tPjBUdZddlZddlZddlZddlZddlmZmZmZddl m Z ddl m Z m Z m Z ddlmZmZmZmZddlmZmZmZmZmZmZmZmZmZddlmZdd lm Z m!Z! dd l"m#Z#m$Z$ddl'Z'dd l(m)Z)m*Z*dd l+m,Z,dd l-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6ddl/m7Z8ddl9m:Z:m;Z;ddlZ>ddl?m@Z@mAZAeddgZBeeCd<dZDeEeCd<dZFeeCd<dZGeeCd<GddeZHdeeHd eId!eEfd"ZJd#ZKeeCd$<er dd%lLmMZNdd&lOmPZP ejdeD r dd)lTmUZUdd/lYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZimjZjmkZkmlZlmmZmmnZnmoZompZpdd0lqmrZrmsZsmtZtmuZumvZvmwZwmxZxmyZydd1lzm{Z{dd2l|m}Z}m~Z~mZdd3lmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZdd4lmZmZdd5lmZmZdd6lmZdd7lmZmZmZmZmZmZmZmZdd8lmZdd9lmZmZmZmZdd:lmZe Gd;d<Zd=e2d!dfd>Zd=e2d!dfd?Zd=e2d!dfd@Z7d=ed!dfdAZeejhZeeeCdB<d=ed!dfdCZd!eEfdDZdEeIdFeId!eIfdGZdHed!eIfdIZGdJdKe!ZGdLdMe!ZdHedEeId!efdNZdEeId!efdOZiZeeeIefeCdP<d dQZdHedRed!efdSZdHedRed!dfdTZdUeId!edzfdVZĐd dWZd=edUeIdXeId!dfdYZdUeId!edzfdZZdUeId!edzfd[Zd\ed!efd]Z dd_Zd`eed!eefdaZdbed!eEfdcZdbed!eEfddZd\ed!efdeZd`eed!eefdfZd\ed!efdgZd`eed!eefdhZdiZeeeeIeIfdjfeCdk<d^dld!eEfdmZd=ed!efdnZd=ed!eIfdoZd=edXeIdzdUeId!efdpZdqeIfdrZeBjdsdgeegteefdbefduZeBjdvdgeegteefdbefdwZeBjdxdgeegdyzd{efd|ZeBjd}dgd~d{efdZd!efdZdeId!eefdZdbed!eefdZdbed!eeIfdZeBjddeegeeeeedded(dfdbedeIdzdeEfdZeBjddeegeddeefdeeIdzdbefdZeBjddeegeejeeefd=edbefdZeBjddeegeeeefdbefdZeBjddeegeeeefdUeIdbefdZeBjddeegeeeefdUeId=edbefdZeBjddeegeeefd{edUeIdbefdZeBjddeegeejeeeeddfd=edbedeIdzfdZeBjddeefeejeeefd=edbefdZeBjddeegejeeeeddfd=edbedeIdzfdZd{ed!efdZ ddUeIdbed{edzd!efdZeBjdd(eegeededjdddddfd{edUeIdbedeIdzdeIdeIdeIdzdeIdzdeIdzdeIdzfdZeBjdd(eegeeedjedededededededf d{edUeIdbedeIdeIdzdeIdzdeIdzdeIdzdeIdzdeIdzdeIdzfd„ZeBjdd(eegeefd{edUeIdbefdĄZeBjddeegeejƫeeeeddfdUeIdbedeIdzfdDŽZeBjddeegeeeefdUeId=edbefdʄZeBjddeegeeeefdUeIdbefd̄ZeBjddeegeeeefdUeId=edbefdτZeBjddeegeeeefdUeIdbefdфZeBjddeegeeeefdUeIdbefdԄZeBjddeegeeeeefdbefdׄZdbedUeId!efd؄ZdHedeeIeIfd!efdڄZeBjddeegeeeefdUeIdbed!efd݄ZeBjddeegeeeefdUeId=edbed!efd߄ZeBjddeegeeeefdUeIdbed!efdZeBjddeegeeeeefdbed!eefdZeBjddeegeejeeeeddfd=edbedeIdzfdZeBjddeegejeefd{edbefdZejjejjejjejje dZ eeCd<da eeIeeeIeIffdzeCd<d!eeIeeeIeIfffdZeBjddeegedd﬊edd𬊫eefdeIdzdeIdzdbefdZejjejjejjejje dZeeCd<ej"dd!eeIeffdZeBjddeefdbefdZddlmZmZmZmZmZddlmZmZeBjddejeeeedfd=edbedeIdzfdZeBjddeeefdbefdZeBjddeeefdeIdbefdZ eBjddeeeedfd=edbedeIdzfd Z!eBjdd ejeeeedfdeIdbedeIdzfd Z"yy#e%$re&Z#e&Z$Y wxYw#e%$r ZRe)jd'eRd(ZDYdZR[R dZR[RwwxYw#e%$rdd*lVmWZWGd+d,eWZXd-eId!eXfd.ZUY 8wxYw(a 1. Allow proxy admin to perform create, update, and delete operations on MCP servers in the db. 2. Allows users to view the mcp servers they have access to. Endpoints here: - GET `/v1/mcp/server` - Returns all of the configured mcp servers in the db filtered by requestor's access - GET `/v1/mcp/server/{server_id}` - Returns the the specific mcp server in the db given `server_id` filtered by requestor's access - POST `/v1/mcp/server` - Add a new external mcp server. - PUT `/v1/mcp/server` - Edits an existing mcp server. - DELETE `/v1/mcp/server/{server_id}` - Deletes the mcp server given `server_id`. - GET `/v1/mcp/tools - lists all the tools available for a key - GET `/v1/mcp/access_groups` - lists all available MCP access groups - GET `/v1/mcp/discover` - Returns curated list of well-known MCP servers for discovery UI - GET `/v1/mcp/openapi-registry` - Returns well-known OpenAPI APIs with OAuth 2.0 metadata N)IterableMappingSequence) dataclass)datetime timedeltatimezone) TYPE_CHECKINGFinalLiteralProtocol) APIRouterDependsFormHeader HTTPExceptionQueryRequestResponsestatus) JSONResponse)ReadOnly TypedDict)RecordNotFoundErrorUniqueViolationError)verbose_loggerverbose_proxy_logger)uuid)LITELLM_PROXY_ADMIN_NAME)LITELLM_MCP_SERVER_DESCRIPTIONLITELLM_MCP_SERVER_NAMEMcpServerPayloadLikebuild_env_var_setup_urlcollect_env_var_referencesget_server_prefixparse_admin_env_vars))validate_and_normalize_mcp_server_payload)decrypt_value_helperencrypt_value_helper)get_audit_log_changed_byis_audit_logging_enabled)MCPServerRepositoryMCPUserCredentialsRepositoryz/v1/mcpmcp)prefixtagsrouterT MCP_AVAILABLEi, TEMPORARY_MCP_SERVER_TTL_SECONDSzlitellm:mcp:temporary_server%TEMPORARY_MCP_SERVER_REDIS_KEY_PREFIXceZdZUeed<y) _HasServerId server_idN)__name__ __module__ __qualname__str__annotations__/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/mcp_management_endpoints.pyr6r6TsNr>r6mcp_server_records mcp_server_idreturnc4|D]}|j|k(syy)z Check if the mcp server with the given id exists in the iterable of mcp servers. Defined at module level (outside ``if MCP_AVAILABLE``) so it can be imported on Python < 3.10 where the ``mcp`` package is unavailable. TFr7)r@rAmcp_server_records r?does_mcp_server_existrFXs*0  & &- 7 r>z1.0.0DEFAULT_MCP_REGISTRY_VERSION)models) PrismaClientzMCP module not found: %sF)validate_tool_name) BaseModelc0eZdZUdZeed<gZeeed<y)_ToolNameValidationResultTis_validwarningsN) r8r9r:rNboolr<rOlistr;r=r>r?rMrMzs!Hd !"$Hd3i $r>rMnamectSN)rM)rRs r?rJrJ~s ,. .r>)approve_mcp_servercreate_draft_mcp_servercreate_mcp_serverdelete_mcp_serverdelete_user_credentialdelete_user_env_varsget_all_mcp_serversget_all_mcp_servers_for_userget_draft_mcp_serverget_mcp_serverget_mcp_serversget_mcp_submissionsget_user_env_varsget_user_env_vars_bulkget_user_oauth_credentiallist_user_oauth_credentialsmcp_oauth_token_identitymerge_user_env_vars'purge_user_oauth_credentials_for_serverreject_mcp_serverstore_user_credentialstore_user_oauth_credentialupdate_mcp_server)_raise_if_not_oauth2authorize_with_serverclient_supplied_redirect_urisexchange_token_with_serverget_request_base_url%redeem_passthrough_authorization_coderegister_client_with_serverresolve_ephemeral_dcr_clientglobal_mcp_server_manager)admitted_user_contextbuild_effective_auth_contextsis_ui_session_credential)LiteLLM_MCPServerTableLitellmUserRolesMakeMCPServersPublicRequestMCPApprovalStatusMCPOAuthUserCredentialRequestMCPOAuthUserCredentialStatusMCPSubmissionsSummary MCPTransportMCPUserCredentialListItemMCPUserCredentialRequestMCPUserCredentialResponseMCPUserEnvVarSpecMCPUserEnvVarsRequestMCPUserEnvVarsStatusNewMCPServerRequestRejectMCPServerRequestSpecialMCPServerNameUpdateMCPServerRequestUserAPIKeyAuthUserMCPManagementMode)_user_api_key_auth_builderuser_api_key_auth)_read_request_body!populate_request_with_path_params)_user_has_admin_view)ConnectorConversionErrorConvertedConnectorMCPConnectorImportFailureMCPConnectorImportRequestMCPConnectorImportResponseMCPConnectorImportResultMCPConnectorImportSkippedconvert_connector_entries)management_endpoint_wrapper) MCP_ADMIN_CONFIG_CREDENTIAL_KEYSMCPAuthMCPCredentialsnormalize_upstream_header_name) MCPServerc"eZdZUeed<eed<y)_TemporaryMCPServerEntryserver expires_atN)r8r9r:rr<rr=r>r?rrsr>rpayloadc|g}t|dd}t|dd}|r|jd|f|r|jd|f|D]q\}}|s t|}|jr!d|d|}|jr!