diff --git a/.circleci/config.yml b/.circleci/config.yml
index 55fa9410845..dfc539fb80e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -112,10 +112,10 @@ commands:
             node --version
             npm --version
   install_rust:
-    description: "Install pinned rustup (1.28.2) and Rust toolchain (1.97.1) with checksum verification. Adds ~/.cargo/bin to PATH. Run this before any `uv sync` or `uv build` of the workspace: the root package builds litellm-rust through maturin, and on an image without cargo maturin fetches an unpinned rustup and a floating toolchain by itself."
+    description: "Install pinned rustup (1.28.2) and Rust toolchain (1.98.0) with checksum verification. Adds ~/.cargo/bin to PATH. Run this before any `uv sync` or `uv build` of the workspace: the root package builds litellm-rust through maturin, and on an image without cargo maturin fetches an unpinned rustup and a floating toolchain by itself."
     steps:
       - run:
-          name: Install Rust (rustup 1.28.2, toolchain 1.97.1)
+          name: Install Rust (rustup 1.28.2, toolchain 1.98.0)
           command: |
             case "$(uname -m)" in
               x86_64)
@@ -135,7 +135,7 @@ commands:
               "https://static.rust-lang.org/rustup/archive/1.28.2/${RUSTUP_TRIPLE}/rustup-init"
             echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum -c -
             chmod +x /tmp/rustup-init
-            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.97.1
+            /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain 1.98.0
             rm -f /tmp/rustup-init
             echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
             export PATH="$HOME/.cargo/bin:$PATH"
@@ -300,7 +300,7 @@ jobs:
             if ($rustupActual -ne $rustupExpected) {
               throw "rustup installer hash mismatch: expected $rustupExpected got $rustupActual"
             }
-            & $rustupInit -y --profile minimal --default-toolchain stable
+            & $rustupInit -y --profile minimal --default-toolchain 1.98.0
             if ($LASTEXITCODE -ne 0) {
               exit $LASTEXITCODE
             }
diff --git a/.github/scripts/smoke_test_native_wheel.py b/.github/scripts/smoke_test_native_wheel.py
new file mode 100644
index 00000000000..577bb32fcf0
--- /dev/null
+++ b/.github/scripts/smoke_test_native_wheel.py
@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+import tempfile
+import zipfile
+from pathlib import Path
+from typing import Final
+
+CHILD_SCRIPT: Final = """
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+import sys
+
+native_path = Path(sys.argv[1])
+spec = spec_from_file_location("litellm.rust_bridge._native", native_path)
+if spec is None or spec.loader is None:
+    raise RuntimeError("cannot create native extension import specification")
+module = module_from_spec(spec)
+spec.loader.exec_module(module)
+
+before = module.gil_stats()
+if not isinstance(before.get("releases"), int):
+    raise AssertionError(f"unexpected gil_stats result: {before!r}")
+
+try:
+    module._panic_for_test()
+except BaseException as error:
+    if type(error).__name__ != "PanicException":
+        raise AssertionError(f"expected PanicException, got {type(error).__name__}") from error
+else:
+    raise AssertionError("Rust panic returned without raising")
+
+after = module.gil_stats()
+if not isinstance(after.get("releases"), int):
+    raise AssertionError(f"native module unusable after panic: {after!r}")
+"""
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        sys.stderr.write(f"usage: {Path(sys.argv[0]).name} WHEEL\n")
+        return 2
+
+    wheel: Final = Path(sys.argv[1])
+    with tempfile.TemporaryDirectory() as temporary_directory, zipfile.ZipFile(wheel) as archive:
+        native_members: Final = tuple(
+            member
+            for member in archive.infolist()
+            if member.filename.startswith("litellm/rust_bridge/_native.") and member.filename.endswith(".so")
+        )
+        if len(native_members) != 1:
+            sys.stderr.write(f"expected one native extension, found {len(native_members)}\n")
+            return 1
+
+        native_path: Final = Path(temporary_directory) / Path(native_members[0].filename).name
+        native_path.write_bytes(archive.read(native_members[0]))
+        result: Final = subprocess.run((sys.executable, "-c", CHILD_SCRIPT, str(native_path)), check=False)
+
+    if result.returncode != 0:
+        sys.stderr.write(f"native wheel smoke test exited with status {result.returncode}\n")
+        return 1
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/scripts/verify_linux_native_wheel.py b/.github/scripts/verify_linux_native_wheel.py
new file mode 100644
index 00000000000..899e2a211c0
--- /dev/null
+++ b/.github/scripts/verify_linux_native_wheel.py
@@ -0,0 +1,282 @@
+from __future__ import annotations
+
+import importlib.util
+import os
+import re
+import subprocess
+import sys
+import zipfile
+from collections.abc import Callable, Mapping, Sequence
+from itertools import product
+from pathlib import Path, PurePosixPath
+from types import MappingProxyType, ModuleType
+from typing import Final, Protocol
+
+EXPECTED_PYTHON_TAG: Final = "cp310"
+EXPECTED_ABI_TAG: Final = "abi3"
+EXPECTED_PLATFORM_TAG: Final = "linux_x86_64"
+
+
+class CommandRunner(Protocol):
+    def __call__(
+        self,
+        command: tuple[str, ...],
+        *,
+        check: bool,
+        capture_output: bool,
+        text: bool,
+    ) -> subprocess.CompletedProcess[str]: ...
+
+
+def _run_command(
+    command: tuple[str, ...],
+    *,
+    check: bool,
+    capture_output: bool,
+    text: bool,
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(command, check=check, capture_output=capture_output, text=text)
+
+
+def _dist_info_directory(member: zipfile.ZipInfo) -> str | None:
+    parts: Final = PurePosixPath(member.filename).parts
+    if not parts or not parts[0].endswith(".dist-info"):
+        return None
+    return parts[0]
+
+
+def _wheel_metadata_tags(archive: zipfile.ZipFile, members: tuple[zipfile.ZipInfo, ...]) -> tuple[str, ...]:
+    if len(members) != 1:
+        return ()
+    lines: Final = archive.read(members[0]).splitlines()
+    return tuple(line.removeprefix(b"Tag:").strip().decode("ascii") for line in lines if line.startswith(b"Tag:"))
+
+
+def _load_native_module(native_path: Path) -> ModuleType | None:
+    module_spec: Final = importlib.util.spec_from_file_location("litellm.rust_bridge._native", native_path)
+    if module_spec is None or module_spec.loader is None:
+        return None
+    try:
+        native_module: Final = importlib.util.module_from_spec(module_spec)
+        module_spec.loader.exec_module(native_module)
+    except Exception as error:  # noqa: BLE001  # native module initialization can raise arbitrary exceptions
+        sys.stderr.write(f"native module load failed: {error}\n")
+        return None
+    return native_module
+
+
+def main(
+    argv: Sequence[str] | None = None,
+    environment: Mapping[str, str] | None = None,
+    load_native_module: Callable[[Path], ModuleType | None] = _load_native_module,
+    run_command: CommandRunner = _run_command,
+) -> int:
+    arguments: Final = tuple(sys.argv if argv is None else argv)
+    resolved_environment: Final = os.environ if environment is None else environment
+    if len(arguments) != 2:
+        sys.stderr.write(f"usage: {Path(arguments[0]).name} WHEEL\n")
+        return 2
+
+    wheel: Final = Path(arguments[1])
+    wheel_tags: Final = wheel.stem.rsplit("-", maxsplit=3)
+    if len(wheel_tags) != 4:
+        sys.stderr.write(f"cannot parse wheel tags from {wheel.name}\n")
+        return 1
+
+    wheel_identity: Final = wheel_tags[0].split("-")
+    if len(wheel_identity) != 2 or wheel_identity[0] != "litellm" or not wheel_identity[1]:
+        sys.stderr.write(f"unexpected wheel identity: {wheel_tags[0]}\n")
+        return 1
+
+    expected_dist_info_directory: Final = f"{wheel_tags[0]}.dist-info"
+    expected_dist_info_directories: Final = frozenset((expected_dist_info_directory,))
+    python_tag: Final = wheel_tags[1]
+    abi_tag: Final = wheel_tags[2]
+    platform_tag: Final = wheel_tags[3]
+    expanded_filename_tags: Final = frozenset(
+        "-".join(tag) for tag in product(python_tag.split("."), abi_tag.split("."), platform_tag.split("."))
+    )
+
+    with zipfile.ZipFile(wheel) as archive:
+        wheel_members: Final = archive.infolist()
+        dist_info_directories: Final = frozenset(
+            directory for member in wheel_members if (directory := _dist_info_directory(member)) is not None
+        )
+        required_dist_info_files: Final = ("METADATA", "RECORD", "WHEEL")
+        dist_info_file_counts: Final = MappingProxyType(
+            {
+                filename: sum(
+                    member.filename == f"{expected_dist_info_directory}/{filename}" for member in wheel_members
+                )
+                for filename in required_dist_info_files
+            }
+        )
+        wheel_metadata_members: Final = tuple(
+            member for member in wheel_members if member.filename == f"{expected_dist_info_directory}/WHEEL"
+        )
+        wheel_metadata_tags: Final = _wheel_metadata_tags(archive, wheel_metadata_members)
+        native_members: Final = tuple(
+            member
+            for member in wheel_members
+            if member.filename.startswith("litellm/rust_bridge/_native.") and member.filename.endswith(".so")
+        )
+        if len(native_members) != 1:
+            sys.stderr.write(f"expected one native extension, found {len(native_members)}\n")
+            return 1
+
+        unexpected_members: Final = tuple(
+            member.filename
+            for member in wheel_members
+            if member.filename.endswith((".pdb", ".dwp", ".rlib", ".rmeta", "Cargo.toml", "Cargo.lock"))
+            or any(part.endswith(".dSYM") for part in PurePosixPath(member.filename).parts)
+        )
+        native_member: Final = native_members[0]
+        uncompressed_wheel_size: Final = sum(member.file_size for member in wheel_members)
+        native_path: Final = wheel.parent / "native" / Path(native_member.filename).name
+        native_path.parent.mkdir(parents=True, exist_ok=True)
+        native_path.write_bytes(archive.read(native_member))
+
+    wheel_metadata_tags_match: Final = (
+        len(wheel_metadata_tags) == len(expanded_filename_tags)
+        and frozenset(wheel_metadata_tags) == expanded_filename_tags
+    )
+    commit_sha: Final = resolved_environment.get(
+        "RELEASE_WHEEL_COMMIT_SHA", resolved_environment.get("GITHUB_SHA", "unknown")
+    )
+    rustc_version: Final = run_command(
+        ("rustc", "--version"),
+        check=True,
+        capture_output=True,
+        text=True,
+    ).stdout.strip()
+    pyproject: Final = (Path(__file__).parents[2] / "pyproject.toml").read_text()
+    maturin_match: Final = re.search(r'"maturin==([^";]+)', pyproject)
+    if maturin_match is None:
+        sys.stderr.write("build-system does not pin an exact Maturin version\n")
+        return 1
+
+    maturin_version: Final = maturin_match.group(1)
+    native_percentage: Final = native_member.file_size / uncompressed_wheel_size * 100
+    size_report: Final = "\n".join(
+        (
+            "## Native wheel build report",
+            "",
+            "| Build | Value |",
+            "| --- | --- |",
+            f"| Commit | `{commit_sha}` |",
+            f"| Platform | `{platform_tag}` |",
+            f"| Python ABI | `{python_tag}-{abi_tag}` |",
+            f"| Rust compiler | `{rustc_version}` |",
+            f"| Maturin | `{maturin_version}` |",
+            "| Cargo profile | `release` |",
+            "",
+            "| Artifact | Size |",
+            "| --- | ---: |",
+            f"| Compressed wheel | {wheel.stat().st_size / 1_000_000:.2f} MB |",
+            f"| Uncompressed wheel | {uncompressed_wheel_size / 1_000_000:.2f} MB |",
+            f"| Native extension | {native_member.file_size / 1_000_000:.2f} MB |",
+            f"| Native share | {native_percentage:.2f}% |",
+            "",
+        )
+    )
+    summary_path: Final = resolved_environment.get("GITHUB_STEP_SUMMARY")
+    if summary_path is None:
+        sys.stdout.write(size_report)
+    else:
+        Path(summary_path).write_text(size_report)
+
+    sections: Final = run_command(
+        ("readelf", "--sections", "--wide", str(native_path)),
+        check=True,
+        capture_output=True,
+        text=True,
+    ).stdout
+    debug_sections: Final = tuple(section for section in (".debug_", ".zdebug_") if section in sections)
+    debug_sections_absent: Final = not debug_sections
+    static_symbol_table_absent: Final = ".symtab" not in sections
+
+    dynamic_symbols: Final = run_command(
+        ("readelf", "--dyn-syms", "--wide", str(native_path)),
+        check=True,
+        capture_output=True,
+        text=True,
+    ).stdout
+    extension_entry_point_present: Final = "PyInit__native" in dynamic_symbols
+    native_module: Final = load_native_module(native_path)
+    native_module_loads: Final = native_module is not None
+    panic_test_hook_absent: Final = native_module is not None and not hasattr(native_module, "_panic_for_test")
+    native_size_limit: Final = 20_000_000
+    native_size_within_limit: Final = native_member.file_size <= native_size_limit
+    validations: Final = (
+        (f"Python tag is {EXPECTED_PYTHON_TAG}", python_tag == EXPECTED_PYTHON_TAG),
+        (f"ABI tag is {EXPECTED_ABI_TAG}", abi_tag == EXPECTED_ABI_TAG),
+        (f"Platform tag is {EXPECTED_PLATFORM_TAG}", platform_tag == EXPECTED_PLATFORM_TAG),
+        ("Wheel dist-info directory matches the filename", dist_info_directories == expected_dist_info_directories),
+        (
+            "Required dist-info files are present exactly once",
+            all(count == 1 for count in dist_info_file_counts.values()),
+        ),
+        ("Wheel metadata tags match the filename", wheel_metadata_tags_match),
+        ("Debug sections are absent", debug_sections_absent),
+        ("Static symbol table is absent", static_symbol_table_absent),
+        ("Python extension entry point is present", extension_entry_point_present),
+        ("Native module loads", native_module_loads),
+        ("Production module omits the panic test hook", panic_test_hook_absent),
+        ("Native extension does not exceed 20 MB", native_size_within_limit),
+        ("Wheel contents are valid", not unexpected_members),
+    )
+
+    verified_report: Final = size_report + "\n".join(
+        ("", "| Validation | Expected | Result |", "| --- | --- | :---: |")
+        + tuple(f"| {label} | Yes | {'O' if passed else 'X'} |" for label, passed in validations)
+        + ("",)
+    )
+    if summary_path is not None:
+        Path(summary_path).write_text(verified_report)
+
+    invalid_dist_info_files: Final = any(count != 1 for count in dist_info_file_counts.values())
+    validation_errors: Final = tuple(
+        message
+        for failed, message in (
+            (bool(debug_sections), f"{native_member.filename} contains debug sections: {', '.join(debug_sections)}"),
+            (not static_symbol_table_absent, f"{native_member.filename} contains a static symbol table"),
+            (not extension_entry_point_present, "native extension does not export PyInit__native"),
+            (
+                python_tag != EXPECTED_PYTHON_TAG,
+                f"unexpected Python tag: expected {EXPECTED_PYTHON_TAG}, found {python_tag}",
+            ),
+            (abi_tag != EXPECTED_ABI_TAG, f"unexpected ABI tag: expected {EXPECTED_ABI_TAG}, found {abi_tag}"),
+            (
+                platform_tag != EXPECTED_PLATFORM_TAG,
+                f"unexpected platform tag: expected {EXPECTED_PLATFORM_TAG}, found {platform_tag}",
+            ),
+            (
+                dist_info_directories != expected_dist_info_directories,
+                f"unexpected dist-info directories: expected {expected_dist_info_directory}, "
+                f"found {', '.join(sorted(dist_info_directories))}",
+            ),
+            (invalid_dist_info_files, f"required dist-info file counts are invalid: {dist_info_file_counts}"),
+            (
+                not invalid_dist_info_files and not wheel_metadata_tags_match,
+                f"WHEEL tags do not match filename: expected {', '.join(sorted(expanded_filename_tags))}, "
+                f"found {', '.join(sorted(wheel_metadata_tags))}",
+            ),
+            (
+                native_module is not None and not panic_test_hook_absent,
+                "production native module exposes _panic_for_test",
+            ),
+            (
+                not native_size_within_limit,
+                f"native extension exceeds 20 MB: {native_member.file_size / 1_000_000:.2f} MB",
+            ),
+            (bool(unexpected_members), f"wheel contains unexpected build artifacts: {', '.join(unexpected_members)}"),
+        )
+        if failed
+    )
+    sys.stderr.write("".join(f"{message}\n" for message in validation_errors))
+
+    return 0 if all(passed for _, passed in validations) else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/workflows/report-rust-release-wheel.yml b/.github/workflows/report-rust-release-wheel.yml
new file mode 100644
index 00000000000..1d93b56f77f
--- /dev/null
+++ b/.github/workflows/report-rust-release-wheel.yml
@@ -0,0 +1,130 @@
+name: Report LiteLLM Rust release wheel
+
+on: # zizmor: ignore[dangerous-triggers] reporter executes no PR code and consumes no PR artifacts or outputs
+  workflow_run:
+    workflows:
+      - LiteLLM Rust
+    types:
+      - completed
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.id }}
+  cancel-in-progress: false
+
+jobs:
+  report-release-wheel:
+    name: report release wheel
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.path == '.github/workflows/test-rust.yml' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      github.event.workflow_run.pull_requests[0].number != null
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      issues: write # PR comments use the issues API
+      pull-requests: read # Current-head validation rejects stale workflow runs
+
+    steps:
+      - name: Link release wheel report on PR
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        env:
+          COMMENT_MARKER: "<!-- litellm-release-wheel-size -->"
+        with:
+          script: |
+            const marker = process.env.COMMENT_MARKER;
+            const workflowRun = context.payload.workflow_run;
+            const allowedConclusions = new Set([
+              "action_required",
+              "cancelled",
+              "failure",
+              "neutral",
+              "skipped",
+              "stale",
+              "startup_failure",
+              "success",
+              "timed_out",
+            ]);
+            if (
+              !allowedConclusions.has(workflowRun.conclusion) ||
+              workflowRun.event !== "pull_request" ||
+              workflowRun.path !== ".github/workflows/test-rust.yml" ||
+              workflowRun.head_repository?.full_name !==
+                `${context.repo.owner}/${context.repo.repo}` ||
+              workflowRun.pull_requests?.length !== 1
+            ) {
+              throw new Error("unexpected source workflow");
+            }
+            const pullRequest = workflowRun.pull_requests[0];
+            const pullRequestNumber = pullRequest.number;
+            const headSha = workflowRun.head_sha;
+            const runId = workflowRun.id;
+            if (
+              !Number.isSafeInteger(pullRequestNumber) ||
+              pullRequestNumber <= 0 ||
+              !Number.isSafeInteger(runId) ||
+              runId <= 0 ||
+              !/^[0-9a-f]{40}$/.test(headSha) ||
+              pullRequest.head?.sha !== headSha
+            ) {
+              throw new Error("invalid source workflow metadata");
+            }
+            const runUrl =
+              `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}` +
+              `/actions/runs/${runId}`;
+            const result =
+              workflowRun.conclusion === "success"
+                ? "successfully"
+                : `with \`${workflowRun.conclusion}\``;
+            const body = [
+              marker,
+              "## LiteLLM Rust workflow",
+              "",
+              `Workflow completed ${result} for \`${headSha}\``,
+              "",
+              `[View workflow run](${runUrl})`,
+            ].join("\n");
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pullRequestNumber,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (comment) =>
+                comment.user?.login === "github-actions[bot]" &&
+                comment.body?.startsWith(marker),
+            );
+            const currentPullRequest = (
+              await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: pullRequestNumber,
+              })
+            ).data;
+            if (
+              currentPullRequest.state !== "open" ||
+              currentPullRequest.head.repo?.full_name !==
+                `${context.repo.owner}/${context.repo.repo}` ||
+              currentPullRequest.head.sha !== headSha
+            ) {
+              core.info("source workflow no longer matches the current pull request head");
+              return;
+            }
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pullRequestNumber,
+                body,
+              });
+            }
diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index 21e1bcb90c6..aada0fcf239 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -4,6 +4,11 @@ on:
   push:
     paths:
       - "litellm-rust/**"
+      - ".cargo/**"
+      - "pyproject.toml"
+      - "rust-toolchain.toml"
+      - ".github/scripts/smoke_test_native_wheel.py"
+      - ".github/scripts/verify_linux_native_wheel.py"
       - ".github/workflows/test-rust.yml"
   pull_request:
     branches:
@@ -13,6 +18,11 @@ on:
       - "litellm_**"
     paths:
       - "litellm-rust/**"
+      - ".cargo/**"
+      - "pyproject.toml"
+      - "rust-toolchain.toml"
+      - ".github/scripts/smoke_test_native_wheel.py"
+      - ".github/scripts/verify_linux_native_wheel.py"
       - ".github/workflows/test-rust.yml"
 
 permissions:
@@ -40,9 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust
-        run: |
-          rustup toolchain install stable --profile minimal --component clippy,rustfmt
-          rustup default stable
+        run: rustup toolchain install
 
       - name: Cache Cargo registry and target
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
@@ -51,7 +59,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             litellm-rust/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('litellm-rust/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('rust-toolchain.toml', 'litellm-rust/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
 
@@ -69,3 +77,47 @@ jobs:
 
       - name: Run core tests with Bedrock auth
         run: cargo test -p litellm-core --features bedrock-auth --locked
+
+  release-wheel:
+    name: release wheel
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      CARGO_TERM_COLOR: always
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Set up Rust
+        run: rustup toolchain install
+
+      - name: Build release wheel
+        run: uv build --wheel --out-dir dist
+
+      - name: Build panic contract wheel
+        run: >-
+          uv build --wheel --out-dir panic-dist
+          --config-setting "maturin.build-args=--features panic-test,extension-module"
+
+      - name: Smoke-test native panic unwinding
+        run: python .github/scripts/smoke_test_native_wheel.py panic-dist/*.whl
+
+      - name: Verify stripped native extension
+        env:
+          RELEASE_WHEEL_COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python .github/scripts/verify_linux_native_wheel.py dist/*.whl
diff --git a/basedpyright-code-budget.json b/basedpyright-code-budget.json
index da788bf1ce3..d094c98f5ec 100644
--- a/basedpyright-code-budget.json
+++ b/basedpyright-code-budget.json
@@ -1,6 +1,6 @@
 {
   "reportAny": {
-    "limit": 14076
+    "limit": 14074
   },
   "reportArgumentType": {
     "limit": 2216
@@ -24,7 +24,7 @@
     "limit": 19
   },
   "reportExplicitAny": {
-    "limit": 4128
+    "limit": 4125
   },
   "reportFunctionMemberAccess": {
     "limit": 7
@@ -108,10 +108,10 @@
     "limit": 38350
   },
   "reportUnknownParameterType": {
-    "limit": 19626
+    "limit": 19625
   },
   "reportUnknownVariableType": {
-    "limit": 29890
+    "limit": 29877
   },
   "reportUnnecessaryCast": {
     "limit": 111
@@ -138,7 +138,7 @@
     "limit": 138
   },
   "reportUnusedImport": {
-    "limit": 543
+    "limit": 542
   },
   "reportUnusedVariable": {
     "limit": 137
diff --git a/enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py b/enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py
index 1d3268da9a0..190141470df 100644
--- a/enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py
+++ b/enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py
@@ -39,9 +39,9 @@ async def available_enterprise_users(
 
     if not premium_user:
         # check if SSO is enabled - show 5 user limit
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
-        if _has_user_setup_sso():
+        if has_user_setup_sso():
             premium_user_data = EnterpriseLicenseData(
                 max_users=5,
             )
diff --git a/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py b/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py
index f3b55fd4d96..2283814ab35 100644
--- a/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/prisma_toolchain.py
@@ -14,9 +14,22 @@ then fails on a Node binary that was never written. Deleting a cache directory
 that exists without a Node binary is what turns a killed bootstrap back into a
 recoverable one.
 
-Both budgets are overridable so an operator can widen them without a release:
-``LITELLM_PRISMA_BOOTSTRAP_TIMEOUT`` for the toolchain install and
-``LITELLM_PRISMA_COMMAND_TIMEOUT`` for every individual Prisma command.
+``prisma migrate deploy`` is the other command whose runtime is not a
+constant: it grows with the number of pending migrations, so a fresh database
+that has to replay every migration this package ships overruns a per-command
+budget sized for the short bookkeeping commands, on a laptop as much as on a
+slow CI runner. The Python ``prisma`` wrapper spawns Node and the schema engine
+as separate children, so killing the wrapper on timeout leaves them running:
+the retry then contends with that orphan for Prisma's advisory lock and cannot
+finish any sooner. Migrate deploy therefore runs under its own budget.
+
+All three budgets are overridable so an operator can widen them without a
+release: ``LITELLM_PRISMA_BOOTSTRAP_TIMEOUT`` for the toolchain install,
+``LITELLM_PRISMA_MIGRATE_DEPLOY_TIMEOUT`` for ``prisma migrate deploy`` and
+``LITELLM_PRISMA_COMMAND_TIMEOUT`` for every other Prisma command. The
+per-command budget used to bound migrate deploy as well, so a deployment that
+raised it above the deploy default keeps that larger budget for deploy unless
+the deploy override says otherwise.
 """
 
 import math
@@ -36,10 +49,12 @@ except ImportError:
 
 PRISMA_COMMAND_TIMEOUT_ENV_VAR = "LITELLM_PRISMA_COMMAND_TIMEOUT"
 PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR = "LITELLM_PRISMA_BOOTSTRAP_TIMEOUT"
+PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR = "LITELLM_PRISMA_MIGRATE_DEPLOY_TIMEOUT"
 NODEENV_CACHE_DIR_ENV_VAR = "PRISMA_NODEENV_CACHE_DIR"
 
 DEFAULT_PRISMA_COMMAND_TIMEOUT = 60.0
 DEFAULT_PRISMA_BOOTSTRAP_TIMEOUT = 600.0
+DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT = 600.0
 
 BOOTSTRAP_ARG = "--version"
 
@@ -88,6 +103,15 @@ def prisma_bootstrap_timeout() -> float:
     )
 
 
+def prisma_migrate_deploy_timeout() -> float:
+    """Seconds one ``prisma migrate deploy`` may run for, however many migrations are pending."""
+    if os.getenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR) is not None:
+        return _timeout_from_env(
+            PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT
+        )
+    return max(DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT, prisma_command_timeout())
+
+
 def nodeenv_cache_dir() -> Optional[Path]:
     """Where Prisma installs its private Node runtime, or None if unknowable."""
     override = os.getenv(NODEENV_CACHE_DIR_ENV_VAR)
diff --git a/litellm-proxy-extras/litellm_proxy_extras/utils.py b/litellm-proxy-extras/litellm_proxy_extras/utils.py
index b8032dd0d28..f6647268624 100644
--- a/litellm-proxy-extras/litellm_proxy_extras/utils.py
+++ b/litellm-proxy-extras/litellm_proxy_extras/utils.py
@@ -15,8 +15,11 @@ from litellm_proxy_extras.replica_identity import (
     apply_replica_identity_full,
 )
 from litellm_proxy_extras.prisma_toolchain import (
+    PRISMA_COMMAND_TIMEOUT_ENV_VAR,
+    PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR,
     ensure_prisma_toolchain,
     prisma_command_timeout,
+    prisma_migrate_deploy_timeout,
 )
 
 
@@ -698,12 +701,13 @@ class ProxyExtrasDBManager:
 
         original_dir = os.getcwd()
         os.chdir(migrations_dir)
+        deploy_timeout = prisma_migrate_deploy_timeout()
         try:
             for attempt in range(4):
                 try:
                     result = subprocess.run(
                         [_get_prisma_command(), "migrate", "deploy"],
-                        timeout=prisma_command_timeout(),
+                        timeout=deploy_timeout,
                         check=True,
                         capture_output=True,
                         text=True,
@@ -713,8 +717,12 @@ class ProxyExtrasDBManager:
                     return True
 
                 except subprocess.TimeoutExpired:
-                    logger.info(
-                        f"prisma migrate deploy attempt {attempt + 1} timed out, retrying"
+                    logger.warning(
+                        "prisma migrate deploy attempt %s timed out after %ss, retrying. "
+                        "Raise %s if this database needs longer to apply its pending migrations.",
+                        attempt + 1,
+                        deploy_timeout,
+                        PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR,
                     )
                     time.sleep(random.randrange(5, 15))
                     continue
@@ -823,7 +831,8 @@ class ProxyExtrasDBManager:
                 "Database migration failed after 4 attempts (retry loop "
                 "exhausted by timeouts or repeated idempotent-recovery "
                 "continues). Check database connectivity, load, and "
-                "_prisma_migrations ledger state."
+                "_prisma_migrations ledger state, and raise "
+                f"{PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR} if the attempts timed out."
             )
         finally:
             os.chdir(original_dir)
@@ -908,7 +917,7 @@ class ProxyExtrasDBManager:
                         # Set migrations directory for Prisma
                         result = subprocess.run(
                             [_get_prisma_command(), "migrate", "deploy"],
-                            timeout=prisma_command_timeout(),
+                            timeout=prisma_migrate_deploy_timeout(),
                             check=True,
                             capture_output=True,
                             text=True,
@@ -1126,7 +1135,11 @@ class ProxyExtrasDBManager:
                     )
                     return True
             except subprocess.TimeoutExpired:
-                logger.info(f"Attempt {attempt + 1} timed out")
+                logger.warning(
+                    "Attempt %s timed out. Raise %s if this database needs longer to apply its schema.",
+                    attempt + 1,
+                    PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR if use_migrate else PRISMA_COMMAND_TIMEOUT_ENV_VAR,
+                )
                 time.sleep(random.randrange(5, 15))
             except subprocess.CalledProcessError as e:
                 attempts_left = 3 - attempt
diff --git a/litellm-rust/AGENTS.md b/litellm-rust/AGENTS.md
index 36a5ad5a8f4..b8b6291283d 100644
--- a/litellm-rust/AGENTS.md
+++ b/litellm-rust/AGENTS.md
@@ -1,6 +1,6 @@
 # AGENTS.md
 
-litellm-rust has exactly THREE crates. A crate is a LAYER, not a route. Routes (ocr, realtime, chat) and providers (mistral, openai) are MODULES inside the layers.
+litellm-rust has four crates. A crate is a layer or shared foundation, not a route. Routes (ocr, realtime, chat) and providers (mistral, openai) are modules inside the layers.
 
 ## Crates
 
@@ -8,9 +8,10 @@ litellm-rust has exactly THREE crates. A crate is a LAYER, not a route. Routes (
 |-------|------|
 | litellm-core | The LiteLLM SDK in Rust. One public entrypoint per top-level call (`messages::messages()`), owning types, transforms, provider resolution, auth, and the provider HTTP call. Call it, get a typed response. |
 | litellm-ai-gateway | The axum server (behind the `server` feature) plus the WebSocket hosts. Translates HTTP/WS to core entrypoints; owns no provider logic and no handlers. |
-| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. |
+| litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
+| litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. Owns API registration, domain wiring, and Python exception mapping. |
 
-Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge.
+Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
 
 ## Where a route lives
 
@@ -28,7 +29,7 @@ core/src/messages/
 
 Handlers never live in `ai-gateway`. `ocr`, `audio_transcription`, and `realtime` are still hosted there from before this rule; they move to `core` as they are touched.
 
-Adding a crate: default to a MODULE. New crate ONLY on a real trigger — separate artifact (binary/cdylib), proc-macro, shared foundation, or publishable standalone. A new provider or route is none of these.
+Adding a crate: default to a module. A new crate requires a real trigger: separate artifact (binary/cdylib), proc-macro, shared foundation, or publishable standalone. A new provider or route is none of these.
 
 Adding a crate fails crates/core/tests/workspace_crate_allowlist.rs until you update its allowlist and this file — intentional.
 
diff --git a/litellm-rust/CLAUDE.md b/litellm-rust/CLAUDE.md
index fe6ceedbb86..3dcf1853efc 100644
--- a/litellm-rust/CLAUDE.md
+++ b/litellm-rust/CLAUDE.md
@@ -21,12 +21,13 @@ variants of it. The test for a good abstraction is that adding the next provider
 is a few declarative lines, not a new file of duplicated flow. Only diverge from
 the base when behavior is genuinely different, and say so explicitly in the PR.
 
-## Crates (exactly three — see AGENTS.md)
+## Crates (see AGENTS.md)
 
 `litellm-core` **is** the LiteLLM SDK in Rust: it makes the LLM call.
 `litellm-ai-gateway` is an HTTP/WebSocket server in front of it, and
-`litellm-python-bridge` exposes it to the Python SDK. A crate is a **layer**, not
-a route — add modules, not crates.
+`litellm-python-bridge` exposes it to the Python SDK. `litellm-python-interop`
+holds domain-neutral PyO3 primitives shared by Python-facing Rust code. A crate
+is a layer or shared foundation, not a route; add modules, not crates.
 
 ## Core Boundary
 
@@ -175,7 +176,7 @@ cd litellm-rust
 cargo fmt --check
 # the ai-gateway binary + server code is behind the `server` feature
 cargo clippy -p litellm-ai-gateway --all-targets --features server -- -D warnings
-cargo clippy -p litellm-core -p litellm-python-bridge --all-targets -- -D warnings
+cargo clippy -p litellm-core -p litellm-python-interop -p litellm-python-bridge --all-targets -- -D warnings
 cargo test --workspace
 ```
 
diff --git a/litellm-rust/Cargo.lock b/litellm-rust/Cargo.lock
index 4388e561026..dd41cf0e84b 100644
--- a/litellm-rust/Cargo.lock
+++ b/litellm-rust/Cargo.lock
@@ -919,6 +919,12 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
+[[package]]
+name = "futures-timer"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+
 [[package]]
 name = "futures-util"
 version = "0.3.33"
@@ -972,6 +978,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
 [[package]]
 name = "h2"
 version = "0.3.27"
@@ -1432,14 +1444,24 @@ dependencies = [
  "criterion",
  "litellm-ai-gateway",
  "litellm-core",
+ "litellm-python-interop",
  "pyo3",
  "pyo3-async-runtimes",
- "pythonize",
- "serde",
  "serde_json",
  "tokio",
 ]
 
+[[package]]
+name = "litellm-python-interop"
+version = "0.1.0"
+dependencies = [
+ "pyo3",
+ "pythonize",
+ "rstest",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -1627,6 +1649,15 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -1899,6 +1930,12 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "relative-path"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
+
 [[package]]
 name = "reqwest"
 version = "0.12.28"
@@ -1956,6 +1993,35 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rstest"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5a3193c063baaa2a95a33f03035c8a72b83d97a54916055ba22d35ed3839d49"
+dependencies = [
+ "futures-timer",
+ "futures-util",
+ "rstest_macros",
+]
+
+[[package]]
+name = "rstest_macros"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c845311f0ff7951c5506121a9ad75aec44d083c31583b2ea5a30bcb0b0abba0"
+dependencies = [
+ "cfg-if",
+ "glob",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "relative-path",
+ "rustc_version",
+ "syn 2.0.119",
+ "unicode-ident",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -2488,6 +2554,36 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -2903,6 +2999,15 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.3"
diff --git a/litellm-rust/Cargo.toml b/litellm-rust/Cargo.toml
index c17a0605fc7..c447d915abe 100644
--- a/litellm-rust/Cargo.toml
+++ b/litellm-rust/Cargo.toml
@@ -2,6 +2,7 @@
 members = [
     "crates/core",
     "crates/ai-gateway",
+    "crates/python-interop",
     "crates/python-bridge",
 ]
 resolver = "2"
@@ -15,12 +16,14 @@ repository = "https://github.com/BerriAI/litellm"
 [workspace.dependencies]
 litellm-core = { path = "crates/core" }
 litellm-ai-gateway = { path = "crates/ai-gateway", default-features = false }
+litellm-python-interop = { path = "crates/python-interop" }
 axum = "0.7"
 pyo3 = "0.29.0"
 pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] }
 pythonize = "0.29.0"
 rand = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls", "http2", "stream"] }
+rstest = "0.26.1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 sha2 = "0.10"
diff --git a/litellm-rust/README.md b/litellm-rust/README.md
index bcccf93300b..a0d79c6f0a5 100644
--- a/litellm-rust/README.md
+++ b/litellm-rust/README.md
@@ -26,9 +26,10 @@ coverage and production evidence.
 |-------|------|
 | litellm-core | The SDK. Per-route entrypoints (`messages::messages()`), types, provider transforms (modules under `providers/`), provider resolution, auth, the provider HTTP call, and the router. |
 | litellm-ai-gateway | The axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. |
-| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. |
+| litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
+| litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. Owns API registration, domain wiring, and Python exception mapping. |
 
-Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge.
+Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
 
 ## Layout
 
@@ -38,7 +39,8 @@ crates/
     src/messages/   mod.rs (entrypoint), types, transformation, prepare, handler, client
     src/providers/anthropic/messages/transformation.rs
   ai-gateway/     Axum server + WebSocket hosts; calls core entrypoints.
-  python-bridge/  PyO3 bridge for Python LiteLLM.
+  python-interop/ Domain-neutral PyO3 conversion and GIL primitives.
+  python-bridge/  PyO3 API adapter for Python LiteLLM.
 ```
 
 The folder shape follows the Python provider tree:
diff --git a/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
index a1860d8a9c9..4a689cb9579 100644
--- a/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
+++ b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
@@ -54,6 +54,6 @@ Rules for adding or changing an LLM provider/route in `litellm-rust`. `messages`
     cd litellm-rust
     cargo fmt --check
     cargo clippy -p litellm-ai-gateway --all-targets --features server -- -D warnings
-    cargo clippy -p litellm-core -p litellm-python-bridge --all-targets -- -D warnings
+    cargo clippy -p litellm-core -p litellm-python-interop -p litellm-python-bridge --all-targets -- -D warnings
     cargo test --workspace
     ```
diff --git a/litellm-rust/crates/ai-gateway/README.md b/litellm-rust/crates/ai-gateway/README.md
index 7a6c620ee84..5cbb47220be 100644
--- a/litellm-rust/crates/ai-gateway/README.md
+++ b/litellm-rust/crates/ai-gateway/README.md
@@ -6,15 +6,16 @@ dials OpenAI upstream, and splices the two sockets frame-by-frame.
 
 ## Crates
 
-`litellm-rust` is exactly three crates (a crate is a **layer**, not a route):
+`litellm-rust` has four crates. A crate is a layer or shared foundation, not a route:
 
 | Crate | Role |
 |-------|------|
 | litellm-core | The LiteLLM SDK in Rust — per-route entrypoints (`messages::messages()`) that resolve the provider, transform, and make the call; plus types, provider transforms, and the router. |
 | litellm-ai-gateway | The Axum server (behind the `server` feature) and WebSocket hosts. Translates HTTP/WS to core entrypoints; no provider handlers. |
-| litellm-python-bridge | PyO3 cdylib exposing Rust to the litellm Python SDK — marshals Python objects and calls core entrypoints. |
+| litellm-python-interop | Domain-neutral PyO3 foundation for GIL handling and typed Python/Serde conversion. |
+| litellm-python-bridge | PyO3 cdylib exposing LiteLLM Rust APIs to the Python SDK. |
 
-Dependency direction (acyclic): litellm-core ← litellm-ai-gateway ← litellm-python-bridge.
+Dependency direction is acyclic: `litellm-python-bridge` depends on the domain layers and `litellm-python-interop`; the interop foundation depends on no LiteLLM domain crate.
 
