialize`` call. Returns the consumed ASGI messages so the caller can replay them faithfully to the downstream handler, and the peeked body bytes (capped at ``_MCP_ROUTING_PEEK_MAX_BYTES``). Stops reading from the wire as soon as either (a) we have peeked ``_MCP_ROUTING_PEEK_MAX_BYTES`` of body, or (b) the body is complete. The remainder of an oversized body is streamed lazily through ``wrapped_receive`` in the caller — so an authenticated client cannot force the proxy to buffer an arbitrarily large payload just to make a routing decision. rNrz http.requestrtrV more_bodyF)rrrLminrYr)rzconsumed_messages body_chunks peeked_bytesrrt remainings rT_read_request_body_for_routingr s 35*,  #IoG  $ $W -{{6"n4!++fc29cD8,F q=&&tJY'78 CD 9$==L;;{E2::58!#((;"7777&sCCB.CsendmgrrcKd}|jdg}dtdtdzfd}d}|D]A\}} |||k(st| tr| j dd }n t | }n|y t |d d} | y || vry |jd dj} | dk(rCt|tjd|tdddi} | |||d{ytjd||D cgc]\} }|| |k7s| |fc}} |d<y #t$rtjd |Yy wxYw7gcc}} ww)a Inspect the incoming ``mcp-session-id`` header **before** the request reaches the MCP SDK. If the session is stale (not known to this worker), strip the header so the SDK creates a fresh stateless session instead of returning a 400. Returns: True if the request was fully handled (e.g. DELETE on non-existent session). False if the request should continue to the session manager. Fixes https://github.com/BerriAI/litellm/issues/20992 r\rrarQNct|tr|jSt|tr!|jj ddSy)Nrereplaceerrors)rqr]rsrrr^)ras rT_normalize_header_namez9_handle_stale_mcp_session.._normalize_header_name sG+u-"((**+s+"((*11')1LLrVrerrFr)zMUnable to inspect active MCP sessions for '%s'. Deferring to session manager.r}r|DELETEzXDELETE request for non-existent MCP session '%s'. Returning success (idempotent DELETE).rzSession terminated successfullyrrTzlMCP session ID '%s' not found in this worker's memory. Stripping stale header to force new session creation.)rr'r]rqr_rrrrFrrqupperr,rMrr)rrzrr_mcp_session_header_headersr _session_idrarCknown_sessionsr}success_responser$r?s rT_handle_stale_mcp_sessionr s&&7EJYYyZ\E]  54< #' )1  %K%k26IIlE2"."5"5gi"5"PK"%l"3K    !(-@$ G  ! n,- (B/557 X  -k :   j '3"$EF' #5'48 8 8  D  08ltq!;QRS;TXk;kQFli=   _   ( 9msU=EAED1 A$E.E/ EE#E)E1EEEEE toolset_idc$Kddlm}ddlm}|j}|7t j j|jxsgvr tdd||}|s4|j}|r t|ddnd}|||vrtdd |d tj|g d{}t|j} |j} | | j| |gd  } n |d| |} |jd| i S7aw)a Restrict a key's MCP permissions to a single toolset. When a request arrives via /toolset/{name}/mcp we override the key's object_permission so that only the toolset's tools are visible. Raises HTTPException(403) if the key has an explicit toolset grant list that does not include toolset_id (i.e. mcp_toolsets is set but empty, or set to a list that omits this toolset). Admin keys always pass. r)LiteLLM_ObjectPermissionTable)_user_has_admin_viewNrz>API key is scoped to no MCP servers; toolset access is denied.r mcp_toolsetsz)API key does not