|dzdj |jz}t tjd|iy)N server_namealiaszInvalid MCP tool prefix 'z' provided via  error status_codedetail) getattrappendrJrNrOjoinrrHTTP_400_BAD_REQUEST)r candidatesrr field_namevaluevalidation_resulterror_messages_texts r? _validate_mcp_server_name_fieldsrs:< $WmTB w6    }k: ;    w. /!+  J 25 9  ))$=eWOT^S_"`  ))&9D&@499M^MgMgCh&h#"77!45  r>ct|dd}t|tr|jdnd}t|tr|dk(ryt |!t tjdd|diy)N credentialsupstream_token_headerrzInvalid upstream_token_header zE: must be a valid HTTP header name (RFC 7230 token, e.g. 'esb-oauth')r) r isinstancedictgetr;rrrr)rrraws r?_validate_upstream_token_headerrs$WmTB AKKY]A^[__%<=dh#s#sby  )# . 6"778@==  7r>cFt|t|t|yrT)/_base_validate_and_normalize_mcp_server_payloadrr)rs r?r'r's7@(1'0r>c0|jtjk7ry|jry|jxsi}t |j xr3|jdxr |jdxr |j }|rd|_yd|_y)aFallback only: fill in oauth2_flow when an oauth2 create omits it. An explicit oauth2_flow from the caller (the dashboard's flow selector, a REST body, config.yaml) always wins and is never touched. The shape check below runs solely for oauth2 creates that leave the field unset, so those rows still persist a flow instead of relying on read-time inference. The create payload carries the plaintext credentials, so the M2M-vs-interactive decision is reliable here in a way it is not at read time (credentials are encrypted at rest and redacted in responses). The client_credentials shape mirrors the legacy inference in MCPServerManager._resolve_oauth2_flow; every other oauth2 configuration is the authorization_code grant, including delegate_auth_to_upstream, where the client runs that grant upstream. N client_id client_secretclient_credentialsauthorization_code) auth_typeroauth2 oauth2_flowrrP token_urlrauthorization_url)rr has_m2m_shapes r?stamp_omitted_oauth2_flowrs    .     $006B #    . , .0 .---  7D2I]r>_VALID_MCP_REQUIRED_FIELDScfddlm}|jd}|sy|Dcgc] }|tvs |}}|r!t t j dd|did d td tffd }|Dcgc] }||r |}}|r!t t jdd |diycc}wcc}w)zIValidate submission payload against admin-configured mcp_required_fields.rgeneral_settingsmcp_required_fieldsNrz2mcp_required_fields contains unknown field names: zB. Check general_settings.mcp_required_fields in your proxy config.rnonerrBcnt|d}|yt|ttfr|sy|dk(r|k(ryy)NFrT)rrr;rQ)rr_AUTH_TYPE_SENTINELrs r?_field_presentz5_validate_mcp_required_fields.._field_presentKsB"7J=E}%#t-e[(U6I-Ir>z'Submission is missing required fields: zE. Configure required fields via general_settings.mcp_required_fields.) litellm.proxy.proxy_serverrrrrrHTTP_500_INTERNAL_SERVER_ERRORr;rPr)rproxy_general_settingsrequired_fieldsfunknownrmissingrs` @r?_validate_mcp_required_fieldsr1s 4J3M3MNc3d &5\A[8[!\\ "AAQRYQZ[WW &, s t &5NN1base_urlpathc`|jd}|jdr|nd|}||S)N/)rstrip startswith)rrnormalized_basenormalized_paths r?_build_registry_remote_urlrgs9!)!5)-)=Qtf:!"?"344r>rcz|jr |jS|jr |jS|jSrT)rrr7)rs r?_build_mcp_registry_server_namerls4 <<<<    %% %r>c.eZdZUeeed<eeed<y)_McpRegistryRemotetypeurlN)r8r9r:rr;r<r=r>r?rrsssm c]r>rcdeZdZUeeed<eeed<eeed<eeed<eeeed<y)_McpRegistryEntryrRtitle descriptionversionremotesN)r8r9r:rr;r<rrr=r>r?rrws;sm}c]"#(#5677r>rct|}|}|}t}t|}|s tdt |d|d}||||d|dgdS)NzMCP server prefix is missingr/mcpstreamable-httprrrRrrrr)rrGr% ValueErrorr)rrrrrr server_prefix remote_urls r?$_build_mcp_registry_entry_for_serverr~stcRt|d}ttttd|dgdS)Nrrrr)rr!r rG)rrs r?_build_builtin_registry_entryrs66xH +,93.%  r>_temporary_mcp_serversctsytj}tjDcgc]\}}|j|ks|}}}|D]}tj |dycc}}wrT)rrutcnowitemsrpop)nowr7entry expired_idss r?$_prune_expired_temporary_mcp_serversr si% __&9O9U9U9Ws%5Y[`[k[kor[rys s$ 8I " & &y$ 7 8ts A0 A0 ttl_secondsctd|}ttjt |z}t ||t |j<|S)N)seconds)rr)maxr rrrrrr7)rr rs r?_cache_temporary_mcp_serverrsM![) ,.$OO- +0NN 3K!4 v//0 r>cKtjttjdsyttjdd}| t|dsy|j d}t j |} t|}t|tstjdy |jtd|j|t!d | d{y#t$r }tjd|Yd}~yd}~wwxYw71#t$r }tjd |Yd}~yd}~wwxYww) z Best-effort write-through to Redis so temporary MCP OAuth sessions are shared across proxy instances. Keep local in-memory cache as fallback. Ncacheasync_set_cachejson)modezBFailed to encrypt temporary MCP server payload for Redis cache: %szKEncrypted temporary MCP payload is not a string; skipping Redis cache write:r )keyrttlz7Failed to write temporary MCP server to Redis cache: %s)litellmrhasattrr model_dumprdumpsr) Exceptionrdebugrr;rr4r7r)rr  cache_backendr payload_jsonencrypted_payloades r?$_cache_temporary_mcp_server_in_redisr#s1 ==  w(G &w}}gtD   ?P(Q ,2,=,=6,=,J"jj1  ';L'I  +S1 & &'t u  e//<=Qv?O?O>PQ';'0    & &'kmn o     e & &'`bc d d eslA=E C, &E24D&D'D+E, D5D EDED E#D>9E>EEr7cKtjttjdsyttjdd}| t|dsy |j t d|d{}t|tstjdyt|dd }|y tj|}t|tsy|} tj |S7z#t $r }tjd|Yd}~yd}~wwxYw#t $r }tjd |Yd}~yd}~wwxYw#t $r }tjd |Yd}~yd}~wwxYww) z Best-effort read from Redis shared cache. Returns None on miss/errors. Values must be encrypted strings (same contract as _cache_temporary_mcp_server_in_redis); legacy plaintext dict payloads are rejected. Nrasync_get_cacherrz8Failed reading temporary MCP server from Redis cache: %szYTemporary MCP Redis cache value must be an encrypted string; rejecting non-string payloadtemporary_mcp_serverr)rrexception_typez:Invalid decrypted temporary MCP payload in Redis cache: %sz7Invalid temporary MCP server payload in Redis cache: %s)rrrrr%r4rrrrr;r(rloadsrrmodel_validate)r7r cached_serverr"decrypted_jsonloaded payload_dicts r?$_get_temporary_mcp_server_from_redisr/sj ==  w(G&w}}gtD   ?P(Q )6)F)F<=QykJ*G*$M-- & &k  4&"!   !  JJ~6F&$'17  ++L9 9=$  & &'acd e &  & &'cef g   & &'`bc d sAE8C47C28C4<7E84D E8E 1E82C44 D=DE8DE8 E )E?E8E  E8 E5E0+E80E55E8cddlm}|S)zNon-throwing counterpart to ``get_prisma_client_or_throw`` for paths that degrade gracefully: a proxy configured without a database keeps the in-memory OAuth session.r prisma_client)rr2r1s r?_get_prisma_client_or_noner3 s  =r> created_bycbKt}|yt|||t|d{y7w)a Write the draft row that makes the OAuth session resolvable from any worker. A failure here is raised, not swallowed: without the shared row the flow degrades to the per-process cache and fails intermittently, which is the defect being fixed. N)r r7)r3rVr3)rr7r4r2s r?