 - **Client endpoint:** `wss://<host>/v1/realtime?model=<model>` (WebSocket)
 - **Auth:** `Authorization: Bearer $LITELLM_MASTER_KEY` (fails closed if unset)
diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs
deleted file mode 100644
index 270d5c2d97a..00000000000
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs
+++ /dev/null
@@ -1,48 +0,0 @@
-use std::collections::BTreeMap;
-
-use litellm_core::CoreResult;
-use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig;
-use litellm_core::error::CoreError;
-use litellm_core::providers::bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG;
-use serde_json::{Map, Value};
-
-pub(super) fn audio_transcription_provider_config(
-    provider: &str,
-) -> Option<&'static dyn AudioTranscriptionProviderConfig> {
-    match provider {
-        "bedrock" => Some(&BEDROCK_AUDIO_TRANSCRIPTION_CONFIG),
-        _ => None,
-    }
-}
-
-pub(super) fn string_headers(
-    headers: Option<Map<String, Value>>,
-) -> CoreResult<BTreeMap<String, String>> {
-    headers
-        .unwrap_or_default()
-        .into_iter()
-        .map(|(key, value)| {
-            value
-                .as_str()
-                .map(|value| (key.clone(), value.to_string()))
-                .ok_or_else(|| {
-                    CoreError::InvalidRequest(format!(
-                        "audio transcription extra_headers.{key} must be a string"
-                    ))
-                })
-        })
-        .collect()
-}
-
-pub(super) fn has_header(headers: &BTreeMap<String, String>, name: &str) -> bool {
-    headers.keys().any(|key| key.eq_ignore_ascii_case(name))
-}
-
-pub(super) fn truncate_error_body(body: &str) -> String {
-    let truncated: String = body.chars().take(256).collect();
-    if truncated.chars().count() == body.chars().count() {
-        truncated
-    } else {
-        format!("{truncated}... (truncated)")
-    }
-}
diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs
deleted file mode 100644
index 33c13550f58..00000000000
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-use std::time::SystemTime;
-
-use litellm_core::CoreResult;
-use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth;
-use litellm_core::error::CoreError;
-use litellm_core::providers::bedrock::audio_transcription::aws_auth_config;
-use litellm_core::providers::bedrock::aws_base::{resolve_credentials, sign_bedrock_post};
-use serde_json::Value;
-
-use super::common_utils::truncate_error_body;
-use super::types::ProviderAudioTranscriptionRequest;
-use crate::client::http_client;
-
-pub(crate) async fn execute_audio_transcription_provider_call(
-    request: ProviderAudioTranscriptionRequest,
-) -> CoreResult<Value> {
-    let body = serde_json::to_vec(&request.body).map_err(|error| {
-        CoreError::InvalidRequest(format!("invalid audio request body: {error}"))
-    })?;
-    let mut request_builder = http_client().post(&request.url).body(body.clone());
-    for (key, value) in &request.upstream_headers {
-        request_builder = request_builder.header(key, value);
-    }
-    if let Some(duration) = request.timeout {
-        request_builder = request_builder.timeout(duration);
-    }
-    let response = request_builder
-        .send()
-        .await
-        .map_err(|error| CoreError::Network(error.to_string()))?;
-    let status = response.status();
-    let text = response
-        .text()
-        .await
-        .map_err(|error| CoreError::Network(error.to_string()))?;
-    if !status.is_success() {
-        return Err(CoreError::Http {
-            status: status.as_u16(),
-            body: truncate_error_body(&text),
-        });
-    }
-    let response_json: Value = serde_json::from_str(&text).map_err(|error| {
-        CoreError::InvalidResponse(format!("invalid audio response JSON: {error}"))
-    })?;
-    Ok(request
-        .config
-        .transform_transcription_response(&request.model, response_json)?
-        .into_json())
-}
-
-pub(crate) async fn sign_request(
-    request: &ProviderAudioTranscriptionRequest,
-    optional_params: &serde_json::Map<String, Value>,
-) -> CoreResult<ProviderAudioTranscriptionRequest> {
-    let env_lookup = environment_lookup;
-    let auth = request
-        .config
-        .auth_strategy(&request.model, optional_params, &env_lookup)?;
-    let body = serde_json::to_vec(&request.body).map_err(|error| {
-        CoreError::InvalidRequest(format!("invalid audio request body: {error}"))
-    })?;
-    let mut headers = super::common_utils::string_headers(None)?;
-    headers.insert("Content-Type".to_string(), "application/json".to_string());
-    headers.extend(request.upstream_headers.iter().cloned());
-    match auth {
-        AudioTranscriptionAuth::Bearer => {}
-        AudioTranscriptionAuth::AwsSigV4 { region, .. } => {
-            let credentials =
-                resolve_credentials(aws_auth_config(optional_params, &env_lookup), &env_lookup)
-                    .await?;
-            headers.extend(sign_bedrock_post(
-                &request.url,
-                &body,
-                &headers,
-                &region,
-                &credentials,
-                SystemTime::now(),
-            )?);
-        }
-    }
-    Ok(ProviderAudioTranscriptionRequest {
-        upstream_headers: headers.into_iter().collect(),
-        ..request.clone()
-    })
-}
-
-pub(super) fn environment_lookup(key: &str) -> Option<String> {
-    std::env::var(key).ok()
-}
diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs
index 0c9faeda6e7..dbe2d3a325b 100644
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs
@@ -1,15 +1,14 @@
+use litellm_core::audio_transcription::{
+    AudioTranscriptionRequest as CoreAudioTranscriptionRequest, ProviderAudioTranscriptionRequest,
+    prepare_audio_transcription_provider_call,
+};
+use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
+use litellm_core::error::Error;
+use serde_json::{Map, Value, json};
 use std::future::Future;
 use std::pin::Pin;
 
-use litellm_core::CoreResult;
-use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth;
-use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
-use litellm_core::error::CoreError;
-use serde_json::{Map, Value, json};
-
-use super::common_utils::{audio_transcription_provider_config, has_header, string_headers};
-use super::handler::sign_request;
-use super::types::{PreparedAudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
+use super::types::PreparedAudioTranscriptionRequest;
 use crate::integrations::custom_guardrail::{
     CustomGuardrailRunner, GuardrailContext, GuardrailError, GuardrailRequest,
 };
@@ -26,7 +25,7 @@ pub(crate) struct AudioTranscriptionLifecycleHooks {
     request_metadata: RequestMetadata,
 }
 
-type AudioFuture<'a, T> = Pin<Box<dyn Future<Output = CoreResult<T>> + Send + 'a>>;
+type AudioFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, Error>> + Send + 'a>>;
 type AudioLogFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
 
 impl AudioTranscriptionLifecycleHooks {
@@ -45,7 +44,7 @@ impl AudioTranscriptionLifecycleHooks {
     async fn run_pre_call_guardrails(
         &self,
         request: PreparedAudioTranscriptionRequest,
-    ) -> CoreResult<PreparedAudioTranscriptionRequest> {
+    ) -> Result<PreparedAudioTranscriptionRequest, Error> {
         if self.guardrail_runner.is_empty() {
             return Ok(request);
         }
@@ -63,17 +62,17 @@ impl AudioTranscriptionLifecycleHooks {
             .await
             .map_err(guardrail_error_to_core_error)?;
         let Value::Object(mut data) = guardrail_request.data else {
-            return Err(CoreError::InvalidRequest(
+            return Err(Error::InvalidRequest(
                 "audio transcription pre_call guardrail must return an object".to_string(),
             ));
         };
         let audio = data.remove("audio").ok_or_else(|| {
-            CoreError::InvalidRequest("audio transcription guardrail removed audio".to_string())
+            Error::InvalidRequest("audio transcription guardrail removed audio".to_string())
         })?;
         let optional_params = match data.remove("optional_params") {
             Some(Value::Object(value)) => value,
             Some(_) => {
-                return Err(CoreError::InvalidRequest(
+                return Err(Error::InvalidRequest(
                     "audio transcription optional_params must be an object".to_string(),
                 ));
             }
@@ -89,53 +88,36 @@ impl AudioTranscriptionLifecycleHooks {
     async fn prepare_provider_request(
         &self,
         request: PreparedAudioTranscriptionRequest,
-    ) -> CoreResult<ProviderAudioTranscriptionRequest> {
-        let config = audio_transcription_provider_config(&request.custom_llm_provider)
-            .ok_or_else(|| CoreError::InvalidProvider(request.custom_llm_provider.clone()))?;
-        let env_lookup = super::handler::environment_lookup;
-        let headers = string_headers(request.extra_headers)?;
-        let url = config.complete_url(
-            request.api_base.as_deref(),
-            &request.model,
-            &request.optional_params,
-            &env_lookup,
-        )?;
-        let filtered_params = config.map_transcription_params(&request.optional_params);
-        let body = config.transform_transcription_request(
-            &request.model,
-            request.audio,
-            filtered_params,
-        )?;
-        let auth = config.auth_strategy(&request.model, &request.optional_params, &env_lookup)?;
-        let mut upstream_headers = headers.into_iter().collect::<Vec<_>>();
-        if matches!(auth, AudioTranscriptionAuth::Bearer)
-            && !has_header(
-                &upstream_headers
-                    .iter()
-                    .cloned()
-                    .collect::<std::collections::BTreeMap<_, _>>(),
-                "authorization",
-            )
-            && let Some(api_key) = request.api_key.as_deref()
-        {
-            upstream_headers.push(("Authorization".to_string(), format!("Bearer {api_key}")));
-        }
-        let provider_request = ProviderAudioTranscriptionRequest {
-            model: request.model,
-            config,
-            url,
-            body: body.body,
-            upstream_headers,
-            timeout: request.timeout,
-        };
-        let provider_request = self.run_during_call_guardrails(provider_request).await?;
-        sign_request(&provider_request, &request.optional_params).await
+    ) -> Result<ProviderAudioTranscriptionRequest, Error> {
+        let PreparedAudioTranscriptionRequest {
+            model,
+            custom_llm_provider,
+            audio,
+            api_key,
+            api_base,
+            extra_headers,
+            optional_params,
+            timeout,
+            ..
+        } = request;
+        let provider_request =
+            prepare_audio_transcription_provider_call(CoreAudioTranscriptionRequest {
+                model: &model,
+                audio,
+                api_key: api_key.as_deref(),
+                api_base: api_base.as_deref(),
+                custom_llm_provider: Some(&custom_llm_provider),
+                extra_headers,
+                optional_params,
+                timeout,
+            })?;
+        self.run_during_call_guardrails(provider_request).await
     }
 
     async fn run_during_call_guardrails(
         &self,
         request: ProviderAudioTranscriptionRequest,
-    ) -> CoreResult<ProviderAudioTranscriptionRequest> {
+    ) -> Result<ProviderAudioTranscriptionRequest, Error> {
         if self.guardrail_runner.is_empty() {
             return Ok(request);
         }
@@ -144,23 +126,23 @@ impl AudioTranscriptionLifecycleHooks {
             .run_during_call(
                 &guardrail_context(&self.request_metadata),
                 GuardrailRequest::new(json!({
-                    "model": request.model,
-                    "custom_llm_provider": "bedrock",
-                    "url": request.url,
-                    "body": request.body,
+                    "model": request.model(),
+                    "custom_llm_provider": request.custom_llm_provider(),
+                    "url": request.url(),
+                    "body": request.body(),
                 })),
             )
             .await
             .map_err(guardrail_error_to_core_error)?;
         let Value::Object(mut data) = guardrail_request.data else {
-            return Err(CoreError::InvalidRequest(
+            return Err(Error::InvalidRequest(
                 "audio transcription during_call guardrail must return an object".to_string(),
             ));
         };
         let body = data.remove("body").ok_or_else(|| {
-            CoreError::InvalidRequest("audio transcription guardrail removed body".to_string())
+            Error::InvalidRequest("audio transcription guardrail removed body".to_string())
         })?;
-        Ok(ProviderAudioTranscriptionRequest { body, ..request })
+        Ok(request.with_body(body))
     }
 
     fn logging_payload(
@@ -241,7 +223,7 @@ impl CallLifecycleHooks<PreparedAudioTranscriptionRequest, ProviderAudioTranscri
     fn async_log_failure_event<'a>(
         &'a self,
         context: &'a CallLifecycleContext,
-        error: &'a CoreError,
+        error: &'a Error,
         timing: &'a CallLifecycleTiming,
     ) -> Self::FailureFuture<'a> {
         Box::pin(async move {
@@ -281,22 +263,22 @@ fn guardrail_context(metadata: &RequestMetadata) -> GuardrailContext {
     }
 }
 
-fn guardrail_error_to_core_error(error: GuardrailError) -> CoreError {
-    CoreError::InvalidRequest(format!("{}: {}", error.kind, error.message))
+fn guardrail_error_to_core_error(error: GuardrailError) -> Error {
+    Error::InvalidRequest(format!("{}: {}", error.kind, error.message))
 }
 
-fn core_error_kind(error: &CoreError) -> &'static str {
+fn core_error_kind(error: &Error) -> &'static str {
     match error {
-        CoreError::Auth(_) => "AuthError",
-        CoreError::InvalidProvider(_) => "InvalidProvider",
-        CoreError::InvalidRequest(_) => "InvalidRequest",
-        CoreError::InvalidType { .. } => "InvalidType",
-        CoreError::MissingField(_) => "MissingField",
-        CoreError::Http { .. } => "HttpError",
-        CoreError::InvalidResponse(_) => "InvalidResponse",
-        CoreError::Network(_) => "NetworkError",
-        CoreError::Connect(_) => "ConnectError",
-        CoreError::Routing(_) => "RoutingError",
-        CoreError::Unsupported(_) => "UnsupportedRequest",
+        Error::Auth(_) => "AuthError",
+        Error::InvalidProvider(_) => "InvalidProvider",
+        Error::InvalidRequest(_) => "InvalidRequest",
+        Error::InvalidType { .. } => "InvalidType",
+        Error::MissingField(_) => "MissingField",
+        Error::Http { .. } => "HttpError",
+        Error::InvalidResponse(_) => "InvalidResponse",
+        Error::Network(_) => "NetworkError",
+        Error::Connect(_) => "ConnectError",
+        Error::Routing(_) => "RoutingError",
+        Error::Unsupported(_) => "UnsupportedRequest",
     }
 }
diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs
index 5d33d912c40..03d621b8414 100644
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs
@@ -1,19 +1,17 @@
-use litellm_core::CoreResult;
+use litellm_core::Error;
+use litellm_core::audio_transcription::execute_audio_transcription_provider_call;
 use litellm_core::call_lifecycle::CallLifecycle;
 use serde_json::Value;
 
-mod common_utils;
-mod handler;
 mod hooks;
 mod prepare;
 mod types;
 
 pub use types::AudioTranscriptionRequest;
 
-use handler::execute_audio_transcription_provider_call;
 use prepare::{PreparedAudioTranscriptionCall, prepare_audio_transcription_call};
 
-pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> CoreResult<Value> {
+pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> Result<Value, Error> {
     let PreparedAudioTranscriptionCall { request, hooks } =
         prepare_audio_transcription_call(request);
     CallLifecycle::default()
diff --git a/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs b/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs
index 9697aa98b0a..b470638264e 100644
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs
@@ -1,7 +1,6 @@
 use std::sync::Arc;
 use std::time::Duration;
 
-use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig;
 use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleRequest};
 use serde_json::{Map, Value};
 
@@ -46,13 +45,3 @@ impl CallLifecycleRequest for PreparedAudioTranscriptionRequest {
         )
     }
 }
-
-#[derive(Clone)]
-pub(crate) struct ProviderAudioTranscriptionRequest {
-    pub(crate) model: String,
-    pub(crate) config: &'static dyn AudioTranscriptionProviderConfig,
-    pub(crate) url: String,
-    pub(crate) body: Value,
-    pub(crate) upstream_headers: Vec<(String, String)>,
-    pub(crate) timeout: Option<Duration>,
-}
diff --git a/litellm-rust/crates/ai-gateway/src/io/realtime.rs b/litellm-rust/crates/ai-gateway/src/io/realtime.rs
index 845e7bf9527..662f7328982 100644
--- a/litellm-rust/crates/ai-gateway/src/io/realtime.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/realtime.rs
@@ -15,8 +15,7 @@ use std::time::Duration;
 
 use futures_util::stream::{SplitSink, SplitStream};
 use futures_util::{Sink, SinkExt, Stream, StreamExt};
-use litellm_core::CoreResult;
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::realtime::transformation::RealtimeProviderConfig;
 use litellm_core::realtime::types::RealtimeEvent;
 use tokio::net::TcpStream;
@@ -48,7 +47,7 @@ pub(crate) type UpstreamRx = SplitStream<UpstreamWs>;
 /// Resolve the OpenAI API key from the explicit param or the environment.
 ///
 /// Blank/whitespace values are treated as absent (guard at resolution time).
-pub(crate) fn resolve_api_key(api_key: Option<&str>) -> CoreResult<String> {
+pub(crate) fn resolve_api_key(api_key: Option<&str>) -> Result<String, Error> {
     api_key
         .map(str::trim)
         .filter(|key| !key.is_empty())
@@ -58,7 +57,7 @@ pub(crate) fn resolve_api_key(api_key: Option<&str>) -> CoreResult<String> {
                 .ok()
                 .filter(|key| !key.trim().is_empty())
         })
-        .ok_or_else(|| CoreError::Auth(MISSING_KEY_MESSAGE.to_string()))
+        .ok_or_else(|| Error::Auth(MISSING_KEY_MESSAGE.to_string()))
 }
 
 /// Open the upstream WebSocket to OpenAI for `(model, api_key, api_base)`.
@@ -70,24 +69,24 @@ pub(crate) async fn dial_upstream(
     model: &str,
     api_key: &str,
     api_base: Option<&str>,
-) -> CoreResult<UpstreamWs> {
+) -> Result<UpstreamWs, Error> {
     let url = OPENAI_REALTIME_CONFIG.complete_url(api_base, model);
 
     let mut request = url
         .as_str()
         .into_client_request()
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
     // GA realtime: only Authorization. The legacy OpenAI-Beta header triggers
     // beta_api_shape_disabled, so we do not send it.
     request.headers_mut().insert(
         AUTHORIZATION,
         HeaderValue::from_str(&format!("Bearer {api_key}"))
-            .map_err(|err| CoreError::Auth(err.to_string()))?,
+            .map_err(|err| Error::Auth(err.to_string()))?,
     );
 
     let (upstream, _response) = connect_async(request)
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
     Ok(upstream)
 }
 
@@ -96,22 +95,22 @@ pub(crate) async fn dial_upstream(
 /// Used by the pool to pre-read OpenAI's unprompted `session.created`. Returns an
 /// error on a non-text frame, a closed socket, or undecodable JSON so the pool can
 /// discard a misbehaving socket rather than warm it.
-pub(crate) async fn read_event(upstream_rx: &mut UpstreamRx) -> CoreResult<RealtimeEvent> {
+pub(crate) async fn read_event(upstream_rx: &mut UpstreamRx) -> Result<RealtimeEvent, Error> {
     loop {
         let message = upstream_rx
             .next()
             .await
-            .ok_or_else(|| CoreError::Network("upstream closed before first event".to_string()))?
-            .map_err(|err| CoreError::Network(err.to_string()))?;
+            .ok_or_else(|| Error::Network("upstream closed before first event".to_string()))?
+            .map_err(|err| Error::Network(err.to_string()))?;
         match message {
             Message::Text(text) => {
                 return serde_json::from_str(&text)
-                    .map_err(|err| CoreError::InvalidResponse(err.to_string()));
+                    .map_err(|err| Error::InvalidResponse(err.to_string()));
             }
             // Ignore protocol frames (ping/pong) while waiting for the first event.
             Message::Ping(_) | Message::Pong(_) => continue,
             Message::Close(_) => {
-                return Err(CoreError::Network(
+                return Err(Error::Network(
                     "upstream closed before first event".to_string(),
                 ));
             }
@@ -139,7 +138,7 @@ pub(crate) async fn splice<In, Out>(
     mut observe: impl FnMut(&RealtimeEvent) + Send,
     mut client_in: In,
     mut client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = RealtimeEvent> + Unpin + Send,
     Out: Sink<RealtimeEvent> + Unpin + Send,
@@ -154,7 +153,7 @@ where
             client_out
                 .send(outbound)
                 .await
-                .map_err(|err| CoreError::Network(err.to_string()))?;
+                .map_err(|err| Error::Network(err.to_string()))?;
         }
     }
 
@@ -175,26 +174,26 @@ where
                 // inflate its own spend log. Logging observes upstream events only.
                 for outbound in config.transform_realtime_request(&event, model)?.events {
                     let payload = serde_json::to_string(&outbound)
-                        .map_err(|err| CoreError::InvalidResponse(err.to_string()))?;
+                        .map_err(|err| Error::InvalidResponse(err.to_string()))?;
                     upstream_tx
                         .send(Message::Text(payload))
                         .await
-                        .map_err(|err| CoreError::Network(err.to_string()))?;
+                        .map_err(|err| Error::Network(err.to_string()))?;
                 }
             }
             // upstream -> client
             upstream_message = upstream_rx.next() => {
                 let Some(message) = upstream_message else { break }; // upstream closed
-                match message.map_err(|err| CoreError::Network(err.to_string()))? {
+                match message.map_err(|err| Error::Network(err.to_string()))? {
                     Message::Text(text) => {
                         let event: RealtimeEvent = serde_json::from_str(&text)
-                            .map_err(|err| CoreError::InvalidResponse(err.to_string()))?;
+                            .map_err(|err| Error::InvalidResponse(err.to_string()))?;
                         observe(&event);
                         for outbound in config.transform_realtime_response(&event, model)?.events {
                             client_out
                                 .send(outbound)
                                 .await
-                                .map_err(|err| CoreError::Network(err.to_string()))?;
+                                .map_err(|err| Error::Network(err.to_string()))?;
                         }
                     }
                     Message::Close(_) => break,
@@ -225,7 +224,7 @@ pub async fn realtime<In, Out>(
     observe: impl FnMut(&RealtimeEvent) + Send,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = RealtimeEvent> + Unpin + Send,
     Out: Sink<RealtimeEvent> + Unpin + Send,
@@ -258,7 +257,7 @@ pub async fn realtime_warm<In, Out>(
     observe: impl FnMut(&RealtimeEvent) + Send,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = RealtimeEvent> + Unpin + Send,
     Out: Sink<RealtimeEvent> + Unpin + Send,
diff --git a/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs b/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs
index 4a1a3cd1166..49e9c459a88 100644
--- a/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs
@@ -28,7 +28,7 @@ use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
 use futures_util::StreamExt;
-use litellm_core::CoreResult;
+use litellm_core::Error;
 use litellm_core::realtime::types::RealtimeEvent;
 
 use crate::io::realtime::{
@@ -438,7 +438,7 @@ impl RealtimePool {
 ///
 /// `key.api_key` is already resolved (non-blank). The first frame OpenAI sends
 /// unprompted is `session.created`; we buffer exactly that and read nothing more.
-async fn warm_one(key: &UpstreamKey) -> CoreResult<WarmConnection> {
+async fn warm_one(key: &UpstreamKey) -> Result<WarmConnection, Error> {
     let upstream: UpstreamWs =
         dial_upstream(&key.model, &key.api_key, key.api_base.as_deref()).await?;
     let (tx, mut rx) = upstream.split();
diff --git a/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs b/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs
index 9b51019f4bc..0b01747b1a5 100644
--- a/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs
@@ -4,10 +4,10 @@ use std::time::Duration;
 
 use futures_util::stream::{SplitSink, SplitStream};
 use futures_util::{Sink, SinkExt, Stream, StreamExt};
+use litellm_core::Error;
 use litellm_core::providers::openai::responses::transformation::OPENAI_RESPONSES_WS_CONFIG;
 use litellm_core::responses::types::ResponsesWsEvent;
 use litellm_core::responses::websocket::ResponsesWebSocketProviderConfig;
-use litellm_core::{CoreError, CoreResult};
 use tokio::net::TcpStream;
 use tokio::sync::Mutex;
 use tokio_tungstenite::tungstenite::Message;
@@ -37,51 +37,49 @@ impl ResponsesWebSocketConnection {
         url: &str,
         headers: &HashMap<String, String>,
         timeout: Option<Duration>,
-    ) -> CoreResult<Self> {
+    ) -> Result<Self, Error> {
         let mut request = url
             .into_client_request()
-            .map_err(|error| CoreError::Network(error.to_string()))?;
+            .map_err(|error| Error::Network(error.to_string()))?;
         for (name, value) in headers {
             let header_name = name
                 .parse::<HeaderName>()
-                .map_err(|error| CoreError::InvalidRequest(error.to_string()))?;
+                .map_err(|error| Error::InvalidRequest(error.to_string()))?;
             let header_value = HeaderValue::from_str(value)
-                .map_err(|error| CoreError::InvalidRequest(error.to_string()))?;
+                .map_err(|error| Error::InvalidRequest(error.to_string()))?;
             request.headers_mut().insert(header_name, header_value);
         }
         let connect = connect_async(request);
         let result = match timeout {
             Some(timeout) => tokio::time::timeout(timeout, connect).await.map_err(|_| {
-                CoreError::Network("Responses WebSocket connection timed out".to_string())
+                Error::Network("Responses WebSocket connection timed out".to_string())
             })?,
             None => connect.await,
         };
         let (socket, _) = result.map_err(|error| match error {
-            tokio_tungstenite::tungstenite::Error::Http(response) => CoreError::Http {
+            tokio_tungstenite::tungstenite::Error::Http(response) => Error::Http {
                 status: response.status().as_u16(),
                 body: String::new(),
             },
-            other => CoreError::Network(other.to_string()),
+            other => Error::Network(other.to_string()),
         })?;
         Ok(Self {
             socket: Arc::new(Mutex::new(Some(socket))),
         })
     }
 
-    pub async fn send_text(&self, text: String) -> CoreResult<()> {
+    pub async fn send_text(&self, text: String) -> Result<(), Error> {
         let mut socket = self.socket.lock().await;
         let Some(socket) = socket.as_mut() else {
-            return Err(CoreError::Network(
-                "Responses WebSocket is closed".to_string(),
-            ));
+            return Err(Error::Network("Responses WebSocket is closed".to_string()));
         };
         socket
             .send(Message::Text(text))
             .await
-            .map_err(|error| CoreError::Network(error.to_string()))
+            .map_err(|error| Error::Network(error.to_string()))
     }
 
-    pub async fn recv_text(&self) -> CoreResult<Option<String>> {
+    pub async fn recv_text(&self) -> Result<Option<String>, Error> {
         let mut socket_guard = self.socket.lock().await;
         let Some(socket) = socket_guard.as_mut() else {
             return Ok(None);
@@ -90,27 +88,27 @@ impl ResponsesWebSocketConnection {
             Some(Ok(Message::Text(text))) => Ok(Some(text)),
             Some(Ok(Message::Binary(bytes))) => String::from_utf8(bytes.to_vec())
                 .map(Some)
-                .map_err(|error| CoreError::InvalidResponse(error.to_string())),
+                .map_err(|error| Error::InvalidResponse(error.to_string())),
             Some(Ok(Message::Close(_))) | None => Ok(None),
             Some(Ok(_)) => Ok(None),
-            Some(Err(error)) => Err(CoreError::Network(error.to_string())),
+            Some(Err(error)) => Err(Error::Network(error.to_string())),
         }
     }
 
-    pub async fn close(&self) -> CoreResult<()> {
+    pub async fn close(&self) -> Result<(), Error> {
         let mut socket = self.socket.lock().await;
         if let Some(socket) = socket.as_mut() {
             socket
                 .close(None)
                 .await
-                .map_err(|error| CoreError::Network(error.to_string()))?;
+                .map_err(|error| Error::Network(error.to_string()))?;
         }
         *socket = None;
         Ok(())
     }
 }
 
-pub(crate) fn resolve_api_key(api_key: Option<&str>) -> CoreResult<String> {
+pub(crate) fn resolve_api_key(api_key: Option<&str>) -> Result<String, Error> {
     api_key
         .map(str::trim)
         .filter(|value| !value.is_empty())
@@ -120,38 +118,38 @@ pub(crate) fn resolve_api_key(api_key: Option<&str>) -> CoreResult<String> {
                 .ok()
                 .filter(|value| !value.trim().is_empty())
         })
-        .ok_or_else(|| CoreError::Auth(MISSING_KEY_MESSAGE.to_string()))
+        .ok_or_else(|| Error::Auth(MISSING_KEY_MESSAGE.to_string()))
 }
 
 async fn dial_upstream(
     model: &str,
     api_key: &str,
     api_base: Option<&str>,
-) -> CoreResult<ResponsesUpstreamWs> {
+) -> Result<ResponsesUpstreamWs, Error> {
     let url = OPENAI_RESPONSES_WS_CONFIG.complete_websocket_url(api_base, model);
     let mut request = url
         .as_str()
         .into_client_request()
-        .map_err(|error| CoreError::Network(error.to_string()))?;
+        .map_err(|error| Error::Network(error.to_string()))?;
     request.headers_mut().insert(
         AUTHORIZATION,
         HeaderValue::from_str(&format!("Bearer {api_key}"))
-            .map_err(|error| CoreError::Auth(error.to_string()))?,
+            .map_err(|error| Error::Auth(error.to_string()))?,
     );
     let result = tokio::time::timeout(
         Duration::from_secs(DEFAULT_RESPONSES_WS_CONNECT_TIMEOUT_SECS),
         connect_async(request),
     )
     .await
-    .map_err(|_| CoreError::Network("Responses WebSocket connection timed out".to_string()))?;
+    .map_err(|_| Error::Network("Responses WebSocket connection timed out".to_string()))?;
     result
         .map(|(socket, _)| socket)
         .map_err(|error| match error {
-            tokio_tungstenite::tungstenite::Error::Http(response) => CoreError::Http {
+            tokio_tungstenite::tungstenite::Error::Http(response) => Error::Http {
                 status: response.status().as_u16(),
                 body: String::new(),
             },
-            other => CoreError::Network(other.to_string()),
+            other => Error::Network(other.to_string()),
         })
 }
 
@@ -166,7 +164,7 @@ impl ResponsesWebSocketStreaming {
         observe: impl FnMut(&ResponsesWsEvent) + Send,
         client_in: In,
         client_out: Out,
-    ) -> CoreResult<()>
+    ) -> Result<(), Error>
     where
         In: Stream<Item = ResponsesWsEvent> + Unpin + Send,
         Out: Sink<ResponsesWsEvent> + Unpin + Send,
@@ -193,7 +191,7 @@ pub(crate) async fn splice<In, Out>(
     mut observe: impl FnMut(&ResponsesWsEvent) + Send,
     mut client_in: In,
     mut client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = ResponsesWsEvent> + Unpin + Send,
     Out: Sink<ResponsesWsEvent> + Unpin + Send,
@@ -210,18 +208,18 @@ where
                     .events
                 {
                     let payload = serde_json::to_string(&outbound)
-                        .map_err(|error| CoreError::InvalidResponse(error.to_string()))?;
+                        .map_err(|error| Error::InvalidResponse(error.to_string()))?;
                     upstream_tx.send(Message::Text(payload))
                         .await
-                        .map_err(|error| CoreError::Network(error.to_string()))?;
+                        .map_err(|error| Error::Network(error.to_string()))?;
                 }
             }
             message = upstream_rx.next() => {
                 let Some(message) = message else { break };
-                match message.map_err(|error| CoreError::Network(error.to_string()))? {
+                match message.map_err(|error| Error::Network(error.to_string()))? {
                     Message::Text(text) => {
                         let event = serde_json::from_str::<ResponsesWsEvent>(&text)
-                            .map_err(|error| CoreError::InvalidResponse(error.to_string()))?;
+                            .map_err(|error| Error::InvalidResponse(error.to_string()))?;
                         observe(&event);
                         for outbound in OPENAI_RESPONSES_WS_CONFIG
                             .transform_ws_response(&event, model)?
@@ -229,7 +227,7 @@ where
                         {
                             client_out.send(outbound)
                                 .await
-                                .map_err(|error| CoreError::Network(error.to_string()))?;
+                                .map_err(|error| Error::Network(error.to_string()))?;
                         }
                     }
                     Message::Close(_) => break,
@@ -252,7 +250,7 @@ pub async fn async_responses_websocket<In, Out>(
     mut observe: impl FnMut(&ResponsesWsEvent) + Send,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = ResponsesWsEvent> + Unpin + Send,
     Out: Sink<ResponsesWsEvent> + Unpin + Send,
@@ -267,11 +265,11 @@ where
             .events
         {
             let payload = serde_json::to_string(&outbound)
-                .map_err(|error| CoreError::InvalidResponse(error.to_string()))?;
+                .map_err(|error| Error::InvalidResponse(error.to_string()))?;
             upstream_tx
                 .send(Message::Text(payload))
                 .await
-                .map_err(|error| CoreError::Network(error.to_string()))?;
+                .map_err(|error| Error::Network(error.to_string()))?;
         }
     }
     ResponsesWebSocketStreaming::bidirectional_forward(
@@ -296,7 +294,7 @@ pub async fn responses_ws<In, Out>(
     observe: impl FnMut(&ResponsesWsEvent) + Send,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = ResponsesWsEvent> + Unpin + Send,
     Out: Sink<ResponsesWsEvent> + Unpin + Send,
@@ -514,7 +512,7 @@ mod tests {
         )
         .await
         .expect_err("status error");
-        assert!(matches!(error, CoreError::Http { status: 401, .. }));
+        assert!(matches!(error, Error::Http { status: 401, .. }));
         server.await.expect("server task");
     }
 
@@ -543,7 +541,7 @@ mod tests {
         )
         .await
         .expect_err("status error");
-        assert!(matches!(error, CoreError::Http { status: 500, .. }));
+        assert!(matches!(error, Error::Http { status: 500, .. }));
         server.await.expect("server task");
     }
 }
diff --git a/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs b/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs
index 9bc2818b6e7..e0ce165dc93 100644
--- a/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs
@@ -3,8 +3,7 @@ use std::time::{Duration, Instant};
 
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
-use litellm_core::CoreResult;
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::ocr::transformation::OcrProviderConfig;
 use reqwest::Url;
 use serde_json::{Map, Value};
@@ -56,7 +55,7 @@ fn is_azure_document_intelligence_model(model: &str) -> bool {
 
 pub(super) fn string_headers(
     extra_headers: Option<Map<String, Value>>,
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     extra_headers
         .unwrap_or_default()
         .into_iter()
@@ -65,7 +64,7 @@ pub(super) fn string_headers(
                 .as_str()
                 .map(|value| (key.clone(), value.to_string()))
                 .ok_or_else(|| {
-                    CoreError::InvalidRequest(format!(
+                    Error::InvalidRequest(format!(
                         "OCR extra_headers.{key} must be a string, got {}",
                         litellm_core::error::json_type_name(&value)
                     ))
@@ -80,7 +79,7 @@ pub(super) fn has_header(headers: &[(String, String)], name: &str) -> bool {
         .any(|(key, _)| key.eq_ignore_ascii_case(name))
 }
 
-fn document_url_field(document: &Value) -> CoreResult<Option<(&str, &str)>> {
+fn document_url_field(document: &Value) -> Result<Option<(&str, &str)>, Error> {
     let Some(object) = document.as_object() else {
         return Ok(None);
     };
@@ -138,13 +137,13 @@ fn is_blocked_ip(ip: IpAddr) -> bool {
     }
 }
 
-fn blocked_url_error(url: &Url) -> CoreError {
-    CoreError::InvalidRequest(format!(
+fn blocked_url_error(url: &Url) -> Error {
+    Error::InvalidRequest(format!(
         "OCR document URL rejected by SSRF protection: {url}"
     ))
 }
 
-async fn validate_safe_fetch_url(url: &Url) -> CoreResult<()> {
+async fn validate_safe_fetch_url(url: &Url) -> Result<(), Error> {
     if !matches!(url.scheme(), "http" | "https") {
         return Err(blocked_url_error(url));
     }
@@ -162,7 +161,7 @@ async fn validate_safe_fetch_url(url: &Url) -> CoreResult<()> {
         .ok_or_else(|| blocked_url_error(url))?;
     let addresses = tokio::net::lookup_host((host, port))
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
     let mut saw_address = false;
     for address in addresses {
         saw_address = true;
@@ -176,25 +175,25 @@ async fn validate_safe_fetch_url(url: &Url) -> CoreResult<()> {
     Ok(())
 }
 
-fn redirect_location(response: &reqwest::Response, url: &Url) -> CoreResult<Url> {
+fn redirect_location(response: &reqwest::Response, url: &Url) -> Result<Url, Error> {
     let location = response
         .headers()
         .get(reqwest::header::LOCATION)
         .and_then(|value| value.to_str().ok())
         .ok_or_else(|| {
-            CoreError::InvalidResponse("OCR document redirect missing Location header".to_string())
+            Error::InvalidResponse("OCR document redirect missing Location header".to_string())
         })?;
     url.join(location)
-        .map_err(|err| CoreError::InvalidResponse(format!("invalid OCR document redirect: {err}")))
+        .map_err(|err| Error::InvalidResponse(format!("invalid OCR document redirect: {err}")))
 }
 
-async fn safe_get_document_url(url: &str) -> CoreResult<(Url, reqwest::Response)> {
+async fn safe_get_document_url(url: &str) -> Result<(Url, reqwest::Response), Error> {
     let client = reqwest::Client::builder()
         .redirect(reqwest::redirect::Policy::none())
         .build()
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
     let mut current_url = Url::parse(url)
-        .map_err(|err| CoreError::InvalidRequest(format!("invalid OCR document URL: {err}")))?;
+        .map_err(|err| Error::InvalidRequest(format!("invalid OCR document URL: {err}")))?;
 
     for _ in 0..MAX_SAFE_FETCH_REDIRECTS {
         validate_safe_fetch_url(&current_url).await?;
@@ -202,28 +201,28 @@ async fn safe_get_document_url(url: &str) -> CoreResult<(Url, reqwest::Response)
             .get(current_url.clone())
             .send()
             .await
-            .map_err(|err| CoreError::Network(err.to_string()))?;
+            .map_err(|err| Error::Network(err.to_string()))?;
         if !response.status().is_redirection() {
             return Ok((current_url, response));
         }
         current_url = redirect_location(&response, &current_url)?;
     }
 
-    Err(CoreError::InvalidRequest(
+    Err(Error::InvalidRequest(
         "Too many redirects while fetching OCR document URL".to_string(),
     ))
 }
 
-fn enforce_download_size(content_length: u64, max_bytes: u64, url: &Url) -> CoreResult<()> {
+fn enforce_download_size(content_length: u64, max_bytes: u64, url: &Url) -> Result<(), Error> {
     if max_bytes == 0 {
-        return Err(CoreError::InvalidRequest(format!(
+        return Err(Error::InvalidRequest(format!(
             "OCR document URL download is disabled (MAX_IMAGE_URL_DOWNLOAD_SIZE_MB=0). url={url}"
         )));
     }
     if content_length > max_bytes {
         let size_mb = content_length as f64 / (1024.0 * 1024.0);
         let max_size_mb = max_bytes as f64 / (1024.0 * 1024.0);
-        return Err(CoreError::InvalidRequest(format!(
+        return Err(Error::InvalidRequest(format!(
             "OCR document size ({size_mb:.2}MB) exceeds maximum allowed size ({max_size_mb:.2}MB). url={url}"
         )));
     }
@@ -233,7 +232,7 @@ fn enforce_download_size(content_length: u64, max_bytes: u64, url: &Url) -> Core
 async fn read_response_with_limit(
     mut response: reqwest::Response,
     url: &Url,
-) -> CoreResult<Vec<u8>> {
+) -> Result<Vec<u8>, Error> {
     let max_bytes = max_document_download_bytes();
     if let Some(content_length) = response.content_length() {
         enforce_download_size(content_length, max_bytes, url)?;
@@ -246,7 +245,7 @@ async fn read_response_with_limit(
     while let Some(chunk) = response
         .chunk()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?
+        .map_err(|err| Error::Network(err.to_string()))?
     {
         bytes_downloaded += chunk.len() as u64;
         enforce_download_size(bytes_downloaded, max_bytes, url)?;
@@ -255,7 +254,7 @@ async fn read_response_with_limit(
     Ok(bytes)
 }
 
-pub(super) async fn convert_document_url_to_data_uri(document: Value) -> CoreResult<Value> {
+pub(super) async fn convert_document_url_to_data_uri(document: Value) -> Result<Value, Error> {
     let Some((field, url)) = document_url_field(&document)? else {
         return Ok(document);
     };
@@ -267,7 +266,7 @@ pub(super) async fn convert_document_url_to_data_uri(document: Value) -> CoreRes
     let status = response.status();
     if !status.is_success() {
         let body = response.text().await.unwrap_or_default();
-        return Err(CoreError::Http {
+        return Err(Error::Http {
             status: status.as_u16(),
             body: truncate_error_body(&body),
         });
@@ -290,7 +289,7 @@ pub(super) async fn convert_document_url_to_data_uri(document: Value) -> CoreRes
     let mut transformed = document
         .as_object()
         .cloned()
-        .ok_or_else(|| CoreError::InvalidRequest("OCR document must be an object".to_string()))?;
+        .ok_or_else(|| Error::InvalidRequest("OCR document must be an object".to_string()))?;
     transformed.insert(field.to_string(), Value::String(data_uri));
     Ok(Value::Object(transformed))
 }
@@ -316,11 +315,11 @@ fn retry_after_secs(response: &reqwest::Response) -> u64 {
         .unwrap_or(2)
 }
 
-fn operation_status(response_json: &Value) -> CoreResult<&str> {
+fn operation_status(response_json: &Value) -> Result<&str, Error> {
     let status = response_json
         .get("status")
         .and_then(Value::as_str)
-        .ok_or(CoreError::MissingField("status"))?;
+        .ok_or(Error::MissingField("status"))?;
     match status {
         "succeeded" => Ok("succeeded"),
         "running" | "notStarted" => Ok("running"),
@@ -330,11 +329,11 @@ fn operation_status(response_json: &Value) -> CoreResult<&str> {
                 .and_then(|error| error.get("message"))
                 .and_then(Value::as_str)
                 .unwrap_or("Unknown error");
-            Err(CoreError::InvalidResponse(format!(
+            Err(Error::InvalidResponse(format!(
                 "Azure Document Intelligence analysis failed: {message}"
             )))
         }
-        other => Err(CoreError::InvalidResponse(format!(
+        other => Err(Error::InvalidResponse(format!(
             "Unknown operation status: {other}"
         ))),
     }
@@ -345,9 +344,9 @@ pub(super) async fn poll_document_intelligence(
     original_url: &str,
     headers: &[(String, String)],
     timeout: Option<Duration>,
-) -> CoreResult<Value> {
+) -> Result<Value, Error> {
     if !same_origin(operation_url, original_url) {
-        return Err(CoreError::InvalidResponse(
+        return Err(Error::InvalidResponse(
             "Azure Document Intelligence: rejected cross-origin polling URL".to_string(),
         ));
     }
@@ -358,7 +357,7 @@ pub(super) async fn poll_document_intelligence(
     ));
     loop {
         if start.elapsed() > timeout {
-            return Err(CoreError::Network(format!(
+            return Err(Error::Network(format!(
                 "Azure Document Intelligence operation polling timed out after {} seconds",
                 timeout.as_secs()
             )));
@@ -373,21 +372,21 @@ pub(super) async fn poll_document_intelligence(
         let response = request_builder
             .send()
             .await
-            .map_err(|err| CoreError::Network(err.to_string()))?;
+            .map_err(|err| Error::Network(err.to_string()))?;
         let retry_after = retry_after_secs(&response);
         let status = response.status();
         let text = response
             .text()
             .await
-            .map_err(|err| CoreError::Network(err.to_string()))?;
+            .map_err(|err| Error::Network(err.to_string()))?;
         if !status.is_success() {
-            return Err(CoreError::Http {
+            return Err(Error::Http {
                 status: status.as_u16(),
                 body: truncate_error_body(&text),
             });
         }
         let response_json: Value = serde_json::from_str(&text).map_err(|err| {
-            CoreError::InvalidResponse(format!("invalid Azure DI poll response JSON: {err}"))
+            Error::InvalidResponse(format!("invalid Azure DI poll response JSON: {err}"))
         })?;
         if operation_status(&response_json)? == "succeeded" {
             return Ok(response_json);
@@ -426,7 +425,7 @@ mod tests {
 
         assert!(matches!(
             error,
-            CoreError::InvalidRequest(message)
+            Error::InvalidRequest(message)
                 if message.contains("SSRF protection")
         ));
     }
diff --git a/litellm-rust/crates/ai-gateway/src/ocr/handler.rs b/litellm-rust/crates/ai-gateway/src/ocr/handler.rs
index 1de34eb400e..815bc84363a 100644
--- a/litellm-rust/crates/ai-gateway/src/ocr/handler.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/handler.rs
@@ -1,5 +1,4 @@
-use litellm_core::CoreResult;
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::ocr::transformation::OcrResponseHandling;
 use serde_json::Value;
 
@@ -7,7 +6,7 @@ use super::common_utils::{poll_document_intelligence, truncate_error_body};
 use super::types::ProviderOcrRequest;
 use crate::client::http_client;
 
-pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> CoreResult<Value> {
+pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> Result<Value, Error> {
     let mut request_builder = http_client().post(&request.url).json(&request.body);
     for (key, value) in &request.upstream_headers {
         request_builder = request_builder.header(key, value);
@@ -19,7 +18,7 @@ pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> Co
     let response = request_builder
         .send()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
 
     let status = response.status();
     if request.config.response_handling() == OcrResponseHandling::AzureDocumentIntelligencePoll
@@ -31,7 +30,7 @@ pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> Co
             .and_then(|value| value.to_str().ok())
             .map(str::to_string)
             .ok_or_else(|| {
-                CoreError::InvalidResponse(
+                Error::InvalidResponse(
                     "Azure Document Intelligence returned 202 but no Operation-Location header found"
                         .to_string(),
                 )
@@ -52,17 +51,17 @@ pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> Co
     let text = response
         .text()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
 
     if !status.is_success() {
-        return Err(CoreError::Http {
+        return Err(Error::Http {
             status: status.as_u16(),
             body: truncate_error_body(&text),
         });
     }
 
     let response_json: Value = serde_json::from_str(&text)
-        .map_err(|err| CoreError::InvalidResponse(format!("invalid OCR response JSON: {err}")))?;
+        .map_err(|err| Error::InvalidResponse(format!("invalid OCR response JSON: {err}")))?;
 
     Ok(request
         .config
diff --git a/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs b/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs
index 95df566dc53..401e26d3b29 100644
--- a/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs
@@ -1,11 +1,9 @@
-use std::future::Future;
-use std::pin::Pin;
-
-use litellm_core::CoreResult;
 use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::ocr::transformation::OcrAuthStrategy;
 use serde_json::{Map, Value, json};
+use std::future::Future;
+use std::pin::Pin;
 
 use super::common_utils::{
     convert_document_url_to_data_uri, has_header, ocr_provider_config, string_headers,
@@ -27,7 +25,7 @@ pub(crate) struct OcrLifecycleHooks {
     request_metadata: RequestMetadata,
 }
 
-type OcrFuture<'a, T> = Pin<Box<dyn Future<Output = CoreResult<T>> + Send + 'a>>;
+type OcrFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, Error>> + Send + 'a>>;
 type OcrLogFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
 
 impl OcrLifecycleHooks {
@@ -46,7 +44,7 @@ impl OcrLifecycleHooks {
     async fn run_pre_call_guardrails(
         &self,
         request: PreparedOcrRequest,
-    ) -> CoreResult<PreparedOcrRequest> {
+    ) -> Result<PreparedOcrRequest, Error> {
         if self.guardrail_runner.is_empty() {
             return Ok(request);
         }
@@ -74,9 +72,9 @@ impl OcrLifecycleHooks {
     async fn prepare_provider_request(
         &self,
         request: PreparedOcrRequest,
-    ) -> CoreResult<ProviderOcrRequest> {
+    ) -> Result<ProviderOcrRequest, Error> {
         let config = ocr_provider_config(&request.custom_llm_provider, &request.model)
-            .ok_or_else(|| CoreError::InvalidProvider(request.custom_llm_provider.clone()))?;
+            .ok_or_else(|| Error::InvalidProvider(request.custom_llm_provider.clone()))?;
         let env_lookup = |key: &str| std::env::var(key).ok();
         let headers = string_headers(request.extra_headers)?;
         let auth_strategy = config.auth_strategy();
@@ -120,7 +118,7 @@ impl OcrLifecycleHooks {
         custom_llm_provider: &str,
         url: &str,
         body: Value,
-    ) -> CoreResult<Value> {
+    ) -> Result<Value, Error> {
         if self.guardrail_runner.is_empty() {
             return Ok(body);
         }
@@ -217,7 +215,7 @@ impl CallLifecycleHooks<PreparedOcrRequest, ProviderOcrRequest, Value> for OcrLi
     fn async_log_failure_event<'a>(
         &'a self,
         context: &'a CallLifecycleContext,
-        error: &'a CoreError,
+        error: &'a Error,
         timing: &'a CallLifecycleTiming,
     ) -> Self::FailureFuture<'a> {
         Box::pin(async move {
@@ -278,19 +276,19 @@ fn guardrail_context(metadata: &RequestMetadata) -> GuardrailContext {
 
 fn parse_ocr_pre_call_guardrail_request(
     request: GuardrailRequest,
-) -> CoreResult<(Value, Map<String, Value>)> {
+) -> Result<(Value, Map<String, Value>), Error> {
     let Value::Object(mut data) = request.data else {
-        return Err(CoreError::InvalidRequest(
+        return Err(Error::InvalidRequest(
             "OCR pre_call guardrail must return an object".to_string(),
         ));
     };
     let document = data.remove("document").ok_or_else(|| {
-        CoreError::InvalidRequest("OCR pre_call guardrail removed document".to_string())
+        Error::InvalidRequest("OCR pre_call guardrail removed document".to_string())
     })?;
     let optional_params = match data.remove("optional_params") {
         Some(Value::Object(params)) => params,
         Some(_) => {
-            return Err(CoreError::InvalidRequest(
+            return Err(Error::InvalidRequest(
                 "OCR pre_call guardrail optional_params must be an object".to_string(),
             ));
         }
@@ -299,33 +297,32 @@ fn parse_ocr_pre_call_guardrail_request(
     Ok((document, optional_params))
 }
 
-fn parse_ocr_during_call_guardrail_request(request: GuardrailRequest) -> CoreResult<Value> {
+fn parse_ocr_during_call_guardrail_request(request: GuardrailRequest) -> Result<Value, Error> {
     let Value::Object(mut data) = request.data else {
-        return Err(CoreError::InvalidRequest(
+        return Err(Error::InvalidRequest(
             "OCR during_call guardrail must return an object".to_string(),
         ));
     };
-    data.remove("body").ok_or_else(|| {
-        CoreError::InvalidRequest("OCR during_call guardrail removed body".to_string())
-    })
+    data.remove("body")
+        .ok_or_else(|| Error::InvalidRequest("OCR during_call guardrail removed body".to_string()))
 }
 
-fn guardrail_error_to_core_error(error: GuardrailError) -> CoreError {
-    CoreError::InvalidRequest(format!("{}: {}", error.kind, error.message))
+fn guardrail_error_to_core_error(error: GuardrailError) -> Error {
+    Error::InvalidRequest(format!("{}: {}", error.kind, error.message))
 }
 
-fn core_error_kind(error: &CoreError) -> &'static str {
+fn core_error_kind(error: &Error) -> &'static str {
     match error {
-        CoreError::Auth(_) => "AuthError",
-        CoreError::InvalidProvider(_) => "InvalidProvider",
-        CoreError::InvalidRequest(_) => "InvalidRequest",
-        CoreError::InvalidType { .. } => "InvalidType",
-        CoreError::MissingField(_) => "MissingField",
-        CoreError::Http { .. } => "HttpError",
-        CoreError::InvalidResponse(_) => "InvalidResponse",
-        CoreError::Network(_) => "NetworkError",
-        CoreError::Connect(_) => "ConnectError",
-        CoreError::Routing(_) => "RoutingError",
-        CoreError::Unsupported(_) => "UnsupportedRequest",
+        Error::Auth(_) => "AuthError",
+        Error::InvalidProvider(_) => "InvalidProvider",
+        Error::InvalidRequest(_) => "InvalidRequest",
+        Error::InvalidType { .. } => "InvalidType",
+        Error::MissingField(_) => "MissingField",
+        Error::Http { .. } => "HttpError",
+        Error::InvalidResponse(_) => "InvalidResponse",
+        Error::Network(_) => "NetworkError",
+        Error::Connect(_) => "ConnectError",
+        Error::Routing(_) => "RoutingError",
+        Error::Unsupported(_) => "UnsupportedRequest",
     }
 }
diff --git a/litellm-rust/crates/ai-gateway/src/ocr/mod.rs b/litellm-rust/crates/ai-gateway/src/ocr/mod.rs
index c4c13e2300c..b59ab626fd3 100644
--- a/litellm-rust/crates/ai-gateway/src/ocr/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/mod.rs
@@ -1,4 +1,4 @@
-use litellm_core::CoreResult;
+use litellm_core::Error;
 use litellm_core::call_lifecycle::CallLifecycle;
 use serde_json::Value;
 
@@ -13,7 +13,7 @@ pub use types::OcrRequest;
 use handler::execute_ocr_provider_call;
 use prepare::{PreparedOcrCall, prepare_ocr_call};
 
-pub async fn ocr(request: OcrRequest<'_>) -> CoreResult<Value> {
+pub async fn ocr(request: OcrRequest<'_>) -> Result<Value, Error> {
     let PreparedOcrCall { request, hooks } = prepare_ocr_call(request);
     CallLifecycle::default()
         .run_request(request, &hooks, execute_ocr_provider_call)
diff --git a/litellm-rust/crates/ai-gateway/src/ocr/tests.rs b/litellm-rust/crates/ai-gateway/src/ocr/tests.rs
index bb2a6b06501..8c3f0425149 100644
--- a/litellm-rust/crates/ai-gateway/src/ocr/tests.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/tests.rs
@@ -1,7 +1,7 @@
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::ocr::transformation::OcrResponseHandling;
 use serde_json::{Map, Value, json};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -395,7 +395,7 @@ async fn ocr_lifecycle_runs_failure_hook_on_provider_error() {
     .await
     .expect_err("provider error propagates");
 
-    assert!(matches!(err, CoreError::Http { status: 500, .. }));
+    assert!(matches!(err, Error::Http { status: 500, .. }));
     server.await.expect("server task completes");
     assert_eq!(
         logger.events(),
@@ -439,7 +439,7 @@ async fn ocr_lifecycle_pre_call_block_skips_provider_socket() {
     .await
     .expect_err("guardrail blocks request");
 
-    assert!(matches!(err, CoreError::InvalidRequest(_)));
+    assert!(matches!(err, Error::InvalidRequest(_)));
     assert_eq!(guardrail.events(), vec!["async_pre_call_hook"]);
     assert_eq!(
         logger.events(),
@@ -607,7 +607,7 @@ fn string_headers_rejects_non_string_values() {
     let err = string_headers(Some(headers)).expect_err("non-string header rejected");
     assert_eq!(
         err,
-        CoreError::InvalidRequest(
+        Error::InvalidRequest(
             "OCR extra_headers.x-retry-count must be a string, got number".to_string()
         )
     );
diff --git a/litellm-rust/crates/ai-gateway/src/python/config.rs b/litellm-rust/crates/ai-gateway/src/python/config.rs
index c028d3d6b51..d5a4dd69c8d 100644
--- a/litellm-rust/crates/ai-gateway/src/python/config.rs
+++ b/litellm-rust/crates/ai-gateway/src/python/config.rs
@@ -6,33 +6,31 @@
 //! (and recorded in [`crate::gil`]); the realtime hot path never touches Python.
 //!
 //! Compiled only under the `python-config` feature.
-
-use litellm_core::CoreResult;
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::router::{Deployment, Router};
 use pyo3::prelude::*;
 
 use crate::gil;
 
 /// Load the router's `model_list` from `config_path` via the Python reader.
-pub fn load_router_from_config(config_path: &str) -> CoreResult<Router> {
+pub fn load_router_from_config(config_path: &str) -> Result<Router, Error> {
     gil::record_acquisition();
     Python::attach(|py| {
         let model_list = py
             .import("litellm.proxy.read_model_list")
             .and_then(|module| module.getattr("read_model_list"))
             .and_then(|reader| reader.call1((config_path,)))
-            .map_err(|err| CoreError::Routing(format!("read_model_list failed: {err}")))?;
+            .map_err(|err| Error::Routing(format!("read_model_list failed: {err}")))?;
 
         let model_list_json: String = py
             .import("json")
             .and_then(|json| json.getattr("dumps"))
             .and_then(|dumps| dumps.call1((model_list,)))
             .and_then(|encoded| encoded.extract())
-            .map_err(|err| CoreError::Routing(format!("serializing model_list failed: {err}")))?;
+            .map_err(|err| Error::Routing(format!("serializing model_list failed: {err}")))?;
 
         let deployments: Vec<Deployment> = serde_json::from_str(&model_list_json)
-            .map_err(|err| CoreError::Routing(format!("parsing model_list failed: {err}")))?;
+            .map_err(|err| Error::Routing(format!("parsing model_list failed: {err}")))?;
 
         Ok(Router::new(deployments))
     })
diff --git a/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs b/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs
index 7e38d10c6ff..e9f8c477f36 100644
--- a/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs
@@ -9,7 +9,7 @@ use axum::http::StatusCode;
 use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE, HeaderMap, HeaderValue};
 use axum::response::{IntoResponse, Response};
 use axum::routing::post;
-use litellm_core::CoreError;
+use litellm_core::Error;
 use serde_json::{Map, Value};
 
 use crate::auth::RequireMasterKey;
@@ -46,7 +46,7 @@ fn stream_response(upstream: reqwest::Response) -> Result<Response, MessagesRout
     let mut response = Response::builder()
         .status(
             StatusCode::from_u16(upstream.status().as_u16()).map_err(|error| {
-                MessagesRouteError(CoreError::InvalidResponse(format!(
+                MessagesRouteError(Error::InvalidResponse(format!(
                     "invalid upstream response status: {error}"
                 )))
             })?,
@@ -58,13 +58,13 @@ fn stream_response(upstream: reqwest::Response) -> Result<Response, MessagesRout
     response
         .body(Body::from_stream(upstream.bytes_stream()))
         .map_err(|error| {
-            MessagesRouteError(CoreError::InvalidResponse(format!(
+            MessagesRouteError(Error::InvalidResponse(format!(
                 "failed to build streaming response: {error}"
             )))
         })
 }
 
-fn forwarded_headers(headers: &HeaderMap) -> Result<Option<Map<String, Value>>, CoreError> {
+fn forwarded_headers(headers: &HeaderMap) -> Result<Option<Map<String, Value>>, Error> {
     let forwarded = headers
         .iter()
         .filter(|(name, _)| {
@@ -74,19 +74,19 @@ fn forwarded_headers(headers: &HeaderMap) -> Result<Option<Map<String, Value>>,
         })
         .map(|(name, value)| {
             let value = value.to_str().map_err(|_| {
-                CoreError::InvalidRequest(format!("invalid value for header {}", name.as_str()))
+                Error::InvalidRequest(format!("invalid value for header {}", name.as_str()))
             })?;
             Ok((name.to_string(), Value::String(value.to_string())))
         })
-        .collect::<Result<Map<_, _>, CoreError>>()?;
+        .collect::<Result<Map<_, _>, Error>>()?;
     Ok((!forwarded.is_empty()).then_some(forwarded))
 }
 
 #[derive(Debug)]
-struct MessagesRouteError(CoreError);
+struct MessagesRouteError(Error);
 
-impl From<CoreError> for MessagesRouteError {
-    fn from(error: CoreError) -> Self {
+impl From<Error> for MessagesRouteError {
+    fn from(error: Error) -> Self {
         Self(error)
     }
 }
@@ -94,28 +94,28 @@ impl From<CoreError> for MessagesRouteError {
 impl IntoResponse for MessagesRouteError {
     fn into_response(self) -> Response {
         let (status, message) = match self.0 {
-            CoreError::InvalidRequest(message) => (StatusCode::BAD_REQUEST, message),
-            CoreError::InvalidProvider(_) | CoreError::Routing(_) => (
+            Error::InvalidRequest(message) => (StatusCode::BAD_REQUEST, message),
+            Error::InvalidProvider(_) | Error::Routing(_) => (
                 StatusCode::NOT_FOUND,
                 "no messages deployment is configured for this model".to_string(),
             ),
-            CoreError::Auth(_) => (
+            Error::Auth(_) => (
                 StatusCode::BAD_GATEWAY,
                 "messages provider authentication failed".to_string(),
             ),
-            CoreError::Http { .. }
-            | CoreError::Network(_)
-            | CoreError::Connect(_)
-            | CoreError::InvalidResponse(_)
-            | CoreError::InvalidType { .. }
-            | CoreError::MissingField(_) => (
+            Error::Http { .. }
+            | Error::Network(_)
+            | Error::Connect(_)
+            | Error::InvalidResponse(_)
+            | Error::InvalidType { .. }
+            | Error::MissingField(_) => (
                 StatusCode::BAD_GATEWAY,
                 "messages provider request failed".to_string(),
             ),
             // The gateway has no Python implementation to decline to, so a
             // request the core cannot serve is reported to the caller. The
             // reason is a fixed internal string, never provider content.
-            CoreError::Unsupported(reason) => (
+            Error::Unsupported(reason) => (
                 StatusCode::BAD_REQUEST,
                 format!("messages request is not supported: {reason}"),
             ),
diff --git a/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs b/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs
index 5f4c5fe8de4..4fd29db05d6 100644
--- a/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs
@@ -1,10 +1,10 @@
 use std::sync::Arc;
 
+use litellm_core::Error;
 use litellm_core::constants::ANTHROPIC_MESSAGES_PROVIDER;
 use litellm_core::messages::types::MessagesRequest;
 use litellm_core::messages::{messages, messages_stream};
 use litellm_core::router::Router;
-use litellm_core::{CoreError, CoreResult};
 use serde_json::{Map, Value};
 
 pub(crate) enum MessagesResponse {
@@ -16,16 +16,16 @@ pub async fn run(
     router: &Arc<Router>,
     body: Value,
     extra_headers: Option<Map<String, Value>>,
-) -> CoreResult<MessagesResponse> {
+) -> Result<MessagesResponse, Error> {
     let model = body
         .get("model")
         .and_then(Value::as_str)
         .map(str::trim)
         .filter(|model| !model.is_empty())
-        .ok_or_else(|| CoreError::InvalidRequest("messages body requires a model".to_string()))?;
-    let deployment = router.get_available_deployment(model).ok_or_else(|| {
-        CoreError::Routing(format!("no deployment available for model '{model}'"))
-    })?;
+        .ok_or_else(|| Error::InvalidRequest("messages body requires a model".to_string()))?;
+    let deployment = router
+        .get_available_deployment(model)
+        .ok_or_else(|| Error::Routing(format!("no deployment available for model '{model}'")))?;
     let provider_model = deployment.litellm_params.model.as_str();
     let upstream_model = provider_model
         .split_once('/')
@@ -37,7 +37,7 @@ pub async fn run(
     };
     let mut body = body;
     body.as_object_mut()
-        .ok_or_else(|| CoreError::InvalidRequest("messages body must be an object".to_string()))?
+        .ok_or_else(|| Error::InvalidRequest("messages body must be an object".to_string()))?
         .insert(
             "model".to_string(),
             Value::String(upstream_model.to_string()),
@@ -60,6 +60,6 @@ pub async fn run(
     serde_json::to_value(response)
         .map(MessagesResponse::Json)
         .map_err(|err| {
-            CoreError::InvalidResponse(format!("failed to serialize messages response: {err}"))
+            Error::InvalidResponse(format!("failed to serialize messages response: {err}"))
         })
 }
diff --git a/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs b/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs
index 4ae8cfe7379..b8ee77c4269 100644
--- a/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs
@@ -11,8 +11,7 @@ use std::time::Duration;
 
 use crate::io::realtime_pool::{RealtimePool, upstream_key};
 use futures_util::{Sink, Stream};
-use litellm_core::CoreResult;
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::realtime::types::RealtimeEvent;
 use litellm_core::router::Router;
 
@@ -29,15 +28,15 @@ pub async fn run<In, Out>(
     observe: impl FnMut(&RealtimeEvent) + Send,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = RealtimeEvent> + Unpin + Send,
     Out: Sink<RealtimeEvent> + Unpin + Send,
     <Out as Sink<RealtimeEvent>>::Error: std::fmt::Display,
 {
-    let deployment = router.get_available_deployment(model).ok_or_else(|| {
-        CoreError::Routing(format!("no deployment available for model '{model}'"))
-    })?;
+    let deployment = router
+        .get_available_deployment(model)
+        .ok_or_else(|| Error::Routing(format!("no deployment available for model '{model}'")))?;
     let params = &deployment.litellm_params;
     // Strip a leading `openai/` so the OpenAI-only realtime fn gets the bare model.
     let provider_model = params
diff --git a/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs b/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs
index 165c95695d3..e8f840c0c8e 100644
--- a/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/responses/service.rs
@@ -2,13 +2,13 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use futures_util::{Sink, Stream};
+use litellm_core::Error;
 use litellm_core::call_lifecycle::{CallLifecycle, CallLifecycleContext};
 use litellm_core::responses::instrumentation::{
     ResponsesWsCallbackPayload, ResponsesWsInstrumentation, ResponsesWsLogOutcome,
     ResponsesWsMetadata,
 };
 use litellm_core::responses::types::ResponsesWsEvent;
-use litellm_core::{CoreError, CoreResult};
 
 use crate::integrations::custom_logger::{
     CallbackTiming, CallbackValue, CustomLogger, CustomLoggerRunner, LoggingError, ModelCallDetails,
@@ -26,22 +26,22 @@ pub async fn run<In, Out>(
     metadata: RequestMetadata,
     client_in: In,
     client_out: Out,
-) -> CoreResult<()>
+) -> Result<(), Error>
 where
     In: Stream<Item = ResponsesWsEvent> + Unpin + Send,
     Out: Sink<ResponsesWsEvent> + Unpin + Send,
     Out::Error: std::fmt::Display,
 {
-    let deployment = router.get_available_deployment(model).ok_or_else(|| {
-        CoreError::Routing(format!("no deployment available for model '{model}'"))
-    })?;
+    let deployment = router
+        .get_available_deployment(model)
+        .ok_or_else(|| Error::Routing(format!("no deployment available for model '{model}'")))?;
     let params = &deployment.litellm_params;
     let provider_model = params
         .model
         .strip_prefix("openai/")
         .unwrap_or(&params.model);
     if params.model.contains('/') && !params.model.starts_with("openai/") {
-        return Err(CoreError::InvalidProvider(
+        return Err(Error::InvalidProvider(
             "Responses WebSocket route supports OpenAI deployments only".to_string(),
         ));
     }
diff --git a/litellm-rust/crates/core/src/audio_transcription/client.rs b/litellm-rust/crates/core/src/audio_transcription/client.rs
new file mode 100644
index 00000000000..0e612628dc6
--- /dev/null
+++ b/litellm-rust/crates/core/src/audio_transcription/client.rs
@@ -0,0 +1,14 @@
+use std::sync::OnceLock;
+use std::time::Duration;
+
+use crate::constants::AUDIO_TRANSCRIPTION_TIMEOUT_SECS;
+
+pub(super) fn http_client() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .timeout(Duration::from_secs(AUDIO_TRANSCRIPTION_TIMEOUT_SECS))
+            .build()
+            .unwrap_or_else(|_| reqwest::Client::new())
+    })
+}
diff --git a/litellm-rust/crates/core/src/audio_transcription/handler.rs b/litellm-rust/crates/core/src/audio_transcription/handler.rs
new file mode 100644
index 00000000000..30ba0da5e68
--- /dev/null
+++ b/litellm-rust/crates/core/src/audio_transcription/handler.rs
@@ -0,0 +1,91 @@
+use serde_json::Value;
+
+use crate::error::Error;
+use crate::http_utils::truncate_error_body;
+
+use super::client::http_client;
+use super::types::ProviderAudioTranscriptionRequest;
+
+pub async fn execute_audio_transcription_provider_call(
+    request: ProviderAudioTranscriptionRequest,
+) -> Result<Value, Error> {
+    let body = serde_json::to_vec(&request.body)
+        .map_err(|error| Error::InvalidRequest(format!("invalid audio request body: {error}")))?;
+    let headers = signed_headers(&request, &body).await?;
+    let mut request_builder = http_client().post(&request.url).body(body);
+    for (key, value) in headers {
+        request_builder = request_builder.header(key, value);
+    }
+    if let Some(duration) = request.timeout {
+        request_builder = request_builder.timeout(duration);
+    }
+    let response = request_builder
+        .send()
+        .await
+        .map_err(|error| Error::Network(error.to_string()))?;
+    let status = response.status();
+    let text = response
+        .text()
+        .await
+        .map_err(|error| Error::Network(error.to_string()))?;
+    if !status.is_success() {
+        return Err(Error::Http {
+            status: status.as_u16(),
+            body: truncate_error_body(&text),
+        });
+    }
+    let response_json = serde_json::from_str(&text)
+        .map_err(|error| Error::InvalidResponse(format!("invalid audio response JSON: {error}")))?;
+    Ok(request
+        .config
+        .transform_transcription_response(&request.model, response_json)?
+        .into_json())
+}
+
+#[cfg(feature = "bedrock-auth")]
+async fn signed_headers(
+    request: &ProviderAudioTranscriptionRequest,
+    body: &[u8],
+) -> Result<Vec<(String, String)>, Error> {
+    use std::collections::BTreeMap;
+    use std::time::SystemTime;
+
+    use crate::audio_transcription::transformation::AudioTranscriptionAuth;
+    use crate::providers::bedrock::audio_transcription::aws_auth_config;
+    use crate::providers::bedrock::aws_base::{resolve_credentials, sign_bedrock_post};
+
+    let AudioTranscriptionAuth::AwsSigV4 { region, .. } = &request.auth else {
+        return Ok(request.upstream_headers.clone());
+    };
+    let env_lookup = |key: &str| std::env::var(key).ok();
+    let credentials = resolve_credentials(
+        aws_auth_config(&request.optional_params, &env_lookup),
+        &env_lookup,
+    )
+    .await?;
+    let unsigned: BTreeMap<String, String> = request.upstream_headers.iter().cloned().collect();
+    let signature = sign_bedrock_post(
+        &request.url,
+        body,
+        &unsigned,
+        region,
+        &credentials,
+        SystemTime::now(),
+    )?;
+    Ok(unsigned.into_iter().chain(signature).collect())
+}
+
+#[cfg(not(feature = "bedrock-auth"))]
+async fn signed_headers(
+    request: &ProviderAudioTranscriptionRequest,
+    _body: &[u8],
+) -> Result<Vec<(String, String)>, Error> {
+    use crate::audio_transcription::transformation::AudioTranscriptionAuth;
+
+    match request.auth {
+        AudioTranscriptionAuth::AwsSigV4 { .. } => Err(Error::Unsupported(
+            "AWS SigV4 requires the bedrock-auth feature",
+        )),
+        AudioTranscriptionAuth::Bearer => Ok(request.upstream_headers.clone()),
+    }
+}
diff --git a/litellm-rust/crates/core/src/audio_transcription/mod.rs b/litellm-rust/crates/core/src/audio_transcription/mod.rs
index ec2fbb969a6..b71748082bf 100644
--- a/litellm-rust/crates/core/src/audio_transcription/mod.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/mod.rs
@@ -1,2 +1,20 @@
+use crate::Error;
+mod client;
+mod handler;
+mod prepare;
 pub mod transformation;
 pub mod types;
+
+use serde_json::Value;
+
+pub use handler::execute_audio_transcription_provider_call;
+pub use prepare::prepare_audio_transcription_provider_call;
+pub use types::{AudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
+
+pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> Result<Value, Error> {
+    execute_audio_transcription_provider_call(prepare_audio_transcription_provider_call(request)?)
+        .await
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/litellm-rust/crates/core/src/audio_transcription/prepare.rs b/litellm-rust/crates/core/src/audio_transcription/prepare.rs
new file mode 100644
index 00000000000..6288e96b380
--- /dev/null
+++ b/litellm-rust/crates/core/src/audio_transcription/prepare.rs
@@ -0,0 +1,72 @@
+use crate::error::Error;
+use crate::http_utils::{has_header, string_headers};
+#[cfg(feature = "bedrock-auth")]
+use crate::providers::bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG;
+use crate::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};
+
+use super::transformation::{AudioTranscriptionAuth, AudioTranscriptionProviderConfig};
+use super::types::{AudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
+
+fn provider_config(provider: &str) -> Option<&'static dyn AudioTranscriptionProviderConfig> {
+    #[cfg(feature = "bedrock-auth")]
+    if provider == "bedrock" {
+        return Some(&BEDROCK_AUDIO_TRANSCRIPTION_CONFIG);
+    }
+    let _ = provider;
+    None
+}
+
+pub fn prepare_audio_transcription_provider_call(
+    request: AudioTranscriptionRequest<'_>,
+) -> Result<ProviderAudioTranscriptionRequest, Error> {
+    let provider_info = get_custom_llm_provider(request.model, request.custom_llm_provider)
+        .or_else(|| {
+            request
+                .custom_llm_provider
+                .map(|provider| CustomLlmProvider {
+                    model: request.model,
+                    custom_llm_provider: provider,
+                })
+        })
+        .ok_or_else(|| {
+            Error::InvalidProvider(
+                "unable to resolve custom_llm_provider for audio transcription request".to_string(),
+            )
+        })?;
+    let model = provider_info.model.to_string();
+    let config = provider_config(provider_info.custom_llm_provider)
+        .ok_or_else(|| Error::InvalidProvider(provider_info.custom_llm_provider.to_string()))?;
+    let env_lookup = |key: &str| std::env::var(key).ok();
+    let mut headers = string_headers("audio transcription", request.extra_headers)?;
+    let auth = config.auth_strategy(&model, &request.optional_params, &env_lookup)?;
+    if matches!(auth, AudioTranscriptionAuth::Bearer)
+        && !has_header(&headers, "authorization")
+        && let Some(api_key) = request.api_key
+    {
+        headers.push(("Authorization".to_string(), format!("Bearer {api_key}")));
+    }
+    if !has_header(&headers, "content-type") {
+        headers.push(("Content-Type".to_string(), "application/json".to_string()));
+    }
+    let url = config.complete_url(
+        request.api_base,
+        &model,
+        &request.optional_params,
+        &env_lookup,
+    )?;
+    let filtered_params = config.map_transcription_params(&request.optional_params);
+    let transformed =
+        config.transform_transcription_request(&model, request.audio, filtered_params)?;
+    Ok(ProviderAudioTranscriptionRequest {
+        model,
+        custom_llm_provider: provider_info.custom_llm_provider.to_string(),
+        config,
+        url,
+        body: transformed.body,
+        upstream_headers: headers,
+        auth,
+        #[cfg(feature = "bedrock-auth")]
+        optional_params: request.optional_params,
+        timeout: request.timeout,
+    })
+}
diff --git a/litellm-rust/crates/core/src/audio_transcription/tests.rs b/litellm-rust/crates/core/src/audio_transcription/tests.rs
new file mode 100644
index 00000000000..263d63337b0
--- /dev/null
+++ b/litellm-rust/crates/core/src/audio_transcription/tests.rs
@@ -0,0 +1,50 @@
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::thread;
+
+use serde_json::{Map, json};
+
+use super::audio_transcription;
+use super::types::AudioTranscriptionRequest;
+
+#[tokio::test]
+async fn bedrock_request_is_signed_and_contains_audio() {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("listener");
+    let address = listener.local_addr().expect("address");
+    let server = thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("connection");
+        let mut request = Vec::new();
+        let mut buffer = [0_u8; 16_384];
+        let count = stream.read(&mut buffer).expect("request");
+        request.extend_from_slice(&buffer[..count]);
+        let request = String::from_utf8_lossy(&request);
+        assert!(request.contains("POST /model/mistral.voxtral-mini-3b-2507/converse"));
+        assert!(request.contains("authorization: AWS4-HMAC-SHA256"));
+        assert!(request.contains("x-amz-date:"));
+        assert!(request.contains("\"bytes\":\"AQI=\""));
+        assert!(request.contains("Transcribe the audio. Respond with only the transcript."));
+        let response = b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 53\r\nConnection: close\r\n\r\n{\"output\":{\"message\":{\"content\":[{\"text\":\"hello\"}]}}}";
+        stream.write_all(response).expect("response");
+    });
+
+    let optional_params = Map::from_iter([
+        ("aws_access_key_id".to_string(), json!("access-key")),
+        ("aws_secret_access_key".to_string(), json!("secret-key")),
+        ("aws_region_name".to_string(), json!("us-east-1")),
+    ]);
+    let api_base = format!("http://{address}");
+    let response = audio_transcription(AudioTranscriptionRequest {
+        model: "mistral.voxtral-mini-3b-2507",
+        audio: json!({"data": "AQI=", "format": "wav", "filename": "audio.wav"}),
+        api_key: None,
+        api_base: Some(&api_base),
+        custom_llm_provider: Some("bedrock"),
+        extra_headers: None,
+        optional_params,
+        timeout: None,
+    })
+    .await
+    .expect("transcription");
+    assert_eq!(response, json!({"text": "hello"}));
+    server.join().expect("server");
+}
diff --git a/litellm-rust/crates/core/src/audio_transcription/transformation.rs b/litellm-rust/crates/core/src/audio_transcription/transformation.rs
index eab34c13843..16a28fbcac0 100644
--- a/litellm-rust/crates/core/src/audio_transcription/transformation.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/transformation.rs
@@ -1,7 +1,6 @@
+use crate::Error;
 use serde_json::{Map, Value};
 
-use crate::CoreResult;
-
 use super::types::{AudioTranscriptionRequestData, AudioTranscriptionResponseData};
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -32,13 +31,13 @@ pub trait AudioTranscriptionProviderConfig: Sync {
         model: &str,
         audio: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<AudioTranscriptionRequestData>;
+    ) -> Result<AudioTranscriptionRequestData, Error>;
 
     fn transform_transcription_response(
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<AudioTranscriptionResponseData>;
+    ) -> Result<AudioTranscriptionResponseData, Error>;
 
     fn complete_url(
         &self,
@@ -46,12 +45,12 @@ pub trait AudioTranscriptionProviderConfig: Sync {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn auth_strategy(
         &self,
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<AudioTranscriptionAuth>;
+    ) -> Result<AudioTranscriptionAuth, Error>;
 }
diff --git a/litellm-rust/crates/core/src/audio_transcription/types.rs b/litellm-rust/crates/core/src/audio_transcription/types.rs
index 3a9e1ecd88c..559d7837027 100644
--- a/litellm-rust/crates/core/src/audio_transcription/types.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/types.rs
@@ -1,5 +1,56 @@
+use std::time::Duration;
+
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
+use serde_json::{Map, Value};
+
+use super::transformation::{AudioTranscriptionAuth, AudioTranscriptionProviderConfig};
+
+pub struct AudioTranscriptionRequest<'a> {
+    pub model: &'a str,
+    pub audio: Value,
+    pub api_key: Option<&'a str>,
+    pub api_base: Option<&'a str>,
+    pub custom_llm_provider: Option<&'a str>,
+    pub extra_headers: Option<Map<String, Value>>,
+    pub optional_params: Map<String, Value>,
+    pub timeout: Option<Duration>,
+}
+
+#[derive(Clone)]
+pub struct ProviderAudioTranscriptionRequest {
+    pub(super) model: String,
+    pub(super) custom_llm_provider: String,
+    pub(super) config: &'static dyn AudioTranscriptionProviderConfig,
+    pub(super) url: String,
+    pub(super) body: Value,
+    pub(super) upstream_headers: Vec<(String, String)>,
+    pub(super) auth: AudioTranscriptionAuth,
+    #[cfg(feature = "bedrock-auth")]
+    pub(super) optional_params: Map<String, Value>,
+    pub(super) timeout: Option<Duration>,
+}
+
+impl ProviderAudioTranscriptionRequest {
+    pub fn model(&self) -> &str {
+        &self.model
+    }
+
+    pub fn custom_llm_provider(&self) -> &str {
+        &self.custom_llm_provider
+    }
+
+    pub fn url(&self) -> &str {
+        &self.url
+    }
+
+    pub fn body(&self) -> &Value {
+        &self.body
+    }
+
+    pub fn with_body(self, body: Value) -> Self {
+        Self { body, ..self }
+    }
+}
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct AudioTranscriptionRequestData {
diff --git a/litellm-rust/crates/core/src/call_lifecycle/mod.rs b/litellm-rust/crates/core/src/call_lifecycle/mod.rs
index d9b68a1b726..637c156e192 100644
--- a/litellm-rust/crates/core/src/call_lifecycle/mod.rs
+++ b/litellm-rust/crates/core/src/call_lifecycle/mod.rs
@@ -1,7 +1,7 @@
 use std::future::Future;
 use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
-use crate::{CoreError, CoreResult};
+use crate::Error;
 
 pub mod types;
 
@@ -11,14 +11,14 @@ pub use types::{
 };
 
 pub trait CallLifecycleHooks<InitialReq, ProviderReq, Resp>: Send + Sync {
-    type PreCallFuture<'a>: Future<Output = CoreResult<InitialReq>> + Send + 'a
+    type PreCallFuture<'a>: Future<Output = Result<InitialReq, Error>> + Send + 'a
     where
         Self: 'a,
         InitialReq: 'a,
         ProviderReq: 'a,
         Resp: 'a;
 
-    type DuringCallFuture<'a>: Future<Output = CoreResult<ProviderReq>> + Send + 'a
+    type DuringCallFuture<'a>: Future<Output = Result<ProviderReq, Error>> + Send + 'a
     where
         Self: 'a,
         InitialReq: 'a,
@@ -56,7 +56,7 @@ pub trait CallLifecycleHooks<InitialReq, ProviderReq, Resp>: Send + Sync {
     fn async_log_failure_event<'a>(
         &'a self,
         context: &'a CallLifecycleContext,
-        error: &'a CoreError,
+        error: &'a Error,
         timing: &'a CallLifecycleTiming,
     ) -> Self::FailureFuture<'a>;
 }
@@ -86,12 +86,12 @@ impl<'a> CallLifecycle<'a> {
         request: InitialReq,
         hooks: &Hooks,
         provider_call: ProviderCall,
-    ) -> CoreResult<Resp>
+    ) -> Result<Resp, Error>
     where
         InitialReq: CallLifecycleRequest,
         Hooks: CallLifecycleHooks<InitialReq, ProviderReq, Resp>,
         ProviderCall: FnOnce(ProviderReq) -> ProviderFuture,
-        ProviderFuture: Future<Output = CoreResult<Resp>>,
+        ProviderFuture: Future<Output = Result<Resp, Error>>,
     {
         let context = request.lifecycle_context();
         self.run(context, request, hooks, provider_call).await
@@ -103,11 +103,11 @@ impl<'a> CallLifecycle<'a> {
         request: InitialReq,
         hooks: &Hooks,
         provider_call: ProviderCall,
-    ) -> CoreResult<Resp>
+    ) -> Result<Resp, Error>
     where
         Hooks: CallLifecycleHooks<InitialReq, ProviderReq, Resp>,
         ProviderCall: FnOnce(ProviderReq) -> ProviderFuture,
-        ProviderFuture: Future<Output = CoreResult<Resp>>,
+        ProviderFuture: Future<Output = Result<Resp, Error>>,
     {
         let call_start = epoch_seconds();
         let mut phases = Vec::new();
@@ -166,7 +166,7 @@ impl<'a> CallLifecycle<'a> {
         &self,
         context: &CallLifecycleContext,
         hooks: &Hooks,
-        error: &CoreError,
+        error: &Error,
         call_start: f64,
         phases: &mut Vec<CallLifecyclePhaseTiming>,
     ) where
@@ -251,8 +251,8 @@ mod tests {
     }
 
     impl CallLifecycleHooks<String, String, String> for RecordingHooks {
-        type PreCallFuture<'a> = BoxFuture<'a, CoreResult<String>>;
-        type DuringCallFuture<'a> = BoxFuture<'a, CoreResult<String>>;
+        type PreCallFuture<'a> = BoxFuture<'a, Result<String, Error>>;
+        type DuringCallFuture<'a> = BoxFuture<'a, Result<String, Error>>;
         type SuccessFuture<'a> = BoxFuture<'a, ()>;
         type FailureFuture<'a> = BoxFuture<'a, ()>;
 
@@ -294,7 +294,7 @@ mod tests {
         fn async_log_failure_event<'a>(
             &'a self,
             _context: &'a CallLifecycleContext,
-            _error: &'a CoreError,
+            _error: &'a Error,
             _timing: &'a CallLifecycleTiming,
         ) -> Self::FailureFuture<'a> {
             Box::pin(async move {
@@ -304,8 +304,8 @@ mod tests {
     }
 
     impl CallLifecycleHooks<RecordingRequest, String, String> for RecordingHooks {
-        type PreCallFuture<'a> = BoxFuture<'a, CoreResult<RecordingRequest>>;
-        type DuringCallFuture<'a> = BoxFuture<'a, CoreResult<String>>;
+        type PreCallFuture<'a> = BoxFuture<'a, Result<RecordingRequest, Error>>;
+        type DuringCallFuture<'a> = BoxFuture<'a, Result<String, Error>>;
         type SuccessFuture<'a> = BoxFuture<'a, ()>;
         type FailureFuture<'a> = BoxFuture<'a, ()>;
 
@@ -345,7 +345,7 @@ mod tests {
         fn async_log_failure_event<'a>(
             &'a self,
             _context: &'a CallLifecycleContext,
-            _error: &'a CoreError,
+            _error: &'a Error,
             _timing: &'a CallLifecycleTiming,
         ) -> Self::FailureFuture<'a> {
             Box::pin(async move {
@@ -383,13 +383,13 @@ mod tests {
                 "request".to_string(),
                 &hooks,
                 |_request| async move {
-                    Err::<String, CoreError>(CoreError::Network("provider down".to_string()))
+                    Err::<String, Error>(Error::Network("provider down".to_string()))
                 },
             )
             .await
             .expect_err("call fails");
 
-        assert_eq!(error, CoreError::Network("provider down".to_string()));
+        assert_eq!(error, Error::Network("provider down".to_string()));
         assert_eq!(hooks.events(), vec!["pre_call", "during_call", "failure"]);
     }
 
diff --git a/litellm-rust/crates/core/src/chat_completions/common_utils.rs b/litellm-rust/crates/core/src/chat_completions/common_utils.rs
index 36eaf242a5a..ca51471eb7c 100644
--- a/litellm-rust/crates/core/src/chat_completions/common_utils.rs
+++ b/litellm-rust/crates/core/src/chat_completions/common_utils.rs
@@ -1,8 +1,7 @@
-use serde_json::{Map, Value};
-
-use crate::error::CoreResult;
+use crate::Error;
 use crate::http_utils::string_headers as shared_string_headers;
 use crate::providers::anthropic::chat_completions::transformation::ANTHROPIC_CHAT_COMPLETIONS_CONFIG;
+use serde_json::{Map, Value};
 
 use super::transformation::ChatCompletionsProviderConfig;
 
@@ -23,6 +22,6 @@ pub(super) fn chat_completions_provider_config(
 
 pub(super) fn string_headers(
     extra_headers: Option<Map<String, Value>>,
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     shared_string_headers(HEADER_CONTEXT, extra_headers)
 }
diff --git a/litellm-rust/crates/core/src/chat_completions/handler.rs b/litellm-rust/crates/core/src/chat_completions/handler.rs
index afc4529fd26..7e2731442cc 100644
--- a/litellm-rust/crates/core/src/chat_completions/handler.rs
+++ b/litellm-rust/crates/core/src/chat_completions/handler.rs
@@ -1,6 +1,6 @@
 use serde_json::Value;
 
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::http_utils::truncate_error_body;
 
 use super::client::http_client;
@@ -11,9 +11,9 @@ use super::types::{
 
 pub(super) async fn execute_chat_completions_provider_call(
     request: ProviderChatCompletionsRequest,
-) -> CoreResult<ChatCompletionsResponse> {
+) -> Result<ChatCompletionsResponse, Error> {
     let body = serde_json::to_vec(&request.body).map_err(|err| {
-        CoreError::InvalidRequest(format!(
+        Error::InvalidRequest(format!(
             "failed to serialize chat completions request: {err}"
         ))
     })?;
@@ -32,9 +32,9 @@ pub(super) async fn execute_chat_completions_provider_call(
         // so the host can still serve it. Everything else here, a timeout
         // above all, may have reached the provider and been answered.
         if err.is_connect() || err.is_builder() {
-            CoreError::Connect(err.to_string())
+            Error::Connect(err.to_string())
         } else {
-            CoreError::Network(err.to_string())
+            Error::Network(err.to_string())
         }
     })?;
 
@@ -42,17 +42,17 @@ pub(super) async fn execute_chat_completions_provider_call(
     let text = response
         .text()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
 
     if !status.is_success() {
-        return Err(CoreError::Http {
+        return Err(Error::Http {
             status: status.as_u16(),
             body: truncate_error_body(&text),
         });
     }
 
     let body: Value = serde_json::from_str(&text).map_err(|err| {
-        CoreError::InvalidResponse(format!("invalid chat completions response JSON: {err}"))
+        Error::InvalidResponse(format!("invalid chat completions response JSON: {err}"))
     })?;
     request
         .config
@@ -69,10 +69,10 @@ pub(super) async fn execute_chat_completions_provider_call(
 /// second kind has already been billed, and a host that keeps a reference
 /// implementation must not retry those, so collapse them to one variant that
 /// can only mean the provider was already called.
-pub(super) fn as_response_error(err: CoreError) -> CoreError {
+pub(super) fn as_response_error(err: Error) -> Error {
     match err {
-        already @ (CoreError::InvalidResponse(_) | CoreError::Http { .. }) => already,
-        other => CoreError::InvalidResponse(other.to_string()),
+        already @ (Error::InvalidResponse(_) | Error::Http { .. }) => already,
+        other => Error::InvalidResponse(other.to_string()),
     }
 }
 
@@ -80,7 +80,7 @@ pub(super) fn as_response_error(err: CoreError) -> CoreError {
 pub(super) async fn signed_headers(
     request: &ProviderChatCompletionsRequest,
     body: &[u8],
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     use std::collections::BTreeMap;
     use std::time::SystemTime;
 
@@ -101,7 +101,7 @@ pub(super) async fn signed_headers(
         .iter()
         .any(|(name, _)| is_sigv4_computed_header(name))
     {
-        return Err(CoreError::Unsupported(
+        return Err(Error::Unsupported(
             "request forwards a header AWS SigV4 computes",
         ));
     }
@@ -137,9 +137,9 @@ pub(super) async fn signed_headers(
 pub(super) async fn signed_headers(
     request: &ProviderChatCompletionsRequest,
     _body: &[u8],
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     match &request.auth {
-        ChatCompletionsAuth::AwsSigV4 { .. } => Err(CoreError::Unsupported(
+        ChatCompletionsAuth::AwsSigV4 { .. } => Err(Error::Unsupported(
             "AWS SigV4 requires the bedrock-auth feature",
         )),
         _ => Ok(request.upstream_headers.clone()),
diff --git a/litellm-rust/crates/core/src/chat_completions/mod.rs b/litellm-rust/crates/core/src/chat_completions/mod.rs
index f30ac1a24bf..0d009d36d16 100644
--- a/litellm-rust/crates/core/src/chat_completions/mod.rs
+++ b/litellm-rust/crates/core/src/chat_completions/mod.rs
@@ -6,6 +6,7 @@
 //! credentials, and it resolves the provider, translates the conversation,
 //! calls the provider, and returns a typed OpenAI-shaped response.
 