have access to toolset 'r) toolset_ids)rgmcp_tool_permissionsrrz toolset-scope)object_permission_idrgrra)litellm.proxy._typesr/litellm.proxy.management_endpoints.common_utilsrrar5no_mcp_serversrurgr rr resolve_toolset_tool_permissionsr2rrr) rerrr original_opis_adminopgrantedtool_permissions server_ids existing_op updated_ops rT_apply_toolset_scoperFsG GX /@@  "'<'K'K'Q'QVaVmVmVsqs'tW //@A);;BBDWR>$G*G";# #FzlRTU ";![![isht!uu !1!6!6!89 .@@  "$//#-,<$&0J7%4&%5J !++4G3T+UU'vsB*D,D-A"Dallowed_server_idsc K|xsgD]S}tj||}|||j|vr.|-|jtj k(r|j dk(r]|tj|d{}|r|jtj k(rtj|dk(rt|dddurtj||d{rt|rtddd t|| i t|} t!| } t#|} | d t%} | j'd |r| d |} n| d|} d| d}tddd |i |st|| }tddd |i |r:|jtj(k(r|sddlm}ddlm}||||rQ|jtj(k(r4|r2t3|xsgdk(r tj4|||d{|r6|j6r*t9|||st|| }tddd |i |rR|j:rFt3|xsgdk(r4t=|)t?||st|| }tddd |i |s|j@st3|xsgdk(stC|rt?||r|jDrtddd t|| i tG|jHxsddd{\}}|dk(sB|sFtddd |i y77~7A7-w)aFail fast with HTTP 401 for MCP servers that need user auth but didn't receive it on this request. Covers both gateway-managed OAuth2 (points clients at the gateway AS metadata) and pass-through OAuth (points clients at the upstream resource-metadata via our well-known). ``allowed_server_ids`` may be passed by callers that have already narrowed the authorized server set (e.g. toolset scoping); servers not in that set are skipped so a client targeting a toolset that excludes a passthrough server is not pushed into an OAuth flow for a server it will be 403'd on immediately after authentication. rNclient_credentialsdelegate_auth_to_upstreamFTr Unauthorizedwww-authenticate)rrrz'/.well-known/oauth-authorization-serverz/mcp/r9zBearer authorization_uri="rzr)raise_token_exchange_challenge)get_server_root_path) root_pathr{)r rirer|)%rget_mcp_server_by_namerPr*r:r+ oauth2_flow ensure_oauth_metadata_discoveredreffective_oauth2_flowrhas_user_oauth_tokenrr r&StarletteRequestrr'r( startswithoauth2_token_exchanger}rr1rrYpreflight_token_exchangeis_oauth_passthroughr%is_oauth_delegate_get_forwarded_auth_from_scoper"is_true_passthrough_scope_has_authorization_header is_dcr_bridge_probe_upstream_authr)rrgrirhrerrrr rbase_url_pathas_metadata_root_as_urlauthorization_uriwww_authenticaterrupstream_statusupstream_www_authenticates rT1_raise_preemptive_401_for_unauthenticated_serversrs(',"} K.EEk]fgF!&8&DIYIYasIs!f&6&6'..&HVM_M_cwMw !8YYZ`aa&**gnn<$99&AEYY6#>FdR7KKFTefff 45FG+(+#1 24T*/0;5"%  /u5G3G%5$6eK="I%5$6a }"E*DWIQ(O%'$'-!35F G & (H#$/($($'-!35E F&**g.K.KKTbE.vAUAWX$$(E(EE" )r*a//HH!#1&7//=fnVmn#C +$ $ #)/1AB,, )r*a/259A:6CZ[#C +$ $ #)/1AB.. )r*a/7>:6CZ['''$'-.0P&+,71!  DXX^XbXbXhfhjlCm=m:!:"c).G'$'-!35N Os} b8g^|>nsvA>M,M!A%M,&M$'D?M,&M''BM,; M, M, M,* M,8AM,<M*= M, M,M,$M,'M,*M,c|jdg}|D]+\}}|jdk(s|jdcSy)z@First ``Authorization`` header value in the ASGI scope, or None.rs authorizationzlatin-1N)rrsr_)rr`rtrus rT$_get_authorization_header_from_scoperYsI>Cii SU>V ' /JCyy{..