_persist_draft_mcp_serverr6s: :;  %   8    s %/-/cKt}|yt||td{}|ytj|d{S7$7w)zTResolve a database-backed draft, which is the only lookup that works across workers.Nr )r3r]r3rubuild_mcp_server_from_table)r7r2drafts r?#_get_draft_mcp_server_as_mcp_serverr;)sX9;  1 92R   =.JJ5QQQ  Rs!#AA AA A AcKttj|}| |jSt |d{}||St |d{}|y|S7 7 wrT)r rrrr;r/)r7r draft_server redis_servers r?get_cached_temporary_mcp_serverr?5su -.-11)<  <<  %H $RR  # $H$SS  STs!O ?M 2 O]4WXgXsXs4t u  9(oo4o8O 9sAA A rc"|}t|tr tj|}t|t sytDcic](}t|j|x}tr|r||*}}|xsdS#tt f$rYywxYwcc}w)aKeep only the non-secret admin-config keys, which are stored unencrypted so they lift out as plaintext; every secret and minted-token key is dropped. Total over every stored shape: a dict is read directly, a JSON-object string is parsed, and anything else (a malformed or non-object JSON string, a scalar, ``None``) falls back to full redaction rather than raising, because this runs on every admin list and get and one bad row must not fail them all.N) rr;rr)r TypeErrorrrr)rparsedrr preserveds r?rGrG\s% k3 ' K0&$'8 FJJsO35c:u J   D  *   sA7-B 7B B  mcp_serversc>|Dcgc] }t|c}Scc}wrT)rIrNrs r?_redact_mcp_credentials_listrQus?JJF'/JJJuser_api_key_dictc<|jtjk(S)aTrue only for ``PROXY_ADMIN``; ``PROXY_ADMIN_VIEW_ONLY`` returns False. Global env var secrets pre-fill the admin edit form, so a full admin must see them, but a read-only admin gets the same redacted view as any other non-managing caller. ) user_rolerz PROXY_ADMIN)rSs r?_user_is_full_adminrWzs!**.>.J.JJJr>c\t|dd}t|txrt|dkDS)a(Best-effort detection for route-restricted virtual keys. We treat a requestor as a "restricted" virtual key if `allowed_routes` is a non-empty list. This matches the auth gate that blocks routes with the error: "Virtual key is not allowed to call this route...". allowed_routesNr)rrrQlen)rSrYs r?"_is_restricted_virtual_key_requestr[s0!((9;KT R.$/KC4G!4KKr>c t|}d|_d|_d|_d|_g|_i|_d|_g|_d|_ d|_ d|_ d|_ d|_ d|_d|_d|_d|_|S)aStrip credential-bearing fields for non-admin viewers. Non-admin users may legitimately need to discover MCP servers their team has access to (so they can pick one in the UI), but they must never see fields that can carry bearer tokens or upstream API keys. ``_redact_mcp_credentials`` already clears the explicit ``credentials`` field; this layers on top to catch the URL+headers+env vectors that the virtual-key sanitizer also strips. Reset values match each field's declared default on ``LiteLLM_MCPServerTable`` (``None`` for Optional fields, ``[]``/``{}`` for required list/dict fields). N)rIrr spec_pathstatic_headers extra_headersenvcommandargsissuerrrregistration_urltoken_exchange_endpointaudiencesubject_token_typetoken_exchange_profileenv_vars)r@ sanitizeds r?"_sanitize_mcp_server_for_non_adminrks3:> $  " #'  "$     &* #" %) ",0 )! '+ $+/ ( " r>c>|Dcgc] }t|c}Scc}wrT)rk)rNss r?'_sanitize_mcp_server_list_for_non_adminrns @KK!215KKKrRc"t|}d|_d|_d|_i|_d|_g|_g|_g|_g|_ g|_ d|_ d|_ d|_ d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d}t5|j6t8r$t;|j6j=d}|r ddi|_|Sd|_|S)aYReturn a minimally sufficient MCP server view for virtual keys. Security model: - Virtual keys should be able to *discover* accessible servers. - They should NOT receive sensitive configuration details like upstream URLs, env vars, headers, commands/args, access-group names, or credentials. NF is_publicT)rIrrr^r`rarbr_ allowed_toolsmcp_access_groupsteamsrircrrrdrerfrgrhhealth_check_errorlast_health_checkr4 updated_by created_at updated_atrmcp_inforrPr)r@rjrps r?$_sanitize_mcp_server_for_virtual_keyrzs-3:> $  #'     "$ "$ &( # !  &* #" %) ",0 )! '+ $+/ ('+ $&* ## # # #  i(($ /Y//33K@AI4=k40 DH r>c>|Dcgc] }t|c}Scc}wrT)rzrPs r?)_sanitize_mcp_server_list_for_virtual_keyr|s LWW4V<WWWrR) )authentication_token auth_value)rr)rr)scopesr)aws_access_key_idr)aws_secret_access_keyr)aws_session_tokenr)aws_region_namer)aws_service_namer)upstream_resourcer)rr._INHERITED_CREDENTIAL_FIELDSzMCPCredentials | Nonec^|syt|}td|jDS)zDid the caller supply an actual credential? Admin config rides in the same blob but is not one, so a form that round-trips it must not read as "credentials supplied".Fc38K|]\}}|tvs|ywrT)r).0rrs r? z4_has_non_admin_config_credentials.. sjZS%cIi>i5js)ranyr)ras_dicts r?!_has_non_admin_config_credentialsrs+,0,=j7==?jjjr>c  |jrt|jr|Stj|j}||St Dcic]\}}t ||dx}r||}}}i|t|jxsi}|s|S |jd|iScc}}w#t$rYnwxYw |j}n#t$r|j}YnwxYw||d<tj|S)Nr)update) r7rrruget_mcp_server_by_idrrrrCrDrrr*)rexisting_server server_attrcredential_keyrinherited_credentialsr.s r?)_inherit_credentials_from_existing_serverrs-  $EgFYFY$ZN!:!O!OPWPaPa!b  "N0L4 + ^ +tDDD E !4 4 !]#8 \DATATAZXZ<[ \$N %%m=R-S%T T4     *"--/L *"<<>L *&; ]#"11,??s*B%B++ B76B7;C C('C(cRK|j}|sttjSt j ||St }||St||d{}||jtjk(rttjS|S7Bw)aDecide the id an OAuth session runs under. A caller-supplied id is honoured only when it names a server that really exists, which is the edit form re-authorizing a saved server against its own id. Anything else gets a fresh id, so two concurrent sessions can never land on one id and silently adopt each other's URL or client credentials. Without a database there is nothing shared to collide over, so the supplied id is kept and behaviour is unchanged. N) r7r;ruuid4rurr3r^approval_statusr|r:)rsuppliedr2existings r?_resolve_session_server_idr1s"++tzz|$ $ $ 9 9( C OO9;  O!/}h GG  x77;L;R;RRtzz|$ $HsA B'"B%#AB'ctj}|jxs|jxs|}t did|d|d|jd|j d|j d|jd|jd|jd |d |d |d |d gd|jd|jxsgd|jxsgd|jd|jd|jd|j d|j"d|j$d|j&d|j(d|j*d|j,d|j.d|j0d|j2S)Nr7rrrr transportrrrwrxr4rvrsrrrqr_ryr^rarbr`rcrrrdallow_all_keysavailable_on_public_internettimeoutmax_concurrent_requestsr=)rrrrryrrrrrrrrqr_ryr^rarbr`rcrrrdrrrr)rr4r7rrs r?"_build_temporary_mcp_server_recordrIs __&$00NGMMNY %  # --  ++    ''  ''  ++   " "  &77 "//52 "//52! "%%# $#11% &OO' () * + ,>>- .&77/ 0''1 2%553 4#115 6*1)M)M7 8OO9 :%,$C$C;  r>messagecPddlm}|ttjd|i|S)Nrr1rr)rr2rrr)rr2s r?get_prisma_client_or_throwrps1<  "AA) r>z/tools)r0 dependenciescKddlm}||dddd{}|j}|Dcgc] }t|}}d|iS7,cc}ww)ze Get all MCP tools available for the current key, including those from access groups r)_list_mcp_toolsN)rmcp_auth_headerrNmcp_server_auth_headerstools)-litellm.proxy._experimental.mcp_server.serverrrr)rSrlistingrtool dumped_toolss r? get_mcp_toolsr|s^ R./ $(    }}6;d}~wwxYww)zR Get all available MCP access groups from the database AND config rrtr1Nrrz#Error getting MCP access groups: %s access_groups)9litellm.proxy._experimental.mcp_server.mcp_server_managerrurr2setconfig_mcp_serversvaluesrrr,table find_manyrrrrrrsortedrQ)rSrur2rrrNr"access_groups_lists r?get_mcp_access_groupsrs  ="u 0BBIIK ;F##$$V%9%9: ;  $ U[n!