+use crate::Error;
 mod client;
 mod common_utils;
 pub mod conversation;
@@ -17,15 +18,13 @@ pub mod types;
 
 use serde_json::{Map, Value};
 
-use crate::error::CoreResult;
-
 use handler::execute_chat_completions_provider_call;
 use prepare::{parse_messages, prepare_chat_completions_call, resolve_provider_config};
 use types::{ChatCompletionsRequest, ChatCompletionsResponse};
 
 pub async fn chat_completions(
     request: ChatCompletionsRequest<'_>,
-) -> CoreResult<ChatCompletionsResponse> {
+) -> Result<ChatCompletionsResponse, Error> {
     execute_chat_completions_provider_call(prepare_chat_completions_call(request)?).await
 }
 
diff --git a/litellm-rust/crates/core/src/chat_completions/prepare.rs b/litellm-rust/crates/core/src/chat_completions/prepare.rs
index 1e1c8d1bafd..142b2f2aaed 100644
--- a/litellm-rust/crates/core/src/chat_completions/prepare.rs
+++ b/litellm-rust/crates/core/src/chat_completions/prepare.rs
@@ -1,6 +1,6 @@
 use serde_json::Value;
 
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::http_utils::has_header;
 use crate::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};
 
@@ -11,7 +11,7 @@ use super::types::{ChatCompletionsRequest, ChatMessage, ProviderChatCompletionsR
 pub(super) fn resolve_provider_config<'a>(
     model: &'a str,
     custom_llm_provider: Option<&'a str>,
-) -> CoreResult<(String, &'static dyn ChatCompletionsProviderConfig)> {
+) -> Result<(String, &'static dyn ChatCompletionsProviderConfig), Error> {
     let provider_info = get_custom_llm_provider(model, custom_llm_provider)
         .or_else(|| {
             custom_llm_provider.map(|provider| CustomLlmProvider {
@@ -20,35 +20,34 @@ pub(super) fn resolve_provider_config<'a>(
             })
         })
         .ok_or_else(|| {
-            CoreError::InvalidProvider(
+            Error::InvalidProvider(
                 "unable to resolve custom_llm_provider for chat completions request".to_string(),
             )
         })?;
     let config = chat_completions_provider_config(provider_info.custom_llm_provider)
-        .ok_or_else(|| CoreError::InvalidProvider(provider_info.custom_llm_provider.to_string()))?;
+        .ok_or_else(|| Error::InvalidProvider(provider_info.custom_llm_provider.to_string()))?;
     Ok((provider_info.model.to_string(), config))
 }
 
-pub(super) fn parse_messages(messages: Value) -> CoreResult<Vec<ChatMessage>> {
-    serde_json::from_value(messages).map_err(|err| {
-        CoreError::InvalidRequest(format!("invalid chat completions messages: {err}"))
-    })
+pub(super) fn parse_messages(messages: Value) -> Result<Vec<ChatMessage>, Error> {
+    serde_json::from_value(messages)
+        .map_err(|err| Error::InvalidRequest(format!("invalid chat completions messages: {err}")))
 }
 
 pub(super) fn prepare_chat_completions_call(
     request: ChatCompletionsRequest<'_>,
-) -> CoreResult<ProviderChatCompletionsRequest> {
+) -> Result<ProviderChatCompletionsRequest, Error> {
     let (model, config) = resolve_provider_config(request.model, request.custom_llm_provider)?;
     let env_lookup = |key: &str| std::env::var(key).ok();
 
     let messages = parse_messages(request.messages)?;
     if messages.is_empty() {
-        return Err(CoreError::InvalidRequest(
+        return Err(Error::InvalidRequest(
             "chat completions requires at least one message".to_string(),
         ));
     }
     if let Some(reason) = config.unsupported_reason(&messages, &request.optional_params) {
-        return Err(CoreError::Unsupported(reason.0));
+        return Err(Error::Unsupported(reason.0));
     }
 
     let mut headers = string_headers(request.extra_headers)?;
diff --git a/litellm-rust/crates/core/src/chat_completions/tests.rs b/litellm-rust/crates/core/src/chat_completions/tests.rs
index e2383723cb0..2858d180e27 100644
--- a/litellm-rust/crates/core/src/chat_completions/tests.rs
+++ b/litellm-rust/crates/core/src/chat_completions/tests.rs
@@ -1,6 +1,6 @@
 use serde_json::{Map, Value, json};
 
-use crate::error::CoreError;
+use crate::error::Error;
 
 use super::prepare::prepare_chat_completions_call;
 use super::transformation::ChatCompletionsAuth;
@@ -29,7 +29,7 @@ fn request<'a>(
 
 /// `ProviderChatCompletionsRequest` deliberately has no `Debug` (its headers
 /// carry resolved credentials), so unwrap the failure case by hand.
-fn decline(request: ChatCompletionsRequest<'_>) -> CoreError {
+fn decline(request: ChatCompletionsRequest<'_>) -> Error {
     match prepare_chat_completions_call(request) {
         Err(error) => error,
         Ok(prepared) => panic!("expected a decline, prepared a call to {}", prepared.url),
@@ -196,7 +196,7 @@ fn declines_an_unsupported_request_before_resolving_credentials() {
     call.api_key = None;
     // No api_key is set and no env is consulted: the gate must run first, so the
     // error is the decline rather than a missing-credential error.
-    assert_eq!(decline(call), CoreError::Unsupported("streaming"));
+    assert_eq!(decline(call), Error::Unsupported("streaming"));
 }
 
 #[test]
@@ -208,7 +208,7 @@ fn rejects_an_unknown_provider() {
             json!([{"role": "user", "content": "hi"}]),
             json!({}),
         )),
-        CoreError::InvalidProvider("openai".to_string())
+        Error::InvalidProvider("openai".to_string())
     );
 }
 
@@ -221,7 +221,7 @@ fn rejects_a_model_with_no_resolvable_provider() {
             json!([{"role": "user", "content": "hi"}]),
             json!({}),
         )),
-        CoreError::InvalidProvider(_)
+        Error::InvalidProvider(_)
     ));
 }
 
@@ -234,7 +234,7 @@ fn rejects_an_empty_or_malformed_message_list() {
             json!([]),
             json!({}),
         )),
-        CoreError::InvalidRequest("chat completions requires at least one message".to_string())
+        Error::InvalidRequest("chat completions requires at least one message".to_string())
     );
     assert!(matches!(
         decline(request(
@@ -243,7 +243,7 @@ fn rejects_an_empty_or_malformed_message_list() {
             json!("not a list"),
             json!({}),
         )),
-        CoreError::InvalidRequest(_)
+        Error::InvalidRequest(_)
     ));
 }
 
@@ -258,7 +258,7 @@ fn rejects_non_string_extra_headers() {
     call.extra_headers = Some(Map::from_iter([("x-trace".to_string(), json!(7))]));
     assert_eq!(
         decline(call),
-        CoreError::InvalidRequest(
+        Error::InvalidRequest(
             "chat completions extra_headers.x-trace must be a string, got number".to_string()
         )
     );
@@ -374,7 +374,7 @@ async fn a_forwarded_header_the_signer_computes_declines_to_python() {
             .await
             .expect_err("{forwarded} should decline instead of being signed");
         assert!(
-            matches!(error, CoreError::Unsupported(_)),
+            matches!(error, Error::Unsupported(_)),
             "{forwarded} declined as {error:?}, which the host would not fall back on"
         );
     }
@@ -727,7 +727,7 @@ mod round_trip {
         .expect_err("response cannot be normalized");
         handle.await.expect("server task");
         assert!(
-            matches!(err, CoreError::InvalidResponse(_)),
+            matches!(err, Error::InvalidResponse(_)),
             "expected a post-send error, got {err:?}"
         );
     }
@@ -745,7 +745,7 @@ mod round_trip {
         .expect_err("response cannot be normalized");
         handle.await.expect("server task");
         assert!(
-            matches!(err, CoreError::InvalidResponse(_)),
+            matches!(err, Error::InvalidResponse(_)),
             "expected a post-send error, got {err:?}"
         );
     }
@@ -763,7 +763,7 @@ mod round_trip {
         .expect_err("upstream rejects");
         handle.await.expect("server task");
         assert!(
-            matches!(err, CoreError::Http { status: 429, .. }),
+            matches!(err, Error::Http { status: 429, .. }),
             "expected a 429, got {err:?}"
         );
     }
@@ -787,7 +787,7 @@ mod round_trip {
         .await
         .expect_err("nothing is listening");
         assert!(
-            matches!(err, CoreError::Connect(_)),
+            matches!(err, Error::Connect(_)),
             "expected a pre-send connect failure, got {err:?}"
         );
     }
@@ -797,24 +797,24 @@ mod round_trip {
         use crate::chat_completions::handler::as_response_error;
 
         for original in [
-            CoreError::MissingField("usage"),
-            CoreError::Unsupported("non-text response content block"),
-            CoreError::InvalidRequest("whatever".to_string()),
-            CoreError::Auth("whatever".to_string()),
+            Error::MissingField("usage"),
+            Error::Unsupported("non-text response content block"),
+            Error::InvalidRequest("whatever".to_string()),
+            Error::Auth("whatever".to_string()),
         ] {
             let label = format!("{original:?}");
             assert!(
-                matches!(as_response_error(original), CoreError::InvalidResponse(_)),
+                matches!(as_response_error(original), Error::InvalidResponse(_)),
                 "{label} must not stay retryable once the provider has answered"
             );
         }
         // An upstream status is already unambiguous, so it survives intact.
         assert!(matches!(
-            as_response_error(CoreError::Http {
+            as_response_error(Error::Http {
                 status: 500,
                 body: "boom".to_string()
             }),
-            CoreError::Http { status: 500, .. }
+            Error::Http { status: 500, .. }
         ));
     }
 }
diff --git a/litellm-rust/crates/core/src/chat_completions/transformation.rs b/litellm-rust/crates/core/src/chat_completions/transformation.rs
index a30ce9dc77c..a0868209305 100644
--- a/litellm-rust/crates/core/src/chat_completions/transformation.rs
+++ b/litellm-rust/crates/core/src/chat_completions/transformation.rs
@@ -1,7 +1,6 @@
+use crate::Error;
 use serde_json::{Map, Value};
 
-use crate::error::CoreResult;
-
 use super::types::{
     ChatCompletionsResponse, ChatMessage, ChatMessageContent, ProviderChatRequestData,
     ProviderChatResponseData,
@@ -39,7 +38,7 @@ pub trait ChatCompletionsProviderConfig: Sync {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn auth(
         &self,
@@ -47,7 +46,7 @@ pub trait ChatCompletionsProviderConfig: Sync {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<ChatCompletionsAuth>;
+    ) -> Result<ChatCompletionsAuth, Error>;
 
     fn default_headers(&self) -> &'static [(&'static str, &'static str)] {
         &[("content-type", "application/json")]
@@ -91,13 +90,13 @@ pub trait ChatCompletionsProviderConfig: Sync {
         model: &str,
         messages: Vec<ChatMessage>,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<ProviderChatRequestData>;
+    ) -> Result<ProviderChatRequestData, Error>;
 
     fn transform_response(
         &self,
         model: &str,
         response: ProviderChatResponseData,
-    ) -> CoreResult<ChatCompletionsResponse>;
+    ) -> Result<ChatCompletionsResponse, Error>;
 }
 
 pub fn unsupported_param(
diff --git a/litellm-rust/crates/core/src/constants.rs b/litellm-rust/crates/core/src/constants.rs
index e1ac0a4fc8f..a73961060eb 100644
--- a/litellm-rust/crates/core/src/constants.rs
+++ b/litellm-rust/crates/core/src/constants.rs
@@ -30,6 +30,8 @@ pub(crate) const CHAT_COMPLETIONS_TIMEOUT_SECS: u64 = 600;
 /// Connect timeout for chat completions provider calls, in seconds.
 pub(crate) const CHAT_COMPLETIONS_CONNECT_TIMEOUT_SECS: u64 = 10;
 
+pub(crate) const AUDIO_TRANSCRIPTION_TIMEOUT_SECS: u64 = 600;
+
 /// `object` field every non-streaming chat completion response carries.
 pub const CHAT_COMPLETION_OBJECT: &str = "chat.completion";
 
diff --git a/litellm-rust/crates/core/src/error.rs b/litellm-rust/crates/core/src/error.rs
index 739532f8cb5..db3fa2ec704 100644
--- a/litellm-rust/crates/core/src/error.rs
+++ b/litellm-rust/crates/core/src/error.rs
@@ -1,9 +1,7 @@
-use thiserror::Error;
+use thiserror::Error as ThisError;
 
-pub type CoreResult<T> = Result<T, CoreError>;
-
-#[derive(Debug, Error, PartialEq, Eq)]
-pub enum CoreError {
+#[derive(Debug, ThisError, PartialEq, Eq)]
+pub enum Error {
     #[error("expected {expected}, got {actual}")]
     InvalidType {
         expected: &'static str,
diff --git a/litellm-rust/crates/core/src/http_utils.rs b/litellm-rust/crates/core/src/http_utils.rs
index c541f50275b..10661fadf96 100644
--- a/litellm-rust/crates/core/src/http_utils.rs
+++ b/litellm-rust/crates/core/src/http_utils.rs
@@ -3,7 +3,7 @@
 use serde_json::{Map, Value};
 
 use crate::constants::UPSTREAM_ERROR_BODY_MAX_CHARS;
-use crate::error::{CoreError, CoreResult, json_type_name};
+use crate::error::{Error, json_type_name};
 
 /// Bound an upstream error body before it crosses a host boundary, so provider
 /// bodies stay data-minimized.
@@ -18,7 +18,7 @@ pub fn truncate_error_body(body: &str) -> String {
 pub fn string_headers(
     context: &'static str,
     extra_headers: Option<Map<String, Value>>,
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     extra_headers
         .unwrap_or_default()
         .into_iter()
@@ -27,7 +27,7 @@ pub fn string_headers(
                 .as_str()
                 .map(|value| (key.clone(), value.to_string()))
                 .ok_or_else(|| {
-                    CoreError::InvalidRequest(format!(
+                    Error::InvalidRequest(format!(
                         "{context} extra_headers.{key} must be a string, got {}",
                         json_type_name(&value)
                     ))
@@ -81,7 +81,7 @@ mod tests {
         let err = string_headers("chat completions", Some(headers)).expect_err("non-string value");
         assert_eq!(
             err,
-            CoreError::InvalidRequest(
+            Error::InvalidRequest(
                 "chat completions extra_headers.x-trace must be a string, got number".to_string()
             )
         );
diff --git a/litellm-rust/crates/core/src/lib.rs b/litellm-rust/crates/core/src/lib.rs
index dce4a425ea0..0e18d24e5d8 100644
--- a/litellm-rust/crates/core/src/lib.rs
+++ b/litellm-rust/crates/core/src/lib.rs
@@ -13,4 +13,4 @@ pub mod responses;
 pub mod router;
 pub mod routing_utils;
 
-pub use error::{CoreError, CoreResult};
+pub use error::Error;
diff --git a/litellm-rust/crates/core/src/messages/common_utils.rs b/litellm-rust/crates/core/src/messages/common_utils.rs
index a14dffbc1fe..8dfdb2e361a 100644
--- a/litellm-rust/crates/core/src/messages/common_utils.rs
+++ b/litellm-rust/crates/core/src/messages/common_utils.rs
@@ -1,9 +1,8 @@
-use serde_json::{Map, Value};
-
-use crate::error::CoreResult;
+use crate::Error;
 use crate::http_utils::string_headers as shared_string_headers;
 use crate::providers::anthropic::messages::transformation::ANTHROPIC_MESSAGES_CONFIG;
 use crate::providers::azure_ai::messages::transformation::AZURE_ANTHROPIC_MESSAGES_CONFIG;
+use serde_json::{Map, Value};
 
 use super::transformation::AnthropicMessagesProviderConfig;
 
@@ -23,6 +22,6 @@ pub(super) fn messages_provider_config(
 
 pub(super) fn string_headers(
     extra_headers: Option<Map<String, Value>>,
-) -> CoreResult<Vec<(String, String)>> {
+) -> Result<Vec<(String, String)>, Error> {
     shared_string_headers(HEADER_CONTEXT, extra_headers)
 }
diff --git a/litellm-rust/crates/core/src/messages/handler.rs b/litellm-rust/crates/core/src/messages/handler.rs
index 1c895f66eba..13a65d86131 100644
--- a/litellm-rust/crates/core/src/messages/handler.rs
+++ b/litellm-rust/crates/core/src/messages/handler.rs
@@ -1,5 +1,5 @@
 use crate::constants::ANTHROPIC_MESSAGES_PROVIDER;
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 
 use super::client::http_client;
 use super::common_utils::truncate_error_body;
@@ -7,7 +7,7 @@ use super::types::{AnthropicMessagesResponse, ProviderMessagesRequest};
 
 pub(super) async fn execute_messages_provider_call(
     request: ProviderMessagesRequest,
-) -> CoreResult<AnthropicMessagesResponse> {
+) -> Result<AnthropicMessagesResponse, Error> {
     let mut request_builder = http_client().post(&request.url).json(&request.body);
     for (key, value) in &request.upstream_headers {
         request_builder = request_builder.header(key, value);
@@ -19,32 +19,31 @@ pub(super) async fn execute_messages_provider_call(
     let response = request_builder
         .send()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
 
     let status = response.status();
     let text = response
         .text()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
 
     if !status.is_success() {
-        return Err(CoreError::Http {
+        return Err(Error::Http {
             status: status.as_u16(),
             body: truncate_error_body(&text),
         });
     }
 
-    let response = serde_json::from_str(&text).map_err(|err| {
-        CoreError::InvalidResponse(format!("invalid messages response JSON: {err}"))
-    })?;
+    let response = serde_json::from_str(&text)
+        .map_err(|err| Error::InvalidResponse(format!("invalid messages response JSON: {err}")))?;
     request.config.transform_response(&request.model, response)
 }
 
 pub(super) async fn execute_messages_provider_stream(
     request: ProviderMessagesRequest,
-) -> CoreResult<reqwest::Response> {
+) -> Result<reqwest::Response, Error> {
     if request.provider != ANTHROPIC_MESSAGES_PROVIDER {
-        return Err(CoreError::InvalidRequest(
+        return Err(Error::InvalidRequest(
             "streaming messages is not supported for this provider".to_string(),
         ));
     }
@@ -60,14 +59,14 @@ pub(super) async fn execute_messages_provider_stream(
     let response = request_builder
         .send()
         .await
-        .map_err(|err| CoreError::Network(err.to_string()))?;
+        .map_err(|err| Error::Network(err.to_string()))?;
     let status = response.status();
     if !status.is_success() {
         let text = response
             .text()
             .await
-            .map_err(|err| CoreError::Network(err.to_string()))?;
-        return Err(CoreError::Http {
+            .map_err(|err| Error::Network(err.to_string()))?;
+        return Err(Error::Http {
             status: status.as_u16(),
             body: truncate_error_body(&text),
         });
diff --git a/litellm-rust/crates/core/src/messages/mod.rs b/litellm-rust/crates/core/src/messages/mod.rs
index acb36d89daf..ee2877e61fc 100644
--- a/litellm-rust/crates/core/src/messages/mod.rs
+++ b/litellm-rust/crates/core/src/messages/mod.rs
@@ -7,6 +7,7 @@
 //! is the streaming variant; it hands the raw upstream response back so a host
 //! can splice the event stream to its own caller.
 
+use crate::Error;
 mod client;
 mod common_utils;
 mod handler;
@@ -14,17 +15,15 @@ mod prepare;
 pub mod transformation;
 pub mod types;
 
-use crate::error::CoreResult;
-
 use handler::{execute_messages_provider_call, execute_messages_provider_stream};
 use prepare::prepare_messages_call;
 use types::{AnthropicMessagesResponse, MessagesRequest};
 
-pub async fn messages(request: MessagesRequest<'_>) -> CoreResult<AnthropicMessagesResponse> {
+pub async fn messages(request: MessagesRequest<'_>) -> Result<AnthropicMessagesResponse, Error> {
     execute_messages_provider_call(prepare_messages_call(request)?).await
 }
 
-pub async fn messages_stream(request: MessagesRequest<'_>) -> CoreResult<reqwest::Response> {
+pub async fn messages_stream(request: MessagesRequest<'_>) -> Result<reqwest::Response, Error> {
     execute_messages_provider_stream(prepare_messages_call(request)?).await
 }
 
diff --git a/litellm-rust/crates/core/src/messages/prepare.rs b/litellm-rust/crates/core/src/messages/prepare.rs
index 94b5b1eaed7..3b253ac3766 100644
--- a/litellm-rust/crates/core/src/messages/prepare.rs
+++ b/litellm-rust/crates/core/src/messages/prepare.rs
@@ -1,4 +1,4 @@
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};
 
 use super::common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers};
@@ -7,7 +7,7 @@ use super::types::{MessagesRequest, ProviderMessagesRequest};
 
 pub(super) fn prepare_messages_call(
     request: MessagesRequest<'_>,
-) -> CoreResult<ProviderMessagesRequest> {
+) -> Result<ProviderMessagesRequest, Error> {
     let provider_info = get_custom_llm_provider(request.model, request.custom_llm_provider)
         .or_else(|| {
             request
@@ -18,7 +18,7 @@ pub(super) fn prepare_messages_call(
                 })
         })
         .ok_or_else(|| {
-            CoreError::InvalidProvider(
+            Error::InvalidProvider(
                 "unable to resolve custom_llm_provider for messages request".to_string(),
             )
         })?;
@@ -26,7 +26,7 @@ pub(super) fn prepare_messages_call(
     let provider = provider_info.custom_llm_provider;
 
     let config = messages_provider_config(provider)
-        .ok_or_else(|| CoreError::InvalidProvider(provider.to_string()))?;
+        .ok_or_else(|| Error::InvalidProvider(provider.to_string()))?;
     let env_lookup = |key: &str| std::env::var(key).ok();
 
     let mut headers = string_headers(request.extra_headers)?;
@@ -53,11 +53,11 @@ pub(super) fn prepare_messages_call(
 
     let url = config.complete_url(request.api_base, &model, &env_lookup)?;
     let typed_request = serde_json::from_value(request.body).map_err(|err| {
-        CoreError::InvalidRequest(format!("invalid Anthropic messages request: {err}"))
+        Error::InvalidRequest(format!("invalid Anthropic messages request: {err}"))
     })?;
     let transformed = config.transform_request(typed_request)?;
     let body = serde_json::to_value(transformed).map_err(|err| {
-        CoreError::InvalidRequest(format!(
+        Error::InvalidRequest(format!(
             "failed to serialize Anthropic messages request: {err}"
         ))
     })?;
diff --git a/litellm-rust/crates/core/src/messages/tests.rs b/litellm-rust/crates/core/src/messages/tests.rs
index 9fc1763683b..df9f7051011 100644
--- a/litellm-rust/crates/core/src/messages/tests.rs
+++ b/litellm-rust/crates/core/src/messages/tests.rs
@@ -4,7 +4,7 @@ use serde_json::{Map, Value, json};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 
-use crate::error::CoreError;
+use crate::error::Error;
 
 use super::common_utils::{
     has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body,
@@ -77,7 +77,7 @@ fn truncate_error_body_caps_long_payloads() {
 fn string_headers_rejects_non_string_values() {
     let headers = json!({"x-count": 3}).as_object().unwrap().clone();
     let err = string_headers(Some(headers)).expect_err("non-string header rejected");
-    assert!(matches!(err, CoreError::InvalidRequest(_)));
+    assert!(matches!(err, Error::InvalidRequest(_)));
 }
 
 #[test]
@@ -341,7 +341,7 @@ async fn messages_requires_auth_when_no_key_and_no_header() {
     .await
     .expect_err("missing auth errors");
 
-    assert!(matches!(err, CoreError::Auth(_)));
+    assert!(matches!(err, Error::Auth(_)));
 }
 
 #[tokio::test]
@@ -420,7 +420,7 @@ async fn messages_maps_provider_error_status_to_http_error() {
     .await
     .expect_err("provider error propagates");
 
-    assert!(matches!(err, CoreError::Http { status: 401, .. }));
+    assert!(matches!(err, Error::Http { status: 401, .. }));
 }
 
 #[tokio::test]
@@ -437,5 +437,5 @@ async fn messages_rejects_unsupported_provider() {
     .await
     .expect_err("unsupported provider errors");
 
-    assert!(matches!(err, CoreError::InvalidProvider(provider) if provider == "openai"));
+    assert!(matches!(err, Error::InvalidProvider(provider) if provider == "openai"));
 }
diff --git a/litellm-rust/crates/core/src/messages/transformation.rs b/litellm-rust/crates/core/src/messages/transformation.rs
index b478e20d24b..673a5728aca 100644
--- a/litellm-rust/crates/core/src/messages/transformation.rs
+++ b/litellm-rust/crates/core/src/messages/transformation.rs
@@ -1,6 +1,5 @@
-use crate::error::CoreResult;
-
 use super::types::{AnthropicMessagesRequest, AnthropicMessagesResponse};
+use crate::Error;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum MessagesAuthStrategy {
@@ -23,13 +22,13 @@ pub trait AnthropicMessagesProviderConfig: Sync {
         api_base: Option<&str>,
         model: &str,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn resolve_api_key(
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn auth_strategy(&self) -> MessagesAuthStrategy {
         MessagesAuthStrategy::Header("x-api-key")
@@ -49,7 +48,7 @@ pub trait AnthropicMessagesProviderConfig: Sync {
     fn transform_request(
         &self,
         request: AnthropicMessagesRequest,
-    ) -> CoreResult<AnthropicMessagesRequest> {
+    ) -> Result<AnthropicMessagesRequest, Error> {
         Ok(request)
     }
 
@@ -57,7 +56,7 @@ pub trait AnthropicMessagesProviderConfig: Sync {
         &self,
         _model: &str,
         response: AnthropicMessagesResponse,
-    ) -> CoreResult<AnthropicMessagesResponse> {
+    ) -> Result<AnthropicMessagesResponse, Error> {
         Ok(response)
     }
 }
diff --git a/litellm-rust/crates/core/src/ocr/transformation.rs b/litellm-rust/crates/core/src/ocr/transformation.rs
index cb3e735e533..3d3c16c8cb6 100644
--- a/litellm-rust/crates/core/src/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/ocr/transformation.rs
@@ -1,7 +1,6 @@
+use crate::Error;
 use serde_json::{Map, Value};
 
-use crate::CoreResult;
-
 use super::types::{OcrRequestData, OcrResponseData};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -43,13 +42,13 @@ pub trait OcrProviderConfig: Sync {
         model: &str,
         document: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData>;
+    ) -> Result<OcrRequestData, Error>;
 
     fn transform_ocr_response(
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData>;
+    ) -> Result<OcrResponseData, Error>;
 
     fn complete_url(
         &self,
@@ -57,13 +56,13 @@ pub trait OcrProviderConfig: Sync {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn resolve_api_key(
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String>;
+    ) -> Result<String, Error>;
 
     fn auth_strategy(&self) -> OcrAuthStrategy {
         OcrAuthStrategy::Bearer
diff --git a/litellm-rust/crates/core/src/providers/anthropic/chat_completions/tests.rs b/litellm-rust/crates/core/src/providers/anthropic/chat_completions/tests.rs
index 4534ac0182c..b22de6c47de 100644
--- a/litellm-rust/crates/core/src/providers/anthropic/chat_completions/tests.rs
+++ b/litellm-rust/crates/core/src/providers/anthropic/chat_completions/tests.rs
@@ -1,4 +1,5 @@
 use super::*;
+use crate::Error;
 use serde_json::json;
 
 fn messages(value: Value) -> Vec<ChatMessage> {
@@ -19,7 +20,7 @@ fn transform(model: &str, msgs: Value, opts: Value) -> Value {
         .body
 }
 
-fn transform_response(body: Value) -> CoreResult<ChatCompletionsResponse> {
+fn transform_response(body: Value) -> Result<ChatCompletionsResponse, Error> {
     ANTHROPIC_CHAT_COMPLETIONS_CONFIG
         .transform_response("claude-sonnet-4-5", ProviderChatResponseData { body })
 }
@@ -390,29 +391,26 @@ fn declines_a_response_carrying_a_non_text_block() {
         "usage": {"input_tokens": 1, "output_tokens": 1}
     }))
     .expect_err("non-text block");
-    assert_eq!(
-        err,
-        CoreError::Unsupported("non-text response content block")
-    );
+    assert_eq!(err, Error::Unsupported("non-text response content block"));
 }
 
 #[test]
 fn errors_on_a_response_missing_required_fields() {
     assert_eq!(
         transform_response(json!("nope")).expect_err("not an object"),
-        CoreError::InvalidResponse("messages response is not an object".to_string())
+        Error::InvalidResponse("messages response is not an object".to_string())
     );
     assert_eq!(
         transform_response(json!({"model": "m", "usage": {}})).expect_err("no content"),
-        CoreError::MissingField("content")
+        Error::MissingField("content")
     );
     assert_eq!(
         transform_response(json!({"model": "m", "content": []})).expect_err("no usage"),
-        CoreError::MissingField("usage")
+        Error::MissingField("usage")
     );
     assert_eq!(
         transform_response(json!({"content": [], "usage": {}})).expect_err("no model"),
-        CoreError::MissingField("model")
+        Error::MissingField("model")
     );
 }
 
diff --git a/litellm-rust/crates/core/src/providers/anthropic/chat_completions/transformation.rs b/litellm-rust/crates/core/src/providers/anthropic/chat_completions/transformation.rs
index 3658642b539..97cc48aa6f2 100644
--- a/litellm-rust/crates/core/src/providers/anthropic/chat_completions/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/anthropic/chat_completions/transformation.rs
@@ -10,7 +10,7 @@ use crate::chat_completions::types::{
     ProviderChatRequestData, ProviderChatResponseData,
 };
 use crate::constants::ANTHROPIC_OAUTH_TOKEN_PREFIX;
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::providers::anthropic::messages::transformation::{
     complete_anthropic_url, resolve_anthropic_api_key,
 };
@@ -74,7 +74,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
         _model: &str,
         _optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         Ok(complete_anthropic_url(api_base, env_lookup))
     }
 
@@ -84,7 +84,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
         _model: &str,
         _optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<ChatCompletionsAuth> {
+    ) -> Result<ChatCompletionsAuth, Error> {
         Ok(ChatCompletionsAuth::Header {
             name: "x-api-key",
             value: resolve_anthropic_api_key(api_key, env_lookup)?,
@@ -137,7 +137,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
         model: &str,
         messages: Vec<ChatMessage>,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<ProviderChatRequestData> {
+    ) -> Result<ProviderChatRequestData, Error> {
         Ok(ProviderChatRequestData {
             body: anthropic_body(model, &build_conversation(&messages), optional_params),
         })
@@ -147,15 +147,16 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
         &self,
         _model: &str,
         response: ProviderChatResponseData,
-    ) -> CoreResult<ChatCompletionsResponse> {
-        let body = response.body.as_object().ok_or_else(|| {
-            CoreError::InvalidResponse("messages response is not an object".into())
-        })?;
+    ) -> Result<ChatCompletionsResponse, Error> {
+        let body = response
+            .body
+            .as_object()
+            .ok_or_else(|| Error::InvalidResponse("messages response is not an object".into()))?;
 
         let content = body
             .get("content")
             .and_then(Value::as_array)
-            .ok_or(CoreError::MissingField("content"))?;
+            .ok_or(Error::MissingField("content"))?;
         // The route declines tool and thinking requests, so a non-text block
         // means the response carries something this path never asked for.
         // Decline rather than silently dropping it; the host falls back.
@@ -163,7 +164,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
             .iter()
             .any(|block| block.get("type").and_then(Value::as_str) != Some("text"))
         {
-            return Err(CoreError::Unsupported("non-text response content block"));
+            return Err(Error::Unsupported("non-text response content block"));
         }
         let text: String = content
             .iter()
@@ -173,7 +174,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
         let usage = body
             .get("usage")
             .and_then(Value::as_object)
-            .ok_or(CoreError::MissingField("usage"))?;
+            .ok_or(Error::MissingField("usage"))?;
         let field = |name: &str| usage.get(name).and_then(Value::as_u64).unwrap_or(0);
 
         Ok(ChatCompletionsResponse {
@@ -181,7 +182,7 @@ impl ChatCompletionsProviderConfig for AnthropicChatCompletionsConfig {
             model: body
                 .get("model")
                 .and_then(Value::as_str)
-                .ok_or(CoreError::MissingField("model"))?
+                .ok_or(Error::MissingField("model"))?
                 .to_string(),
             choices: vec![ChatCompletionsChoice {
                 index: 0,
diff --git a/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs b/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs
index 829f2260d3c..8fcc0f36c7d 100644
--- a/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/anthropic/messages/transformation.rs
@@ -1,4 +1,4 @@
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::messages::transformation::{AnthropicMessagesProviderConfig, MessagesAuthStrategy};
 
 const ANTHROPIC_API_KEY_ENV: &str = "ANTHROPIC_API_KEY";
@@ -17,12 +17,12 @@ pub fn non_empty(value: Option<&str>) -> Option<&str> {
 pub fn resolve_anthropic_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     non_empty(api_key)
         .map(str::to_string)
         .or_else(|| env_lookup(ANTHROPIC_API_KEY_ENV).filter(|value| !value.trim().is_empty()))
         .ok_or_else(|| {
-            CoreError::Auth(
+            Error::Auth(
                 "Missing Anthropic API Key - Set `api_key` or the ANTHROPIC_API_KEY \
                  environment variable"
                     .to_string(),
@@ -52,7 +52,7 @@ impl AnthropicMessagesProviderConfig for AnthropicMessagesConfig {
         api_base: Option<&str>,
         _model: &str,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         Ok(complete_anthropic_url(api_base, env_lookup))
     }
 
@@ -60,7 +60,7 @@ impl AnthropicMessagesProviderConfig for AnthropicMessagesConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_anthropic_api_key(api_key, env_lookup)
     }
 
@@ -121,7 +121,7 @@ mod tests {
         );
         assert!(matches!(
             resolve_anthropic_api_key(None, &|_| None).expect_err("missing key"),
-            CoreError::Auth(_)
+            Error::Auth(_)
         ));
     }
 
diff --git a/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs b/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs
index 7b958c77ba3..70dad0300f1 100644
--- a/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs
@@ -1,4 +1,4 @@
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use crate::messages::transformation::{AnthropicMessagesProviderConfig, MessagesAuthStrategy};
 use crate::messages::types::{
     AnthropicMessage, AnthropicMessagesRequest, AnthropicMessagesResponse, ContentBlock,
@@ -28,12 +28,12 @@ pub const AZURE_ANTHROPIC_MESSAGES_CONFIG: AzureAnthropicMessagesConfig =
 pub fn resolve_azure_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     non_empty(api_key)
         .map(str::to_string)
         .or_else(|| env_lookup(AZURE_API_KEY_ENV).filter(|value| !value.trim().is_empty()))
         .ok_or_else(|| {
-            CoreError::Auth(
+            Error::Auth(
                 "Missing Azure API Key - Set `api_key` or the AZURE_API_KEY environment variable"
                     .to_string(),
             )
@@ -43,12 +43,12 @@ pub fn resolve_azure_api_key(
 pub fn complete_azure_anthropic_url(
     api_base: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     let api_base = non_empty(api_base)
         .map(str::to_string)
         .or_else(|| env_lookup(AZURE_API_BASE_ENV).filter(|value| !value.trim().is_empty()))
         .ok_or_else(|| {
-            CoreError::Auth(
+            Error::Auth(
                 "Missing Azure API Base - Set `api_base` or the AZURE_API_BASE environment variable. \
                  Expected format: https://<resource-name>.services.ai.azure.com/anthropic"
                     .to_string(),
@@ -147,7 +147,7 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
         api_base: Option<&str>,
         _model: &str,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         complete_azure_anthropic_url(api_base, env_lookup)
     }
 
@@ -155,7 +155,7 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_azure_api_key(api_key, env_lookup)
     }
 
@@ -174,7 +174,7 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
     fn transform_request(
         &self,
         request: AnthropicMessagesRequest,
-    ) -> CoreResult<AnthropicMessagesRequest> {
+    ) -> Result<AnthropicMessagesRequest, Error> {
         let mut request = fold_system_role_messages(request);
         if let Some(system) = request.system.as_mut() {
             strip_scope_from_system(system);
@@ -190,7 +190,7 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
         &self,
         model: &str,
         response: AnthropicMessagesResponse,
-    ) -> CoreResult<AnthropicMessagesResponse> {
+    ) -> Result<AnthropicMessagesResponse, Error> {
         self.anthropic.transform_response(model, response)
     }
 }
@@ -268,7 +268,7 @@ mod tests {
             "https://env.services.ai.azure.com/anthropic/v1/messages"
         );
         let err = complete_azure_anthropic_url(Some("  "), &|_| None).expect_err("missing base");
-        assert!(matches!(err, CoreError::Auth(_)));
+        assert!(matches!(err, Error::Auth(_)));
     }
 
     #[test]
@@ -284,7 +284,7 @@ mod tests {
         );
         assert!(matches!(
             resolve_azure_api_key(None, &|_| None).expect_err("missing key"),
-            CoreError::Auth(_)
+            Error::Auth(_)
         ));
     }
 
diff --git a/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs
index eabd15677cc..b26a7925e8a 100644
--- a/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs
@@ -1,6 +1,6 @@
 use std::collections::BTreeSet;
 
-use crate::error::{CoreError, CoreResult, json_type_name};
+use crate::error::{Error, json_type_name};
 use crate::ocr::transformation::{OcrAuthStrategy, OcrProviderConfig, OcrResponseHandling};
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
 use serde_json::{Map, Value, json};
@@ -32,17 +32,17 @@ fn resolve_value(
     env_name: &str,
     env_lookup: &dyn Fn(&str) -> Option<String>,
     missing_message: &str,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     non_empty(explicit)
         .map(str::to_string)
         .or_else(|| env_lookup(env_name).filter(|value| !value.trim().is_empty()))
-        .ok_or_else(|| CoreError::Auth(missing_message.to_string()))
+        .ok_or_else(|| Error::Auth(missing_message.to_string()))
 }
 
 pub fn resolve_azure_ai_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     resolve_value(
         api_key,
         AZURE_AI_API_KEY_ENV,
@@ -54,7 +54,7 @@ pub fn resolve_azure_ai_api_key(
 pub fn resolve_azure_ai_api_base(
     api_base: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     resolve_value(
         api_base,
         AZURE_AI_API_BASE_ENV,
@@ -66,7 +66,7 @@ pub fn resolve_azure_ai_api_base(
 pub fn complete_azure_ai_url(
     api_base: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     let base = resolve_azure_ai_api_base(api_base, env_lookup)?;
     Ok(format!(
         "{}/providers/mistral/azure/ocr",
@@ -77,7 +77,7 @@ pub fn complete_azure_ai_url(
 pub fn resolve_document_intelligence_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     resolve_value(
         api_key,
         AZURE_DOCUMENT_INTELLIGENCE_API_KEY_ENV,
@@ -89,7 +89,7 @@ pub fn resolve_document_intelligence_api_key(
 pub fn resolve_document_intelligence_endpoint(
     api_base: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     resolve_value(
         api_base,
         AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT_ENV,
@@ -127,7 +127,7 @@ fn pages_token_is_valid(token: &str) -> bool {
     }
 }
 