||I.. /rVct|duSr)r)rs rTrras3E:$FFrVcf|jdg}td|D}|syt|S)aKReturn the upstream-bound ``Authorization`` header value, or None. Only returns the ``Authorization`` header when ``x-litellm-api-key`` is also present. In that case ``Authorization`` is unambiguously the upstream token the caller wants forwarded to the MCP server. When ``x-litellm-api-key`` is absent the ``Authorization`` header may itself be the LiteLLM proxy API key (backward-compat path in ``MCPRequestHandler.process_mcp_request``), and forwarding it upstream would leak the proxy key to a third-party MCP server. rc3HK|]\}}|jdk(yw)sx-litellm-api-keyN)rs)rrtrs rTrz1_get_forwarded_auth_from_scope..ps#+lTZTWYZCIIK;O,O+ls "N)rr r)rr`has_litellm_key_headers rTrrds9?Dii SU>V (++l^k+l(l%3E::rVc|jtjk(xr(|jduxrt j |dk7S)aWhether ``server`` is an interactive delegate-auth server whose client-supplied token should be preflighted upstream. Mirrors the anonymous-delegate gate in ``get_allowed_mcp_servers``: the flow is resolved via ``effective_oauth2_flow`` so an unstamped M2M-shape row fails closed (its stored client credentials drive egress; the caller's bearer is irrelevant). Tr)r*r:r+rrrr]s rT"_is_delegate_upstream_probe_targetrusI    . W00D8 W 66v>BVV rV auth_headertimeoutc>Kttjd|i}dddtjj iddddd }d d i|rd |ini} |j |||| d{}|j|jjdfS7+#tj$rE}|jj|jjjdfcYd}~Sd}~wt$r!}tjd||Yd}~yd}~wwxYww)aGJSON-RPC initialize-probe the upstream URL to check whether the token is accepted. Uses POST so StreamableHTTP MCP servers run the same auth path as a real client request. Returns (status_code, www_authenticate). Fails-open with (200, None) on network errors so a transient hiccup does not block valid requests. Uses the public ``AsyncHTTPHandler.post()`` interface and catches ``httpx.HTTPStatusError`` separately so the 401/403 we want to surface is not swallowed by the broad fail-open ``except Exception`` below. r) llm_providerparams2.0zlitellm-mcp-auth-probervz1.0.0r )protocolVersion capabilities clientInfo)jsonrpcidr}rAcceptz#application/json, text/event-streamr))rrrrNrzG_probe_upstream_auth: probe to %s failed (%s), allowing request through)rN)rrMCPr;jun_2025rupostrrrhttpxHTTPStatusErrorrrFrrq)rrrrA probe_payload probe_headersresprs rTrrs+ /-11w'  *"#1#:#:#@#@ "4&  ; 1<-"   + %" !D ##T\\%5%56H%II I $$ Z<<++S\\-A-A-E-EFX-YY Y   !jloqt u sZADB,B-*BDBD-:C-'D(D- D9DDDDc Kt||t|dk(r|dndrtj|ndt r t |ndssyt |||d{}rtfd|Dnd}rrtfd|Dnd}||z}|sytj|D cgc] \}} } t|jxsd | "c} } }d{} t|| D]A\\}} } \} } | d k(rt|| d }td d d|i| dk(s6tddy7cc} } }w7^w)uIProbe pass-through and delegate-auth upstream servers in parallel before the MCP session starts. Only servers the caller's key is already authorized to reach are probed — the list is derived from _get_allowed_mcp_servers so that a user cannot trigger an upstream probe against a server their key is not permitted for. The MCP SDK commits HTTP 200 headers before invoking