\% V$ *GFv':;@X@X%,,V-E-EFG%+4 +>$?!344V$  U$**+PRSTT UsTADD#&C% C# C% C%-C% D#C%% D.D D DDz/network/client-ipz5Returns the caller's IP address as seen by the proxy.)r0rrrequestc@Kddlm}|j|}d|iSw)NrIPAddressUtilsip)#litellm.proxy.auth.ip_address_utilsrget_mcp_client_ip)rr client_ips r? get_client_iprs' G);;GD i  z/registry.jsonzMMCP registry endpoint. Spec: https://github.com/modelcontextprotocol/registry)r0rc JKtsttjdddlm}|j |}tjd|t|}g}|jdt|ittj|j}|j!t"|D]"} t%||}|jd|i$d |iS#t&$r,}tjdt)|d d |Yd}~Yd}~wwxYww) NzMCP registry is not enabledrrrzMCP registry request from IP=%srr&z&Skipping MCP server %s in registry: %sr7rservers)rrrHTTP_404_NOT_FOUNDrrrrrrprrrQruget_filtered_registryrsortrrrr) rrrrregistry_serversregistered_serversrrr"s r?get_mcp_registryrs% +,"554  G);;GD ""#DiP.w7FH+H+R ST%))B)X)XYb)c)j)j)l$m$CD( 7F egh  s0CD# C+D#+ D 4"DD#D  D#c>ddlm}|jd}|dk(ryy)Nrruser_mcp_management_modeview_all restricted)rrr)rrs r?_get_user_mcp_management_moders( -001KL : r>team_idcJKddlm}ddlm}m}ddlm}m}||||dd{}||d{}|}||z} | sgSg} | D]@} tj| } | tj| } | j| Bt| S7v7hw)z Return MCP servers scoped to a team: team's allowed servers + allow_all_keys servers. Used by the Create Key UI to populate the MCP server dropdown. rget_team_object)_get_allow_all_keys_server_ids_get_team_allowed_mcp_serversr2user_api_key_cacheTrr2r check_db_onlyN) litellm.proxy.auth.auth_checksr8litellm.proxy.management_helpers.object_permission_utilsrrrr2rrur_build_mcp_server_tablerrQ)rrrrr2rteam_objteam_server_idsallow_all_server_idsall_allowed_idsrr7rmcp_server_tables r? _get_team_scoped_mcp_server_listrs C  Q /'1 !  (EX'N!N&D&F!03G!GI8:( 1I.CCINF!#<#T#TU[#\ /0  1 ,G44- "Os%&B#BB#B!2B#,4B#!B#cbKtdk(r't|stjd{Si}t |d{D]A}tj |d{D]}|j |j| Ct|jS7v7c7Dw)a+The server set the dashboard grid shows (GET /v1/mcp/server, no team filter), returned unredacted. Callers that surface this to a client must apply their own redaction; the per-user env-var status endpoint relies on the raw env_vars and only ever returns is_set booleans, never secrets. Sharing this resolution keeps the red "missing user fields" card status aligned with the cards actually rendered: an admin in view_all mode sees every server even when their key carries no per-server MCP grant. rN)r) rr[ruget_all_mcp_servers_unfilteredrwget_all_allowed_mcp_servers setdefaultr7rQr)rS aggregated auth_contextrs r?_resolve_accessible_mcp_serversrs ) *j 8AcduAv2QQSS S?A "?@Q"RR @L 9 U Uht uu @%%f&6&6? @ @J%%'(( TSus40B/B)B/B+ B/(B-)AB/+B/-B/cKt|d{}| tSttj|d{S767 w)aVServer ids a connected app authorized by this dashboard user is served on the aggregate MCP endpoint, resolved through the one owner of the admitted subject so the page and the session cannot drift. Empty when that identity cannot be built, which is the true answer: the same user cannot open a gateway session either.N)rv frozensetruget_allowed_mcp_servers)rSadmitteds r?#_connected_app_reachable_server_idsr4sL !66G HH  ; 8PPQYZZ[[I[s A A-A A  A  A z/serverz1Returns the mcp server list with associated teams)rrresponse_modelzFilter MCP servers by team scope. When provided, returns only servers the team has access to plus globally available (allow_all_keys) servers. Used by the Create Key UI to show team-scoped MCP servers.)rzAnnotate each returned server with connected_app_reachable: whether a connected app authorized by the calling user (a gateway OAuth session) is served this server on the aggregate MCP endpoint.connected_app_viewcKt}|t|tr|jr|r t dd|j}t }|sOddlm}ddlm }m }||||d d{} tfd | jD} | s t dd t|d{} ntd{} t| } |dur8t!r-t#d{} | D]}|j$| v|_t(j*F| D]A}|j$t(j*vs |j,i|_d|j,d <Cdd lm }j.xsd}|r|| Dcgc]}t1|dds|j$}}|rst3|j4j7|d|idd{}|Dchc]}|j$}}| D]#}t1|dds|j$|v|_%|r t;| St=s t?| S| S7777Ycc}w7{cc}ww)a Get all of the configured mcp servers for the user in the db with their associated teams ``` curl --location 'http://localhost:4000/v1/mcp/server' --header 'Authorization: Bearer your_api_key_here' # Filter by team scope (for Create Key UI) curl --location 'http://localhost:4000/v1/mcp/server?team_id=team-123' --header 'Authorization: Bearer your_api_key_here' ``` Nz=Restricted virtual keys cannot query team-scoped MCP servers.rrrrTrc3pK|]-}|jduxr|jjk(/ywrT)user_id)rmrSs r?rz(fetch_all_mcp_servers..{s:*IIT)Taii;L;T;T.TT*s36z=You do not have permission to view MCP servers for this team.rpr1ris_byokFin)rr7)where) r[rr;striprrrrrr2rrmembers_with_rolesrrrQrxrr7connected_app_reachablerpublic_mcp_serversryrrr-rrhas_user_credentialr|rWrn)rSrris_restricted_virtual_keysanitized_team_idis_adminrr2rr user_in_teamredacted_mcp_serversr reachable_idsr_byok_prisma_clientrrmbyok_server_ids cred_rowsrcred_sets` r?fetch_all_mcp_serversr >sD,NN_+`!  :gs#; )# #Z(/}} 23DEHJ )8-"/'9"& )# '**%88*' $'$'^ *JJ[)\#\ #BCT#UUG#?#H  %*BCT*U)LM^)_#_M. S171A1A]1R. S  % % 1. 8##w'A'AA.*,37FOOK0  8 T*228b *6;O%paSZ[\^ginSoakk%pO%p77JKQQ[[&-T?+H*I #z 15``lvwwG[bcQW&"2"2fmmLc c%BCT%UU ac) HL5__".%G" H##+<<:@--%f&6&67 H  HUfTkTkTmn?Py&i6:nnxcUosV)C8C'C8 C)C8%C.&%C8 C0 C8$0C8C2#C8)C80C82C8z/server/registerz^Submit a new MCP server for admin review (non-admin users). Mirrors POST /guardrails/register.)rrrrc>K|jtjk(rttj ddi|j sttjddi|jtjk(rttjdditd}t|t|t|tj |_|j$|_t)j*t,j.|_ t3|||j$xs |j d{}t=|S7#t4$r;}t7j8d |ttj:dd |id}~wwxYww) z Allow team members to submit an MCP server for admin review. Creates the server with approval_status=pending_review. Requires a team-scoped API key. rzoPROXY_ADMIN users should use POST /v1/mcp/server to create servers directly instead of the submission workflow.rzORegistration requires an API key associated with a team. Use a team-scoped key.zstdio MCP servers cannot be submitted via the user registration workflow. Ask a proxy admin to add this server via POST /v1/mcp/server or to declare it in config.yaml.8Database not connected. Connect a database to your proxy touched_byNz Error registering mcp server: %szError registering mcp server: )rUrzrVrrHTTP_403_FORBIDDENrrrrstdiorr'rrr|pending_reviewrr submitted_byrrr utc submitted_atrWrr exceptionrrI)rrSr2new_mcp_serverr"s r?register_mcp_serverr s"  & &*:*F*F F"55O !