-fn normalize_pages_param(pages: &Value) -> CoreResult<Option<String>> {
+fn normalize_pages_param(pages: &Value) -> Result<Option<String>, Error> {
     match pages {
         Value::String(value) => {
             let normalized = value
@@ -138,7 +138,7 @@ fn normalize_pages_param(pages: &Value) -> CoreResult<Option<String>> {
             if normalized.split(',').all(pages_token_is_valid) {
                 Ok(Some(normalized))
             } else {
-                Err(CoreError::InvalidRequest(format!(
+                Err(Error::InvalidRequest(format!(
                     "Invalid `pages` string for Azure Document Intelligence: {value:?}. Expected format like '1-3,5,7-9'."
                 )))
             }
@@ -152,7 +152,7 @@ fn normalize_pages_param(pages: &Value) -> CoreResult<Option<String>> {
                 for value in values {
                     let page = value.as_i64().expect("checked is_i64");
                     if page < 0 {
-                        return Err(CoreError::InvalidRequest(
+                        return Err(Error::InvalidRequest(
                             "`pages` integers must be >= 0 (Mistral 0-based indices)".to_string(),
                         ));
                     }
@@ -176,16 +176,16 @@ fn normalize_pages_param(pages: &Value) -> CoreResult<Option<String>> {
                 if normalized.split(',').all(pages_token_is_valid) {
                     return Ok(Some(normalized));
                 }
-                return Err(CoreError::InvalidRequest(format!(
+                return Err(Error::InvalidRequest(format!(
                     "Invalid `pages` list for Azure Document Intelligence: {values:?}. Expected tokens like '1' or '3-5'."
                 )));
             }
-            Err(CoreError::InvalidRequest(
+            Err(Error::InvalidRequest(
                 "`pages` must be a list[int] (0-based, Mistral-style) or a string like '1-3,5,7-9'."
                     .to_string(),
             ))
         }
-        _ => Err(CoreError::InvalidRequest(
+        _ => Err(Error::InvalidRequest(
             "`pages` must be a list[int] (0-based, Mistral-style) or a string like '1-3,5,7-9'."
                 .to_string(),
         )),
@@ -197,7 +197,7 @@ pub fn complete_document_intelligence_url(
     model: &str,
     optional_params: &Map<String, Value>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     let endpoint = resolve_document_intelligence_endpoint(api_base, env_lookup)?;
     let mut url = format!(
         "{}/documentintelligence/documentModels/{}:analyze?api-version={}",
@@ -216,20 +216,20 @@ pub fn complete_document_intelligence_url(
     Ok(url)
 }
 
-fn document_url_from_mistral_document(document: &Value) -> CoreResult<&str> {
-    let object = document.as_object().ok_or_else(|| CoreError::InvalidType {
+fn document_url_from_mistral_document(document: &Value) -> Result<&str, Error> {
+    let object = document.as_object().ok_or_else(|| Error::InvalidType {
         expected: "object",
         actual: json_type_name(document),
     })?;
     let doc_type = object
         .get("type")
         .and_then(Value::as_str)
-        .ok_or(CoreError::MissingField("document.type"))?;
+        .ok_or(Error::MissingField("document.type"))?;
     let field_name = match doc_type {
         "document_url" => "document_url",
         "image_url" => "image_url",
         other => {
-            return Err(CoreError::InvalidRequest(format!(
+            return Err(Error::InvalidRequest(format!(
                 "Invalid document type: {other}. Must be 'document_url' or 'image_url'"
             )));
         }
@@ -238,7 +238,7 @@ fn document_url_from_mistral_document(document: &Value) -> CoreResult<&str> {
         .get(field_name)
         .and_then(Value::as_str)
         .filter(|value| !value.is_empty())
-        .ok_or(CoreError::MissingField(field_name))
+        .ok_or(Error::MissingField(field_name))
 }
 
 fn extract_base64_from_data_uri(data_uri: &str) -> &str {
@@ -290,7 +290,7 @@ impl OcrProviderConfig for AzureAiOcrConfig {
         model: &str,
         document: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData> {
+    ) -> Result<OcrRequestData, Error> {
         MISTRAL_OCR_CONFIG.transform_ocr_request(model, document, optional_params)
     }
 
@@ -298,7 +298,7 @@ impl OcrProviderConfig for AzureAiOcrConfig {
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData> {
+    ) -> Result<OcrResponseData, Error> {
         MISTRAL_OCR_CONFIG.transform_ocr_response(model, response_json)
     }
 
@@ -308,7 +308,7 @@ impl OcrProviderConfig for AzureAiOcrConfig {
         _model: &str,
         _optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         complete_azure_ai_url(api_base, env_lookup)
     }
 
@@ -316,7 +316,7 @@ impl OcrProviderConfig for AzureAiOcrConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_azure_ai_api_key(api_key, env_lookup)
     }
 
@@ -335,7 +335,7 @@ impl OcrProviderConfig for AzureDocumentIntelligenceOcrConfig {
         _model: &str,
         document: Value,
         _optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData> {
+    ) -> Result<OcrRequestData, Error> {
         let document_url = document_url_from_mistral_document(&document)?;
         let mut data = Map::new();
         if document_url.starts_with("data:") {
@@ -359,19 +359,19 @@ impl OcrProviderConfig for AzureDocumentIntelligenceOcrConfig {
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData> {
+    ) -> Result<OcrResponseData, Error> {
         let response = response_json
             .as_object()
-            .ok_or_else(|| CoreError::InvalidType {
+            .ok_or_else(|| Error::InvalidType {
                 expected: "object",
                 actual: json_type_name(&response_json),
             })?;
         let status = response
             .get("status")
             .and_then(Value::as_str)
-            .ok_or(CoreError::MissingField("status"))?;
+            .ok_or(Error::MissingField("status"))?;
         if status != "succeeded" {
-            return Err(CoreError::InvalidResponse(format!(
+            return Err(Error::InvalidResponse(format!(
                 "Azure Document Intelligence analysis failed with status: {status}"
             )));
         }
@@ -414,7 +414,7 @@ impl OcrProviderConfig for AzureDocumentIntelligenceOcrConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         complete_document_intelligence_url(api_base, model, optional_params, env_lookup)
     }
 
@@ -422,7 +422,7 @@ impl OcrProviderConfig for AzureDocumentIntelligenceOcrConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_document_intelligence_api_key(api_key, env_lookup)
     }
 
diff --git a/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs b/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs
index 5e885734182..bb4f6afe5f9 100644
--- a/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs
@@ -6,7 +6,7 @@ use crate::audio_transcription::transformation::{
 use crate::audio_transcription::types::{
     AudioTranscriptionRequestData, AudioTranscriptionResponseData,
 };
-use crate::error::{CoreError, CoreResult, json_type_name};
+use crate::error::{Error, json_type_name};
 
 pub use super::aws_base::{aws_auth_config, bedrock_model_id_and_region, resolve_bedrock_region};
 use super::constants::{BEDROCK_RUNTIME_ENDPOINT_TEMPLATE, BEDROCK_SERVICE};
@@ -18,8 +18,8 @@ pub static BEDROCK_AUDIO_TRANSCRIPTION_CONFIG: BedrockAudioTranscriptionConfig =
 
 pub struct BedrockAudioTranscriptionConfig;
 
-fn audio_fields(audio: Value) -> CoreResult<(String, String)> {
-    let object = audio.as_object().ok_or_else(|| CoreError::InvalidType {
+fn audio_fields(audio: Value) -> Result<(String, String), Error> {
+    let object = audio.as_object().ok_or_else(|| Error::InvalidType {
         expected: "object",
         actual: json_type_name(&audio),
     })?;
@@ -27,13 +27,13 @@ fn audio_fields(audio: Value) -> CoreResult<(String, String)> {
         .get("data")
         .and_then(Value::as_str)
         .filter(|value| !value.is_empty())
-        .ok_or(CoreError::MissingField("audio.data"))?;
+        .ok_or(Error::MissingField("audio.data"))?;
     let format = object
         .get("format")
         .and_then(Value::as_str)
         .filter(|value| matches!(*value, "wav" | "mp3" | "flac" | "ogg"))
         .ok_or_else(|| {
-            CoreError::InvalidRequest("audio.format must be wav, mp3, flac, or ogg".to_string())
+            Error::InvalidRequest("audio.format must be wav, mp3, flac, or ogg".to_string())
         })?;
     Ok((data.to_string(), format.to_string()))
 }
@@ -55,7 +55,7 @@ impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig {
         _model: &str,
         audio: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<AudioTranscriptionRequestData> {
+    ) -> Result<AudioTranscriptionRequestData, Error> {
         let (data, format) = audio_fields(audio)?;
         let mut instruction = "Transcribe the audio. Respond with only the transcript.".to_string();
         if let Some(language) = optional_string(&optional_params, "language") {
@@ -87,14 +87,14 @@ impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig {
         &self,
         _model: &str,
         response_json: Value,
-    ) -> CoreResult<AudioTranscriptionResponseData> {
+    ) -> Result<AudioTranscriptionResponseData, Error> {
         let content = response_json
             .get("output")
             .and_then(|value| value.get("message"))
             .and_then(|value| value.get("content"))
             .and_then(Value::as_array)
             .ok_or_else(|| {
-                CoreError::InvalidResponse("Bedrock response has no output content".to_string())
+                Error::InvalidResponse("Bedrock response has no output content".to_string())
             })?;
         let mut text = String::new();
         for block in content {
@@ -111,7 +111,7 @@ impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         let (model_id, model_region) = bedrock_model_id_and_region(model);
         let region = resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup);
         let endpoint = optional_params
@@ -133,7 +133,7 @@ impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<AudioTranscriptionAuth> {
+    ) -> Result<AudioTranscriptionAuth, Error> {
         let (_, model_region) = bedrock_model_id_and_region(model);
         Ok(AudioTranscriptionAuth::AwsSigV4 {
             region: resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup),
diff --git a/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs b/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs
index b11639aa09b..e5e52bfce95 100644
--- a/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs
@@ -4,7 +4,7 @@ use std::time::Duration;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use crate::caching::in_memory_cache::InMemoryCache;
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 use aws_credential_types::Credentials;
 use aws_credential_types::provider::ProvideCredentials;
 use aws_sigv4::http_request::{
@@ -197,7 +197,7 @@ pub fn classify_auth(
 pub async fn resolve_credentials(
     config: AwsAuthConfig,
     env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
-) -> CoreResult<Credentials> {
+) -> Result<Credentials, Error> {
     let resolved = config.clone().with_environment(env_lookup);
     let flow = classify_auth(config, env_lookup);
     match flow {
@@ -244,9 +244,10 @@ pub async fn resolve_credentials(
             let provider = aws_config::profile::ProfileFileCredentialsProvider::builder()
                 .profile_name(name)
                 .build();
-            provider.provide_credentials().await.map_err(|error| {
-                CoreError::Auth(format!("AWS profile credentials failed: {error}"))
-            })
+            provider
+                .provide_credentials()
+                .await
+                .map_err(|error| Error::Auth(format!("AWS profile credentials failed: {error}")))
         }
         AwsAuthFlow::AssumeRole { role, session_name } => {
             if is_already_running_as_role(&role, &resolved).await? {
@@ -260,7 +261,7 @@ pub async fn resolve_credentials(
                         .build()
                         .await;
                 let credentials = provider.provide_credentials().await.map_err(|error| {
-                    CoreError::Auth(format!("AWS default credentials failed: {error}"))
+                    Error::Auth(format!("AWS default credentials failed: {error}"))
                 })?;
                 set_cached_credentials(
                     key,
@@ -301,7 +302,7 @@ pub async fn resolve_credentials(
             provider
                 .provide_credentials()
                 .await
-                .map_err(|error| CoreError::Auth(format!("AWS role credentials failed: {error}")))
+                .map_err(|error| Error::Auth(format!("AWS role credentials failed: {error}")))
         }
         AwsAuthFlow::WebIdentity {
             token,
@@ -325,13 +326,13 @@ pub async fn resolve_credentials(
                 .send()
                 .await
                 .map_err(|error| {
-                    CoreError::Auth(format!("AWS web identity credentials failed: {error}"))
+                    Error::Auth(format!("AWS web identity credentials failed: {error}"))
                 })?;
             let credentials = response.credentials().ok_or_else(|| {
-                CoreError::Auth("AWS web identity response had no credentials".to_string())
+                Error::Auth("AWS web identity response had no credentials".to_string())
             })?;
             let expiration = SystemTime::try_from(*credentials.expiration()).map_err(|error| {
-                CoreError::Auth(format!("AWS web identity expiration was invalid: {error}"))
+                Error::Auth(format!("AWS web identity expiration was invalid: {error}"))
             })?;
             Ok(Credentials::new(
                 credentials.access_key_id(),
@@ -350,9 +351,10 @@ pub async fn resolve_credentials(
                 aws_config::default_provider::credentials::DefaultCredentialsChain::builder()
                     .build()
                     .await;
-            let credentials = provider.provide_credentials().await.map_err(|error| {
-                CoreError::Auth(format!("AWS default credentials failed: {error}"))
-            })?;
+            let credentials = provider
+                .provide_credentials()
+                .await
+                .map_err(|error| Error::Auth(format!("AWS default credentials failed: {error}")))?;
             set_cached_credentials(
                 key,
                 credentials.clone(),
@@ -363,7 +365,7 @@ pub async fn resolve_credentials(
     }
 }
 
-async fn is_already_running_as_role(role: &str, config: &AwsAuthConfig) -> CoreResult<bool> {
+async fn is_already_running_as_role(role: &str, config: &AwsAuthConfig) -> Result<bool, Error> {
     if role_identity(role).is_none() {
         return Ok(false);
     }
@@ -437,7 +439,7 @@ pub fn sign_bedrock_post(
     region: &str,
     credentials: &Credentials,
     signing_time: SystemTime,
-) -> CoreResult<BTreeMap<String, String>> {
+) -> Result<BTreeMap<String, String>, Error> {
     let identity: Identity = credentials.clone().into();
     let params = v4::SigningParams::builder()
         .identity(&identity)
@@ -447,14 +449,14 @@ pub fn sign_bedrock_post(
         .settings(SigningSettings::default())
         .build()
         .map(SigningParams::from)
-        .map_err(|error| CoreError::Auth(format!("AWS signing parameters failed: {error}")))?;
+        .map_err(|error| Error::Auth(format!("AWS signing parameters failed: {error}")))?;
     let header_refs = headers
         .iter()
         .map(|(name, value)| (name.as_str(), value.as_str()));
     let request = SignableRequest::new("POST", url, header_refs, SignableBody::Bytes(body))
-        .map_err(|error| CoreError::Auth(format!("AWS signable request failed: {error}")))?;
+        .map_err(|error| Error::Auth(format!("AWS signable request failed: {error}")))?;
     let (instructions, _) = sign(request, &params)
-        .map_err(|error| CoreError::Auth(format!("AWS request signing failed: {error}")))?
+        .map_err(|error| Error::Auth(format!("AWS request signing failed: {error}")))?
         .into_parts();
     Ok(instructions
         .headers()
diff --git a/litellm-rust/crates/core/src/providers/bedrock/chat_completions/tests.rs b/litellm-rust/crates/core/src/providers/bedrock/chat_completions/tests.rs
index 4b75dcb8e9d..c86f061b9ca 100644
--- a/litellm-rust/crates/core/src/providers/bedrock/chat_completions/tests.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/chat_completions/tests.rs
@@ -1,4 +1,5 @@
 use super::*;
+use crate::Error;
 use serde_json::json;
 
 fn messages(value: Value) -> Vec<ChatMessage> {
@@ -23,7 +24,7 @@ fn transform(msgs: Value, opts: Value) -> Value {
         .body
 }
 
-fn transform_response(body: Value) -> CoreResult<ChatCompletionsResponse> {
+fn transform_response(body: Value) -> Result<ChatCompletionsResponse, Error> {
     BEDROCK_CHAT_COMPLETIONS_CONFIG.transform_response(
         "anthropic.claude-sonnet-4-5-v1:0",
         ProviderChatResponseData { body },
@@ -478,25 +479,22 @@ fn declines_a_response_carrying_a_tool_use_block() {
         "usage": {"inputTokens": 1, "outputTokens": 1}
     }))
     .expect_err("tool use block");
-    assert_eq!(
-        err,
-        CoreError::Unsupported("non-text response content block")
-    );
+    assert_eq!(err, Error::Unsupported("non-text response content block"));
 }
 
 #[test]
 fn errors_on_a_response_missing_required_fields() {
     assert_eq!(
         transform_response(json!("nope")).expect_err("not an object"),
-        CoreError::InvalidResponse("converse response is not an object".to_string())
+        Error::InvalidResponse("converse response is not an object".to_string())
     );
     assert_eq!(
         transform_response(json!({"usage": {}})).expect_err("no output"),
-        CoreError::MissingField("output.message.content")
+        Error::MissingField("output.message.content")
     );
     assert_eq!(
         transform_response(json!({"output": {"message": {"content": []}}})).expect_err("no usage"),
-        CoreError::MissingField("usage")
+        Error::MissingField("usage")
     );
 }
 
diff --git a/litellm-rust/crates/core/src/providers/bedrock/chat_completions/transformation.rs b/litellm-rust/crates/core/src/providers/bedrock/chat_completions/transformation.rs
index b107950748e..ef5f44b4a14 100644
--- a/litellm-rust/crates/core/src/providers/bedrock/chat_completions/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/chat_completions/transformation.rs
@@ -11,7 +11,7 @@ use crate::chat_completions::types::{
     ChatCompletionsUsage, ChatMessage, ChatMessageContent, ProviderChatRequestData,
     ProviderChatResponseData,
 };
-use crate::error::{CoreError, CoreResult};
+use crate::error::Error;
 
 use super::super::aws_base::{bedrock_model_id_and_region, resolve_bedrock_region};
 use super::super::constants::{AWS_BEARER_TOKEN_BEDROCK, BEDROCK_RUNTIME_ENDPOINT_TEMPLATE};
@@ -110,7 +110,7 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         let (model_id, model_region) = bedrock_model_id_and_region(model);
         let region = resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup);
         let endpoint = optional_params
@@ -137,7 +137,7 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<ChatCompletionsAuth> {
+    ) -> Result<ChatCompletionsAuth, Error> {
         // Python reads `api_key` as the Bedrock bearer token and consults the
         // env only when the caller passed none, so a caller-supplied empty key
         // falls through to SigV4 without reaching for the environment. An
@@ -208,7 +208,7 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
         _model: &str,
         messages: Vec<ChatMessage>,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<ProviderChatRequestData> {
+    ) -> Result<ProviderChatRequestData, Error> {
         Ok(ProviderChatRequestData {
             body: converse_body(&build_conversation(&messages), &optional_params),
         })
@@ -218,17 +218,18 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
         &self,
         model: &str,
         response: ProviderChatResponseData,
-    ) -> CoreResult<ChatCompletionsResponse> {
-        let body = response.body.as_object().ok_or_else(|| {
-            CoreError::InvalidResponse("converse response is not an object".into())
-        })?;
+    ) -> Result<ChatCompletionsResponse, Error> {
+        let body = response
+            .body
+            .as_object()
+            .ok_or_else(|| Error::InvalidResponse("converse response is not an object".into()))?;
 
         let content = body
             .get("output")
             .and_then(|output| output.get("message"))
             .and_then(|message| message.get("content"))
             .and_then(Value::as_array)
-            .ok_or(CoreError::MissingField("output.message.content"))?;
+            .ok_or(Error::MissingField("output.message.content"))?;
         // The route declines tool requests, so anything other than a text block
         // is something this path never asked for. Decline; the host falls back.
         if content.iter().any(|block| {
@@ -236,7 +237,7 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
                 .as_object()
                 .is_none_or(|block| block.len() != 1 || !block.contains_key("text"))
         }) {
-            return Err(CoreError::Unsupported("non-text response content block"));
+            return Err(Error::Unsupported("non-text response content block"));
         }
         let text: String = content
             .iter()
@@ -246,7 +247,7 @@ impl ChatCompletionsProviderConfig for BedrockChatCompletionsConfig {
         let usage = body
             .get("usage")
             .and_then(Value::as_object)
-            .ok_or(CoreError::MissingField("usage"))?;
+            .ok_or(Error::MissingField("usage"))?;
         let field = |name: &str| usage.get(name).and_then(Value::as_u64).unwrap_or(0);
         let computed = usage_from_parts(
             field("inputTokens"),
diff --git a/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs
index dc720cc4244..6a8a38204a9 100644
--- a/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs
@@ -1,4 +1,4 @@
-use crate::error::{CoreError, CoreResult, json_type_name};
+use crate::error::{Error, json_type_name};
 use crate::ocr::transformation::OcrProviderConfig;
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
 use serde_json::{Map, Value};
@@ -47,7 +47,7 @@ pub fn complete_url(api_base: Option<&str>) -> String {
 
 /// Resolve the Mistral API key from the explicit param or the environment.
 ///
-/// Blank/whitespace values are treated as absent. Returns `CoreError::Auth`
+/// Blank/whitespace values are treated as absent. Returns `Error::Auth`
 /// when no usable key is available.
 ///
 /// Note: the env fallback only reads the process environment. Secret-manager
@@ -56,13 +56,13 @@ pub fn complete_url(api_base: Option<&str>) -> String {
 pub fn resolve_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     api_key
         .map(str::trim)
         .filter(|key| !key.is_empty())
         .map(str::to_string)
         .or_else(|| env_lookup(MISTRAL_API_KEY_ENV).filter(|key| !key.trim().is_empty()))
-        .ok_or_else(|| CoreError::Auth(MISSING_KEY_MESSAGE.to_string()))
+        .ok_or_else(|| Error::Auth(MISSING_KEY_MESSAGE.to_string()))
 }
 
 pub struct MistralOcrConfig;
@@ -79,9 +79,9 @@ impl OcrProviderConfig for MistralOcrConfig {
         model: &str,
         document: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData> {
+    ) -> Result<OcrRequestData, Error> {
         if !document.is_object() {
-            return Err(CoreError::InvalidType {
+            return Err(Error::InvalidType {
                 expected: "object",
                 actual: json_type_name(&document),
             });
@@ -104,10 +104,10 @@ impl OcrProviderConfig for MistralOcrConfig {
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData> {
+    ) -> Result<OcrResponseData, Error> {
         let response_object = response_json
             .as_object()
-            .ok_or_else(|| CoreError::InvalidType {
+            .ok_or_else(|| Error::InvalidType {
                 expected: "object",
                 actual: json_type_name(&response_json),
             })?;
@@ -140,7 +140,7 @@ impl OcrProviderConfig for MistralOcrConfig {
         _model: &str,
         _optional_params: &Map<String, Value>,
         _env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         Ok(complete_url(api_base))
     }
 
@@ -148,7 +148,7 @@ impl OcrProviderConfig for MistralOcrConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_api_key(api_key, env_lookup)
     }
 }
@@ -165,11 +165,11 @@ pub fn transform_ocr_request(
     model: &str,
     document: Value,
     optional_params: Map<String, Value>,
-) -> CoreResult<OcrRequestData> {
+) -> Result<OcrRequestData, Error> {
     MISTRAL_OCR_CONFIG.transform_ocr_request(model, document, optional_params)
 }
 
-pub fn transform_ocr_response(model: &str, response_json: Value) -> CoreResult<OcrResponseData> {
+pub fn transform_ocr_response(model: &str, response_json: Value) -> Result<OcrResponseData, Error> {
     MISTRAL_OCR_CONFIG.transform_ocr_response(model, response_json)
 }
 
@@ -250,7 +250,7 @@ mod tests {
 
         assert_eq!(
             err,
-            CoreError::InvalidType {
+            Error::InvalidType {
                 expected: "object",
                 actual: "string",
             }
@@ -307,6 +307,6 @@ mod tests {
     #[test]
     fn resolve_api_key_errors_when_absent() {
         let err = resolve_api_key(None, &|_| None).expect_err("missing key should error");
-        assert_eq!(err, CoreError::Auth(MISSING_KEY_MESSAGE.to_string()));
+        assert_eq!(err, Error::Auth(MISSING_KEY_MESSAGE.to_string()));
     }
 }
diff --git a/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs b/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs
index b3f6b03b28a..f1985f81b7d 100644
--- a/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs
@@ -1,4 +1,4 @@
-use crate::CoreResult;
+use crate::Error;
 use crate::realtime::transformation::RealtimeProviderConfig;
 use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult};
 
@@ -72,7 +72,7 @@ impl RealtimeProviderConfig for OpenAiRealtimeConfig {
         &self,
         event: &RealtimeEvent,
         _model: &str,
-    ) -> CoreResult<RealtimeTransformResult> {
+    ) -> Result<RealtimeTransformResult, Error> {
         Ok(RealtimeTransformResult::passthrough(event.clone()))
     }
 
@@ -80,7 +80,7 @@ impl RealtimeProviderConfig for OpenAiRealtimeConfig {
         &self,
         event: &RealtimeEvent,
         _model: &str,
-    ) -> CoreResult<RealtimeTransformResult> {
+    ) -> Result<RealtimeTransformResult, Error> {
         Ok(RealtimeTransformResult::passthrough(event.clone()))
     }
 }
@@ -88,14 +88,14 @@ impl RealtimeProviderConfig for OpenAiRealtimeConfig {
 pub fn transform_realtime_request(
     event: &RealtimeEvent,
     model: &str,
-) -> CoreResult<RealtimeTransformResult> {
+) -> Result<RealtimeTransformResult, Error> {
     OPENAI_REALTIME_CONFIG.transform_realtime_request(event, model)
 }
 
 pub fn transform_realtime_response(
     event: &RealtimeEvent,
     model: &str,
-) -> CoreResult<RealtimeTransformResult> {
+) -> Result<RealtimeTransformResult, Error> {
     OPENAI_REALTIME_CONFIG.transform_realtime_response(event, model)
 }
 
diff --git a/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs b/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs
index e15197c468c..be86bb90311 100644
--- a/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs
@@ -1,4 +1,4 @@
-use crate::CoreResult;
+use crate::Error;
 use crate::responses::types::{ResponsesWsEvent, ResponsesWsTransformResult};
 use crate::responses::websocket::{ResponsesWebSocketProviderConfig, enforce_model};
 
@@ -15,7 +15,7 @@ impl ResponsesWebSocketProviderConfig for OpenAIResponsesWsConfig {
         &self,
         event: &ResponsesWsEvent,
         model: &str,
-    ) -> CoreResult<ResponsesWsTransformResult> {
+    ) -> Result<ResponsesWsTransformResult, Error> {
         Ok(ResponsesWsTransformResult::passthrough(enforce_model(
             event, model,
         )))
@@ -25,7 +25,7 @@ impl ResponsesWebSocketProviderConfig for OpenAIResponsesWsConfig {
         &self,
         event: &ResponsesWsEvent,
         _model: &str,
-    ) -> CoreResult<ResponsesWsTransformResult> {
+    ) -> Result<ResponsesWsTransformResult, Error> {
         Ok(ResponsesWsTransformResult::passthrough(event.clone()))
     }
 }
diff --git a/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs b/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs
index 6300149c237..ee095447028 100644
--- a/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs
@@ -1,4 +1,4 @@
-use crate::error::{CoreError, CoreResult, json_type_name};
+use crate::error::{Error, json_type_name};
 use crate::ocr::transformation::OcrProviderConfig;
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
 use serde_json::{Map, Value, json};
@@ -43,7 +43,7 @@ pub fn is_deepseek_model(model: &str) -> bool {
 pub fn resolve_vertex_api_key(
     api_key: Option<&str>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     api_key
         .map(str::trim)
         .filter(|key| !key.is_empty())
@@ -51,7 +51,7 @@ pub fn resolve_vertex_api_key(
         .or_else(|| env_lookup(VERTEX_AI_API_KEY_ENV).filter(|key| !key.trim().is_empty()))
         .or_else(|| env_lookup(VERTEXAI_API_KEY_ENV).filter(|key| !key.trim().is_empty()))
         .ok_or_else(|| {
-            CoreError::Auth(
+            Error::Auth(
                 "Missing Vertex AI access token - pass api_key or provide Authorization via extra_headers"
                     .to_string(),
             )
@@ -61,12 +61,12 @@ pub fn resolve_vertex_api_key(
 fn vertex_project(
     params: &Map<String, Value>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     string_param(params, &["vertex_project", "vertex_ai_project"])
         .map(str::to_string)
         .or_else(|| env_lookup(VERTEXAI_PROJECT_ENV).filter(|value| !value.trim().is_empty()))
         .ok_or_else(|| {
-            CoreError::InvalidRequest(
+            Error::InvalidRequest(
                 "Missing vertex_project - Set VERTEXAI_PROJECT environment variable or pass vertex_project parameter"
                     .to_string(),
             )
@@ -99,7 +99,7 @@ pub fn complete_vertex_mistral_url(
     model: &str,
     optional_params: &Map<String, Value>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     let project = vertex_project(optional_params, env_lookup)?;
     let location = vertex_location(optional_params, env_lookup);
     let base = vertex_mistral_api_base(api_base, &location);
@@ -112,7 +112,7 @@ pub fn complete_vertex_deepseek_url(
     api_base: Option<&str>,
     optional_params: &Map<String, Value>,
     env_lookup: &dyn Fn(&str) -> Option<String>,
-) -> CoreResult<String> {
+) -> Result<String, Error> {
     let project = vertex_project(optional_params, env_lookup)?;
     let location = vertex_location(optional_params, env_lookup);
     let base = api_base
@@ -125,20 +125,20 @@ pub fn complete_vertex_deepseek_url(
     ))
 }
 
-fn document_content_item(document: &Value) -> CoreResult<Value> {
-    let object = document.as_object().ok_or_else(|| CoreError::InvalidType {
+fn document_content_item(document: &Value) -> Result<Value, Error> {
+    let object = document.as_object().ok_or_else(|| Error::InvalidType {
         expected: "object",
         actual: json_type_name(document),
     })?;
     let doc_type = object
         .get("type")
         .and_then(Value::as_str)
-        .ok_or(CoreError::MissingField("document.type"))?;
+        .ok_or(Error::MissingField("document.type"))?;
     let url_field = match doc_type {
         "image_url" => "image_url",
         "document_url" => "document_url",
         other => {
-            return Err(CoreError::InvalidRequest(format!(
+            return Err(Error::InvalidRequest(format!(
                 "Unsupported document type: {other}. Expected 'image_url' or 'document_url'"
             )));
         }
@@ -147,7 +147,7 @@ fn document_content_item(document: &Value) -> CoreResult<Value> {
         .get(url_field)
         .and_then(Value::as_str)
         .filter(|value| !value.is_empty())
-        .ok_or(CoreError::MissingField(url_field))?;
+        .ok_or(Error::MissingField(url_field))?;
 
     Ok(json!({
         "type": "image_url",
@@ -163,7 +163,7 @@ fn deepseek_model_name(model: &str) -> String {
     }
 }
 
-fn first_choice_content(response: &Value) -> CoreResult<Value> {
+fn first_choice_content(response: &Value) -> Result<Value, Error> {
     response
         .get("choices")
         .and_then(Value::as_array)
@@ -176,9 +176,7 @@ fn first_choice_content(response: &Value) -> CoreResult<Value> {
             Value::Object(_) => true,
             _ => false,
         })
-        .ok_or_else(|| {
-            CoreError::InvalidResponse("No content in DeepSeek OCR response".to_string())
-        })
+        .ok_or_else(|| Error::InvalidResponse("No content in DeepSeek OCR response".to_string()))
 }
 
 fn ocr_data_from_content(content: Value, usage: Option<Value>, model: &str) -> Value {
@@ -219,7 +217,7 @@ impl OcrProviderConfig for VertexAiOcrConfig {
         model: &str,
         document: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData> {
+    ) -> Result<OcrRequestData, Error> {
         MISTRAL_OCR_CONFIG.transform_ocr_request(model, document, optional_params)
     }
 
@@ -227,7 +225,7 @@ impl OcrProviderConfig for VertexAiOcrConfig {
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData> {
+    ) -> Result<OcrResponseData, Error> {
         MISTRAL_OCR_CONFIG.transform_ocr_response(model, response_json)
     }
 
@@ -237,7 +235,7 @@ impl OcrProviderConfig for VertexAiOcrConfig {
         model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         complete_vertex_mistral_url(api_base, model, optional_params, env_lookup)
     }
 
@@ -245,7 +243,7 @@ impl OcrProviderConfig for VertexAiOcrConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_vertex_api_key(api_key, env_lookup)
     }
 
@@ -264,7 +262,7 @@ impl OcrProviderConfig for VertexAiDeepSeekOcrConfig {
         model: &str,
         document: Value,
         optional_params: Map<String, Value>,
-    ) -> CoreResult<OcrRequestData> {
+    ) -> Result<OcrRequestData, Error> {
         let mut data = Map::new();
         data.insert(
             "model".to_string(),
@@ -289,10 +287,10 @@ impl OcrProviderConfig for VertexAiDeepSeekOcrConfig {
         &self,
         model: &str,
         response_json: Value,
-    ) -> CoreResult<OcrResponseData> {
+    ) -> Result<OcrResponseData, Error> {
         let response = response_json
             .as_object()
-            .ok_or_else(|| CoreError::InvalidType {
+            .ok_or_else(|| Error::InvalidType {
                 expected: "object",
                 actual: json_type_name(&response_json),
             })?;
@@ -314,7 +312,7 @@ impl OcrProviderConfig for VertexAiDeepSeekOcrConfig {
             });
         }
 
-        let object = ocr_data.as_object().ok_or_else(|| CoreError::InvalidType {
+        let object = ocr_data.as_object().ok_or_else(|| Error::InvalidType {
             expected: "object",
             actual: json_type_name(&ocr_data),
         })?;
@@ -346,7 +344,7 @@ impl OcrProviderConfig for VertexAiDeepSeekOcrConfig {
         _model: &str,
         optional_params: &Map<String, Value>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         complete_vertex_deepseek_url(api_base, optional_params, env_lookup)
     }
 
@@ -354,7 +352,7 @@ impl OcrProviderConfig for VertexAiDeepSeekOcrConfig {
         &self,
         api_key: Option<&str>,
         env_lookup: &dyn Fn(&str) -> Option<String>,
-    ) -> CoreResult<String> {
+    ) -> Result<String, Error> {
         resolve_vertex_api_key(api_key, env_lookup)
     }
 }
diff --git a/litellm-rust/crates/core/src/realtime/transformation.rs b/litellm-rust/crates/core/src/realtime/transformation.rs
index 69b88687000..b08084514ef 100644
--- a/litellm-rust/crates/core/src/realtime/transformation.rs
+++ b/litellm-rust/crates/core/src/realtime/transformation.rs
@@ -1,4 +1,4 @@
-use crate::CoreResult;
+use crate::Error;
 use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult};
 
 pub trait RealtimeProviderConfig {
@@ -11,12 +11,12 @@ pub trait RealtimeProviderConfig {
         &self,
         event: &RealtimeEvent,
         model: &str,
-    ) -> CoreResult<RealtimeTransformResult>;
+    ) -> Result<RealtimeTransformResult, Error>;
 
     /// Transform a backend → client event before it is forwarded downstream.
     fn transform_realtime_response(
         &self,
         event: &RealtimeEvent,
         model: &str,
-    ) -> CoreResult<RealtimeTransformResult>;
+    ) -> Result<RealtimeTransformResult, Error>;
 }
diff --git a/litellm-rust/crates/core/src/responses/instrumentation.rs b/litellm-rust/crates/core/src/responses/instrumentation.rs
index ec04571da14..b1098f4d386 100644
--- a/litellm-rust/crates/core/src/responses/instrumentation.rs
+++ b/litellm-rust/crates/core/src/responses/instrumentation.rs
@@ -5,9 +5,9 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde_json::Value;
 
+use crate::Error;
 use crate::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
 use crate::responses::types::{ResponsesWsEvent, ResponsesWsEventType};
-use crate::{CoreError, CoreResult};
 
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ResponsesWsUsage {
@@ -205,7 +205,7 @@ impl ResponsesWsInstrumentation {
     }
 }
 
-type LifecycleFuture<'a, T> = Pin<Box<dyn Future<Output = CoreResult<T>> + Send + 'a>>;
+type LifecycleFuture<'a, T> = Pin<Box<dyn Future<Output = Result<T, Error>> + Send + 'a>>;
 
 impl CallLifecycleHooks<(), (), ()> for ResponsesWsInstrumentation {
     type PreCallFuture<'a> = LifecycleFuture<'a, ()>;
@@ -246,7 +246,7 @@ impl CallLifecycleHooks<(), (), ()> for ResponsesWsInstrumentation {
     fn async_log_failure_event<'a>(
         &'a self,
         _context: &'a CallLifecycleContext,
-        _error: &'a CoreError,
+        _error: &'a Error,
         _timing: &'a CallLifecycleTiming,
     ) -> Self::FailureFuture<'a> {
         Box::pin(async move {
@@ -342,7 +342,7 @@ mod tests {
                 ),
                 (),
                 &instrumentation,
-                |_| async { Ok::<(), CoreError>(()) },
+                |_| async { Ok::<(), Error>(()) },
             )
             .await;
 
diff --git a/litellm-rust/crates/core/src/responses/websocket.rs b/litellm-rust/crates/core/src/responses/websocket.rs
index 92dc19627a0..5d037e9cf1b 100644
--- a/litellm-rust/crates/core/src/responses/websocket.rs
+++ b/litellm-rust/crates/core/src/responses/websocket.rs
@@ -1,4 +1,4 @@
-use crate::CoreResult;
+use crate::Error;
 use crate::constants::{OPENAI_RESPONSES_DEFAULT_API_BASE, OPENAI_RESPONSES_PATH};
 use crate::responses::types::{ResponsesWsEvent, ResponsesWsEventType, ResponsesWsTransformResult};
 
@@ -19,13 +19,13 @@ pub trait ResponsesWebSocketProviderConfig: Sync {
         &self,
         event: &ResponsesWsEvent,
         model: &str,
-    ) -> CoreResult<ResponsesWsTransformResult>;
+    ) -> Result<ResponsesWsTransformResult, Error>;
 
     fn transform_ws_response(
         &self,
         event: &ResponsesWsEvent,
         model: &str,
-    ) -> CoreResult<ResponsesWsTransformResult>;
+    ) -> Result<ResponsesWsTransformResult, Error>;
 }
 
 pub fn complete_websocket_url(
diff --git a/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs b/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs
index 656ba033b62..8a8a5ea263a 100644
--- a/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs
+++ b/litellm-rust/crates/core/tests/workspace_crate_allowlist.rs
@@ -1,7 +1,8 @@
-//! Enforcement: the litellm-rust workspace has exactly three crates.
+//! Enforcement: the litellm-rust workspace has exactly four crates.
 //!
-//! `core` (pure translation), `ai-gateway` (routes + all network I/O), and
-//! `python-bridge` (the PyO3 cdylib). Adding or removing a crate must be a
+//! `core` (the Rust SDK), `ai-gateway` (the HTTP/WebSocket host),
+//! `python-interop` (domain-neutral PyO3 primitives), and `python-bridge` (the
+//! PyO3 cdylib). Adding or removing a crate must be a
 //! deliberate act: this test fails until the allowlist here is updated, forcing
 //! whoever changes the crate set to justify the new crate per the rule that a
 //! crate is a layer needing independent compilation / its own deps / a separate
@@ -16,10 +17,15 @@ use std::path::{Path, PathBuf};
 
 /// The one true crate set. Update BOTH this and `litellm-rust/AGENTS.md` when the
 /// workspace legitimately gains or loses a crate.
-const EXPECTED_MEMBERS: &[&str] = &["crates/core", "crates/ai-gateway", "crates/python-bridge"];
+const EXPECTED_MEMBERS: &[&str] = &[
+    "crates/core",
+    "crates/ai-gateway",
+    "crates/python-interop",
+    "crates/python-bridge",
+];
 
 /// The crate subdirectory names that must exist under `crates/`.
-const EXPECTED_CRATE_DIRS: &[&str] = &["core", "ai-gateway", "python-bridge"];
+const EXPECTED_CRATE_DIRS: &[&str] = &["core", "ai-gateway", "python-interop", "python-bridge"];
 
 const MISMATCH: &str = "litellm-rust crate set changed — update this allowlist AND litellm-rust/AGENTS.md, and justify the crate per the rule (crate = layer needing independent compilation / its own deps / a separate artifact).";
 
diff --git a/litellm-rust/crates/python-bridge/AGENTS.md b/litellm-rust/crates/python-bridge/AGENTS.md
index ad3cddfa5fd..42282ca4da4 100644
--- a/litellm-rust/crates/python-bridge/AGENTS.md
+++ b/litellm-rust/crates/python-bridge/AGENTS.md
@@ -1,3 +1,3 @@
-litellm-python-bridge is the PyO3 cdylib that exposes Rust to the litellm Python SDK — a thin adapter (Python objects → Rust calls → Python results) over the litellm-core route entrypoints (e.g. `litellm_core::messages::messages`).
+litellm-python-bridge is the PyO3 cdylib that exposes LiteLLM Rust APIs to the Python SDK. Keep API registration, domain dependency wiring, request assembly, and Python exception mapping here. Put domain-neutral Python/Serde conversion and GIL primitives in litellm-python-interop.
 
 Keep it thin: no business logic, no transforms, no I/O orchestration — just marshal in/out and call the core entrypoint.
diff --git a/litellm-rust/crates/python-bridge/CLAUDE.md b/litellm-rust/crates/python-bridge/CLAUDE.md
index 3ce8b8c639a..d25ae5a8130 100644
--- a/litellm-rust/crates/python-bridge/CLAUDE.md
+++ b/litellm-rust/crates/python-bridge/CLAUDE.md
@@ -5,8 +5,9 @@ Rules for `litellm-rust/crates/python-bridge`.
 ## Responsibility
 
 `python-bridge` is the PyO3 boundary between Python LiteLLM and Rust transforms.
-Keep this crate thin. It adapts Python objects to Rust payloads and returns
-Python-compatible dictionaries.
+Keep this crate thin. It exposes LiteLLM Rust APIs, assembles domain requests,
+maps domain errors to Python exceptions, and delegates generic conversion and
+GIL handling to `litellm-python-interop`.
 