handlers, so a 401 can only be returned before that point. This function raises HTTPException(401) with a WWW-Authenticate header if any upstream rejects the client token, or 403 if the upstream accepts it but forbids the caller. Fails-open: network errors are logged and the request is allowed through. Delegate-auth servers (``auth_type=oauth2`` + ``delegate_auth_to_upstream``) are probed with the caller's bare ``Authorization`` bearer. That bearer is only an upstream token (never a LiteLLM key) when admission took the delegate bypass, so the delegate target is resolved through ``get_mcp_server_by_name`` -- the same resolver admission used -- rather than the wider allowed-server prefix/access-group matching. A name that only reaches a delegate server via server_id or an access group would have been admitted as a real LiteLLM key, so probing it would leak that key upstream; requiring the admission-resolver match closes that gap. Without the probe a rejected token is absorbed by the tools/list handler and masked as an empty tool list. Gated to single-server routes so one rejected token cannot 401 a multi-server aggregate connect, matching the OBO preflight gating; the challenge echoes the requested name so aliased routes get the same resource_metadata URL as the tokenless preemptive challenge. Nr{rrrRc3TK|]}|jr||jf!ywr)rr )rsrvforwarded_auths rTrz3_check_passthrough_upstream_auth..s/ ++nchh/ s%(rc3^K|]$} |jjk(r|f&ywrr)rr delegate_authdelegate_serverrequested_single_targets rTrz3_check_passthrough_upstream_auth..s8".3==OD]D]3]m%<=s*-r|rT)rr invalid_tokenrrrr Forbiddenr)rrYrrrrrtuplerDrTrrrr&r )rrergrallowed_serverspassthrough_targetsdelegate_targets probe_targetsrrr probe_resultschallenge_server_name probe_statusrrrrrs @@@@rT _check_passthrough_upstream_authrs@!?u E;F;RWZ[fWgklWlQrv' & < <=T`i j */QRa/b 1 7  m (@/#( " &  *   2!8 *    35EE  %,^^Zg h hCV3 UV"377=b+> h&  CFmUbBc  > +S!*->lAs"$D 5"&$ $ #)/1AB s"$ #&' Q" Li s8A.E4E5AE %E / E8E9AE?EEc !"#$%&'()*+,-.K jdd}t|d{\.$&%')tt|xsgdk(*t j t tjd&tjd%rt%jndjdg}|Dcgc]\}}|jdk7s||fc}}d<tj}d}|rG.Et.|d{..j} | rt| j xsgn t}t#&'%.| d{t%.&d{t'j()t+&$%' } | rt'j,| t.s/t1d{t3j4d d{t7+d #g"+rbt8j+} t;.'} | >| | k7r9tj<d +t?dddd} | d{y+r(tAtBd{}|ryt7+d}jddk(r!tEd{\"}tG|#tI+xs#--rtBntJ,tjd-rdndd+r d+dddndz#rdndz#rZ+sXt;.'} tM| d{s8tj<dt?dd d!d}|d{y("r"(fd"}|d }jdxsdjO}|rv|dk(rq tQjR|}tU|t*rK|jd#d$k(r7d%|vr3d|vr/d&|vsd'|vr'd(}tjd)|jd%d}-r0+r.|d1vr*|s(t^ja+t3jb}g!d2tdd3df!fd4 -r +r+d5tdd3dffd6 d@ #$%&')*+,-.fd7 } |+|4d{|d{dddd{n|d{!D]}tfj|d8dz }|d8kDr |tf|<ntfji|djdd9k7r#|tjvrtmjntp|<|d8ks~|tjvst^ji|dy7Gcc}}w7[77777%7 77Y7%#tPjVtXf$rE|j[d*d+,}d-|vr*d.|vsd/|vr"t]|sd(}tjd0YwxYw7^7R7E#1d{7swYFxYw7N#!D]}tfj|d8dz }|d8kDr |tf|<ntfji|djdd9k7r#|tjvrtmjntp|<|d8ks~|tjvst^ji|dwxYw#tr$rL}|jutwt jd:xsjd;d}~wtx$rtz$r}t}|d}~wt~$r}}tjd<| d8d=lAmB}t?|d>te|d}|d{7n)#t~$r}tjd?