(("77!rs     2 2 2"77'   ::tu 1':!'*%g."3"B"B088'||HLL9 *;,44Q8I8Q8Q+%N'~66%   * *+Mq Q"AA#A!!EF  s<DF)EEE FE F6FFFz/server/submissionszoReturns all MCP servers submitted by non-admin users (admin review queue). Mirrors GET /guardrails/submissions.c^K|jtjtjfvrt t j dditd}t|d{}t|j|_ t|st|j|_ |S7Ew)z\ Admin-only endpoint to view all user-submitted MCP servers pending review. rz5Admin access required to view MCP server submissions.rrN) rUrzrVPROXY_ADMIN_VIEW_ONLYrrrrr`rQrrWrn)rSr2 submissionss r?get_mcp_server_submissionsr$0s  & &  ( (  2 2/   "55!XY  ::tu #6}#EE 89J9JK "#45 G HYHY ZK  FsA#B-%B+&AB-z/server/{server_id}/approvez[Approve a pending MCP server submission (admin only). Mirrors PUT /guardrails/{id}/approve.crKtj|jk7rttj ddit d}t||d{}|!ttjdd|di|jtjk(rttjddit|||jxst d{}t!j"|j$d{t!j&d{t)|S77T7/7w) u Admin approves a pending or previously-rejected MCP server — sets approval_status=active and loads it into the runtime registry. rz8Admin access required to approve MCP server submissions.rrN MCP server ' ' not found.zMCP server is already active.r)rzrVrUrrrrr^rrr|activerrUrrru'invalidate_byom_submitted_servers_cacherreload_servers_from_databaserI)r7rSr2rapproveds r?approve_mcp_server_submissionr,Ns2  ' '+<+F+F F"55![\  ::tu .}i HH  "55< {,!GH   # #'8'?'? ?"77!@A  !3  (00L4L!   (OOPXPePefff'DDFFF&x00)I gFsIAD7D/BD7D1&D7D3D7D5 D71D73D75D7z/server/{server_id}/rejectzYReject a pending MCP server submission (admin only). Mirrors PUT /guardrails/{id}/reject.ctKtj|jk7rttj ddit d}t||d{}|!ttjdd|di|jtjk(rttjddi|jtjk(}t|||jxst |j" d{}|rt%j&d{t)|S77/7w) ur Admin rejects a pending MCP server — sets approval_status=rejected with optional review_notes. rz7Admin access required to reject MCP server submissions.rrNr&r'zMCP server is already rejected.)r review_notes)rzrVrUrrrrr^rrr|rejectedrr(rhrrr.rur*rI)r7rrSr2r was_activer/s r?reject_mcp_server_submissionr1zs6  ' '+<+F+F F"55!Z[  ::tu .}i HH  "55< {,!GH   # #'8'A'A A"77!BC  %448I8P8PP 1  (00L4L -- !   +HHJ J J&x00-I  Ks7AD8D2B,D8D4D8"D6#D84D86D8z/server/{server_id}zReturns the mcp server infocKtd}t||d{}|du}|vddlm}|j |}t j |}|t j||sd}|t j||}|t j|}|!ttjdd|di t|} t|} | sq|r!t||d{} t!| |} n+t j"|d{} |j$| v} | s!ttj&dd |d i |rt j(|d{ t j*|d{}|jr |jnd |_ |j,|_|j.|_t=|}| r t?|StA|s tC|S|S77777#t0$rQ}t3j4d ||d |_ t7j8|_t;||_Yd}~d}~wwxYww)aY Get the info on the mcp server specified by the `server_id` Parameters: - server_id: str - Required. The unique identifier of the mcp server to get info on. ``` curl --location 'http://localhost:4000/v1/mcp/server/server_id' --header 'Authorization: Bearer your_api_key_here' ``` rNrrrrMCP Server with id not foundrz9User does not have permission to view mcp server with id z8. You can only view mcp servers that you have access to.rz.Error performing health check on server %s: %s)"rr^rrrrur_is_server_accessible_from_ipget_mcp_server_by_namerrrrrr[r\rFrr7r add_serverhealth_check_serverrurtrrrrrr;rIrzrWrk)rr7rSr2r@from_dbrrregistry_server is_admin_viewrr@existsallowed_server_ids health_resultr"redacteds r?fetch_mcp_serverrAs( ::tu *-CC #4/   J-??HI7LLYWO*3L3j3j4#'&";"R"RS\hq"r*6NN_  "55#6yk!LM  44EF +MN_+`!2N}^o2p,p"./A9M3L2c2cdu2v,v"#--1CC# & 9 9WXaWbcUU +66zB B B 3)B)V)VW`)a#aM8E8L8L 4 4R[J +8+J+JJ (,9,L,LJ )2*= $7A A##455h? ?WDB-q-w C$b  3 & &'WYbde f )J +3<<>J (,/FJ ) )  3sI!G8C I!*G;+)I!G>AI!$H%I!*HHAH1I!;I!>I!I!H I AII!II!zAllows creation of mcp serverszThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountabilitylitellm_changed_byczKtd}t|t|tj|j k7rt tjdditj|jk(stj|jk(r+t tjdd|jdi|jKt||jd{}|+t tjdd|jditj |_d|_d|_ t)|||j*xst, d{} t7j8|d{t7j:d{t=|S77K#t.$r;}t1j2d |t tj4dd |id}~wwxYw7v7\#t.$r5}t1j2d |j|Yd}~t=|Sd}~wwxYww) z? Allow users to add a new external mcp server. rrznUser does not have permission to create mcp servers. You can only create mcp servers if you are a PROXY_ADMIN.rr4z is special and cannot be used.Nz' already exists. Cannot create another.rzError creating mcp server: %szError creating mcp server: z?MCP server %s created but in-memory registry refresh failed: %s)rr'rrzrVrUrrrrall_team_serversr7all_proxy_serversrr^r|r(rrrrWrrrrrrrur8r*rI)rrSrBr2r@rr"s r?add_mcp_serverrF s2& ::tu  2':!'*  ' '+<+F+F F"55N  ! 1 1W5F5F F#559J9JJ"77#6w7H7H6IIh!ij     (&4]GDUDU&V VJ%# & ; ;#':7;L;L:MMt%uv#4":":## *;,44P8P+%N  +66~F F F+HHJ J J '~66W!W&%   * *+JA N"AA#>qc!BC   G J  * *QSaSkSkmn  '~66  sC&H;(F+)AH;>#F/!F-"F/'G:?G6G:G8G: H;-F// G386G..G33H;6G:8G:: H8!H3$H;3H88H;z/server/importzHBulk-import MCP connectors from Anthropic mcpServers or mcp_servers JSONc h Ktd tjjk7rt t j ddit| t d{}td|D dtdttzd ttztzf fd dtd ttzf fd }t! fd t# D}t!|Dcgc]$}t%|tr||d{n|&c}}t!d |D}|r t'j(d{t1|t!d|Dt!d|DS77qcc}w7<#t*$r }t-j.d|Yd}~^d}~wwxYww)a2 Bulk-import MCP connectors. Accepts the Claude Desktop / Claude Code ``mcpServers`` mapping or the Anthropic Messages API ``mcp_servers`` array, creates each entry as a LiteLLM MCP server, and returns per-entry results so partial imports are visible to the caller. rrznUser does not have permission to import mcp servers. You can only import mcp servers if you are a PROXY_ADMIN.rNc3`K|]&}|j|jfD] }|s| (ywrT)rr)rrrRs r?rz%import_mcp_servers..s9* V\\6K]K]<^* 48bfD* * s". .index conversionrBct|tr|S|jjxsd}|vrt |j d|dSt dd|D}||vrt |j d|dS|S)NrzAn MCP server named '' already exists.)rRreasonc3pK|].}t|tr|jjxsd0yw)rN)rrrr)rearliers r?rz8import_mcp_servers.._classify..s5/g'9:%%++/s46zDuplicate connector name 'z' in the import payload.)rrrrrrRr)rIrJrearlier_aliases conversionsexisting_namess r? _classifyz%import_mcp_servers.._classifys*&>?!!%--339rE&0#3HO`1a&//*6E2/&O '0#3MeWTl1m r>cxK t|j t|jjxstd{} t!j"|d{t%|j|j&|j(xsdS#t$r}t|jt r/t |jjd|jnt |j}t|j|cYd}~Sd}~wwxYw7#t$rK}tjd|j|t|jt |cYd}~Sd}~wwxYw7#t$r,}tjd|j|Yd}~Gd}~wwxYww)NrrRrrz!Error importing mcp server %s: %szFImported mcp server %s committed but in-memory registration failed: %sr)rRr7r)r'rrrrrr;rrrRrWrrrrrrur8rr7r)rJr" error_textcreatedr2rSs r?_createz#import_mcp_servers.._createss Y9*:L:LM  U'8!&&088T.s!oCT5*)E:">!osc3BK|]}t|ts|ywrT)rrrrs r?rz%import_mcp_servers..sk%z%Qi?jkz>MCP connector import committed but registry refresh failed: %sc3BK|]}t|ts|ywrT)rrr[s r?rz%import_mcp_servers..sfEEKd9e%fr\c3K|]M}t|ttfr5t|tr!t|j|jn|Oyw)rUN)rrrrRrr[s r?rz%import_mcp_servers..sOe&>@Y%Z[e%=>*uzzMsAA)importedskippederrors)rrzrVrUrrrrr[rintrrrrrtuple enumeraterrur*rrrr) rrSexisting_serversrX classifiedroutcomesr_r"rSrQrRr2s ` @@@@r?import_mcp_serversrhhs$ ::tu  ' '+<+F+F F"55N 7w? (;M(J"J )* /* !   $69Q$Q  ": :=V V * *  %(A A :"!oXabmXn!oo fp ]b 5:L(Mgen$$SXX    k8kk  t/LLNNN*fXff&   K#Kt% O t$../oqrss tssAF2&E:'BF2+ E? E= E?F20FFF /F2=E??F2F F/F*%F2*F//F2z/server/oauth/sessionzITemporarily cache an MCP server in memory without writing to the database)rrrcKt|t|tj|jk7rt t jddi|jxst}t|}t||t|d{} tj|dd{}t|t t#||j$|d{t'|t d{t1|S7|7Z7,7#t($r;}t+j,d|t t j.dd |id}~wwxYww) a Cache MCP server info in memory for a short duration (~5 minutes). This endpoint does not write to the database. If the same server_id is provided again while the cache entry is active, it will refresh the cached data + TTL. rzUser does not have permission to create temporary mcp servers. You can only create temporary mcp servers if you are a PROXY_ADMIN.rNF)credentials_are_encryptedr8z&Error caching temporary mcp server: %sz$Error caching temporary mcp server: )r'rrzrVrUrrrrrrrrrur9rr3r6r7r#rrrrrI)rrSrBr4payload_with_credentials temp_recordtemporary_serverr"s r?add_session_mcp_serverrnsj. 2':!'*  ' '+<+F+F F"55b .55Q9Q *ST[*\ ? $ ,-EF F  ,E,a,a*/-'  ( < ,(%%   7 <  '{339 G'     * *+SUV W"AA#Gs!KL  slBED ED +D,/D DD 4D 5D 9 ED D D E6E  EEc Kddl}ddlm}|jj dd}|}|se|j j d}|rH|rF |j ||dgddd  }|j d d vr|j d d}|rd|}|sddlm }ddl m } |jj dd} | r|j| } | s|j| } | rt| ddt j"k(rt| dddur| j$sz| |j'dj)} | j+dr:t-|d{} | xsij dd}|dk7rnt/St/St-|d{}t1||}t3||dddd|d{S#|j$rYUwxYw77C7w)af Auth dependency for MCP OAuth browser-navigation endpoints (/authorize, /token). Tries the Authorization header first. Falls back to decoding the UI 'token' session cookie (set by SSO login) to extract the API key, which allows browser-based OAuth redirects to work without an explicit Authorization header. rN) master_key AuthorizationrtokenHS256F) verify_exp verify_aud) algorithmsoptions login_method)ssousername_passwordrzBearer rt)get_request_router7rdelegate_auth_to_upstreamTrz/tokenr grant_typer) request_datar)rapi_keyazure_api_key_headeranthropic_api_key_headergoogle_ai_studio_api_key_headerazure_apim_headerr)jwtrrpheadersrcookiesdecodeInvalidTokenErrorrrulitellm.proxy.auth.auth_utilsr{ path_paramsrr7rrrhas_client_credentialsrlowerendswithrrrr)r_jwtrp auth_headerr token_cookiedecoded cookie_keyrur{r7_s path_lower body_datar~rs r?_mcp_oauth_user_api_key_authrs 9$__00"E ")//"5"5g">L  %)[[$"$+9/4E J &1&G{{>26RR18UB1G %(/ |&rs r?'_get_cached_temporary_mcp_server_or_404rs_ 7yAA*0*< > KLS~??HY]I.CCb*AA)W`a  >"55;yk!DE $$56'# & 9 9#'CI;%OP36% &CDU&V V q "))0I0a0abn0o*op q'99# & 9 9#'CI;%OP IB:!W*os4D:D3B;D: D6*D:8D8 9;D:6D:8D:z#/server/oauth/{server_id}/authorize)include_in_schemarrr redirect_uristatecode_challengecode_challenge_method response_typescopec ZKt|||d{} t| | jxs|xsd} | st|| |||d{nd} | xs| r | jnd} | st t j dddt|| | |||||| |  d{S77Y7w) Nr}r)rr@rrrmissing_client_idvNo client_id available for this MCP server. Either configure the server with a client_id or supply one in the request.rrr) rr@rrrrrrrephemeral_dcr_client)rrlrrsrrrrm)rr7rSrrrrrrrr@stored_or_supplied_client_idrresolved_client_ids r? mcp_authorizers"#J)Ufpw"xx Z(.8.B.B.Ui.USU$0/%-&;)    %A% .B * * ""770e  +!(%)"7'!5   ;y  0  s4B+B%8B+ B'AB+ B)!B+'B+)B+z/server/oauth/{server_id}/tokenr~coder code_verifier refresh_tokenc Kt|||d{} t| |dk(rt|| |nd} | r | jn|} | rt |dn|}| r | j n|}| r | j n|}| j xs|xsd}|sttjddd t|| || ||||| | | r | jnd d{S77w) Nr}r)rr@rz /callbackrrrrr) rr@r~rrrrrrr!client_token_endpoint_auth_method) rrlrq upstream_coderprrrrrrotoken_endpoint_auth_method)rr7rSr~rrrrrrrr@ sealed_code resolved_coderesolved_redirect_uricaller_client_idcaller_client_secretrs r? mcp_tokenrs!$#J)Ufpw"xx Z( 11 2t bo p  =H{88T Wb*>w*G)H 'Rgs;F+"7"7ICNk&?&?Ta$.$8$8$R  <<' w 7K]K]^ ^ ^  ( ;,yQUV V(9USS+o _s"CCBC#C$.CCz>Delete the calling user's stored API key for a BYOK MCP servercKtd}|jxsd}|sttjddi t |||d{ddlm}|||t|d S7 #t $rY)wxYww) z*Remove the calling user's BYOK credential.rrrrrNrrFr) rrrrrrYrrrr)r7rSr2rrs r?delete_mcp_user_credentialrs ::tu *228b"77!=>  (K K K  $GY7(9USS L"   s:;BA1A/A1B/A11 A=:B<A==Bz)/server/{server_id}/oauth-user-credentialz?Store the calling user's OAuth2 token for an OpenAPI MCP serverc Ktd}t|||d{|jxsd}|sttj ddit ||||j|j|j|jd{dd l m }|j||d{t|||d{}|r|jd nd}t!|d |d S77`7A7.w)z=Persist the OAuth2 access token obtained by the calling user.rNrrrr)r expires_inrrrtrTF)r7rr is_expired)rrrrrrrj access_tokenrrrrru!invalidate_user_oauth_token_cachercrr~)r7rrSr2rrustoredrs r?store_mcp_oauth_user_credentialrs ::tu -m=NPYZZZ*228b"77!=> *     !//))>>    J'II'S\]]]8 wPYZZDJ <(@PT +!   5 [  ^[sFC6C.A0C6C0 C60C21C6C4)C60C62C64C6z?Revoke the calling user's stored OAuth2 token for an MCP serverc`Ktd}|jxsd}|sttjddit |||d{}|7 t |||d{ddlm }|j||d{t|d d S7K75#t$rY>wxYw7%w) z+Revoke/delete the user's OAuth2 credential.rrrrrNrrtFr7rr) rrrrrrcrYrrrurr~)r7rSr2rcred_to_deleterus r? delete_mcp_oauth_user_credentialrs ::tu *228b"77!=> '@ wXa&b b  % ,]GYOOO N+MMgW`a a a+   !cP&   bsTA B. BB.B%B&B*B.B,B.B B)&B.(B))B.z0/server/{server_id}/oauth-user-credential/statuszQCheck whether the calling user has a stored OAuth2 credential for this MCP serverc Ktd}|jxsd}|sttjddit |||d{}|t |ddS|jd }d}|r< tj|}|tjtjk}t |d |||jd  S7#t$rY,wxYww) zMReturn credential status (has_credential, expiry) without exposing the token.rrrrrNFrrT connected_at)r7rrrr)rrrrrrcr~rr fromisoformatrr rr)r7rSr2rcredrrexps r?$get_mcp_oauth_user_credential_statusr s ::tu *228b"77!=> 6mWiXX </)TYfkl l(,(>   %33J? 8<< #== ,!!.1   Y  s6A C# C)C#8;C3 C# C C#C  C#z/user-credentialsz;List all OAuth2 MCP credentials stored for the calling usercZKtd}|jxsd}|sttjddit ||d{}|sgS|Dcgc] }d|vs|d}}t ||d{Dcic]}|j|}}g}|D]|} d| vr| d} |j| }| jd} |jt| |r t|d dnd|r t|d dndd d | | jd ~|S7cc}w7cc}ww)z=Return all servers the calling user has connected via OAuth2.rrrrrNr7rrrrTr)r7rrcredential_typerrr) rrrrrrdr_r7rrrr) rSr2r oauth_credscr srvrrrsidrs r?list_mcp_user_credentialsr@ sN ::tu *228b"77!=> $?}g#VV I5@UKSTDTQ{^U U>Mm]g>h8hi#--,ii8: D$&{#C++c"C%)XXl%;J LL)!EH]D Ad9<'#w5$$,#')!%.!9   " 1WV8hisIA D+ D D+ D#D*D+;D$<D+D&BD+D+&D+cKt||d{}|,tj|}|tj|}t |r%|!t t jdd|di|St}t|d{D].