 ## Bridge Shape
 
diff --git a/litellm-rust/crates/python-bridge/Cargo.toml b/litellm-rust/crates/python-bridge/Cargo.toml
index d461a483ae0..498003de149 100644
--- a/litellm-rust/crates/python-bridge/Cargo.toml
+++ b/litellm-rust/crates/python-bridge/Cargo.toml
@@ -13,14 +13,14 @@ crate-type = ["cdylib"]
 default = ["abi3"]
 abi3 = ["pyo3/abi3-py310"]
 extension-module = ["pyo3/extension-module"]
+panic-test = []
 
 [dependencies]
 litellm-core = { workspace = true, features = ["bedrock-auth"] }
 litellm-ai-gateway = { workspace = true, default-features = false }
+litellm-python-interop.workspace = true
 pyo3.workspace = true
 pyo3-async-runtimes.workspace = true
-pythonize.workspace = true
-serde.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
 
diff --git a/litellm-rust/crates/python-bridge/benches/serialization.rs b/litellm-rust/crates/python-bridge/benches/serialization.rs
index 8a90cf667d0..0b9436d0cb7 100644
--- a/litellm-rust/crates/python-bridge/benches/serialization.rs
+++ b/litellm-rust/crates/python-bridge/benches/serialization.rs
@@ -2,6 +2,7 @@ use std::hint::black_box;
 use std::time::Duration;
 
 use criterion::{BenchmarkId, Criterion, criterion_group, criterion_main};
+use litellm_python_interop::{from_py, to_py};
 use pyo3::prelude::*;
 use pyo3::types::PyDict;
 use serde_json::{Value, json};
@@ -25,7 +26,7 @@ fn former_json_roundtrip_from_py(py: Python<'_>, value: &Bound<'_, PyAny>) -> Va
 }
 
 fn pythonize_from_py(value: &Bound<'_, PyAny>) -> Value {
-    pythonize::depythonize(value).expect("payload should depythonize")
+    from_py(value).expect("payload should depythonize")
 }
 
 fn former_json_roundtrip_to_py(py: Python<'_>, value: &Value) -> Py<PyAny> {
@@ -37,12 +38,10 @@ fn former_json_roundtrip_to_py(py: Python<'_>, value: &Value) -> Py<PyAny> {
 }
 
 fn pythonize_to_py(py: Python<'_>, value: &Value) -> Py<PyAny> {
-    pythonize::pythonize(py, value)
-        .expect("response should pythonize")
-        .unbind()
+    to_py(py, value).expect("response should pythonize")
 }
 
-fn serialization(c: &mut Criterion) {
+fn bridge_serialization(c: &mut Criterion) {
     Python::initialize();
     Python::attach(|py| {
         for &(label, payload_bytes) in PAYLOAD_SIZES {
@@ -98,6 +97,6 @@ criterion_group! {
         .sample_size(20)
         .warm_up_time(Duration::from_secs(1))
         .measurement_time(Duration::from_secs(4));
-    targets = serialization
+    targets = bridge_serialization
 }
 criterion_main!(benches);
diff --git a/litellm-rust/crates/python-bridge/src/gil.rs b/litellm-rust/crates/python-bridge/src/gil.rs
deleted file mode 100644
index e887c8ec1e3..00000000000
--- a/litellm-rust/crates/python-bridge/src/gil.rs
+++ /dev/null
@@ -1,32 +0,0 @@
-//! GIL accounting.
-//!
-//! A single chokepoint for releasing the GIL around blocking work. Every
-//! blocking call in the bridge goes through [`release_gil`] instead of calling
-//! `Python::detach` directly, so the release count stays accurate and we
-//! have one place to extend later (timing histograms, per-call labels, etc.).
-
-use std::sync::atomic::{AtomicU64, Ordering};
-
-use pyo3::prelude::*;
-
-/// Number of times the bridge has released the GIL since process start.
-static GIL_RELEASES: AtomicU64 = AtomicU64::new(0);
-
-/// Release the GIL around `f`, recording the release.
-///
-/// `f` must not touch any Python state — that is what makes releasing the GIL
-/// safe. Returning the value back to Python re-acquires the GIL at the call
-/// site, after `f` has finished.
-pub fn release_gil<T, F>(py: Python<'_>, f: F) -> T
-where
-    F: FnOnce() -> T + Send,
-    T: Send,
-{
-    GIL_RELEASES.fetch_add(1, Ordering::Relaxed);
-    py.detach(f)
-}
-
-/// Total GIL releases performed by the bridge so far.
-pub fn release_count() -> u64 {
-    GIL_RELEASES.load(Ordering::Relaxed)
-}
diff --git a/litellm-rust/crates/python-bridge/src/lib.rs b/litellm-rust/crates/python-bridge/src/lib.rs
index f9e75f45f75..2e2624acbe1 100644
--- a/litellm-rust/crates/python-bridge/src/lib.rs
+++ b/litellm-rust/crates/python-bridge/src/lib.rs
@@ -1,28 +1,24 @@
 use std::collections::HashMap;
 use std::time::Duration;
 
-use litellm_ai_gateway::io::audio_transcription::{
-    AudioTranscriptionRequest, audio_transcription as run_audio_transcription,
-};
 use litellm_ai_gateway::io::ocr::{OcrRequest, ocr as run_ocr};
 use litellm_ai_gateway::io::responses_ws::ResponsesWebSocketConnection as RustResponsesWebSocketConnection;
+use litellm_core::audio_transcription::{
+    AudioTranscriptionRequest, audio_transcription as run_audio_transcription,
+};
 use litellm_core::chat_completions::types::{ChatCompletionsRequest, ChatCompletionsResponse};
 use litellm_core::chat_completions::{
     chat_completions as run_chat_completions, chat_completions_decline_reason,
 };
-use litellm_core::error::CoreError;
+use litellm_core::error::Error;
 use litellm_core::messages::messages as run_messages;
 use litellm_core::messages::types::{AnthropicMessagesResponse, MessagesRequest};
+use litellm_python_interop::{from_py, release_count, release_gil, to_py};
 use pyo3::exceptions::{PyRuntimeError, PyValueError};
 use pyo3::prelude::*;
 use pyo3::types::{PyAny, PyDict};
 use serde_json::{Map, Value};
 
-mod gil;
-mod marshal;
-
-use marshal::{from_py, to_py};
-
 pyo3::create_exception!(
     _native,
     RustBridgeDeclined,
@@ -58,13 +54,13 @@ fn chat_completions_response_to_py(
     to_py(py, &response)
 }
 
-fn core_error_to_pyerr(err: CoreError) -> PyErr {
+fn core_error_to_pyerr(err: Error) -> PyErr {
     match err {
-        CoreError::Auth(message) => PyValueError::new_err(message),
-        CoreError::InvalidProvider(_)
-        | CoreError::InvalidRequest(_)
-        | CoreError::InvalidType { .. }
-        | CoreError::MissingField(_) => PyValueError::new_err(err.to_string()),
+        Error::Auth(message) => PyValueError::new_err(message),
+        Error::InvalidProvider(_)
+        | Error::InvalidRequest(_)
+        | Error::InvalidType { .. }
+        | Error::MissingField(_) => PyValueError::new_err(err.to_string()),
         other => PyRuntimeError::new_err(other.to_string()),
     }
 }
@@ -75,22 +71,22 @@ fn core_error_to_pyerr(err: CoreError) -> PyErr {
 /// Everything raised before the request goes out is safe for the host to retry
 /// on its own path; anything after it is not, because the provider has already
 /// done the work and billed for it.
-fn chat_completions_error_to_pyerr(err: CoreError) -> PyErr {
+fn chat_completions_error_to_pyerr(err: Error) -> PyErr {
     match err {
-        CoreError::Unsupported(_)
-        | CoreError::Auth(_)
-        | CoreError::InvalidProvider(_)
-        | CoreError::InvalidRequest(_)
-        | CoreError::InvalidType { .. }
-        | CoreError::MissingField(_)
-        | CoreError::Routing(_)
+        Error::Unsupported(_)
+        | Error::Auth(_)
+        | Error::InvalidProvider(_)
+        | Error::InvalidRequest(_)
+        | Error::InvalidType { .. }
+        | Error::MissingField(_)
+        | Error::Routing(_)
         // Nothing reached the provider, so serving it on Python cannot double
         // bill and is the only way the caller gets an answer at all.
-        | CoreError::Connect(_) => RustBridgeDeclined::new_err(err.to_string()),
-        CoreError::Http { status, body } => {
+        | Error::Connect(_) => RustBridgeDeclined::new_err(err.to_string()),
+        Error::Http { status, body } => {
             RustUpstreamError::new_err((status, format!("{status}: {body}")))
         }
-        CoreError::Network(message) | CoreError::InvalidResponse(message) => {
+        Error::Network(message) | Error::InvalidResponse(message) => {
             RustUpstreamError::new_err((0u16, message))
         }
     }
@@ -230,7 +226,7 @@ fn ocr(
         timeout_seconds,
     )?;
 
-    let result = gil::release_gil(py, || {
+    let result = release_gil(py, || {
         pyo3_async_runtimes::tokio::get_runtime().block_on(run_ocr(OcrRequest {
             model: &model,
             document,
@@ -318,7 +314,7 @@ fn transcription(
     };
     let optional_params = optional_object_to_map(py, "optional_params", optional_params)?;
     let timeout = optional_timeout(timeout_seconds);
-    let result = gil::release_gil(py, || {
+    let result = release_gil(py, || {
         pyo3_async_runtimes::tokio::get_runtime().block_on(run_audio_transcription(
             AudioTranscriptionRequest {
                 model: &model,
@@ -329,10 +325,6 @@ fn transcription(
                 extra_headers,
                 optional_params,
                 timeout,
-                callbacks: Vec::new(),
-                guardrails: Vec::new(),
-                request_metadata: Default::default(),
-                litellm_call_id: None,
             },
         ))
     });
@@ -373,10 +365,6 @@ fn atranscription(
             extra_headers,
             optional_params,
             timeout,
-            callbacks: Vec::new(),
-            guardrails: Vec::new(),
-            request_metadata: Default::default(),
-            litellm_call_id: None,
         })
         .await
         .map_err(core_error_to_pyerr)?;
@@ -419,7 +407,7 @@ fn messages(
     let (body, extra_headers, timeout) =
         marshal_messages_inputs(py, body, extra_headers, timeout_seconds)?;
 
-    let result = gil::release_gil(py, || {
+    let result = release_gil(py, || {
         pyo3_async_runtimes::tokio::get_runtime().block_on(run_messages(MessagesRequest {
             model: &model,
             body,
@@ -546,7 +534,7 @@ fn chat_completions(
         timeout_seconds,
     )?;
 
-    let result = gil::release_gil(py, || {
+    let result = release_gil(py, || {
         pyo3_async_runtimes::tokio::get_runtime().block_on(run_chat_completions(
             ChatCompletionsRequest {
                 model: &model,
@@ -610,10 +598,16 @@ fn achat_completions(
 #[pyfunction]
 fn gil_stats(py: Python<'_>) -> PyResult<Py<PyAny>> {
     let stats = PyDict::new(py);
-    stats.set_item("releases", gil::release_count())?;
+    stats.set_item("releases", release_count())?;
     Ok(stats.into_any().unbind())
 }
 
+#[cfg(feature = "panic-test")]
+#[pyfunction]
+fn _panic_for_test() {
+    panic!("intentional PyO3 panic smoke test");
+}
+
 #[pymodule]
 fn _native(module: &Bound<'_, PyModule>) -> PyResult<()> {
     let py = module.py();
@@ -630,5 +624,7 @@ fn _native(module: &Bound<'_, PyModule>) -> PyResult<()> {
     module.add_function(wrap_pyfunction!(achat_completions, module)?)?;
     module.add_class::<ResponsesWebSocketConnection>()?;
     module.add_function(wrap_pyfunction!(gil_stats, module)?)?;
+    #[cfg(feature = "panic-test")]
+    module.add_function(wrap_pyfunction!(_panic_for_test, module)?)?;
     Ok(())
 }
diff --git a/litellm-rust/crates/python-bridge/tests/marshal_boundary.rs b/litellm-rust/crates/python-bridge/tests/marshal_boundary.rs
index 6a6ede22e85..d397d20b9fd 100644
--- a/litellm-rust/crates/python-bridge/tests/marshal_boundary.rs
+++ b/litellm-rust/crates/python-bridge/tests/marshal_boundary.rs
@@ -1,7 +1,7 @@
 use std::fs;
 use std::path::{Path, PathBuf};
 
-const DISALLOWED_OUTSIDE_MARSHAL: &[&str] = &[
+const DISALLOWED_OUTSIDE_INTEROP: &[&str] = &[
     "py.import(\"json\")",
     "pythonize::",
     "serde_json::to_string",
@@ -33,18 +33,15 @@ fn rust_sources(directory: &Path) -> Vec<PathBuf> {
 }
 
 #[test]
-fn serialization_is_centralized_in_marshal_module() {
+fn serialization_uses_the_interop_boundary() {
     let root = source_root();
 
     for path in rust_sources(&root) {
-        if path == root.join("marshal.rs") {
-            continue;
-        }
         let source = fs::read_to_string(&path).expect("bridge source should be readable");
-        for disallowed in DISALLOWED_OUTSIDE_MARSHAL {
+        for disallowed in DISALLOWED_OUTSIDE_INTEROP {
             assert!(
                 !source.contains(disallowed),
-                "{} bypasses the typed marshal module with `{disallowed}`",
+                "{} bypasses litellm-python-interop with `{disallowed}`",
                 path.display()
             );
         }
diff --git a/litellm-rust/crates/python-interop/AGENTS.md b/litellm-rust/crates/python-interop/AGENTS.md
new file mode 100644
index 00000000000..d1d61e5dfa0
--- /dev/null
+++ b/litellm-rust/crates/python-interop/AGENTS.md
@@ -0,0 +1 @@
+litellm-python-interop is the domain-neutral PyO3 foundation. Keep generic Python/Serde conversion and interpreter primitives here. Do not add LiteLLM domain crates, route types, API registration, or cdylib build features.
diff --git a/litellm-rust/crates/python-interop/Cargo.toml b/litellm-rust/crates/python-interop/Cargo.toml
new file mode 100644
index 00000000000..9da6af6e2e2
--- /dev/null
+++ b/litellm-rust/crates/python-interop/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "litellm-python-interop"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+pyo3.workspace = true
+pythonize.workspace = true
+serde.workspace = true
+
+[dev-dependencies]
+rstest.workspace = true
+serde_json.workspace = true
diff --git a/litellm-rust/crates/python-interop/src/gil.rs b/litellm-rust/crates/python-interop/src/gil.rs
new file mode 100644
index 00000000000..04b966a6002
--- /dev/null
+++ b/litellm-rust/crates/python-interop/src/gil.rs
@@ -0,0 +1,21 @@
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use pyo3::prelude::*;
+
+static GIL_RELEASES: AtomicU64 = AtomicU64::new(0);
+
+/// Runs work detached from the interpreter and records the release.
+///
+/// `f` must not access Python state while the interpreter is detached.
+pub fn release_gil<T, F>(py: Python<'_>, f: F) -> T
+where
+    F: FnOnce() -> T + Send,
+    T: Send,
+{
+    GIL_RELEASES.fetch_add(1, Ordering::Relaxed);
+    py.detach(f)
+}
+
+pub fn release_count() -> u64 {
+    GIL_RELEASES.load(Ordering::Relaxed)
+}
diff --git a/litellm-rust/crates/python-interop/src/lib.rs b/litellm-rust/crates/python-interop/src/lib.rs
new file mode 100644
index 00000000000..df2bd260fdb
--- /dev/null
+++ b/litellm-rust/crates/python-interop/src/lib.rs
@@ -0,0 +1,5 @@
+mod gil;
+mod marshal;
+
+pub use gil::{release_count, release_gil};
+pub use marshal::{from_py, to_py};
diff --git a/litellm-rust/crates/python-bridge/src/marshal.rs b/litellm-rust/crates/python-interop/src/marshal.rs
similarity index 100%
rename from litellm-rust/crates/python-bridge/src/marshal.rs
rename to litellm-rust/crates/python-interop/src/marshal.rs
diff --git a/litellm-rust/crates/python-interop/tests/interop.rs b/litellm-rust/crates/python-interop/tests/interop.rs
new file mode 100644
index 00000000000..9c456dcb938
--- /dev/null
+++ b/litellm-rust/crates/python-interop/tests/interop.rs
@@ -0,0 +1,44 @@
+use pyo3::Python;
+use rstest::{fixture, rstest};
+use serde_json::{Value, json};
+
+use litellm_python_interop::{from_py, release_count, release_gil, to_py};
+
+struct InitializedPython;
+
+impl InitializedPython {
+    fn attach<F, R>(&self, f: F) -> R
+    where
+        F: for<'py> FnOnce(Python<'py>) -> R,
+    {
+        Python::attach(f)
+    }
+}
+
+#[fixture]
+#[once]
+fn initialized_python() -> InitializedPython {
+    Python::initialize();
+    InitializedPython
+}
+
+#[rstest]
+fn serde_values_round_trip_through_python(#[from(initialized_python)] python: &InitializedPython) {
+    python.attach(|py| {
+        let expected = json!({"model": "test", "items": [1, true, null]});
+        let python_value = to_py(py, &expected).expect("value should convert to Python");
+        let actual: Value =
+            from_py(python_value.bind(py)).expect("Python value should convert to serde");
+
+        assert_eq!(actual, expected);
+    });
+}
+
+#[rstest]
+fn release_gil_runs_work_and_records_it(#[from(initialized_python)] python: &InitializedPython) {
+    let before = release_count();
+    let result = python.attach(|py| release_gil(py, || 42));
+
+    assert_eq!(result, 42);
+    assert_eq!(release_count(), before + 1);
+}
diff --git a/litellm/__init__.py b/litellm/__init__.py
index 4eeececdb7e..61794dabddc 100644
--- a/litellm/__init__.py
+++ b/litellm/__init__.py
@@ -29,7 +29,7 @@ def _dev_env_hot_reload_enabled() -> bool:
 if os.getenv("LITELLM_MODE", "DEV") == "DEV":
     _dotenv.load_dotenv(override=_dev_env_hot_reload_enabled())
 
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from typing import (
     Any,
     Callable,
@@ -490,6 +490,7 @@ public_mcp_hub_strict_whitelist: bool = True
 public_model_groups: Optional[List[str]] = None
 public_agent_groups: Optional[List[str]] = None
 agent_search_embedding_model: Optional[str] = None
+mcp_tool_search: Optional[Mapping[str, object]] = None
 # Supports both old format (Dict[str, str]) and new format (Dict[str, Dict[str, Any]])
 # New format: { "displayName": { "url": "...", "index": 0 } }
 # Old format: { "displayName": "url" } (for backward compatibility)
diff --git a/litellm/_logging.py b/litellm/_logging.py
index 9435562f890..14cda772234 100644
--- a/litellm/_logging.py
+++ b/litellm/_logging.py
@@ -6,6 +6,7 @@ import sys
 from datetime import datetime
 from logging import Formatter
 from typing import Any, Final, TextIO
+from urllib.parse import unquote
 
 import litellm
 from litellm.constants import (
@@ -146,6 +147,72 @@ class SecretRedactionFilter(logging.Filter):
 _secret_filter: Final = SecretRedactionFilter()
 
 
+_MAX_SCRUBBED_ACCESS_ARG: Final = 512
+
+_REDACTION_PLACEHOLDER: Final = "REDACTED"
+
+
+def _hides_a_credential(value: str) -> bool:
+    """Whether *value* only looks clean until it is percent-decoded."""
+    decoded: Final = unquote(value)
+    return _redact_string(decoded) != decoded
+
+
+def _drop_encoded_credential(scrubbed: str) -> str:
+    """Drop the part of a request target that only decoding shows to be a secret.
+
+    The request parser decodes query names and values, so `?k%65y=sk%2D...` is a
+    working credential that the patterns, which match literal text, do not see.
+    The decoded text is never logged back: it can carry a newline, and forging
+    log lines is not a trade worth making for a readable request target.
+    """
+    path, separator, _query = scrubbed.partition("?")
+    if _hides_a_credential(path):
+        return _REDACTION_PLACEHOLDER
+    if separator and _hides_a_credential(scrubbed):
+        return f"{path}?{_REDACTION_PLACEHOLDER}"
+    return scrubbed
+
+
+def _scrub_access_arg(value: str) -> str:
+    """Redact one access-log positional arg, bounding the scanned length.
+
+    The request target is the only input to the secret regex an unauthenticated
+    caller controls end to end, so it is cut back to a whole query parameter
+    before it is scanned; a half-parameter would be too short to match its
+    pattern and would then be logged raw.
+    """
+    if len(value) <= _MAX_SCRUBBED_ACCESS_ARG:
+        return _drop_encoded_credential(_redact_string(value))
+    head: Final = value[:_MAX_SCRUBBED_ACCESS_ARG]
+    kept: Final = head[: max(head.rfind("?"), head.rfind("&"))] if "?" in head else head
+    scrubbed: Final = _drop_encoded_credential(_redact_string(kept))
+    return f"{scrubbed}... ({len(value) - len(kept)} more chars truncated) ..."
+
+
+class AccessLogRedactionFilter(logging.Filter):
+    """Scrubs known secret/credential patterns from HTTP access-log records.
+
+    uvicorn's AccessFormatter unpacks ``record.args`` as a five-element tuple at
+    emit time, so SecretRedactionFilter cannot be reused here: it collapses the
+    record into ``record.msg`` and clears the args, and the formatter then raises.
+    """
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if not _ENABLE_SECRET_REDACTION:
+            return True
+        if isinstance(record.args, tuple) and record.args:
+            record.args = tuple(  # rebind-ok: a Filter scrubs records in place
+                _scrub_access_arg(arg) if isinstance(arg, str) else arg for arg in record.args
+            )
+            return True
+        # No positional args means everything is in msg, where collapsing is correct.
+        return _secret_filter.filter(record)
+
+
+_access_log_filter: Final = AccessLogRedactionFilter()
+
+
 def _get_max_string_length_stdout_log() -> int:
     """Read the limit per record so a value loaded later via proxy config
     environment_variables is honored."""
@@ -553,6 +620,14 @@ _REDACTED_THIRD_PARTY_LOGGERS: Final[tuple[str, ...]] = (
     "uvicorn.error",
 )
 
+# Access loggers, which emit the full request target, so a credential passed as a
+# query parameter (e.g. `/key/info?key=`) lands on stdout verbatim. uvicorn.access
+# covers uvicorn.run, --run_gunicorn (its worker_class is UvicornWorker, so the
+# access line is still uvicorn's) and an embedding host app. --run_hypercorn and
+# --run_granian log through their own loggers in their own record shapes, and
+# both ship with access logging off.
+_REDACTED_ACCESS_LOGGERS: Final[tuple[str, ...]] = ("uvicorn.access",)
+
 
 def _redact_third_party_loggers() -> None:
     """Extend secret redaction to records litellm does not emit directly.
@@ -575,6 +650,8 @@ def _redact_third_party_loggers() -> None:
     """
     for name in _REDACTED_THIRD_PARTY_LOGGERS:
         logging.getLogger(name).addFilter(_secret_filter)
+    for name in _REDACTED_ACCESS_LOGGERS:
+        logging.getLogger(name).addFilter(_access_log_filter)
 
 
 # Call the suppression function
diff --git a/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py b/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py
index 32252711997..1e8cc4ff90e 100644
--- a/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py
+++ b/litellm/a2a_protocol/providers/bedrock_agentcore/transformation.py
@@ -10,8 +10,19 @@ from collections.abc import AsyncIterator, Mapping
 from typing import Any, Final
 
 from litellm._logging import verbose_logger
+from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+    A2A_USER_API_KEY_HASH_PARAM,
+)
+from litellm.a2a_protocol.utils import (
+    get_session_id_from_a2a_params,
+    scope_session_to_principal,
+)
+from litellm.exceptions import BadRequestError
 from litellm.llms.bedrock.chat.agentcore.transformation import AmazonAgentCoreConfig
 
+RUNTIME_SESSION_ID_MIN_LENGTH: Final = 33
+RUNTIME_SESSION_ID_MAX_LENGTH: Final = 256
+
 # Reserved outbound header names that must never be sourced from per-request
 # ``agent_extra_headers`` for AgentCore requests. ``agent_extra_headers`` carries
 # values rewritten from the client-controlled ``x-a2a-{agent}-*`` convention, so
@@ -19,8 +30,9 @@ from litellm.llms.bedrock.chat.agentcore.transformation import AmazonAgentCoreCo
 # request identity / SigV4 metadata by overwriting headers the proxy sets from
 # trusted server-side config.
 #
-# The runtime headers (session / user id) are derived server-side from
-# ``runtimeSessionId`` / ``runtimeUserId`` in the agent's ``litellm_params``;
+# The runtime headers (session / user id) are derived server-side from the A2A
+# ``message.contextId`` and ``runtimeSessionId`` / ``runtimeUserId`` in the
+# agent's ``litellm_params``;
 # ``authorization`` is set by the AgentCore signer (JWT or SigV4); ``host`` and
 # the ``x-amz-*`` family are owned by SigV4 itself.
 _RESERVED_EXACT_HEADERS: Final = frozenset(
@@ -66,6 +78,31 @@ def _filter_reserved_headers(
     return filtered or None
 
 
+def _request_scoped_runtime_session_id(
+    params: Mapping[str, Any],
+    litellm_params: Mapping[str, Any],
+) -> str | None:
+    context_id: Final = get_session_id_from_a2a_params(params)
+    if not isinstance(context_id, str) or not context_id:
+        return None
+    return scope_session_to_principal(context_id, litellm_params.get(A2A_USER_API_KEY_HASH_PARAM))
+
+
+def _validate_runtime_session_id(session_id: str, model: str) -> str:
+    if RUNTIME_SESSION_ID_MIN_LENGTH <= len(session_id) <= RUNTIME_SESSION_ID_MAX_LENGTH:
+        return session_id
+    raise BadRequestError(
+        message=(
+            f"Invalid AgentCore runtime session id {session_id!r}: AWS requires "
+            f"{RUNTIME_SESSION_ID_MIN_LENGTH}-{RUNTIME_SESSION_ID_MAX_LENGTH} characters. It is built from the A2A "
+            "message.contextId (prefixed with a 16-hex-char hash of the calling key and '-') when set, "
+            "otherwise from the agent's configured runtimeSessionId."
+        ),
+        model=model,
+        llm_provider="bedrock",
+    )
+
+
 class BedrockAgentCoreA2ATransformation:
     """
     Request/response transformation for Bedrock AgentCore A2A agents.
@@ -100,7 +137,9 @@ class BedrockAgentCoreA2ATransformation:
                 here to prevent a caller-controlled ``x-a2a-{agent}-*`` header from
                 spoofing the AgentCore runtime user id or other SigV4 metadata. Use
                 ``api_key`` / ``runtimeUserId`` / ``runtimeSessionId`` in litellm_params
-                (not ``agent_extra_headers``) to override those values.
+                (not ``agent_extra_headers``) to override those values. The runtime
+                session id is taken from ``params["message"]["contextId"]`` (scoped to
+                the calling key) when present, then ``runtimeSessionId``, else generated.
 
         Returns:
             Tuple of (url, signed_headers, signed_body_bytes)
@@ -139,7 +178,11 @@ class BedrockAgentCoreA2ATransformation:
         # Set required AgentCore session headers (normally set by transform_request,
         # which we skip because it also builds {"prompt": "..."})
         headers: Final[dict] = {}
-        session_id: Final = agentcore_config._get_runtime_session_id(optional_params)
+        session_id: Final = _validate_runtime_session_id(
+            _request_scoped_runtime_session_id(params, litellm_params)
+            or agentcore_config._get_runtime_session_id(optional_params),
+            model=model,
+        )
         headers["X-Amzn-Bedrock-AgentCore-Runtime-Session-Id"] = session_id
         runtime_user_id: Final = agentcore_config._get_runtime_user_id(optional_params)
         if runtime_user_id:
diff --git a/litellm/a2a_protocol/utils.py b/litellm/a2a_protocol/utils.py
index f2e61f66105..7c459daf720 100644
--- a/litellm/a2a_protocol/utils.py
+++ b/litellm/a2a_protocol/utils.py
@@ -2,6 +2,8 @@
 Utility functions for A2A protocol.
 """
 
+import hashlib
+from collections.abc import Mapping
 from typing import TYPE_CHECKING, Any, Final
 
 import litellm
@@ -140,6 +142,29 @@ class A2ARequestUtils:
         return prompt_tokens, completion_tokens, total_tokens
 
 
+def get_session_id_from_a2a_params(params: Mapping[str, Any]) -> str | None:
+    message: Final = params.get("message", {})
+    if isinstance(message, dict):
+        return message.get("contextId")
+    return getattr(message, "contextId", None)
+
+
+def scope_session_to_principal(session_id: str, principal: str | None) -> str:
+    """
+    Bind a client-supplied A2A contextId to the authenticated principal.
+
+    Without this, two distinct keys authorized for the same agent could set the
+    same contextId and read/append to each other's backend memory. The
+    principal is hashed (it is already a hashed token) so the raw value is never
+    sent to the agent backend, while the original contextId is kept as a suffix
+    for operator-side correlation.
+    """
+    if not principal:
+        return session_id
+    principal_prefix: Final = hashlib.sha256(principal.encode("utf-8")).hexdigest()[:16]
+    return f"{principal_prefix}-{session_id}"
+
+
 # Backwards compatibility aliases
 def extract_text_from_a2a_message(message: Any) -> str:
     return A2ARequestUtils.extract_text_from_message(message)
diff --git a/litellm/constants.py b/litellm/constants.py
index 8fbe0eeb4f9..864efc59640 100644
--- a/litellm/constants.py
+++ b/litellm/constants.py
@@ -9,6 +9,38 @@ DEFAULT_HEALTH_CHECK_PROMPT: Final = str(os.getenv("DEFAULT_HEALTH_CHECK_PROMPT"
 AZURE_DEFAULT_RESPONSES_API_VERSION: Final = str(os.getenv("AZURE_DEFAULT_RESPONSES_API_VERSION", "preview"))
 ROUTER_MAX_FALLBACKS: Final = int(os.getenv("ROUTER_MAX_FALLBACKS", 5))
 ROUTER_FALLBACK_ERROR_DETAIL_MAX_CHARS: Final = 2000
+RUNTIME_UPDATABLE_ROUTER_SETTINGS: Final[frozenset[str]] = frozenset(
+    {
+        "routing_strategy_args",
+        "routing_strategy",
+        "routing_groups",
+        "allowed_fails",
+        "cooldown_time",
+        "num_retries",
+        "timeout",
+        "max_retries",
+        "retry_after",
+        "fallbacks",
+        "context_window_fallbacks",
+        "retry_policy",
+        "model_group_retry_policy",
+        "model_group_alias",
+        "enable_weighted_failover",
+        "enable_tag_filtering",
+        "tag_routing_prefix",
+        "optional_pre_call_checks",
+    }
+)
+ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG: Final[frozenset[str]] = frozenset(
+    {
+        "model_list",
+        "search_tools",
+        "assistants_config",
+        "router_general_settings",
+        "ignore_invalid_deployments",
+        "fallback_access_check",
+    }
+)
 DEFAULT_BATCH_SIZE: Final = int(os.getenv("DEFAULT_BATCH_SIZE", 512))
 DEFAULT_FLUSH_INTERVAL_SECONDS: Final = int(os.getenv("DEFAULT_FLUSH_INTERVAL_SECONDS", 5))
 DEFAULT_S3_FLUSH_INTERVAL_SECONDS: Final = int(os.getenv("DEFAULT_S3_FLUSH_INTERVAL_SECONDS", 10))
@@ -1711,6 +1743,7 @@ LITELLM_SETTINGS_SAFE_DB_OVERRIDES: Final = [
     "anthropic_prompt_caching_ttl",
     "max_ui_session_budget",
     "budget_rollover",
+    "mcp_tool_search",
 ]
 SPECIAL_LITELLM_AUTH_TOKEN: Final = ["ui-token"]
 DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int(os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60))
diff --git a/litellm/containers/main.py b/litellm/containers/main.py
index 97ca11872c1..90d59af009f 100644
--- a/litellm/containers/main.py
+++ b/litellm/containers/main.py
@@ -1,7 +1,7 @@
 import asyncio
 import contextvars
 import json
-from collections.abc import Coroutine, Mapping
+from collections.abc import Callable, Coroutine, Mapping
 from functools import partial
 from typing import Final, Literal, overload
 
@@ -47,6 +47,13 @@ __all__ = [
 
 
 ##### Container Create #######################
+async def _encode_created_container_id(
+    pending: Coroutine[object, object, ContainerObject],
+    encode: Callable[[ContainerObject], ContainerObject],
+) -> ContainerObject:
+    return encode(await pending)
+
+
 @client
 async def acreate_container(
     name: str,
@@ -256,16 +263,16 @@ def create_container(
             _is_async=_is_async,
         )
 
-        # Encode container_id with provider/model metadata for routing
+        encode: Final = partial(
+            ContainerRequestUtils.encode_container_id_in_response,
+            custom_llm_provider=custom_llm_provider,
+            litellm_metadata=kwargs.get("litellm_metadata"),
+            extra_body=extra_body,
+        )
         if isinstance(container_obj, ContainerObject):
-            container_obj = ContainerRequestUtils.encode_container_id_in_response(
-                response_obj=container_obj,
-                custom_llm_provider=custom_llm_provider,
-                litellm_metadata=kwargs.get("litellm_metadata"),
-                extra_body=extra_body,
-            )
+            return encode(container_obj)
 
-        return container_obj
+        return _encode_created_container_id(pending=container_obj, encode=encode)
 
     except Exception as e:
         raise litellm.exception_type(
diff --git a/litellm/integrations/anthropic_cache_control_hook.py b/litellm/integrations/anthropic_cache_control_hook.py
index 545b0f40018..3519240dda9 100644
--- a/litellm/integrations/anthropic_cache_control_hook.py
+++ b/litellm/integrations/anthropic_cache_control_hook.py
@@ -755,6 +755,7 @@ class AnthropicCacheControlHook(CustomPromptManagement):
     def record_gateway_injection(
         request_kwargs: Mapping[str, object],
         added: int,
+        injected_for_every_deployment: bool = False,
     ) -> None:
         """Name the deployment whose payload the gateway, not the client, put breakpoints on.
 
@@ -771,7 +772,16 @@ class AnthropicCacheControlHook(CustomPromptManagement):
 
         A pass that runs before a deployment is chosen, which is what the proxy does for
         prompt templates, injects into the payload every leg goes on to send, so it marks
-        the request for all of them rather than for one.
+        the request for all of them rather than for one. Such a pass says so with
+        ``injected_for_every_deployment`` instead of relying on the shape of
+        ``request_kwargs``: the router's prompt-management factory stamps a provisional
+        deployment's ``model_info`` into kwargs before the prompt pass runs, and billing
+        the request through any other deployment would silently drop the credit. An
+        every-deployment mark, once written, also never narrows: a later per-leg stamp
+        (the Bedrock converse tool_config one included) describes one leg of a payload
+        every leg sends, so narrowing to it would uncredit whichever leg gets billed
+        after a failover. Both losses are fail-closed under-crediting, which is why the
+        guard only protects the sentinel and per-leg marks still overwrite each other.
 
         Only what this pass actually placed counts. A ``tool_config`` point is placed by
         the Bedrock converse transform, and only when the request carries tools, so the
@@ -801,13 +811,19 @@ class AnthropicCacheControlHook(CustomPromptManagement):
             ),
             None,
         )
-        if bucket is not None:
-            model_info: Final = request_kwargs.get("model_info")
-            bucket[GATEWAY_INJECTED_CACHE_METADATA_KEY] = (
-                model_info.get("id", GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT)
-                if isinstance(model_info, dict)
-                else GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT
-            )
+        if bucket is None:
+            return
+        if bucket.get(GATEWAY_INJECTED_CACHE_METADATA_KEY) == GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT:
+            return
+        if injected_for_every_deployment:
+            bucket[GATEWAY_INJECTED_CACHE_METADATA_KEY] = GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT
+            return
+        model_info: Final = request_kwargs.get("model_info")
+        bucket[GATEWAY_INJECTED_CACHE_METADATA_KEY] = (
+            model_info.get("id", GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT)
+            if isinstance(model_info, dict)
+            else GATEWAY_INJECTED_FOR_EVERY_DEPLOYMENT
+        )
 
     @staticmethod
     def maybe_inject_cache_control(
diff --git a/litellm/integrations/otel/langfuse_logger.py b/litellm/integrations/otel/langfuse_logger.py
new file mode 100644
index 00000000000..ed47533e700
--- /dev/null
+++ b/litellm/integrations/otel/langfuse_logger.py
@@ -0,0 +1,60 @@
+from collections.abc import AsyncGenerator, AsyncIterator, Callable, Mapping
+from typing import TYPE_CHECKING, Final
+
+from litellm._logging import verbose_logger
+from litellm.integrations.otel.logger import OpenTelemetryV2
+from litellm.integrations.otel.mappers.langfuse import LANGFUSE_OBSERVATION_INPUT, LANGFUSE_OBSERVATION_OUTPUT
+from litellm.integrations.otel.model.request_io import request_input, response_output, stream_output
+from litellm.integrations.otel.plumbing.context import request_root_span
+
+if TYPE_CHECKING:
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.types.utils import ModelResponseStream
+
+
+class LangfuseOpenTelemetryV2(OpenTelemetryV2):
+    """Stamps the request's input and output on the root observation while it is still recording.
+
+    Langfuse shows a trace's input and output from its root observation. The proxy's root span ends
+    when the response is sent, before the success callback runs, so both stamps come from the
+    post-call hooks in the request task: the request as it stands after the pre-call chain and the
+    response as it is returned, for the call types whose response renders as a message.
+    """
+
+    async def async_post_call_success_hook(
+        self,
+        data: Mapping[str, object],
+        user_api_key_dict: "UserAPIKeyAuth",
+        response: object,
+    ) -> None:
+        self._stamp_root_io(data, lambda: response_output(response))
+
+    async def async_post_call_streaming_iterator_hook(
+        self,
+        user_api_key_dict: "UserAPIKeyAuth",
+        response: "AsyncIterator[ModelResponseStream]",
+        request_data: Mapping[str, object],
+    ) -> "AsyncGenerator[ModelResponseStream, None]":
+        relayed: Final[list[ModelResponseStream]] = []  # mutable-ok: relayed as they arrive, assembled at end of stream
+        async for chunk in response:
+            relayed.append(chunk)
+            yield chunk
+        self._stamp_root_io(request_data, lambda: stream_output(tuple(relayed), request_data))
+
+    def _stamp_root_io(self, data: Mapping[str, object], render_output: Callable[[], str | None]) -> None:
+        root: Final = request_root_span()
+        if root is None or not root.is_recording():
+            return
+        try:
+            output: Final = render_output()
+            if output is None:
+                return
+            root.set_attribute(LANGFUSE_OBSERVATION_OUTPUT, output)
+            rendered_input: Final = request_input(data)
+        except Exception:  # noqa: BLE001  # telemetry must never fail the request it describes
+            verbose_logger.debug(
+                "otel v2 langfuse: could not render the root observation input or output", exc_info=True
+            )
+            return
+        if rendered_input is not None:
+            root.set_attribute(LANGFUSE_OBSERVATION_INPUT, rendered_input)
diff --git a/litellm/integrations/otel/logger.py b/litellm/integrations/otel/logger.py
index d2a32ef73b6..a550dca6cc8 100644
--- a/litellm/integrations/otel/logger.py
+++ b/litellm/integrations/otel/logger.py
@@ -4,6 +4,7 @@ from collections import OrderedDict
 from collections.abc import Callable, Iterator, Mapping, Sequence
 from contextlib import contextmanager
 from datetime import datetime
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, cast
 
 from opentelemetry.context import Context, attach, get_current
@@ -909,3 +910,29 @@ def phase_span(name: str) -> "Iterator[Span | None]":
         return
     with logger.start_phase_span(name) as span:
         yield span
+
+
+def build_otel_v2_logger(
+    config: OpenTelemetryV2Config,
+    callback_name: str | None = None,
+    tracer_provider: TracerProvider | None = None,
+    logger_provider: LoggerProvider | None = None,
+    meter_provider: "MeterProvider | None" = None,
+    settings: Mapping[str, object] = MappingProxyType({}),
+) -> OpenTelemetryV2:
+    return _logger_class(config)(
+        config=config,
+        callback_name=callback_name,
+        tracer_provider=tracer_provider,
+        logger_provider=logger_provider,
+        meter_provider=meter_provider,
+        **settings,
+    )
+
+
+def _logger_class(config: OpenTelemetryV2Config) -> type[OpenTelemetryV2]:
+    if "langfuse" not in config.mapper_names or not config.capture_span_content:
+        return OpenTelemetryV2
+    from litellm.integrations.otel.langfuse_logger import LangfuseOpenTelemetryV2
+
+    return LangfuseOpenTelemetryV2
diff --git a/litellm/integrations/otel/mappers/langfuse.py b/litellm/integrations/otel/mappers/langfuse.py
index 6d4f1b4fd0a..01063d85355 100644
--- a/litellm/integrations/otel/mappers/langfuse.py
+++ b/litellm/integrations/otel/mappers/langfuse.py
@@ -11,6 +11,7 @@ the JSON-serialized payloads. ``_llm_call`` just applies both tables.
 
 import json
 from collections.abc import Callable
+from typing import Final
 
 from litellm.integrations.otel.mappers.base import AttributeMap, AttrValue, SpanData
 from litellm.integrations.otel.mappers.utils import (
@@ -25,6 +26,9 @@ from litellm.integrations.otel.model.payloads import (
     LLMUsage,
 )
 