||d}~wwxYwYd}~yd}~wwxYww)Az+Handle MCP requests through StreamableHTTP.rr|Nr{)MCP request mcp_servers (header/path): %sMCP server auth headers: %srx-mcp-toolset-idrrgrirhrerr)rnrrgrfrhrir皙?Fz3Rejecting MCP request: session '%s' owner mismatch.rrz.mcp-session-id is bound to a different caller.rdetailsrrVr}POSTzMCP routing to statefulrz managerz (session=rz...)z (initialize)z^Rejecting MCP initialize: caller already holds the maximum number of active stateful sessions.izToo Many Requestsz-Too many active MCP sessions for this caller.cTKrjdSd{S7w)Nr)rS)r~original_receivesrTwrapped_receivez3handle_streamable_http_mcp..wrapped_receives*(044Q77!1!3333s (&(rrrrrTzUMCP: detected JSON-RPC response POST (id=%s), skipping session lock to avoid deadlockrerrz "jsonrpc"z"result"z"error"znMCP: detected truncated JSON-RPC response POST via top-level key scan, skipping session lock to avoid deadlock)rrsession_id_to_trackrQcr|vryj|tj|ddzt|<y)Nrr{)rrr)r active_request_session_idss rT!_increment_active_request_sessionzEhandle_streamable_http_mcp.._increment_active_request_session sA&*DD*112EF;??@SUVWZ[[88KLrVinitialized_session_idc|yrr)r r s rT#_track_initialized_stateful_sessionzGhandle_streamable_http_mcp.._track_initialized_stateful_sessions22HIrVc Kt t rnd jdxsdjdk7 } }rrt ||t }t  4d{j |d{r!r jddk(r tdddd{y7S7:7 #1d{7swYyxYww)Nr}r|r) rerfrgrhrirnrr"touch_last_seen"copy_existing_session_auth_contextrP) r_set_or_update_auth_contextrr-_wrap_send_with_stateful_session_auth_contextrsrZhandle_requestr,)r  local_sendr|r is_initializerfrhrgrirnrzrrPrr"target_manager use_statefulres rT _dispatchz-handle_streamable_http_mcp.._dispatchs5e<#>&7$3 +,C#1 +(-9zt%*YYx%8%>B$E$E$G8$S7D $ " M!N"!./@.R\]; "JJ%+A FF )77w SSS# uyy7Jh7V9*EFFF T FFFFsZA;C->C?C-CC'C C- C C-CC-C*C! C*&C-rr_original_pathr request_pathError handling MCP request: %sHTTP_500_INTERNAL_SERVER_ERRORMCP request failed!Failed to send error response: %sr)CrrZrYrWr7get_mcp_client_iprrrqr2rrrsr!rrarnrgrrr$maybe_build_debug_headersrwrap_send_with_debug_headersrLrTrDrErbrrsrrrrrryrrrBrrrwrqrxrr_rr setdefaultLockrrrrSrr[r\rr to_http_exceptionrr r4rrFrGstarlette.statusr!)/rrzrrr`r$r?active_toolset_idtoolset_allowed_server_idsr_debug_headersexpected_owner request_ownerforbidden_responsehandledrttoo_many_responseris_jsonrpc_responserequest_method_peeked _body_str session_lockractive_request_session_idactive_request_countrIr!error_responseresponse_errorr|r rr r~rrfrhrgrirrnrPr"rrres/``` @@@@@@@@@@@@@@@@@rThandle_streamable_http_mcpr</s<~ $yy4D/ud;; !',/0H0N0TRT,UYZ,Z "!/ @ @AQRWAX YJ  !Lk Z  -Wnt4K4P4P4R/Stx  CH))IWYBZM3@e41aAGGIQdDdAeE) (>'A'A'C :> & %6%B*>?PRc*d$d!-??JLS1E2-FRURW*D'-(?"3$#=  35:K[Zde e e%-$F$F'5k' /(?-$%N<R11333mmC((( 4E:J!M/1 (@(D(DZ(P 67H.Zd e !-.M2Q"**M"1=$'%0'W!1&-UGTBBB '@QUWo'p!p7> Dyy"f,0Nw0W*W'!4 6t < "&z'B]"CL@L$B$E$E$GN&0%)ZZ%5G"7D1#KK 2e; GO$G3%0Gw4F.2+&,,s#KK-.15L ~AS/S\o6AA*glln] ;= & s t  1*= J(+ J J  F F FB U++**'k))***$+%%1K U-+R+V+VWprs+twx+x(+a/]q?