}|jtj|d{0||j|vr!t t jdd|di|S77j7Aw)aResolve the MCP server a caller may manage their own per-user state for. Looks the server up in the DB, then the in-memory registry, so a config-defined server (which never gets a DB row) resolves too. Admins may reach any server and get a 404 for an unknown id. A non-admin may only reach a server in their allowed set and otherwise gets 403 (never 404, so server ids can't be enumerated), using the same allowed-server resolution the MCP gateway enforces on tool calls. Nrz MCP Server r5rz;User does not have permission to access mcp server with id z:. You can only manage mcp servers that you have access to.)r^rurrrrrrrrwrrr7r)r2rSr7rr;r>rs r?rrn s&mY?? >%>%S%ST]%^O*2JJ?[  1 2~# & 9 9#{9+Z%HIM.1e"?@Q"RR mL  % %,E,],]^j,k&k l m >V--5GG"55UV_U`aSS  7@S&ks4C<C6A:C< C8*C<8C: 9>C<8C<:C< stored_valuesc .tt|dd\}}|jDcic] \}}|s || }}}t|ddxsi}t|tr t j |xsi}t|j}|Dchc]}|d } }|| zDchc] }||vs| } }g} d} |D][}|d}|| vr |j|}t|} | s| dz } | jt||jd| ]t|j t|d dt|d d| | | rt#|j  Sd Scc}}w#ttf$ri}YwxYwcc}wcc}w) a8Build a status object for one server given the user's stored values. Stored credentials are write-only: the response reports only whether each value ``is_set`` and never echoes the decrypted secret back, so a leaked token can't be used to exfiltrate the raw upstream credential. riNr^)stringsrRrr r)rRris_setrr)r7rrrequired missing_count setup_url)r&rrrr;rr)rrKr$rrrPrrrr7r#)rr global_values user_specsrRrr^ referencedspecuser_var_namesblockingrrrs r?_compute_user_env_var_statusr s%9UY9Z$[! z 9F8K8K8MWuQVuW W !)94@FB nc * $!%N!;!Ar7~?T?T?VW :D E$f E E-7.-HgDTYfMf4gg35  DV D8#!%%d+E%[F" OO! $ 7!   $&& t<&'40'CK-f.>.>?   RV   EX * $!# $!Fgs. E/E/"E5 F . F8F5F  F z!/server/{server_id}/user-env-varszFReturn the calling user's per-user MCP env var status for this server.cKtd}|jxsd}|sttjddit |||d{}t |||d{}t||S7&7w)Nrrrrrrr)rrrrrrrar)r7rSr2rrrs r?get_mcp_user_env_varsr s ::tu *228b"77!=> >mM^`ijj/ w RR+6PPkRs$A A8 A4A8"A6#A86A8aStore the calling user's per-user MCP env var values for this server. Submitted values are merged over any previously stored values, so you only send the fields you want to set or change; a variable omitted (or sent empty) keeps its stored value. Use DELETE to clear all stored values.cKtd}|jxsd}|sttjddit |||d{}t t|dd\}}|Dchc]}|d } }|jjD cic]\} } | | vs | dk7s| | } } } t|||| | d{} dd l m }|||t|| S7cc}wcc} } w7-w) NrrrrrrirRrinvalidate_user_env_vars_cacher)rrrrrrr&rrrrfrrr)r7rrSr2rr_rr allowed_nameskvupdatesmergedrs r?store_mcp_user_env_varsr  s $ ::tu *228b"77!=> >mM^`ijj -WVZ-NO :9CDV D D+2>>+?+?+Ad41aQ-EW\]ac\c!Q$dd1-)U\^kll  'w :+6PPk EdlsHA C7 C(!C7/ C*;C7 C/'C/-C/2C7C5!C7* C7zEClear the calling user's per-user MCP env var values for this server.cKtd}|jxsd}|sttjddit |||d{}t |||d{ddlm}|||t|iS757"w) Nrrrrrrrr) rrrrrrrZrrr)r7rSr2rrrs r?clear_mcp_user_env_varsr  s ::tu *228b"77!=> >mM^`ijj"='9EEE  'w :+6LLkEs$A B BB"B#!BBz/user-env-vars/statuszPer-user MCP env var status across every server the user can access. Used by the dashboard to highlight servers with missing per-user vars.cKtd}|jxsd}|sgSt|d{}|sgS|Dcgc]}|j}}t |||d{}g}|D]I}|j |ji} t || } | js9|j| K|S7cc}w7]w)Nrrr) rrrr7rbrrrr) rSr2r accessiblermr  stored_bulkstatusesrr status_objs r?list_mcp_user_env_var_statusr/ s ::tu *228bI"ABS"TT I2<=QQ[[= =#9-R\#]] 68  ,F __V%5%5r:F5VSYZJ"" +  , U>]s3.CB9 CB;C"C#AC$C;Cc0Ktd}t|j}t|tj |j k7r,ttjddjdi t||jd{}d}|j rp|j"d||r`|r |j"nd}t%|d |} |t&j(t&j*fvr!ttj,dd | d it/|||j0xst2| d{} | *ttj4dd|jit7j8| d{t7j:d{|Yt=|t=| k7rB t?||jd{} | r!tj@d|j| tCr tE| S7#t$r0}tjd|j|d}d }Yd}~d}~wwxYw7777#t$r+}tjd|j|Yd}~d}~wwxYww)a5 Updates the MCP Server in the db. Parameters: - payload: UpdateMCPServerRequest - Required. The updated mcp server data. ``` curl -X "PUT" --location 'http://localhost:4000/v1/mcp/server' --header 'Authorization: Bearer your_api_key_here' ``` rrzJCall not allowed to update MCP server. User is not a proxy admin. route={}zPUT /v1/mcp/serverrNFz[MCP server %s: could not snapshot the pre-update record; skipping the stale-token check: %sTrzadcr_bridge is only supported for auth_type true_passthrough or oauth_delegate (stored auth_type: zs). Include the server's auth_type in the update payload or configure one of the client-forwarded token modes first.)r fields_setrzZMCP server %s: purged %d stale per-user OAuth token(s) after a mint-relevant config changezRMCP server %s: failed to purge stale per-user OAuth tokens after config change: %s)#rrrr'rzrVrUrrrrr^r7rrwarning dcr_bridgerrrtrue_passthroughoauth_delegaterrkrrrru update_serverr*rerginfor+rI) rrSrBr2payload_fields_setold_server_recordold_server_record_read_failedexcstored_auth_typestored_auth_type_namemcp_server_record_updatedpurgeds r?edit_mcp_serverr#K s4 : P %((:(:(<$= 2':  ' '+<+F+F F"55ipp,  1&4]GDUDU&V V ,1 )   !!)".2OEV&7&A&A\` +23CWN^+_ !(@(@'BXBX'YY# & ; ;AAV@YZBB  2C  (00L4L) 2 , ! % ,"55#J7K\K\J]!^_ (556OPPP(DDFFF  (-EFW-X\t %] .  &Mm]d]n]n&o o"''t)) $ % &'@AA[!W 1  " "m!!  !% ,0 ) 1<,  Q G!p &&h%% sA9J<HHHB J<I=AJIJ!I"JII'IJH I#%IJIJJJI J(!J JJJz /make_publicz+Allows making MCP servers public for AI HubcK ddl}ddlm}ddlm}|j d{}|j tjk7rtddd|j i|jg|_ |jD](}|j| }|td d |d |j|_ d |vs|d i|d <|j|d d<|j|d{tjd|j|j d|j|j dS77L#t$rt"$r1}tj$d|tdt'|d}~wwxYww)z4 Make MCP servers public for AI Hub rNrt) proxy_configrrz;Only proxy admins can update public mcp servers. Your role=rrDizMCP Server with ID r5litellm_settingsr) new_configz-Updated public mcp servers to: %s by user: %sz'Successfully updated public mcp servers)rrrvzError making agent public: %si)rrrurr% get_configrUrzrVrrmcp_server_idsr save_configrrrrrr;) rrSrrur%configr7rr"s r?make_mcp_servers_publicr, s6 @   @#/"9"9";;F **.>.J.JJ# ##^_p_z_z^{!|))1-/*$33  G2GGR[\>'$'!4YKzJ *1)?)?G &"/6:L3M3U-/)*?F?Y?YF% &'; <**f*= = = & &?A[A[]n]v]v  E&-&@&@/77 I<< >   @ * *+JA NCA? ? @sSF #ED?A4EAE5E6AE>F ?EEF,FFF zmcp_registry.json_MCP_REGISTRY_PATH_mcp_registry_cachecttS ttd5}tj|}ddda|S#1swY xYw#t $r,}t jdt|dgi}Yd}~|a|Sd}~wwxYw)zALoad the curated MCP registry from disk. Cached after first read.Nr z'Failed to load MCP registry from %s: %sr)r.openr-rloadrrr)rrr"s r?