+LANGFUSE_OBSERVATION_INPUT: Final = "langfuse.observation.input"
+LANGFUSE_OBSERVATION_OUTPUT: Final = "langfuse.observation.output"
+
 
 class LangfuseMapper:
     _LLM_CALL_ATTRS: dict[str, Callable[[LLMCallSpanData], AttrValue | None]] = {
@@ -56,8 +60,8 @@ class LangfuseMapper:
         "langfuse.observation.model.parameters": lambda d: json_if(
             collect(LangfuseMapper._MODEL_PARAMS, d.request_params)
         ),
-        "langfuse.observation.input": lambda d: serialize_messages(d.messages_in),
-        "langfuse.observation.output": lambda d: serialize_messages(output_messages(d)),
+        LANGFUSE_OBSERVATION_INPUT: lambda d: serialize_messages(d.messages_in),
+        LANGFUSE_OBSERVATION_OUTPUT: lambda d: serialize_messages(output_messages(d)),
         "langfuse.observation.usage_details": lambda d: json_if(collect(LangfuseMapper._USAGE_FIELDS, d.usage)),
         "langfuse.observation.cost_details": lambda d: (
             json.dumps({"total": d.response_cost}) if d.response_cost is not None else None
diff --git a/litellm/integrations/otel/model/request_io.py b/litellm/integrations/otel/model/request_io.py
new file mode 100644
index 00000000000..4e80fb91993
--- /dev/null
+++ b/litellm/integrations/otel/model/request_io.py
@@ -0,0 +1,90 @@
+from collections.abc import Mapping, Sequence
+from typing import Final, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, TypeAdapter, ValidationError
+from typing_extensions import ReadOnly, TypedDict
+
+import litellm
+from litellm.integrations.otel.mappers.utils import json_or_none
+from litellm.proxy.guardrails.anthropic_sse import assemble_anthropic_sse_stream, is_raw_sse_stream
+from litellm.types.llms.openai import ResponseCompletedEvent, ResponsesAPIResponse
+from litellm.types.utils import ModelResponse, ModelResponseStream
+
+_SYSTEM_KEYS: Final = ("system", "instructions")
+_TURNS: Final = TypeAdapter(tuple[object, ...])
+_MESSAGES: Final = TypeAdapter(list[object] | None)
+
+
+class _Turn(TypedDict):
+    role: ReadOnly[str]
+    content: ReadOnly[object]
+
+
+class _AnthropicMessage(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    type: Literal["message"] = Field(exclude=True)
+    role: str = "assistant"
+    content: object = None
+
+
+def request_input(data: Mapping[str, object]) -> str | None:
+    turns: Final = data.get("messages", data.get("input"))
+    if turns is None:
+        return None
+    return json_or_none((*_system_turns(data), *_user_turns(turns)))
+
+
+def _system_turns(data: Mapping[str, object]) -> tuple[_Turn, ...]:
+    return tuple(_Turn(role="system", content=data[key]) for key in _SYSTEM_KEYS if data.get(key) is not None)
+
+
+def _user_turns(turns: object) -> tuple[object, ...]:
+    if isinstance(turns, str):
+        return (_Turn(role="user", content=turns),)
+    try:
+        return _TURNS.validate_python(turns)
+    except ValidationError:
+        return (_Turn(role="user", content=turns),)
+
+
+def response_output(response: object) -> str | None:
+    match response:
+        case ModelResponse():
+            return json_or_none(tuple(choice.message.model_dump(exclude_none=True) for choice in response.choices))
+        case ResponsesAPIResponse():
+            return json_or_none(response.model_dump(exclude_none=True).get("output"))
+        case _:
+            return _anthropic_message_output(response)
+
+
+def _anthropic_message_output(message: object) -> str | None:
+    try:
+        parsed: Final = _AnthropicMessage.model_validate(message)
+    except ValidationError:
+        return None
+    return json_or_none((parsed.model_dump(),))
+
+
+def stream_output(chunks: Sequence[object], data: Mapping[str, object]) -> str | None:
+    if not chunks:
+        return None
+    if is_raw_sse_stream(chunks):
+        return response_output(assemble_anthropic_sse_stream(chunks))
+    if all(isinstance(chunk, ModelResponseStream) for chunk in chunks):
+        return response_output(_assembled_chat_stream(chunks, data))
+    return response_output(_completed_response(chunks))
+
+
+def _assembled_chat_stream(chunks: Sequence[object], data: Mapping[str, object]) -> object:
+    try:
+        return litellm.stream_chunk_builder(  # pyright: ignore[reportUnknownMemberType]  # upstream types chunks as a bare list
+            chunks=list(chunks),  # mutable-ok: stream_chunk_builder takes a list
+            messages=_MESSAGES.validate_python(data.get("messages")),
+        )
+    except (litellm.APIError, ValidationError):
+        return None
+
+
+def _completed_response(chunks: Sequence[object]) -> ResponsesAPIResponse | None:
+    return next((chunk.response for chunk in reversed(chunks) if isinstance(chunk, ResponseCompletedEvent)), None)
diff --git a/litellm/litellm_core_utils/litellm_logging.py b/litellm/litellm_core_utils/litellm_logging.py
index 9a6fb11f978..f54eeca5178 100644
--- a/litellm/litellm_core_utils/litellm_logging.py
+++ b/litellm/litellm_core_utils/litellm_logging.py
@@ -901,6 +901,7 @@ class Logging(LiteLLMLoggingBaseClass):
         prompt_label: str | None = None,
         prompt_version: int | None = None,
         request_kwargs: dict[str, object] | None = None,  # mutable-ok: marker stamped into live request kwargs
+        injected_for_every_deployment: bool = False,
     ) -> tuple[str, list[AllMessageValues], dict]:
         from litellm.integrations.anthropic_cache_control_hook import AnthropicCacheControlHook
 
@@ -933,6 +934,7 @@ class Logging(LiteLLMLoggingBaseClass):
                 AnthropicCacheControlHook.record_gateway_injection(
                     request_kwargs,
                     AnthropicCacheControlHook.count_request_cache_breakpoints(messages) - breakpoints_before,
+                    injected_for_every_deployment=injected_for_every_deployment,
                 )
         self.messages = messages
         return model, messages, non_default_params
@@ -950,6 +952,7 @@ class Logging(LiteLLMLoggingBaseClass):
         prompt_label: str | None = None,
         prompt_version: int | None = None,
         request_kwargs: dict[str, object] | None = None,  # mutable-ok: marker stamped into live request kwargs
+        injected_for_every_deployment: bool = False,
     ) -> tuple[str, list[AllMessageValues], dict]:
         from litellm.integrations.anthropic_cache_control_hook import AnthropicCacheControlHook
 
@@ -985,6 +988,7 @@ class Logging(LiteLLMLoggingBaseClass):
                 AnthropicCacheControlHook.record_gateway_injection(
                     request_kwargs,
                     AnthropicCacheControlHook.count_request_cache_breakpoints(messages) - breakpoints_before,
+                    injected_for_every_deployment=injected_for_every_deployment,
                 )
         self.messages = messages
         return model, messages, non_default_params
@@ -4390,13 +4394,15 @@ def _init_custom_logger_compatible_class(
             from litellm.integrations.otel.model.config import is_otel_v2_enabled
 
             if is_otel_v2_enabled():
-                from litellm.integrations.otel.logger import OpenTelemetryV2
+                from litellm.integrations.otel.logger import OpenTelemetryV2, build_otel_v2_logger
+                from litellm.integrations.otel.model.config import OpenTelemetryV2Config
 
                 for callback in _in_memory_loggers:
-                    if type(callback) is OpenTelemetryV2:
+                    if isinstance(callback, OpenTelemetryV2):
                         return callback
-                otel_logger_v2: Final = OpenTelemetryV2(
-                    **_get_custom_logger_settings_from_proxy_server(callback_name=logging_integration)
+                otel_settings: Final = _get_custom_logger_settings_from_proxy_server(callback_name=logging_integration)
+                otel_logger_v2: Final = build_otel_v2_logger(
+                    config=OpenTelemetryV2Config(**otel_settings), settings=otel_settings
                 )
                 _in_memory_loggers.append(otel_logger_v2)
                 _maybe_auto_initialize_arize_phoenix(_in_memory_loggers)
@@ -4759,7 +4765,7 @@ def _maybe_construct_otel_v2(callback_name: str, _in_memory_loggers: list[Custom
 
     if not is_otel_v2_enabled():
         return None
-    from litellm.integrations.otel.logger import OpenTelemetryV2
+    from litellm.integrations.otel.logger import OpenTelemetryV2, build_otel_v2_logger
     from litellm.integrations.otel.presets import PRESET_BY_CALLBACK
 
     preset_fn: Final = PRESET_BY_CALLBACK.get(callback_name)
@@ -4774,7 +4780,7 @@ def _maybe_construct_otel_v2(callback_name: str, _in_memory_loggers: list[Custom
         # If env vars are missing or the preset raises, defer to the legacy path
         # so customers get the same error story they had before V2 landed.
         return None
-    v2_logger: Final = OpenTelemetryV2(config=config, callback_name=callback_name)
+    v2_logger: Final = build_otel_v2_logger(config=config, callback_name=callback_name)
     _in_memory_loggers.append(v2_logger)
     return v2_logger
 
diff --git a/litellm/litellm_core_utils/secret_redaction.py b/litellm/litellm_core_utils/secret_redaction.py
index 5d5bd547d22..e93ab155786 100644
--- a/litellm/litellm_core_utils/secret_redaction.py
+++ b/litellm/litellm_core_utils/secret_redaction.py
@@ -30,6 +30,11 @@ def _build_secret_patterns() -> "re.Pattern[str]":
         r"Basic\s+[A-Za-z0-9+/]{10,}={0,2}",
         # OpenAI / Anthropic sk- prefixed keys
         rf"sk-[A-Za-z0-9\-_]{{{MINIMUM_CUSTOM_KEY_LENGTH - len('sk-')},}}",
+        # Credentials passed as URL query params. Terminated by "&" like the key=
+        # and sig= patterns below, so the rest of the request line survives in an
+        # access log. Must precede the generic patterns to win at the same position.
+        r"(?<=[?&])(?:api[_-]?key|\w*(?:token|password|passwd|client_secret|secret_key|_secret))"
+        r"=[^\s&'\"]+",
         # Generic api_key / api-key / apikey (handles 'key': 'value' dict repr)
         r"(?:api[_-]?key)['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]{8,}",
         # x-api-key / api-key header values (handles 'key': 'value' dict repr)
@@ -45,8 +50,10 @@ def _build_secret_patterns() -> "re.Pattern[str]":
         # Word boundary prevents O(n^2) backtracking on long word-char runs.
         r"(?:^|(?<=\W))\w*(?:password|passwd|client_secret|secret_key|_secret)"
         r"['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]+",
-        # Database connection string credentials (scheme://user:pass@host)
-        r"(?<=://)[^\s'\"]*:[^\s'\"@]+(?=@)",
+        # Database connection string credentials (scheme://user:pass@host).
+        # The user half stops at the ":" separator and both halves are length-capped,
+        # so a long attacker-supplied URL cannot backtrack quadratically.
+        r"(?<=://)[^\s'\":]{0,4096}:[^\s'\"]{1,4096}(?=@)",
         # Databricks personal access tokens
         r"dapi[0-9a-f]{32}",
         # Module-level provider keys logged as litellm.<provider>_key=<value>
@@ -67,8 +74,10 @@ def _build_secret_patterns() -> "re.Pattern[str]":
         r"""['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]+""",
         # Raw JWTs (without Bearer prefix)
         r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*",
-        # Azure SAS tokens in URLs
-        r"[?&]sig=[A-Za-z0-9%+/=]+",
+        # Azure SAS tokens in URLs. The delimiter is a lookbehind, like the
+        # `key=` pattern above, so the `?` or `&` survives and the redacted URL
+        # stays well formed (this string is often a request line in a log).
+        r"(?<=[?&])sig=[A-Za-z0-9%+/=]+",
         # Full JSON service-account blobs (single-line and multi-line)
         r'\{[^{}]*"type"\s*:\s*"service_account"[^{}]*(?:\{[^{}]*\}[^{}]*)*\}',
     ]
diff --git a/litellm/llms/azure_ai/vector_stores/transformation.py b/litellm/llms/azure_ai/vector_stores/transformation.py
index 5e61d0a1dd9..64e72b819b1 100644
--- a/litellm/llms/azure_ai/vector_stores/transformation.py
+++ b/litellm/llms/azure_ai/vector_stores/transformation.py
@@ -19,6 +19,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     LiteLLMLoggingObj = _LiteLLMLoggingObj
 else:
@@ -115,6 +116,7 @@ class AzureAIVectorStoreConfig(BaseVectorStoreConfig, BaseAzureLLM):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict[str, Any]]:
         """
         Transform search request for Azure AI Search API
diff --git a/litellm/llms/base_llm/files/azure_blob_storage_backend.py b/litellm/llms/base_llm/files/azure_blob_storage_backend.py
index e22cf528856..a192226110c 100644
--- a/litellm/llms/base_llm/files/azure_blob_storage_backend.py
+++ b/litellm/llms/base_llm/files/azure_blob_storage_backend.py
@@ -7,16 +7,36 @@ to reuse all authentication and Azure Storage operations.
 """
 
 import time
+from pathlib import Path
 from typing import Final
 from urllib.parse import quote, urlparse
 
 from litellm._logging import verbose_logger
 from litellm._uuid import uuid
 from litellm.integrations.azure_storage.azure_storage import AzureBlobStorageLogger
+from litellm.proxy.common_utils.path_utils import safe_filename
 
 from .storage_backend import BaseFileStorageBackend
 
 
+def _safe_basename(original_filename: str) -> str:
+    try:
+        return safe_filename(original_filename)
+    except ValueError:
+        return "file"
+
+
+def _safe_extension(original_filename: str) -> str:
+    """The extension off a basename, with no path separators or traversal sequences.
+
+    original_filename.split(".")[-1] does not parse path structure, so a filename
+    like "a.jsonl/../../etc/cron.d/x" would put "../../etc/cron.d/x" straight into
+    the blob path built below. Path.suffix only ever looks at the last path
+    component, so routing through safe_filename() first closes that off.
+    """
+    return Path(_safe_basename(original_filename)).suffix.lstrip(".")
+
+
 class AzureBlobStorageBackend(BaseFileStorageBackend, AzureBlobStorageLogger):
     """
     Azure Blob Storage backend implementation.
@@ -81,16 +101,15 @@ class AzureBlobStorageBackend(BaseFileStorageBackend, AzureBlobStorageLogger):
     def _generate_file_name(self, original_filename: str, file_naming_strategy: str) -> str:
         """Generate file name based on naming strategy."""
         if file_naming_strategy == "original_filename":
-            # Use original filename, but sanitize it
-            return quote(original_filename, safe="")
+            return quote(_safe_basename(original_filename), safe="")
         elif file_naming_strategy == "timestamp":
             # Use timestamp
-            extension = original_filename.split(".")[-1] if "." in original_filename else ""
+            extension = _safe_extension(original_filename)
             timestamp: Final = int(time.time() * 1000)  # milliseconds
             return f"{timestamp}.{extension}" if extension else str(timestamp)
         else:  # default to "uuid"
             # Use UUID
-            extension = original_filename.split(".")[-1] if "." in original_filename else ""
+            extension = _safe_extension(original_filename)
             file_uuid: Final = str(uuid.uuid4())
             return f"{file_uuid}.{extension}" if extension else file_uuid
 
diff --git a/litellm/llms/base_llm/vector_store/transformation.py b/litellm/llms/base_llm/vector_store/transformation.py
index 02a51a8bace..63e99c0915a 100644
--- a/litellm/llms/base_llm/vector_store/transformation.py
+++ b/litellm/llms/base_llm/vector_store/transformation.py
@@ -17,6 +17,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     from ..chat.transformation import BaseLLMException as _BaseLLMException
 
@@ -57,6 +58,7 @@ class BaseVectorStoreConfig:
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         pass
 
@@ -69,6 +71,7 @@ class BaseVectorStoreConfig:
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         """
         Optional async version of transform_search_vector_store_request.
@@ -84,6 +87,7 @@ class BaseVectorStoreConfig:
             litellm_logging_obj=litellm_logging_obj,
             litellm_params=litellm_params,
             extra_body=extra_body,
+            router=router,
         )
 
     @abstractmethod
@@ -197,6 +201,7 @@ class BaseDirectVectorStoreConfig(BaseVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: Mapping[str, object],
         extra_body: Mapping[str, object] | None = None,
+        router: "Router | None" = None,
     ) -> NoReturn:
         raise NotImplementedError("Direct vector store providers execute the search themselves; no HTTP request shape")
 
diff --git a/litellm/llms/bedrock/vector_stores/transformation.py b/litellm/llms/bedrock/vector_stores/transformation.py
index 2d72db0cdba..bad17a2181d 100644
--- a/litellm/llms/bedrock/vector_stores/transformation.py
+++ b/litellm/llms/bedrock/vector_stores/transformation.py
@@ -27,6 +27,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+    from litellm.router import Router
 else:
     LiteLLMLoggingObj = Any
 
@@ -196,6 +197,7 @@ class BedrockVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         if isinstance(query, list):
             query = " ".join(query)
diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py
index 834f7d564a2..6f42d42de00 100644
--- a/litellm/llms/custom_httpx/llm_http_handler.py
+++ b/litellm/llms/custom_httpx/llm_http_handler.py
@@ -178,6 +178,7 @@ if TYPE_CHECKING:
         AnthropicMessagesStreamingResponse,
     )
     from litellm.llms.base_llm.passthrough.transformation import BasePassthroughConfig
+    from litellm.router import Router
     from litellm.types.llms.openai_evals import (
         CancelEvalResponse,
         CancelRunResponse,
@@ -2923,7 +2924,7 @@ class BaseLLMHTTPHandler:
         final_response: Final = await self._call_agentic_completion_hooks(
             response=initial_response,
             model=model,
-            messages=(input if isinstance(input, list) else [{"role": "user", "content": input}]),
+            messages=(input if isinstance(input, list) else [{"role": "user", "content": input}]),  # pyright: ignore[reportArgumentType]  # pre-existing mismatch surfaced by the Router import; the hook accepts response input items at runtime
             anthropic_messages_provider_config=responses_api_provider_config,
             anthropic_messages_optional_request_params=response_api_optional_request_params,
             logging_obj=logging_obj,
@@ -5415,7 +5416,7 @@ class BaseLLMHTTPHandler:
         try:
             response: ResponsesAPIResponse | BaseResponsesAPIStreamingIterator = await litellm.aresponses(
                 model=patch.model or model,
-                input=patch.messages,
+                input=patch.messages,  # pyright: ignore[reportArgumentType]  # pre-existing mismatch surfaced by the Router import; patch messages are valid response input at runtime
                 **optional_params,
                 **kwargs_for_followup,
             )
@@ -9688,6 +9689,7 @@ class BaseLLMHTTPHandler:
         timeout: float | httpx.Timeout | None = None,
         client: HTTPHandler | AsyncHTTPHandler | None = None,
         _is_async: bool = False,
+        router: "Router | None" = None,
     ) -> VectorStoreSearchResponse:
         if isinstance(vector_store_provider_config, BaseDirectVectorStoreConfig):
             self._pre_call_direct_vector_store_search(
@@ -9738,6 +9740,7 @@ class BaseLLMHTTPHandler:
                 litellm_logging_obj=logging_obj,
                 litellm_params=dict(litellm_params),
                 extra_body=extra_body,
+                router=router,
             )
         else:
             (
@@ -9751,6 +9754,7 @@ class BaseLLMHTTPHandler:
                 litellm_logging_obj=logging_obj,
                 litellm_params=dict(litellm_params),
                 extra_body=extra_body,
+                router=router,
             )
         all_optional_params: Final[dict[str, object]] = dict(litellm_params)
         all_optional_params.update(vector_store_search_optional_params or {})
@@ -9802,6 +9806,7 @@ class BaseLLMHTTPHandler:
         timeout: float | httpx.Timeout | None = None,
         client: HTTPHandler | AsyncHTTPHandler | None = None,
         _is_async: bool = False,
+        router: "Router | None" = None,
     ) -> VectorStoreSearchResponse | Coroutine[object, object, VectorStoreSearchResponse]:
         if _is_async:
             return self.async_vector_store_search_handler(
@@ -9816,6 +9821,7 @@ class BaseLLMHTTPHandler:
                 extra_body=extra_body,
                 timeout=timeout,
                 client=client,
+                router=router,
             )
 
         if isinstance(vector_store_provider_config, BaseDirectVectorStoreConfig):
@@ -9862,6 +9868,7 @@ class BaseLLMHTTPHandler:
             litellm_logging_obj=logging_obj,
             litellm_params=dict(litellm_params),
             extra_body=extra_body,
+            router=router,
         )
 
         all_optional_params: Final[dict[str, object]] = dict(litellm_params)
diff --git a/litellm/llms/gemini/vector_stores/transformation.py b/litellm/llms/gemini/vector_stores/transformation.py
index f6525a449b6..82586b1f638 100644
--- a/litellm/llms/gemini/vector_stores/transformation.py
+++ b/litellm/llms/gemini/vector_stores/transformation.py
@@ -33,6 +33,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+    from litellm.router import Router
 else:
     LiteLLMLoggingObj = Any
 
@@ -168,6 +169,7 @@ class GeminiVectorStoreConfig(BaseVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: Mapping[str, object] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         """
         Transform search request to Gemini's generateContent format.
diff --git a/litellm/llms/langflow/a2a.py b/litellm/llms/langflow/a2a.py
index cae750d586e..060dc0a4d05 100644
--- a/litellm/llms/langflow/a2a.py
+++ b/litellm/llms/langflow/a2a.py
@@ -1,28 +1,9 @@
-import hashlib
 from typing import Any, Final
 
-
-def get_session_id_from_a2a_params(params: dict[str, Any]) -> str | None:
-    message: Final = params.get("message", {})
-    if isinstance(message, dict):
-        return message.get("contextId")
-    return getattr(message, "contextId", None)
-
-
-def scope_session_to_principal(session_id: str, principal: str | None) -> str:
-    """
-    Bind a client-supplied A2A contextId to the authenticated principal.
-
-    Without this, two distinct keys authorized for the same LangFlow agent could
-    set the same contextId and read/append to each other's LangFlow memory. The
-    principal is hashed (it is already a hashed token) so the raw value is never
-    sent to the LangFlow backend, while the original contextId is kept as a
-    suffix for operator-side correlation.
-    """
-    if not principal:
-        return session_id
-    principal_prefix: Final = hashlib.sha256(principal.encode("utf-8")).hexdigest()[:16]
-    return f"{principal_prefix}-{session_id}"
+from litellm.a2a_protocol.utils import (
+    get_session_id_from_a2a_params,
+    scope_session_to_principal,
+)
 
 
 def merge_a2a_session_into_litellm_params(
diff --git a/litellm/llms/milvus/vector_stores/transformation.py b/litellm/llms/milvus/vector_stores/transformation.py
index 34f0cd854c4..c3581abfbcc 100644
--- a/litellm/llms/milvus/vector_stores/transformation.py
+++ b/litellm/llms/milvus/vector_stores/transformation.py
@@ -19,6 +19,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     LiteLLMLoggingObj = _LiteLLMLoggingObj
 else:
@@ -123,6 +124,7 @@ class MilvusVectorStoreConfig(BaseVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict[str, Any]]:
         """
         Transform search request for Azure AI Search API
diff --git a/litellm/llms/openai/vector_stores/transformation.py b/litellm/llms/openai/vector_stores/transformation.py
index f6c093f2e2a..4e925494039 100644
--- a/litellm/llms/openai/vector_stores/transformation.py
+++ b/litellm/llms/openai/vector_stores/transformation.py
@@ -21,6 +21,7 @@ from litellm.utils import add_openai_metadata
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     LiteLLMLoggingObj = _LiteLLMLoggingObj
 else:
@@ -99,6 +100,7 @@ class OpenAIVectorStoreConfig(BaseVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         encoded_vector_store_id: Final = encode_url_path_segment(vector_store_id, field_name="vector_store_id")
         url: Final = f"{api_base}/{encoded_vector_store_id}/search"
diff --git a/litellm/llms/pg_vector/vector_stores/transformation.py b/litellm/llms/pg_vector/vector_stores/transformation.py
index e4b06c36bf4..9de1f589ae4 100644
--- a/litellm/llms/pg_vector/vector_stores/transformation.py
+++ b/litellm/llms/pg_vector/vector_stores/transformation.py
@@ -8,6 +8,7 @@ from litellm.types.vector_stores import VectorStoreSearchOptionalRequestParams
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+    from litellm.router import Router
 else:
     LiteLLMLoggingObj = Any
 
@@ -80,6 +81,7 @@ class PGVectorStoreConfig(OpenAIVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         encoded_vector_store_id: Final = encode_url_path_segment(vector_store_id, field_name="vector_store_id")
         url: Final = f"{api_base}/{encoded_vector_store_id}/search"
diff --git a/litellm/llms/ragflow/vector_stores/transformation.py b/litellm/llms/ragflow/vector_stores/transformation.py
index 282cb7a92a7..ffa6c9e1076 100644
--- a/litellm/llms/ragflow/vector_stores/transformation.py
+++ b/litellm/llms/ragflow/vector_stores/transformation.py
@@ -17,6 +17,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+    from litellm.router import Router
 else:
     LiteLLMLoggingObj = Any
 
@@ -92,6 +93,7 @@ class RAGFlowVectorStoreConfig(BaseVectorStoreConfig):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         """RAGFlow vector stores are management-only, search is not supported."""
         raise NotImplementedError("RAGFlow vector stores support dataset management only, not search/retrieval")
diff --git a/litellm/llms/s3_vectors/vector_stores/transformation.py b/litellm/llms/s3_vectors/vector_stores/transformation.py
index 5be35ae4148..733358381fe 100644
--- a/litellm/llms/s3_vectors/vector_stores/transformation.py
+++ b/litellm/llms/s3_vectors/vector_stores/transformation.py
@@ -1,8 +1,8 @@
-import re
 from typing import TYPE_CHECKING, Any, Final
 
 import httpx
 
+from litellm.caching._embedding_router import resolve_embedding_router
 from litellm.llms.base_llm.vector_store.transformation import BaseVectorStoreConfig
 from litellm.llms.bedrock.base_aws_llm import BaseAWSLLM
 from litellm.types.router import GenericLiteLLMParams
@@ -18,6 +18,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
+    from litellm.router import Router
 else:
     LiteLLMLoggingObj = Any
 
@@ -58,13 +59,20 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
         return headers
 
     def get_complete_url(self, api_base: str | None, litellm_params: dict) -> str:
-        aws_region_name: Final = litellm_params.get("aws_region_name")
-        if not aws_region_name:
-            raise ValueError("aws_region_name is required for S3 Vectors")
-        if not re.match(r"^[a-z][a-z0-9-]*$", aws_region_name):
-            raise ValueError("Invalid aws_region_name format")
+        # Resolve region the same way the ingestion path does:
+        # dynamic param -> AWS_REGION_NAME -> AWS_REGION -> default (us-west-2)
+        aws_region_name: Final = self.get_aws_region_name_for_non_llm_api_calls(litellm_params.get("aws_region_name"))
         return f"https://s3vectors.{aws_region_name}.api.aws"
 
+    def _resolve_query_embedding_router(self, embedding_model: str, router: "Router | None") -> "Router | None":
+        """Return the router iff it serves ``embedding_model`` as a deployment."""
+        if router is None:
+            return None
+        model_list: Final = [
+            dict(m) for m in (router.get_model_list() or ())
+        ]  # mutable-ok: resolve_embedding_router requires list[dict]
+        return resolve_embedding_router(embedding_model=embedding_model, llm_router=router, llm_model_list=model_list)
+
     def transform_search_vector_store_request(
         self,
         vector_store_id: str,
@@ -74,6 +82,7 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         """Sync version - generates embedding synchronously."""
         # For S3 Vectors, vector_store_id should be in format: bucket_name:index_name
@@ -99,10 +108,16 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
 
         # Generate embedding for the query
         embedding_model: Final = litellm_params.get("embedding_model", "text-embedding-3-small")
+        embedding_router: Final = self._resolve_query_embedding_router(embedding_model=embedding_model, router=router)
 
         import litellm as litellm_module
 
-        embedding_response: Final = litellm_module.embedding(model=embedding_model, input=[query])
+        embedding_input: Final = [query]  # mutable-ok: the embedding API takes list input
+        embedding_response: Final = (
+            embedding_router.embedding(model=embedding_model, input=embedding_input)
+            if embedding_router is not None
+            else litellm_module.embedding(model=embedding_model, input=embedding_input)
+        )
         query_embedding: Final = embedding_response.data[0]["embedding"]
 
         url: Final = f"{api_base}/QueryVectors"
@@ -128,6 +143,7 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: dict[str, Any] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict]:
         """Async version - generates embedding asynchronously."""
         # For S3 Vectors, vector_store_id should be in format: bucket_name:index_name
@@ -153,10 +169,16 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
 
         # Generate embedding for the query asynchronously
         embedding_model: Final = litellm_params.get("embedding_model", "text-embedding-3-small")
+        embedding_router: Final = self._resolve_query_embedding_router(embedding_model=embedding_model, router=router)
 
         import litellm as litellm_module
 
-        embedding_response: Final = await litellm_module.aembedding(model=embedding_model, input=[query])
+        embedding_input: Final = [query]  # mutable-ok: the embedding API takes list input
+        embedding_response: Final = (
+            await embedding_router.aembedding(model=embedding_model, input=embedding_input)
+            if embedding_router is not None
+            else await litellm_module.aembedding(model=embedding_model, input=embedding_input)
+        )
         query_embedding: Final = embedding_response.data[0]["embedding"]
 
         url: Final = f"{api_base}/QueryVectors"
diff --git a/litellm/llms/vertex_ai/vector_stores/rag_api/transformation.py b/litellm/llms/vertex_ai/vector_stores/rag_api/transformation.py
index 5c250fc1a7e..36b57e7c995 100644
--- a/litellm/llms/vertex_ai/vector_stores/rag_api/transformation.py
+++ b/litellm/llms/vertex_ai/vector_stores/rag_api/transformation.py
@@ -21,6 +21,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     LiteLLMLoggingObj = _LiteLLMLoggingObj
 else:
@@ -161,6 +162,7 @@ class VertexVectorStoreConfig(BaseVectorStoreConfig, VertexBase):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: Mapping[str, object] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict[str, object]]:
         """
         Transform search request for Vertex AI RAG API
diff --git a/litellm/llms/vertex_ai/vector_stores/search_api/transformation.py b/litellm/llms/vertex_ai/vector_stores/search_api/transformation.py
index 0bcf16ee06f..f0812e3ed9f 100644
--- a/litellm/llms/vertex_ai/vector_stores/search_api/transformation.py
+++ b/litellm/llms/vertex_ai/vector_stores/search_api/transformation.py
@@ -25,6 +25,7 @@ from litellm.types.vector_stores import (
 
 if TYPE_CHECKING:
     from litellm.litellm_core_utils.litellm_logging import Logging as _LiteLLMLoggingObj
+    from litellm.router import Router
 
     LiteLLMLoggingObj = _LiteLLMLoggingObj
 else:
@@ -245,6 +246,7 @@ class VertexSearchAPIVectorStoreConfig(BaseVectorStoreConfig, VertexBase):
         litellm_logging_obj: LiteLLMLoggingObj,
         litellm_params: dict,
         extra_body: Mapping[str, object] | None = None,
+        router: "Router | None" = None,
     ) -> tuple[str, dict[str, object]]:
         """
         Transform a search request for the Vertex AI Search (Discovery Engine) API.
diff --git a/litellm/main.py b/litellm/main.py
index 01c106adc7c..0128e4defe5 100644
--- a/litellm/main.py
+++ b/litellm/main.py
@@ -141,7 +141,6 @@ from litellm.utils import (
     convert_to_model_response_object,
     create_pretrained_tokenizer,
     create_tokenizer,
-    get_api_key,
     get_llm_provider,
     get_model_info,
     get_non_default_completion_params,
diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json
index 10e8b56d925..d8a8f84b032 100644
--- a/litellm/model_prices_and_context_window_backup.json
+++ b/litellm/model_prices_and_context_window_backup.json
@@ -10177,7 +10177,7 @@
         "cache_read_input_token_cost": 2.8e-08,
         "supports_prompt_caching": true
     },
-    "azure_ai/deepseek-v4-flash-0731": {
+    "azure_ai/DeepSeek-V4-Flash-0731": {
         "cache_read_input_token_cost": 1.4e-08,
         "deprecation_date": "2026-12-03",
         "input_cost_per_token": 4.4e-07,
@@ -33093,6 +33093,88 @@
         "supports_web_search": true,
         "supports_xhigh_reasoning_effort": true
     },
+    "meta/muse-spark-1.3": {
+        "cache_read_input_token_cost": 1.5e-07,
+        "input_cost_per_token": 1.25e-06,
+        "litellm_provider": "meta",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 131072,
+        "max_tokens": 131072,
+        "mode": "chat",
+        "output_cost_per_token": 4.25e-06,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.0025,
+            "search_context_size_low": 0.0025,
+            "search_context_size_medium": 0.0025
+        },
+        "source": "https://ai.developer.meta.com/docs/pricing-rate-limits",
+        "supported_endpoints": [
+            "/v1/chat/completions",
+            "/v1/responses",
+            "/v1/messages"
+        ],
+        "supported_modalities": [
+            "text",
+            "image",
+            "video"
+        ],
+        "supported_output_modalities": [
+            "text"
+        ],
+        "supports_function_calling": true,
+        "supports_minimal_reasoning_effort": true,
+        "supports_parallel_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_system_messages": true,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_web_search": true,
+        "supports_xhigh_reasoning_effort": true
+    },
+    "meta/muse-spark-1.3-contributor": {
+        "cache_read_input_token_cost": 2e-09,
+        "input_cost_per_token": 1e-07,
+        "litellm_provider": "meta",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 131072,
+        "max_tokens": 131072,
+        "mode": "chat",
+        "output_cost_per_token": 2e-07,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.0025,
+            "search_context_size_low": 0.0025,
+            "search_context_size_medium": 0.0025
+        },
+        "source": "https://ai.developer.meta.com/docs/pricing-rate-limits",
+        "supported_endpoints": [
+            "/v1/chat/completions",
+            "/v1/responses",
+            "/v1/messages"
+        ],
+        "supported_modalities": [
+            "text",
+            "image",
+            "video"
+        ],
+        "supported_output_modalities": [
+            "text"
+        ],
+        "supports_function_calling": true,
+        "supports_minimal_reasoning_effort": true,
+        "supports_parallel_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_system_messages": true,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_web_search": true,
+        "supports_xhigh_reasoning_effort": true
+    },
     "meta_llama/Llama-3.3-70B-Instruct": {
         "litellm_provider": "meta_llama",
         "max_input_tokens": 128000,
diff --git a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py
index 425f82794e6..66d4aedba06 100644
--- a/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py
+++ b/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py
@@ -1149,10 +1149,11 @@ class MCPRequestHandler:
         would miss a real outage wrapped inside it."""
         from litellm.proxy.db.exception_handler import PrismaDBExceptionHandler
 
-        if PrismaDBExceptionHandler.is_database_service_unavailable_error_in_chain(e):
+        outage: Final = PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(e)
+        if outage is not None:
             raise HTTPException(
                 status_code=503,
-                detail="Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly.",
+                detail=PrismaDBExceptionHandler.database_unavailable_message(outage),
             ) from None
 
     @staticmethod
diff --git a/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py b/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py
index 09a3703e904..35a30127e27 100644
--- a/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py
+++ b/litellm/proxy/_experimental/mcp_server/bridge_token_flow.py
@@ -101,18 +101,29 @@ class _ResolvedKey:
     key: "UserAPIKeyAuth"
 
 
-_KeyResolutionFailure = Literal["no_active_key", "unavailable", "unresolvable"]
+_KeyResolutionFailure = Literal["no_active_key", "unavailable", "faulted", "unresolvable"]
 """Why a token request yielded no active litellm key, kept distinct so a caller statuses each truthfully
 instead of blaming the client for a gateway problem:
 - ``no_active_key``: none was presented, or the presented key is unknown / blocked / expired (the
   caller's request is at fault)
 - ``unavailable``: the auth database was transiently unreachable while resolving (retryable)
+- ``faulted``: the auth database's query engine reported a fault that retrying will not clear (still a
+  503, but the wording must not tell the operator to wait)
 - ``unresolvable``: the gateway cannot resolve identity right now (no DB connection, or an unexpected
   error) -- a gateway fault, not the caller's
 The classification mirrors admission's ``_reload_admitted_key`` so the mint (ingress) and admission
 (egress) never disagree on the status of the same outage."""
 
 
+def _database_failure(exc: Exception) -> Literal["unavailable", "faulted"]:
+    from litellm.proxy.db.exception_handler import (  # noqa: PLC0415  # inline import avoids a module-load circular import
+        PrismaDBExceptionHandler,
+    )
+
+    fault: Final = PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(exc) or exc
+    return "faulted" if PrismaDBExceptionHandler.is_permanent_database_fault(fault) else "unavailable"
+
+
 async def _resolve_active_litellm_key(request: Request) -> "_ResolvedKey | _KeyResolutionFailure":
     """Resolve the presented litellm key to an active key record, or say precisely why not.
 