@YZ?CCD]_cdyy*h6;TXw;w^b^l^l^n@AZ[,q05NVu5u/334MtT US< f%e  f"4(BC"q+X"TB^,,i8(,{{79{'MI#y0'94 Y8N B9 M.2+&,,ZX*)****&1K U-+R+V+VWprs+twx+x(+a/]q?@YZ?CCD]_cdyy*h6;TXw;w^b^l^l^n@AZ[,q05NVu5u/334MtT U$ %%-.>u.EF"YY'78MEIIf&:s1vN)%UGT::: (()Ln] ; s5_ ![VB"[V8V>0[.V /A [9V :[VA[$V%[VA1[3V4[8_ 9[V[_ /[VB[V! 6[?V$[_ 8[>A0V'.A3["X**X+X*. X9X :X> X* X X*X'X*A?[['[?_ [[ [[[[[[[![$['AX[X[X* XX*X$X X$ X**B[ +[ 4[  [ _ A\  _ 5 ] _  _#,^^^_ ^<^77^<<_?_ _  _ c |K |jdd}t||d{\}}}}}} tt|xsgdk(} t j t |} tjd|tjd|rt|jnd|jdg} | D cgc]\} }| jdk7s| |fc}} |d<tj}d}|rG|Et||d{}|j}|rt|j xsgn t}t#|||||| | d{t%|||| d{t'|||||| | t(s/t+d{t-j.d d{t1||| | 4d{t2j5|||d{dddd{y7cc}} w7777x7]7G7*7#1d{7swYyxYw#t6$rL}|j9t;t ||jd xs|jdd}~wt<$rt>$r}tA|d}~wtB$r}tjDd| ddl#m$}ddl%m&}||dtO|d}||||d{7n)#tB$r}tjDd||d}~wwxYwYd}~yd}~wwxYww)z Handle MCP requests through SSE.rr|Nr{rrrrrrerfrgrhrirnrrrrrrrrr r"rrr#)(rrZrYrWr7r$rrrqr2rrrsr!rrarnrgrrset_auth_contextrLrTrDrErZr.rr r)rr r4rrFrGstarlette.responsesrr*r!rr)rrzrrrerfrgrhrirnrP_sse_client_ipr`r$r?r+r,rrIrr!r:r;s rThandle_sse_mcprBqs_n $yy4D/ud;; !',/0H0N0TRT,UYZ,Z "%3$D$DEUV[E\$]N  !Lk Z  -Wnt4K4P4P4R/Stx  CH))IWYBZM3@e41aAGGIQdDdAeE)  (>'A'A'C :> & %6%B*>?PRc*d$d!-??JLS1E2-FRURW*D'-(?"3(#=   35:K[Zhi i i "3 /'(?-'( 11333mmC(((E!'=  O O *88NNN  O O O{< f%e  j4( O O  O O O O$ %%-.>u.EF"YY'78MEIIf&:s1vN)%UGT::: (()Ln] ; s[L<!H=HB"H=H$H*0H=HA H=%H&H=;H<)H=%H&H=H H=H"H=H(9H$:H(> H= H& H=L<H=H=H=H=H= H="H=$H(&H=(H:.H1 /H:6H=9L<:H== L9AJ  L9" J-- L99L4/L?LLL4 L,L''L,,L4/L<4L99L<)titlerr r]z/enabledz$Returns if the MCP server is enabled)rcdtiS)z6 Returns if the MCP server is enabled enabled)r^rrVrTget_mcp_server_enabledrFs=))rVr9z/mcpz/{mcp_server_name}/mcpz/sser cn||_||_||_|xsi|_||_||_||_yrr>r rerfrgrhrirnrs rT_update_auth_contextrIsA'8 #$3 ! + ,C,Ir )#1  + ' rVc Tt|||||||}tj||S)a Set the UserAPIKeyAuth in the auth context variable. Args: user_api_key_auth: UserAPIKeyAuth object mcp_auth_header: MCP auth header to be passed to the MCP server (deprecated) mcp_servers: Optional list of server names and access groups to filter by mcp_server_auth_headers: Optional dict of server-specific auth headers {server_alias: auth_value} client_ip: Client IP address for MCP access control r>)rrrn)rerfrgrhrirnrr s rTr?r?s9&0/+#$;)#  Y'rVrrc |rtj|nd} | ]|[|rtjt|<| rt |||||||St | |||||||tj| | St |||||||S)Nr>rH) rrr[r\rr?rIrrn) rerfrgrhrirnrr"rrr s rTrr1sOY:>>zJ^b  Z%;GK~~GW8D1'&7$3 +,C#1 +' !#"3 /'(?-'#    + /+#$;)#  rVowner_fingerprinton_session_registeredc0dtddffd }|S)NrrQcK|jddk(r|jdg}|D]\}}t|tr|nt|j }|j dk(sEt|tr|j n t|}|tjt|<tjt|<t|<n |d{y7w)Nrzhttp.response.startrr\)rrqr]rrr^rsr_rrnrr[r\rr) rresponse_headersrtrurar"r rMrLrs rT wrapped_sendzC_wrap_send_with_stateful_session_auth_context..wrapped_sendgs{{6"&;;U\U`U`ajlnUo "2 JC)3C)?