_load_mcp_registryr2 s  *& & #(#. O!BF))A, O #  O O # ( ()RTfhi jr?D"  #s-A AA A A BA<<Bz /discoverzAReturns a curated list of well-known MCP servers for discovery UIz/Search filter for server names and descriptionszFilter by categoryquerycategorycdKt|stddd|jit}|j dg}|r|j }|Dcgc]j}||j ddj vsD||j ddj vs"||j d dj vr|l}}|r%|Dcgc]}|j d d|k(s|}}|j dg}t td |D}||d Scc}wcc}ww) z Returns a curated list of well-known MCP servers that can be added to the proxy. Used by the UI to show a discovery grid when adding new MCP servers. rrz6Only proxy admins can access MCP discovery. Your role=rrrRrrrr4c3@K|]}|jddyw)r4OtherN)r)rrms r?rz'discover_mcp_servers..T s&WaquuZ'A&Wr)r categories)rrrUr2rrrr) r3r4rSregistryr query_lowerrm all_serversr8s r?discover_mcp_serversr<( sF $$56UVgVqVqUrs -.,,y"- !&K!!%%"3"9"9";;!%%"4":":"<<!%% r":"@"@"BB G ")OQQUU:r-Bh-NqOGO&\\)R8 "3&W;&W#WX $  !Ps%AD0A/D& D0D+.D+2>D0zopenapi_registry.json_OPENAPI_REGISTRY_PATHr )maxsizec|ttd5}tj|}ddd|S#1swYSxYw)Nr )r0r=rr1)rrs r?_load_openapi_registryr@b s6 (# . :!-1YYq\D :  : s1;z/openapi-registryzRReturns well-known OpenAPI APIs with OAuth 2.0 metadata for the OpenAPI MCP pickercKt|stddd|ji tS#t$r)}t j dt|dgicYd}~Sd}~wwxYww)Nrrz=Only proxy admins can access the OpenAPI registry. Your role=rz+Failed to load OpenAPI registry from %s: %sapis)rrrUr@rrrr=)rSr"s r?get_openapi_registryrCh sw$$56\]n]x]x\yz   )+ + ( ()VXnpq rB<  s0(A* 5A* A'A"A'A*"A''A*)create_mcp_toolsetdelete_mcp_toolsetget_mcp_toolsetlist_mcp_toolsetsupdate_mcp_toolset)NewMCPToolsetRequestUpdateMCPToolsetRequestz/toolsetz%Create a new MCP toolset (admin only))rrcKtd}tj|jk7rt t j ddit||txst} t|||d{}d d l m}|j|S7#t$r,t t jdd|jdiwxYww) uOCreate a named toolset — a curated selection of {server_id, tool_name} pairs.rrz*Only proxy admins can create MCP toolsets.rrBrSlitellm_proxy_admin_nameNA toolset named 'rLrrt)rrzrVrUrrrr*rrDrHTTP_409_CONFLICT toolset_namerruinvalidate_toolset_cacherrSrBr2rresultrus r?add_mcp_toolsetrT s ::tu  ' '+<+F+F F"55!MN  %#5"3)A  ( (  "4]GZ"XXF   ;!::< Y# "44#4W5I5I4JJ[!\]  s0A C #B3B4B8C B5CC z/List MCP toolsets accessible to the calling keycKtd}t|}|j}|r t|ddnd}|s|rt |d{SgSt ||d{S77w)z5Return toolsets the calling key is allowed to access.r mcp_toolsetsN) toolset_ids)rrobject_permissionrrG)rSr2rop raw_toolsetss r?fetch_mcp_toolsetsr[ sq ::tu ./@A%77 DFgb.$?4 .}===I&},OOO>Os$AA(A$ A(A& A(&A(z/toolset/{toolset_id}z Get a specific MCP toolset by ID toolset_idc,Ktd}t|s@|j}|r t|ddnd}|||vrt t j ddit||d{}|!t t jdd|di|S7)w)NrrVrz-API key does not have access to this toolset.r Toolset 'r') rrrXrrrrrFr)r\rSr2rYgrantedtoolsets r?fetch_mcp_toolsetra s ::tu #$56);;BBDWR>$G*G";# & 9 9#%TU /}jII ?"559ZL !EF  JsA&B(B)*Bz+Update an existing MCP toolset (admin only)c4Ktd}tj|jk7rt t j ddit||txst} t|||d{}|+t t jdd |jd id d lm}|j"t%|d d|S7V#t$r@t t jd|jrd|jdidiwxYww)Nrrz*Only proxy admins can update MCP toolsets.rrLrNrLz(A toolset with that name already exists.r^r'rrtr\)rrzrVrUrrrr*rrHrrOrPrr\rrurQrrRs r?edit_mcp_toolsetrc sA ::tu  ' '+<+F+F F"55!MN  %#5"3)A  ( (  "4]GZ"XXF >"559W-?-?,@ !MN   ;!::77LZ^;_` -Y# "44"//,G,@,@+AARS   H    s2A D#C 3C 4C 8AD C A DDz"Delete an MCP toolset (admin only)cjKtd}tj|jk7rt t j ddit||d{}|!t t jdd|diddl m }|j|tt j S7Yw) Nrrz*Only proxy admins can delete MCP toolsets.rr^r'rrtr)rrzrVrUrrrrErrrurQrr)r\rSrBr2deletedrus r?remove_mcp_toolsetrf s ::tu  ' '+<+F+F F"55!MN  2-LL ?"559ZL !EF   ;!:::FF$<$<==MsAB3B1AB3)rBN)rBzPrismaClient | None)rzMCPCredentials | str | NonerBzdict[str, str] | NonerT(#__doc__ functools importlibroscollections.abcrrr dataclassesrrrr typingr r r r fastapirrrrrrrrrfastapi.responsesrtyping_extensionsrr prisma.errorsrr ImportErrorrrlitellm._loggingrr litellm._uuidrlitellm.constantsr,litellm.proxy._experimental.mcp_server.utilsr r!r"r#r$r%r&r'r0litellm.proxy.common_utils.encrypt_decrypt_utilsr(r)+litellm.proxy.management_helpers.audit_logsr*r+'litellm.repositories.table_repositoriesr,r-r1r<r2rPr3r4r6r;rFrGprismarH prisma_modelslitellm.proxy.utilsrI import_moduler"rmcp.shared.tool_name_validationrJpydanticrKrM)litellm.proxy._experimental.mcp_server.dbrUrVrWrXrYrZr[r\r]r^r_r`rarbrcrdrerfrgrhrirjrk=litellm.proxy._experimental.mcp_server.discoverable_endpointsrlrmrnrorprqrrrsrru7litellm.proxy._experimental.mcp_server.ui_session_utilsrvrwrxlitellm.proxy._typesryrzr{r|r}r~rrrrrrrrrrrrrr$litellm.proxy.auth.user_api_key_authrr-litellm.proxy.common_utils.http_parsing_utilsrr/litellm.proxy.management_endpoints.common_utilsr7litellm.proxy.management_endpoints.mcp_connector_importrrrrrrrr&litellm.proxy.management_helpers.utilsrlitellm.types.mcprrrr+litellm.types.mcp_server.mcp_server_managerrrrrrr model_fieldsrrrrrrrrrrrr rbrr#r/r3r6r;r?rIrGrQrQrWr[rkrnrzr|rrcrrrrrrrrrrrrrrr rpostHTTP_201_CREATEDr r$putr,r1rArF HTTP_200_OKrhrnrrrrrdeleterrrrrrrrrrrr r rr#r,rrdirnameabspath__file__r-r.r2r<r= lru_cacheobjectr@rC1litellm.proxy._experimental.mcp_server.toolset_dbrDrErFrGrH$litellm.types.mcp_server.mcp_toolsetrIrJrTr[rarcrfr=r>r?rs]" 77!22::   +1%G A6 %99 t*- %-/M%uM8 h|.D UX ]a '.e-.0IE"  / 2    ,U   S F2F461E$ 1;O1TX1 ^+>^4^84==P=]=]3^i 0^-/B-t-^GG5S555   c Y8I8 Y # Rc 0    8I  JLE$s,D'D"EFK8ICIe9eSVe[_e@11 T 1f $      * RS RYQUEU R T .*  !2! !2K45K $ %K K~K$K Ln LQU L(*( (TL45L $ %L 2*2 2hX45X $ %X H %eCHos.B(C"D k7NkSWk!@$!@ !@F2E#0% $% $J% %  % NC ZZW/01 -44E,F')'  '& ZZW/01 -44E,F 5) 5  5D ZZW/01K  !W!  !  ZZWc - -  -F+@$5$5 $ %$5L))) $ %)*\^\XabeXf\ ZZG/0123 -44E,F# I $) 9$ m$)m$tm$!m$  m$^ ZZ2/01 (- ^( -44E,F ,oI$,o * ,o  ,o\ [[t/01-++ !-44E,F@7$@7)@7!@7D ZZF/01,  !,34E,F)! . ZZ%q/01-  !-44E,F#1#1)#1! #1J ZZ$o/01-  !-44E,F&1&1'&1*&1! &1P ZZ1/01- -44E,F\\\*\  \| [[4/01-++ !-44E,F)/ x* Q7$Q7)Q7 $JQ7!Q7f [[^/021&& !-44E,Fd *d )d !d L [[_/01&&  !-44E,F)/ x* =4$=4)=4 $J=4! =4~b Gb b N#'))))4)  )V ZZ-:;<-44P,Q $!#J%),0$( 4 4 4 *4 : 4  4  4 d 4  #Tz4 Tz4 Tz4  4 l [[):;<-44P,Qs):#': $T $(J$(J$(J J5 5 5 *5  5 Dj 5 Dj 5 :5 Tz5 Tz5 Tz5 Tz5  5 n [[,/01-44E,F   *   , ]]:/01#,, !-44E,F)/ x* 8>8>)8> $J8>!8>t [[-V/010  !-44E,FTT)T*T! T< ]]-T/010  !-44E,FTT)T! T2 [[3U/013  !-44E,F& & .& *& ! & P ]]3U/013  !-44E,F  ) !  @ ZZ:g/013  !-44E,F  ) !  > ZZQ/0156  !,34E,F#)#! #N)))) )V9 &9 CH~9   9 v ZZ+\/01+  !-44E,F Q Q) Q  Q!  Q [[+ 1 /01+ !-44E,FQQ&Q*Q  Q! Q: ]]+[/01+  !-44E,FMM)M M! M( ZZQ/0101 !,34E,F) " #!( ZZ:/01-,, !-44E,F)/ x* wB'wB)wB $JwB!wBr [[A/01,, -44E,F=@,=@)=@  =@B!#  (ABC! MQhwsCx/@&A!ABTIP Xgc3h6G-H(H I  ZZW/01 "$4ef$T7KL,34E,F, Tz, *, *,  , `%'GGLL (ABC%E Y#Df$5$  ZZh -44E,F )  *  [[;++ !-44E,F)/ % )  $J !  D ZZE!,34E,FP)P!  P$ ZZ6!-44E,F)!  , ZZA!-44E,F)/*(*)* $J*!  *X ]]8,, !-44E,F)/>>)> $J>!  >Y]O%#$%FN3Q7M /& %  % /S /-F //s<w=x x5= x  x  x2x--x25yy