From 0dcf316f59f30ff892999f065e94a8b0242c8620 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 3 Jun 2026 20:54:32 +0000
Subject: [PATCH] fix(mcp/ui): clear value for user-scope env vars before
 submit

A stale admin secret left in form state after switching an env var's
scope from instance to per-user was forwarded to the backend as the
user-scope value, which is returned unredacted to authorized non-admin
users. Per-user entries carry no admin value, so drop it on submit.
---
 .../src/components/mcp_tools/create_mcp_server.tsx              | 2 +-
 .../src/components/mcp_tools/mcp_server_edit.tsx                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx b/ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx
index 9df3d92a10b..17470331778 100644
--- a/ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx
+++ b/ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx
@@ -65,7 +65,7 @@ const normalizeEnvVars = (list: unknown): EnvVarEntry[] => {
     const scope = (entry as Record<string, unknown>).scope === "user" ? "user" : "global";
     out.push({
       name,
-      value: String((entry as Record<string, unknown>).value ?? ""),
+      value: scope === "user" ? "" : String((entry as Record<string, unknown>).value ?? ""),
       scope,
       description: ((entry as Record<string, unknown>).description as string | undefined) || undefined,
     });
diff --git a/ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx b/ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx
index 1143ba45bd3..ad6b804cfcc 100644
--- a/ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx
+++ b/ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx
@@ -444,7 +444,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
               const scope = entry?.scope === "user" ? "user" : "global";
               acc.push({
                 name,
-                value: String(entry?.value ?? ""),
+                value: scope === "user" ? "" : String(entry?.value ?? ""),
                 scope,
                 description: (entry?.description as string | undefined) || undefined,
               });