#SX__EVK"((*.??7A%7OU\\^UXY^U_ 0<1*=(,,Y7FO7 COS~~O_@L?P0< w-  sA-C>1BC>6C<7C>)r)rr rLrMrQs```` rTrras#   D  rVctj}|r_t|trO|j|j |j |j|j|j|jfSy)a Get the UserAPIKeyAuth from the auth context variable. Returns: Tuple containing: UserAPIKeyAuth, MCP auth header (deprecated), MCP servers, server-specific auth headers, OAuth2 headers, raw headers, client IP NNNNNNN) rrrqrrerfrgrhrirnrrs rTget_auth_contextrTysm ,//1 I/CD++))%%11((%%## 8rVcn ddlm}|jjS#tt f$rYywxYw)Nrr_)rmr`rro LookupErrorrr_s rT_get_current_sessionrWs4  >??$,, ,[)  s "44cPt}|y |tvry tj}|rt|tr |t|<yyy#t$r,tjdt |j YywxYw#t$rtjdYywxYw)Nz]_cache_auth_context_lazily: session object is unhashable (type=%s), cannot cache auth contextuf_cache_auth_context_lazily: could not store auth via session identity — session object is unhashable) rWrhrrrqrrrrrqr)roauths rT_cache_auth_context_lazilyrZs-/ ?  334'**, Jt%9: 59)'2;4   oW &&     $$H s#A B 2BBB%$B%ct}|yd} tj|}|S#t$r-t j dt |jY|SwxYw)Nzm_recover_auth_from_session: session object is unhashable (type=%s), skipping _session_obj_auth_storage lookup)rWrhrrrrqrr)rostoreds rT_recover_auth_from_sessionr]sl-/ ?.2 .227;F    GW &&    s(2AAcKt\}}}}}}}| tn`t}|rT|j}|j}|j }|j }|j}|j}|j}|||||||fSw)z Get auth context from ContextVar first, then fall back to session storage (which survives cross-task boundaries in the MCP SDK). ) rTrZr]rerfrgrhrirnr)rerfrgrhrirnr|r\s rTrprps*      #     ( & (68F$*$<$<!"("8"8$00 *0*H*H'!'!6!6$00 #--    #     sB B cFtj}||StS)z@Return the active MCP session captured during handler execution.)rlrrW)ros rTget_active_mcp_sessionr`s$/335  N#%%rVcptj}|rt|tr|St }||Sy)z7Return auth context from ContextVar or session storage.N)rrrqrr])rYr\s rTget_active_auth_contextrbs8&**, Jt%9:K24  MrV)NNrr)rQzListToolsResult | list[Tool])NNNNN)F)NNNFNNNN)NNN) NNNNNNFNN)NNNNNNrS)g@) NNNNNNNTF(@rrDrW contextvarsrjrr[rtypesrcollections.abcrrrrrtypingrr r r rfastapir r pydanticrrstarlette.requestsrrr@rstarlette.typesrrrrlitellm._loggingrlitellm.constantsr*litellm.litellm_core_utils.litellm_loggingrLiteLLMLoggingObj&litellm.llms.custom_httpx.http_handlerrrAlitellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcprr=litellm.proxy._experimental.mcp_server.discoverable_endpointsr1litellm.proxy._experimental.mcp_server.exceptionsrr 2litellm.proxy._experimental.mcp_server.mcp_contextr!r"r#0litellm.proxy._experimental.mcp_server.mcp_debugr$2litellm.proxy._experimental.mcp_server.oauth_utilsr%r&r'r(rr)r*r+r,r-r.r/r0r1r2r3rr4r5r6#litellm.proxy.auth.ip_address_utilsr7rr8r9litellm.types.mcpr:r;+litellm.types.mcp_server.mcp_server_managerr<r=litellm.types.utilsr>r? litellm.utilsr@rArBmcp.server.sessionrC_McpServerSessionr,rDrErrrrrrrGrHrIrKrLrNrUr]r^rweakrefrFr_r` mcp.serverra mcp.server.lowlevel.helper_typesrbrsrcrdrerfrgWeakKeyDictionaryrhrrIrq ContextVarrlrLr(rmrvrr'rrrrrrrr'mcp.server.auth.middleware.auth_contextrrrmrmcp.server.modelsr"mcp.server.streamable_http_managerrrrrrr@litellm.proxy._experimental.mcp_server.auth.litellm_auth_handlerr;litellm.proxy._experimental.mcp_server.faults.list_outcomesrrrrrr9litellm.proxy._experimental.mcp_server.mcp_server_managerrrrrrr?litellm.proxy._experimental.mcp_server.openapi_to_mcp_generatorrrr4litellm.proxy._experimental.mcp_server.sse_transportr4litellm.proxy._experimental.mcp_server.tool_registryrrrrrrrrrr2rr r  MethodTyperrrrrrrrrrrr!r*r,r-r.rOrPrQr/Taskr7rBrJrTr[asynccontextmanagerr]rcrrrrrBrrrrrrrrrrr rr"r%r-r5rDrOrZr^rrrrrrwrrrrrrrr frozensetrr,rrrrrrrWrZrbrsr]ryrrrrnrrrrrrrr<rBrrrFmountadd_middlewarerIr?rrrTrWrZr]rpr`rbrrVrTrsC   FF66 *':,99+<S F     ?6JE77EP LN%U38_eC$J4E.FFGHM e #'5'07&7+. %- &*U)(EuD5555LCLCLS4ZLTXL t 0!EE\u[b[t[t[vXv UkT_TjTj$Uk445OPQ !&*gllne, c3h$& 4Z 3S3T3lVS#X0E0 c3h$)> 6   D 4444@ 4v 4& 4 v &  & T N},!?7,S * XL@G@t=Q8R<<@IMD1D8D$(T#v+->(>#?$#FD  D,# $*FE&M,<5+;+;-BG/x/_X_ J(:JFcFdF7OU6">  "#' "?C')<C!!> T\!> !>F%QS%QT%QNcd<2@##.}T2.$. OCOCb 4 J15 $ !#!#V $!#*!#S#X&- !# : !# T ! !#P)-&*DH04-1T T V $t+T *D0T : T #Y% T t T "&c4S>&9!:T!AT S#X-T #s(^d*T  $ T l hChCc6k9JT9QhCVdhChCT /CV /C/Cb ,Cs,CtCH~/D,C,C,C\ )C$x.)C)CV ##%+C40@+A+C&+CZ  C CD1E,F C CT8##Y%8#!)_8# i8#t Uc US Uy U]a U(G}(( g(TG} g. t  !%;#)D0;##Y%;#:;# i ;#z!%c4S>&9!:T!A :SSS#X-S"&c4S>&9!:T!AS  S,MQGG)D0GJG c3h$  G*)D0 c++ ,>4804f1f1!%c4S>&9!:T!Af1tf1S#X- f1 #s(^d* f1 *D0 f1I-f1 tCH~#d*DcNT,AA Bf1PK!)_K tK2## (- $>)D0$>#Y%$>:$>!% $> t  $>$$>L6i6C6EI04-1,1,0'+)- $W)D0WtW#Y%W"&c4S>&9!:T!A W S#X- W #s(^d* W&*W #TzW*W3i$&W:W WzEI04-1 ?)D0?t?#Y%?"&c4S>&9!:T!A ? S#X- ? #s(^d* ? f?JEI04-1 1)D01t1#Y%1"&c4S>&9!:T!A 1 S#X- 1 #s(^d* 1 h1nEI04-1 ;&)D0;&t;&#Y%;&"&c4S>&9!:T!A ;& S#X- ;& #s(^d* ;&  ;&z G}  *D0  g  :48&*(,DH04-1,1,0 $-?)D0-?t-?#Y%-?"&c4S>&9!:T!A -? S#X- -? #s(^d* -?&*-? #Tz-?:-? -?`48&*(,DH04-1 &)D0&t&#Y%&"&c4S>&9!:T!A & S#X- & #s(^d* & f&R48&*(,DH04-1 !)D0!t!#Y%!"&c4S>&9!:T!A ! S#X- ! #s(^d* ! h!<48&*(,DH04-1 !*)D0!*t!*#Y%!*"&c4S>&9!:T!A !* S#X- !* #s(^d* !*  !*F!)_ $!!)D0! t!FVV)D0V Vz48&*DH04-126~ ~ V $~ ")_~  ~ *D0 ~ t ~ "&c4S>&9!:T!A~ S#X-~ #s(^d*~ !)4~ ~  ~ @   .5 *D0 c6k*    4-6 -"E4848 @&@@@ @ *D0 @ c6k*T1 @ @D /337&*(,DH04-1ggV $t+g*D0gt g #Y% g "&c4S>&9!:T!A gS#X-g#s(^d*gg g gV/337&*(,DH04-12 2 V $t+2 *D02 t 2 #Y% 2 "&c4S>&9!:T!A 2 S#X-2 #s(^d*2  2 l48&*(,DH04-1/ / )D0/ t/ #Y% / "&c4S>&9!:T!A / S#X- / #s(^d*/  / j"& V $4Z$J  $ @48&*DH04-18<26   V $ *D0  t  "&c4S>&9!:T!A  S#X- #s(^d* /5 !)4   @c3c4V ;LcQ_c@*%s*%tCy4/?*%X  D % C$J 15 $6)D06S#X-6:6 6p U t 0808 tG}e# $08dQQQQ, Q  Qf>V)>V>V >VN/3QQ#Y%QS#X-Q"&c4S>&9!:T!A Q *D0 Q : Q HtOQ QfEcDjGuGG;e;d ;"  9    "4 444 sC$J  4ltt)D0t#Y%t: t  tl@@@t@X\@D pEpGp4pDpd %2*  C WW: *DdO* *IIc-.IIf01II&(BCIIfn%,-'+(,DH04-1 $('()D0(t(#Y% ( "&c4S>&9!:T!A ( S#X- (#s(^d*(:( (('+(,DH04-1 $)D0t#Y%"&c4S>&9!:T!A  S#X-  #s(^d* : B'+(,DH04-1 $!% $38. )D0. t. #Y%. "&c4S>&9!:T!A . S#X- . #s(^d* . :. $J. . -1.  . h?C ' (t 4t;   08e d  S D S$sCx. !D( S#X S#X d  8:0(