@@ -170,7 +181,7 @@ async def _reload_active_key_by_hash(key_hash: str) -> "_ResolvedKey | _KeyResol
         return "no_active_key"
     except Exception as exc:  # noqa: BLE001  # classify: a DB outage is retryable, anything else is an opaque gateway fault
         if PrismaDBExceptionHandler.is_database_service_unavailable_error(exc):
-            return "unavailable"
+            return _database_failure(exc)
         verbose_logger.debug(
             "_reload_active_key_by_hash: unexpected key-resolution error (%s)",
             type(exc).__name__,
@@ -225,8 +236,9 @@ async def load_active_user_by_id(user_id: str) -> "LiteLLM_UserTable | _KeyResol
     except (ProxyException, HTTPException):
         return "no_active_key"
     except Exception as exc:  # noqa: BLE001  # a DB outage is retryable; a missing user (get_user_object's wrapped ValueError) or any other resolution failure fails closed as no_active_key, never a 500
-        if PrismaDBExceptionHandler.is_database_service_unavailable_error_in_chain(exc):
-            return "unavailable"
+        outage: Final = PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(exc)
+        if outage is not None:
+            return _database_failure(outage)
         verbose_logger.debug("_reload_active_user_by_id: user-resolution error (%s)", type(exc).__name__)
         return "no_active_key"
     if user_object is None:
@@ -383,6 +395,7 @@ _BridgeMintError = Literal[
     "no_identity",
     "invalid_refresh",
     "identity_unavailable",
+    "identity_faulted",
     "identity_unresolvable",
     "not_configured",
     "no_upstream_token",
@@ -433,6 +446,13 @@ def _bridge_mint_error_response(error: _BridgeMintError) -> JSONResponse:
                 "temporarily_unavailable",
                 "the authentication database is temporarily unreachable; retry shortly",
             )
+        case "identity_faulted":
+            status, code, desc = (
+                503,
+                "temporarily_unavailable",
+                "the authentication database reported a fault that is not a transient outage; "
+                "retrying will not help until the gateway deployment is repaired",
+            )
         case "identity_unresolvable":
             status, code, desc = (
                 500,
@@ -485,6 +505,8 @@ def _key_resolution_failure_to_mint_error(failure: _KeyResolutionFailure) -> _Br
             return "no_identity"
         case "unavailable":
             return "identity_unavailable"
+        case "faulted":
+            return "identity_faulted"
         case "unresolvable":
             return "identity_unresolvable"
         case _:
@@ -569,6 +591,8 @@ def _refresh_key_failure_to_mint_error(failure: _KeyResolutionFailure) -> _Bridg
             return "invalid_refresh"
         case "unavailable":
             return "identity_unavailable"
+        case "faulted":
+            return "identity_faulted"
         case "unresolvable":
             return "identity_unresolvable"
         case _:
diff --git a/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py
index a43e762a456..c7b0045dde5 100644
--- a/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py
+++ b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py
@@ -150,11 +150,18 @@ _CLIENT_RECORD_DEBUG_KEY: Final = "gateway_dcr_client"
 _CONNECT_FLOW_DEBUG_KEY: Final = "gateway_connect_flow"
 _AUTH_CODE_DEBUG_KEY: Final = "gateway_authorization_code"
 
-ReloadUserFailure = Literal["unresolvable", "unavailable", "no_active_key"]
+ReloadUserFailure = Literal["unresolvable", "unavailable", "faulted", "no_active_key"]
 ReloadUser = Callable[[str], Awaitable[ReloadUserFailure | None]]
 """Injected live-user revalidation (the token endpoint's mirror of admission):
-``None`` means the user is active; ``unavailable`` is a retryable DB outage; anything
-else fails the grant closed."""
+``None`` means the user is active; ``unavailable`` is a retryable DB outage; ``faulted`` is
+a DB fault retrying will not clear (still 503, worded so nobody just waits); anything else
+fails the grant closed."""
+
+_DB_UNAVAILABLE_DESCRIPTION: Final = "the gateway database is unavailable; retry"
+_DB_FAULTED_DESCRIPTION: Final = (
+    "the gateway database reported a fault that is not a transient outage; "
+    "retrying will not help until the gateway deployment is repaired"
+)
 
 PROXY_API_AUDIENCE: Final[SessionAudience] = "proxy_api"
 """The audience a native client (``lite login --pkce``, a Go CLI) asks for by sending the
@@ -659,7 +666,9 @@ def _set_flow_cookie(response: Response, request: Request, handle: str, flow: _C
 def _consent_lookup_failure_response(failure: ReloadUserFailure) -> Response:
     match failure:
         case "unavailable":
-            return _oauth_error(503, "temporarily_unavailable", "the gateway database is unavailable; retry")
+            return _oauth_error(503, "temporarily_unavailable", _DB_UNAVAILABLE_DESCRIPTION)
+        case "faulted":
+            return _oauth_error(503, "temporarily_unavailable", _DB_FAULTED_DESCRIPTION)
         case "unresolvable":
             return _oauth_error(500, "server_error", "the gateway is not configured to resolve users")
         case "no_active_key":
@@ -962,7 +971,9 @@ def _reload_failure_response(failure: ReloadUserFailure) -> Response:
     ``ReloadUserFailure`` member is a type error here rather than silently 400ing."""
     match failure:
         case "unavailable":
-            return _oauth_error(503, "temporarily_unavailable", "the gateway database is unavailable; retry")
+            return _oauth_error(503, "temporarily_unavailable", _DB_UNAVAILABLE_DESCRIPTION)
+        case "faulted":
+            return _oauth_error(503, "temporarily_unavailable", _DB_FAULTED_DESCRIPTION)
         case "unresolvable":
             return _oauth_error(500, "server_error", "the gateway is not configured to resolve users")
         case "no_active_key":
@@ -981,7 +992,7 @@ def _mint_failure_response(failure: ProxyCredentialMintFailure) -> Response:
             return _oauth_error(
                 400, "invalid_grant", "this user belongs to a team; sign in again and pick the team for this credential"
             )
-        case "unavailable" | "unresolvable" | "no_active_key":
+        case "unavailable" | "faulted" | "unresolvable" | "no_active_key":
             return _reload_failure_response(failure)
         case _:
             assert_never(failure)
@@ -1297,8 +1308,8 @@ async def introspect_gateway_token(
         if peeked == "claimed":
             return _inactive_introspection_response()
     failure: Final = await reload_user(opened.principal.user_id)
-    if failure == "unavailable":
-        return _oauth_error(503, "temporarily_unavailable", "the gateway database is unavailable; retry")
+    if failure == "unavailable" or failure == "faulted":
+        return _reload_failure_response(failure)
     if failure is not None:
         return _inactive_introspection_response()
     return _active_introspection_response(opened)
diff --git a/litellm/proxy/_experimental/mcp_server/tool_search.py b/litellm/proxy/_experimental/mcp_server/tool_search.py
index f79765f6d01..4f6305d88cf 100644
--- a/litellm/proxy/_experimental/mcp_server/tool_search.py
+++ b/litellm/proxy/_experimental/mcp_server/tool_search.py
@@ -2,20 +2,31 @@ from __future__ import annotations
 
 import json
 from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
 from datetime import datetime
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, TypedDict, assert_never
 
+from pydantic import ValidationError
 from typing_extensions import ReadOnly, Required
 
 import litellm
 from litellm.proxy.agent_endpoints.agent_search import DEFAULT_AGENT_SEARCH_TOP_K
+from litellm.proxy.common_utils.semantic_text_index import (
+    Embedder,
+    EmbeddingFailed,
+    SemanticTextIndex,
+    router_embedder,
+)
+from litellm.types.mcp import MCPToolSearchSettings
 
 if TYPE_CHECKING:
-    from mcp.types import CallToolResult
+    from mcp.types import CallToolResult, Tool
 
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
     from litellm.proxy._types import UserAPIKeyAuth
 
+MCP_TOOL_SEARCH_SETTINGS_KEY: Final[str] = "mcp_tool_search"
 MCP_TOOL_SEARCH_TOOL_NAME: Final[str] = "mcp_tool_search"
 MCP_TOOL_CALL_TOOL_NAME: Final[str] = "mcp_tool_call"
 AGENT_SEARCH_TOOL_NAME: Final[str] = "agent_search"
@@ -29,17 +40,91 @@ def coerce_top_k(value: Any, default: int = 5) -> int:
         return default
 
 
-def search_tools(query: str, tools: list[dict[str, Any]], top_k: int = 5) -> list[dict[str, Any]]:
+class ToolSearchResult(TypedDict, total=False):
+    name: Required[ReadOnly[str]]
+    description: Required[ReadOnly[str]]
+    inputSchema: Required[ReadOnly[Mapping[str, object]]]
+    score: ReadOnly[float]
+
+
+@dataclass(frozen=True, slots=True)
+class SemanticToolRanker:
+    embed: Embedder
+    embedding_model: str
+    index: SemanticTextIndex
+
+
+global_mcp_tool_search_index: Final = SemanticTextIndex()
+
+
+def mcp_tool_search_settings() -> MCPToolSearchSettings | ValidationError:
+    try:
+        return MCPToolSearchSettings.model_validate(litellm.mcp_tool_search or {})
+    except ValidationError as exc:
+        return exc
+
+
+def _tool_result(tool: Tool) -> ToolSearchResult:
+    return {"name": tool.name, "description": tool.description or "", "inputSchema": tool.inputSchema}
+
+
+def _scored_result(tool: Tool, score: float) -> ToolSearchResult:
+    return {"name": tool.name, "description": tool.description or "", "inputSchema": tool.inputSchema, "score": score}
+
+
+def _tool_text(tool: Tool) -> str:
+    return "\n".join(part for part in (tool.name, tool.description or "") if part)
+
+
+def _keyword_score(query: str, tool: Tool) -> float:
+    haystack: Final = _tool_text(tool).lower()
+    return float(sum(1 for token in query.lower().split() if token in haystack))
+
+
+def _split_core_tools(tools: Sequence[Tool], core_tools: Sequence[str]) -> tuple[tuple[Tool, ...], tuple[Tool, ...]]:
+    by_name: Final = MappingProxyType({tool.name: tool for tool in tools})
+    core: Final = tuple(by_name[name] for name in dict.fromkeys(core_tools) if name in by_name)
+    rest: Final = tuple(tool for tool in tools if tool.name not in frozenset(core_tools))
+    return core, rest
+
+
+def _top_hits(
+    tools: Sequence[Tool], scores: Sequence[float], minimum: float, limit: int
+) -> tuple[tuple[float, Tool], ...]:
+    hits: Final = ((score, tool) for score, tool in zip(scores, tools, strict=True) if score >= minimum)
+    return tuple(sorted(hits, key=lambda hit: hit[0], reverse=True)[:limit])
+
+
+def search_tools(query: str, tools: Sequence[Tool], top_k: int = 5) -> tuple[ToolSearchResult, ...]:
+    """Keyword fallback used when no embedding model is configured: one point per query token found in the tool."""
     if not query:
-        return []
-    tokens: Final = query.lower().split()
+        return ()
+    scores: Final = tuple(_keyword_score(query, tool) for tool in tools)
+    return tuple(_tool_result(tool) for _, tool in _top_hits(tools, scores, minimum=1.0, limit=top_k))
 
-    def _score(tool: dict[str, Any]) -> int:
-        haystack: Final = (tool.get("name", "") + " " + tool.get("description", "")).lower()
-        return sum(1 for t in tokens if t in haystack)
 
-    scored: Final = ((s, tool) for tool in tools if (s := _score(tool)) > 0)
-    return [tool for _, tool in sorted(scored, key=lambda x: x[0], reverse=True)[:top_k]]
+async def search_mcp_tools(
+    query: str,
+    tools: Sequence[Tool],
+    top_k: int,
+    settings: MCPToolSearchSettings,
+    ranker: SemanticToolRanker | None,
+) -> tuple[ToolSearchResult, ...] | EmbeddingFailed:
+    """Core tools the caller can access come first, then up to `top_k` ranked matches from the remaining tools."""
+    core, rest = _split_core_tools(tools, settings.core_tools)
+    limit: Final = min(top_k, settings.top_k)
+    core_results: Final = tuple(_tool_result(tool) for tool in core)
+    if ranker is None:
+        return (*core_results, *search_tools(query, rest, limit))
+    if not query:
+        return core_results
+    scores: Final = await ranker.index.scores(
+        query, tuple(_tool_text(tool) for tool in rest), ranker.embed, ranker.embedding_model
+    )
+    if isinstance(scores, EmbeddingFailed):
+        return scores
+    hits: Final = _top_hits(rest, scores, minimum=settings.similarity_threshold, limit=limit)
+    return (*core_results, *(_scored_result(tool, score) for score, tool in hits))
 
 
 class _ToolParamSchema(TypedDict, total=False):
@@ -66,11 +151,17 @@ def _json_array(*items: str) -> Sequence[str]:
 
 _MCP_TOOL_SEARCH_DEFINITION: Final[VirtualToolDefinition] = {
     "name": MCP_TOOL_SEARCH_TOOL_NAME,
-    "description": "Search for MCP tools by keyword. Returns top matching tools with names, descriptions, and input schemas.",
+    "description": (
+        "Search for MCP tools by describing what you need. "
+        "Returns top matching tools with names, descriptions, and input schemas."
+    ),
     "inputSchema": {
         "type": "object",
         "properties": {
-            "query": {"type": "string", "description": "Keywords to search for in tool names and descriptions."},
+            "query": {
+                "type": "string",
+                "description": "What the tool should do, matched against names and descriptions.",
+            },
             "top_k": {"type": "integer", "description": "Maximum number of results to return.", "default": 5},
         },
         "required": _json_array("query"),
@@ -165,10 +256,28 @@ async def handle_mcp_tool_search(
     oauth2_headers: dict[str, str] | None = None,
     raw_headers: dict[str, str] | None = None,
 ) -> CallToolResult:
-    from mcp.types import CallToolResult, TextContent
-
     from litellm.proxy._experimental.mcp_server.server import _list_mcp_tools
+    from litellm.proxy.proxy_server import llm_router
 
+    settings: Final = mcp_tool_search_settings()
+    if isinstance(settings, ValidationError):
+        return _text_tool_result(
+            f"litellm_settings.{MCP_TOOL_SEARCH_SETTINGS_KEY} is invalid: {settings}", is_error=True
+        )
+    if settings.embedding_model is not None and llm_router is None:
+        return _text_tool_result(
+            f"litellm_settings.{MCP_TOOL_SEARCH_SETTINGS_KEY}.embedding_model needs a model_list so it can be called",
+            is_error=True,
+        )
+    ranker: Final = (
+        SemanticToolRanker(
+            embed=router_embedder(llm_router, settings.embedding_model, user_api_key_dict),
+            embedding_model=settings.embedding_model,
+            index=global_mcp_tool_search_index,
+        )
+        if settings.embedding_model is not None and llm_router is not None
+        else None
+    )
     mcp_listing: Final = await _list_mcp_tools(
         user_api_key_auth=user_api_key_dict,
         mcp_servers=mcp_servers,
@@ -178,17 +287,10 @@ async def handle_mcp_tool_search(
         oauth2_headers=oauth2_headers,
         raw_headers=raw_headers,
     )
-    mcp_tools: Final = mcp_listing.tools
-    tools: Final = [
-        {
-            "name": t.name,
-            "description": t.description or "",
-            "inputSchema": t.inputSchema,
-        }
-        for t in mcp_tools
-    ]
-    results: Final = search_tools(query, tools, top_k)
-    return CallToolResult(content=[TextContent(type="text", text=json.dumps(results))], isError=False)
+    results: Final = await search_mcp_tools(query, mcp_listing.tools, top_k, settings, ranker)
+    if isinstance(results, EmbeddingFailed):
+        return _text_tool_result(results.reason, is_error=True)
+    return _text_tool_result(json.dumps(results), is_error=False)
 
 
 async def handle_mcp_tool_call(
diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 5c0ba55d411..d186f427944 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -2508,6 +2508,14 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
         None,
         description="max batch input file size in MB for /v1/files uploads with purpose=batch, if a file is larger than this size it will be rejected before being forwarded to the provider",
     )
+    max_file_size_mb: int | None = Field(
+        None,
+        description="max file size in MB for /v1/files uploads, for any purpose, if a file is larger than this size it will be rejected before being forwarded to the provider",
+    )
+    blocked_file_extensions: tuple[str, ...] | None = Field(
+        None,
+        description="file extensions (e.g. ['.exe', '.sh']) rejected on /v1/files uploads, for any purpose, matched case-insensitively against the uploaded filename",
+    )
     max_response_size_mb: int | None = Field(
         None,
         description="max response size in MB, if a response is larger than this size it will be rejected",
@@ -2696,6 +2704,40 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
         None,
         description="List of MCP server fields that must be filled in for a submission to pass standards checks (e.g. ['description', 'source_url', 'alias']).",
     )
+    password_policy_min_length: int | None = Field(
+        None,
+        description=(
+            "Minimum length required for a locally-managed user's password. Default is 12; "
+            "a value below 8 is floored to 8 rather than weakening the requirement further."
+        ),
+    )
+    password_policy_require_uppercase: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain an uppercase letter.",
+    )
+    password_policy_require_lowercase: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a lowercase letter.",
+    )
+    password_policy_require_numbers: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a number.",
+    )
+    password_policy_require_special_characters: bool | None = Field(
+        None,
+        description="If True (default), a locally-managed user's password must contain a special (non-alphanumeric) character.",
+    )
+    disable_password_login_when_sso_enabled: bool | None = Field(
+        None,
+        description=(
+            "If True and SSO is configured (MICROSOFT_CLIENT_ID, GOOGLE_CLIENT_ID, "
+            "GENERIC_CLIENT_ID, or SAML_IDP_METADATA_URL/XML), disables username/password "
+            "login on /login, /v2/login, and /v3/login so SSO is the only way to reach the "
+            "Admin UI. An admin locked out of the UI can still administer the proxy over the "
+            "API with the master key; unset this setting and restart the proxy to restore "
+            "UI username/password login. Default is False."
+        ),
+    )
     disable_budget_reservation: bool | None = Field(
         None,
         description=(
diff --git a/litellm/proxy/agent_endpoints/a2a_endpoints.py b/litellm/proxy/agent_endpoints/a2a_endpoints.py
index 31b05320cd3..28882484db4 100644
--- a/litellm/proxy/agent_endpoints/a2a_endpoints.py
+++ b/litellm/proxy/agent_endpoints/a2a_endpoints.py
@@ -1019,4 +1019,6 @@ async def invoke_agent_a2a(
             )
         except Exception:
             pass
+        if isinstance(e, litellm.BadRequestError):
+            return _jsonrpc_error(body.get("id"), -32602, e.message, 400)
         return _jsonrpc_error(body.get("id"), -32603, f"Internal error: {e}", 500)
diff --git a/litellm/proxy/agent_endpoints/agent_registry.py b/litellm/proxy/agent_endpoints/agent_registry.py
index 144de52d0d2..c7b6bca72cf 100644
--- a/litellm/proxy/agent_endpoints/agent_registry.py
+++ b/litellm/proxy/agent_endpoints/agent_registry.py
@@ -6,8 +6,12 @@ from datetime import datetime, timezone
 from types import MappingProxyType
 from typing import TYPE_CHECKING, Final, NamedTuple, Protocol, TypedDict
 
+from pydantic import TypeAdapter, ValidationError
+
 import litellm
+from litellm.constants import REDACTED_BY_LITELM_STRING
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
+from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
 from litellm.proxy.management_helpers.object_permission_utils import (
     handle_update_object_permission_common,
 )
@@ -52,6 +56,9 @@ class AgentRecord(Protocol):
     @property
     def agent_name(self) -> str: ...
 
+    @property
+    def litellm_params(self) -> Mapping[str, object] | None: ...
+
     @property
     def object_permission_id(self) -> str | None: ...
 
@@ -121,6 +128,188 @@ def _dump_agent_params(raw: Mapping[str, object]) -> dict[str, object]:
     return dict(raw) if raw else {}
 
 
+_AGENT_PARAMS_MASKER: Final = SensitiveDataMasker()
+_REDACT_AGENT_PARAMS_MAX_DEPTH: Final = 10
+_AGENT_PARAMS_ADAPTER: Final[TypeAdapter[dict[str, object]]] = TypeAdapter(
+    dict[str, object]
+)  # mutable-ok: safe_dumps() and AgentResponse.litellm_params both require a real dict, not a Mapping
+_AGENT_PARAMS_SEQUENCE_ADAPTER: Final[TypeAdapter[tuple[object, ...]]] = TypeAdapter(tuple[object, ...])
+_EMPTY_LITELLM_PARAMS: Final[Mapping[str, object]] = MappingProxyType({})
+
+
+def redact_sensitive_agent_litellm_params(litellm_params: object, _depth: int = 0) -> object:
+    """
+    Replace credential-bearing values in an agent's litellm_params with
+    ``REDACTED_BY_LITELM_STRING`` while preserving non-secret keys (``model``,
+    ``is_public``, rate-limit config). Used so list/get/create/update
+    responses never echo a stored provider credential back to the caller.
+
+    Handles a plain dict, a JSON-serialized string (some callers hold the
+    in-memory registry's params that way), and ``None`` at the top level;
+    anything else is passed through. Recursion depth is bounded to match the
+    convention documented in ``tests/code_coverage_tests/recursive_detector.py``.
+    """
+    if litellm_params is None:
+        return None
+    if isinstance(litellm_params, str):
+        if _depth >= _REDACT_AGENT_PARAMS_MAX_DEPTH:
+            return REDACTED_BY_LITELM_STRING
+        try:
+            parsed_params: Final = _AGENT_PARAMS_ADAPTER.validate_json(litellm_params)
+        except ValidationError:
+            return REDACTED_BY_LITELM_STRING
+        return json.dumps(_redact_agent_params_tree(parsed_params, _depth + 1))
+    return _redact_agent_params_tree(litellm_params, _depth)
+
+
+def _redact_agent_params_tree(value: object, _depth: int) -> object:
+    """Structural recursion over an already-parsed litellm_params value: a
+    dict redacts sensitive keys and recurses into the rest, a list redacts
+    each element (so a secret nested inside a list of provider configs is
+    still caught), and anything else -- including a plain string leaf, which
+    must never be re-interpreted as a JSON blob -- passes through unchanged.
+    """
+    if _depth >= _REDACT_AGENT_PARAMS_MAX_DEPTH:
+        return REDACTED_BY_LITELM_STRING
+    if isinstance(value, list):
+        typed_items: Final = _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(value)
+        return tuple(_redact_agent_params_tree(item, _depth + 1) for item in typed_items)
+    if not isinstance(value, dict):
+        return value
+    typed_params: Final = _AGENT_PARAMS_ADAPTER.validate_python(value)
+    return {
+        key: (
+            REDACTED_BY_LITELM_STRING
+            if _AGENT_PARAMS_MASKER.is_sensitive_key(key)
+            else _redact_agent_params_tree(nested_value, _depth + 1)
+        )
+        for key, nested_value in typed_params.items()
+    }  # mutable-ok: consumed by json.dumps()/AgentResponse.litellm_params, both of which require a real dict
+
+
+def parse_agent_litellm_params(value: object) -> Mapping[str, object]:
+    """Normalize a stored litellm_params column to a read-only mapping.
+
+    The prisma Json column comes back as either an already-parsed dict or a
+    JSON string depending on the read path, so handle both rather than
+    assuming one. Only ever read from (merge-source lookups), never mutated
+    or re-serialized directly, so a read-only view is enough here.
+    """
+    if isinstance(value, str):
+        try:
+            return _AGENT_PARAMS_ADAPTER.validate_json(value)
+        except ValidationError:
+            return _EMPTY_LITELLM_PARAMS
+    if isinstance(value, Mapping):
+        try:
+            return _AGENT_PARAMS_ADAPTER.validate_python(value)
+        except ValidationError:
+            return _EMPTY_LITELLM_PARAMS
+    return _EMPTY_LITELLM_PARAMS
+
+
+_MISSING_AGENT_PARAM: Final = object()
+_RESTORE_AGENT_PARAMS_MAX_DEPTH: Final = 10
+
+
+def _restore_redacted_nested_value(incoming_value: object, existing_value: object, _depth: int) -> object:
+    """Recurse into a non-sensitively-named dict/list value so a secret
+    nested underneath it (e.g. inside a list of per-provider configs) is
+    still restored, not just top-level keys. Mirrors the shapes
+    ``redact_sensitive_agent_litellm_params`` recurses into on read, so
+    restore and redact stay symmetric.
+
+    List elements are paired with the existing list by position: with no
+    stable per-element identity in an arbitrary ``dict[str, object]`` schema,
+    index is the same correspondence every other part of this restore (and
+    the endpoints' existing full-replace-on-PUT semantics) already assumes.
+    This correctly preserves a masked secret across an ordinary edit of that
+    same entry's other fields; it does not protect against a caller who both
+    reorders/resizes the list AND echoes back a masked marker in the same
+    request, which is a known, narrow limitation (see LIT-6736 PR discussion)
+    rather than a cross-entry credential leak in the common case.
+
+    A value collapsed to the flat marker by the read side's depth cap is
+    recovered wholesale from ``existing_value`` (rather than the marker
+    string itself getting persisted) whenever ``existing_value`` isn't
+    already that same flat marker. Depth-bounded like its read-side
+    counterpart; a value at the cap is returned unchanged rather than
+    corrupted.
+    """
+    if incoming_value == REDACTED_BY_LITELM_STRING and existing_value != REDACTED_BY_LITELM_STRING:
+        return existing_value
+    if _depth >= _RESTORE_AGENT_PARAMS_MAX_DEPTH:
+        return incoming_value
+    if isinstance(incoming_value, Mapping):
+        typed_incoming_map: Final = _AGENT_PARAMS_ADAPTER.validate_python(incoming_value)
+        existing_map: Final = (
+            _AGENT_PARAMS_ADAPTER.validate_python(existing_value)
+            if isinstance(existing_value, Mapping)
+            else _EMPTY_LITELLM_PARAMS
+        )
+        return _restore_redacted_litellm_params(typed_incoming_map, existing_map, _depth + 1)
+    if isinstance(incoming_value, (list, tuple)):
+        typed_incoming_seq: Final = _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(incoming_value)
+        existing_seq: Final = (
+            _AGENT_PARAMS_SEQUENCE_ADAPTER.validate_python(existing_value)
+            if isinstance(existing_value, (list, tuple))
+            else ()
+        )
+        return tuple(
+            _restore_redacted_nested_value(
+                item,
+                existing_seq[index] if index < len(existing_seq) else None,
+                _depth + 1,
+            )
+            for index, item in enumerate(typed_incoming_seq)
+        )
+    return incoming_value
+
+
+def _resolved_agent_param_value(
+    key: str,
+    incoming: Mapping[str, object],
+    existing: Mapping[str, object],
+    _depth: int,
+) -> object:
+    """The value ``key`` should end up with in a restored litellm_params, or
+    ``_MISSING_AGENT_PARAM`` when it should be dropped entirely."""
+    if key in incoming:
+        value: Final = incoming[key]
+        if _AGENT_PARAMS_MASKER.is_sensitive_key(key):
+            return existing.get(key, _MISSING_AGENT_PARAM) if value == REDACTED_BY_LITELM_STRING else value
+        return _restore_redacted_nested_value(value, existing.get(key), _depth)
+    if _AGENT_PARAMS_MASKER.is_sensitive_key(key):
+        return existing.get(key, _MISSING_AGENT_PARAM)
+    return _MISSING_AGENT_PARAM
+
+
+def _restore_redacted_litellm_params(
+    incoming: Mapping[str, object],
+    existing: Mapping[str, object],
+    _depth: int = 0,
+) -> dict[str, object]:
+    """Restore the real credential behind any litellm_params value the caller
+    echoed back as ``REDACTED_BY_LITELM_STRING``, and behind any sensitive key
+    omitted entirely, so an edit to an unrelated field never overwrites (or
+    silently drops) a stored provider credential -- the UI never has to
+    read-and-resend a secret to keep it. Recurses into nested dicts and lists
+    so a secret nested under a non-sensitively-named key is restored too.
+
+    A sensitive key given a real (non-marker) value, including an explicit
+    empty string, is treated as a deliberate update -- that's how a caller
+    clears a credential. Non-sensitive keys always take the incoming value
+    (recursed into), matching the endpoints' existing full-replace-on-PUT /
+    merge-on-PATCH semantics for everything that isn't a secret.
+    """
+    all_keys: Final = frozenset(incoming) | frozenset(existing)
+    return {
+        key: value
+        for key in all_keys
+        if (value := _resolved_agent_param_value(key, incoming, existing, _depth)) is not _MISSING_AGENT_PARAM
+    }  # mutable-ok: fed to safe_dumps() for JSON-column storage, which requires a real dict
+
+
 class GrantMigrationResult(NamedTuple):
     rewritten: int
     missed: int
@@ -301,9 +490,14 @@ class AgentRegistry:
         try:
             agent_name: Final = agent.get("agent_name")
 
-            # Serialize litellm_params
+            # Serialize litellm_params. A create has no stored row to restore a
+            # secret behind, so a sensitive key submitted as the redaction
+            # marker (e.g. a stray client re-post) is dropped rather than
+            # persisted as the literal placeholder string.
             litellm_params_obj: Final = agent.get("litellm_params", {})
-            litellm_params_dict: Final[dict[str, object]] = _dump_agent_params(litellm_params_obj)
+            litellm_params_dict: Final = _restore_redacted_litellm_params(
+                _dump_agent_params(litellm_params_obj), _EMPTY_LITELLM_PARAMS
+            )
             litellm_params: Final[str] = safe_dumps(litellm_params_dict)
 
             # Serialize agent_card_params
@@ -410,8 +604,14 @@ class AgentRegistry:
             update_data: Final[dict[str, object]] = {}
             if augment_agent.get("agent_name"):
                 update_data["agent_name"] = augment_agent.get("agent_name")
-            if augment_agent.get("litellm_params"):
-                update_data["litellm_params"] = safe_dumps(augment_agent.get("litellm_params"))
+            if "litellm_params" in agent:
+                existing_litellm_params: Final = parse_agent_litellm_params(existing_agent.get("litellm_params"))
+                update_data["litellm_params"] = safe_dumps(
+                    _restore_redacted_litellm_params(
+                        _dump_agent_params(agent.get("litellm_params") or _EMPTY_LITELLM_PARAMS),
+                        existing_litellm_params,
+                    )
+                )
             if augment_agent.get("agent_card_params"):
                 update_data["agent_card_params"] = safe_dumps(augment_agent.get("agent_card_params"))
 
@@ -474,9 +674,22 @@ class AgentRegistry:
         try:
             agent_name: Final = agent.get("agent_name")
 
+            # A PUT fully replaces litellm_params from the request body, so the
+            # existing row is read up front to restore any sensitive key the
+            # caller echoed back redacted (or omitted) rather than persisting
+            # the marker -- or nothing -- over the real stored credential.
+            existing_row: Final = await agents_table(prisma_client).find_unique(
+                where={"agent_id": agent_id}  # mutable-ok: prisma's query builder rejects a Mapping/MappingProxyType
+            )
+            existing_litellm_params: Final = parse_agent_litellm_params(
+                existing_row.litellm_params if existing_row is not None else None
+            )
+
             # Serialize litellm_params
             litellm_params_obj: Final = agent.get("litellm_params", {})
-            litellm_params_dict: Final[dict[str, object]] = _dump_agent_params(litellm_params_obj)
+            litellm_params_dict: Final = _restore_redacted_litellm_params(
+                _dump_agent_params(litellm_params_obj), existing_litellm_params
+            )
             litellm_params: Final[str] = safe_dumps(litellm_params_dict)
 
             # Serialize agent_card_params
@@ -512,9 +725,8 @@ class AgentRegistry:
                     update_data[rate_field] = _val
 
             if agent.get("object_permission") is not None:
-                existing_agent: Final = await agents_table(prisma_client).find_unique(where={"agent_id": agent_id})
                 existing_object_permission_id: Final = (
-                    existing_agent.object_permission_id if existing_agent is not None else None
+                    existing_row.object_permission_id if existing_row is not None else None
                 )
                 agent_copy: Final = dict(agent)
                 object_permission_id: Final = await handle_update_object_permission_common(
diff --git a/litellm/proxy/agent_endpoints/agent_search.py b/litellm/proxy/agent_endpoints/agent_search.py
index 46ab36d7b72..76e3fe6c5ad 100644
--- a/litellm/proxy/agent_endpoints/agent_search.py
+++ b/litellm/proxy/agent_endpoints/agent_search.py
@@ -2,17 +2,18 @@
 
 from __future__ import annotations
 
-import math
-from collections.abc import Awaitable, Mapping, Sequence
+from collections.abc import Sequence
 from dataclasses import dataclass
-from itertools import chain
-from types import MappingProxyType
-from typing import TYPE_CHECKING, Final, Protocol, TypeAlias
+from typing import TYPE_CHECKING, Final, TypeAlias
 
-from openai import OpenAIError
 from pydantic import BaseModel, ConfigDict, ValidationError
 
-from litellm.exceptions import BudgetExceededError
+from litellm.proxy.common_utils.semantic_text_index import (
+    Embedder,
+    EmbeddingFailed,
+    SemanticTextIndex,
+    router_embedder,
+)
 from litellm.types.agents import AgentResponse
 
 if TYPE_CHECKING:
@@ -21,12 +22,6 @@ if TYPE_CHECKING:
 
 DEFAULT_AGENT_SEARCH_TOP_K: Final = 5
 
-Vector: TypeAlias = tuple[float, ...]
-
-
-class Embedder(Protocol):
-    def __call__(self, texts: Sequence[str]) -> Awaitable[Sequence[Vector]]: ...
-
 
 @dataclass(frozen=True, slots=True)
 class AgentSearchHit:
@@ -67,18 +62,6 @@ class _SearchableCard(BaseModel):
     skills: tuple[_SearchableSkill, ...] = ()
 
 
-class _EmbeddingItem(BaseModel):
-    model_config = ConfigDict(frozen=True, extra="ignore")
-
-    embedding: tuple[float, ...]
-
-
-class _EmbeddingData(BaseModel):
-    model_config = ConfigDict(frozen=True, extra="ignore")
-
-    data: tuple[_EmbeddingItem, ...]
-
-
 class AgentSearchResult(BaseModel):
     model_config = ConfigDict(frozen=True)
 
@@ -117,110 +100,21 @@ def agent_search_result(hit: AgentSearchHit) -> AgentSearchResult:
     )
 
 
-def cosine_similarity(left: Vector, right: Vector) -> float:
-    dot: Final = sum(a * b for a, b in zip(left, right, strict=True))
-    norms: Final = math.sqrt(sum(a * a for a in left)) * math.sqrt(sum(b * b for b in right))
-    return dot / norms if norms else 0.0
-
-
-def embedding_spend_metadata(user_api_key_dict: UserAPIKeyAuth) -> dict[str, object]:
-    from litellm.proxy.litellm_pre_call_utils import LiteLLMProxyRequestSetup
-
-    return {  # mutable-ok: the router mutates the metadata dict it is handed
-        **LiteLLMProxyRequestSetup.get_sanitized_user_information_from_key(user_api_key_dict),
-        "user_api_key": user_api_key_dict.api_key,
-    }
-
-
-def router_embedder(router: Router, embedding_model: str, user_api_key_dict: UserAPIKeyAuth) -> Embedder:
-    async def embed(texts: Sequence[str]) -> Sequence[Vector]:
-        batch: Final = list(texts)  # mutable-ok: Router.aembedding accepts only str | list input
-        response: Final = await router.aembedding(
-            model=embedding_model, input=batch, metadata=embedding_spend_metadata(user_api_key_dict)
-        )
-        return tuple(item.embedding for item in _EmbeddingData.model_validate(response.model_dump()).data)
-
-    return embed
-
-
-_NO_VECTORS: Final[Mapping[str, Vector]] = MappingProxyType({})
-
-
-async def _embed_all(embed: Embedder, texts: Sequence[str]) -> tuple[Vector, ...] | AgentSearchEmbeddingFailed:
-    try:
-        vectors: Final = tuple(await embed(texts))
-    except (OpenAIError, ValueError, BudgetExceededError) as exc:
-        return AgentSearchEmbeddingFailed(reason=f"embedding the search query failed: {exc}")
-    if len(vectors) != len(texts):
-        return AgentSearchEmbeddingFailed(
-            reason=f"embedding model returned {len(vectors)} vectors for {len(texts)} inputs"
-        )
-    return vectors
-
-
-@dataclass(frozen=True, slots=True)
-class _Embedded:
-    query_vector: Vector
-    vectors: Mapping[str, Vector]
-
-
-def _same_dimension(query_vector: Vector, vectors: Mapping[str, Vector], texts: Sequence[str]) -> bool:
-    return all(len(vectors[text]) == len(query_vector) for text in texts)
-
-
-async def _embed_query_and_agents(
-    embed: Embedder, query: str, texts: Sequence[str], cached: Mapping[str, Vector]
-) -> _Embedded | AgentSearchEmbeddingFailed:
-    missing: Final = tuple(dict.fromkeys(text for text in texts if text not in cached))
-    embedded: Final = await _embed_all(embed, (query, *missing))
-    if isinstance(embedded, AgentSearchEmbeddingFailed):
-        return embedded
-    vectors: Final = MappingProxyType(dict(chain(cached.items(), zip(missing, embedded[1:], strict=True))))
-    if _same_dimension(embedded[0], vectors, texts):
-        return _Embedded(query_vector=embedded[0], vectors=vectors)
-    unique: Final = tuple(dict.fromkeys(texts))
-    reembedded: Final = await _embed_all(embed, (query, *unique))
-    if isinstance(reembedded, AgentSearchEmbeddingFailed):
-        return reembedded
-    return _Embedded(
-        query_vector=reembedded[0], vectors=MappingProxyType(dict(zip(unique, reembedded[1:], strict=True)))
-    )
-
-
 class AgentSearchIndex:
     """Caches one vector per distinct agent text per embedding model, so repeat searches only embed the query."""
 
     def __init__(self) -> None:
-        self._vectors: Mapping[str, Mapping[str, Vector]] = MappingProxyType({})
-
-    def _merged(self, embedding_model: str, embedded: _Embedded) -> Mapping[str, Vector]:
-        kept: Final = {
-            text: vector
-            for text, vector in self._vectors.get(embedding_model, _NO_VECTORS).items()
-            if len(vector) == len(embedded.query_vector)
-        }
-        return MappingProxyType({**kept, **embedded.vectors})
+        self._index: Final = SemanticTextIndex()
 
     async def search(
         self, query: str, agents: Sequence[AgentResponse], top_k: int, embed: Embedder, embedding_model: str
     ) -> AgentSearchHits | AgentSearchEmbeddingFailed:
-        if not agents:
-            return AgentSearchHits(hits=())
         texts: Final = tuple(agent_search_text(agent) for agent in agents)
-        cached: Final = self._vectors.get(embedding_model, _NO_VECTORS)
-        embedded: Final = await _embed_query_and_agents(embed, query, texts, cached)
-        if isinstance(embedded, AgentSearchEmbeddingFailed):
-            return embedded
-        if not _same_dimension(embedded.query_vector, embedded.vectors, texts):
-            return AgentSearchEmbeddingFailed(
-                reason=f"embedding model {embedding_model} returned vectors of mixed dimensions"
-            )
-        self._vectors = MappingProxyType({**self._vectors, embedding_model: self._merged(embedding_model, embedded)})
+        scores: Final = await self._index.scores(query, texts, embed, embedding_model)
+        if isinstance(scores, EmbeddingFailed):
+            return AgentSearchEmbeddingFailed(reason=scores.reason)
         ranked: Final = sorted(
-            (
-                AgentSearchHit(agent=agent, score=cosine_similarity(embedded.query_vector, embedded.vectors[text]))
-                for agent, text in zip(agents, texts, strict=True)
-            ),
+            (AgentSearchHit(agent=agent, score=score) for agent, score in zip(agents, scores, strict=True)),
             key=lambda hit: hit.score,
             reverse=True,
         )
diff --git a/litellm/proxy/agent_endpoints/endpoints.py b/litellm/proxy/agent_endpoints/endpoints.py
index b6c41a17503..3e4dc07a521 100644
--- a/litellm/proxy/agent_endpoints/endpoints.py
+++ b/litellm/proxy/agent_endpoints/endpoints.py
@@ -20,7 +20,6 @@ from typing_extensions import ReadOnly, Required
 
 import litellm
 from litellm._logging import verbose_proxy_logger
-from litellm.litellm_core_utils.litellm_logging import _get_masked_values
 from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
 from litellm.proxy._types import (
     CommonProxyErrors,
@@ -33,6 +32,10 @@ from litellm.proxy.a2a.agent_card import (
     merge_agent_card,
     normalize_protocol_version,
 )
+from litellm.proxy.agent_endpoints.agent_registry import (
+    parse_agent_litellm_params,
+    redact_sensitive_agent_litellm_params,
+)
 from litellm.proxy.agent_endpoints.agent_search import (
     DEFAULT_AGENT_SEARCH_TOP_K,
     AgentSearchEmbeddingFailed,
@@ -139,25 +142,37 @@ async def _attach_keys_to_agents(agents: Sequence[AgentResponse], prisma_client)
         agent.keys = matched_keys or None
 
 
+def _redact_agent_litellm_params_dict(
+    litellm_params: Mapping[str, object],
+) -> dict[str, object]:  # mutable-ok: AgentResponse.litellm_params is declared as a plain dict, not Mapping
+    """Type-narrowing wrapper: a dict in always yields a dict back from
+    ``redact_sensitive_agent_litellm_params``, which the function's general
+    (possible-JSON-string, possibly-None) signature can't express."""
+    return dict(  # mutable-ok: AgentResponse.litellm_params is declared as a plain dict, not Mapping
+        parse_agent_litellm_params(redact_sensitive_agent_litellm_params(litellm_params))
+    )
+
+
 def _redact_sensitive_agent_fields(
     agents: Sequence[AgentResponse],
+    *,
+    is_admin: bool,
 ) -> list[AgentResponse]:
     """
-    Return copies of the given agents with sensitive configuration fields
-    redacted.  The original objects are not modified.
+    Return copies of the given agents with credential-bearing litellm_params
+    values replaced by a fixed marker (never returned to ANY caller,
+    admin included) and, for non-admin callers, virtual-key and header
+    fields stripped entirely. The original objects are not modified.
     """
     redacted: Final[list[AgentResponse]] = []
     for agent in agents:
         copy = agent.model_copy(deep=True)
-        copy.static_headers = None
-        copy.extra_headers = None
-        copy.keys = None
+        if not is_admin:
+            copy.static_headers = None
+            copy.extra_headers = None
+            copy.keys = None
         if copy.litellm_params:
-            copy.litellm_params = _get_masked_values(
-                copy.litellm_params,
-                unmasked_length=4,
-                number_of_asterisks=4,
-            )
+            copy.litellm_params = _redact_agent_litellm_params_dict(copy.litellm_params)
         redacted.append(copy)
     return redacted
 
@@ -345,13 +360,13 @@ async def get_agents(
                 global_agent_registry.ids_for_agent(agent.agent_id).isdisjoint(litellm.public_agent_groups)
             )
 
-        # Redact sensitive fields for non-admin users
+        # litellm_params secrets are always redacted; keys/headers stay
+        # admin-only.
         is_admin: Final = (
             user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
             or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
         )
-        if not is_admin:
-            returned_agents = _redact_sensitive_agent_fields(returned_agents)
+        returned_agents = _redact_sensitive_agent_fields(returned_agents, is_admin=is_admin)
 
         if health_check:
             agents_with_url: Final = [agent for agent in returned_agents if (agent.agent_card_params or {}).get("url")]
@@ -505,7 +520,9 @@ async def create_agent(
                 "Failed to register agent '%s' (ID: %s) in memory: %s", agent_name, agent_id, reg_error
             )
 
-        return result
+        # The caller is a proxy admin (enforced above); litellm_params
+        # secrets are still never echoed back in the response.
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
 
     except HTTPException:
         raise
@@ -578,13 +595,13 @@ async def get_agent_by_id(
 
         await _attach_keys_to_agents([agent], prisma_client)
 
-        # Redact sensitive fields for non-admin users
+        # litellm_params secrets are always redacted; keys/headers stay
+        # admin-only.
         is_admin = (
             user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
             or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
         )
-        if not is_admin:
-            agent = _redact_sensitive_agent_fields([agent])[0]
+        agent = _redact_sensitive_agent_fields((agent,), is_admin=is_admin)[0]
 
         return agent
     except HTTPException:
@@ -688,7 +705,7 @@ async def update_agent(
             "Successfully updated agent '%s' (ID: %s) in memory", existing_agent.get("agent_name"), agent_id
         )
 
-        return result
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
     except HTTPException:
         raise
     except Exception as e:
@@ -791,7 +808,7 @@ async def patch_agent(
             "Successfully updated agent '%s' (ID: %s) in memory", existing_agent.get("agent_name"), agent_id
         )
 
-        return result
+        return _redact_sensitive_agent_fields((result,), is_admin=True)[0]
     except HTTPException:
         raise
     except Exception as e:
diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py
index 5703c6cd5e8..0db4cbc3bf2 100644
--- a/litellm/proxy/auth/auth_checks.py
+++ b/litellm/proxy/auth/auth_checks.py
@@ -4705,6 +4705,13 @@ async def is_valid_fallback_model(
     return True
 
 
+# The shape abbreviate_api_key writes into LiteLLM_VerificationToken.key_name. The
+# last four characters are only barred from being whitespace or a control code,
+# because a custom key's can be anything else, punctuation and non-ASCII included;
+# a real key is at least MINIMUM_CUSTOM_KEY_LENGTH long, so it never fullmatches.
+_MASKED_KEY_NAME_RE: Final = re.compile(r"sk-\.\.\.(?:[^\s\x00-\x1f\x7f-\x9f]{4})?")
+
+
 def _apply_budget_exceeded_throttle(valid_token: UserAPIKeyAuth) -> bool:
     """
     Throttle an over-budget key instead of blocking it, when the key opted in
@@ -4785,10 +4792,15 @@ async def _virtual_key_max_budget_check(
         if math.isfinite(valid_token.max_budget) and spend >= valid_token.max_budget:
             if _apply_budget_exceeded_throttle(valid_token):
                 return
-            # name the key in the error so operators don't have to reverse-map
-            # spend back to a key; key_name is the masked form (last 4 chars)
+            # This message is returned to the caller, and key_name has no enforced
+            # shape (a direct DB write bypasses abbreviate_api_key), so echo it only
+            # when it still looks masked and fall back to the alias otherwise.
             key_label: Final = valid_token.key_alias or "key"
-            key_descriptor: Final = f"{key_label} ({valid_token.key_name})" if valid_token.key_name else key_label
+            key_descriptor: Final = (
+                f"{key_label} ({valid_token.key_name})"
+                if valid_token.key_name and _MASKED_KEY_NAME_RE.fullmatch(valid_token.key_name)
+                else key_label
+            )
             raise litellm.BudgetExceededError(
                 current_cost=spend,
                 max_budget=valid_token.max_budget,
diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py
index 64878a480a7..b36c8a038fc 100644
--- a/litellm/proxy/auth/auth_exception_handler.py
+++ b/litellm/proxy/auth/auth_exception_handler.py
@@ -61,9 +61,7 @@ def _as_proxy_exception(e: Exception) -> ProxyException:
         return e
     if PrismaDBExceptionHandler.is_database_service_unavailable_error(e):
         return ProxyException(
-            message=(
-                "Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly."
-            ),
+            message=PrismaDBExceptionHandler.database_unavailable_message(e),
             type=ProxyErrorTypes.no_db_connection,
             param="None",
             code=status.HTTP_503_SERVICE_UNAVAILABLE,
diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index 89b2c92cdfd..d6007a2d56e 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -1,3 +1,4 @@
+import importlib.util
 import os
 import re
 import sys
@@ -1402,7 +1403,7 @@ def is_pass_through_provider_route(route: str) -> bool:
     return False
 
 
-def _has_user_setup_sso() -> bool:
+def has_user_setup_sso() -> bool:
     """
     Check if the user has set up single sign-on (SSO).
 
@@ -1425,6 +1426,63 @@ def _has_user_setup_sso() -> bool:
     )
 
 
+def _is_google_ready() -> bool:
+    return bool(os.getenv("GOOGLE_CLIENT_ID")) and bool(os.getenv("GOOGLE_CLIENT_SECRET"))
+
+
+def _is_microsoft_ready() -> bool:
+    return (
+        bool(os.getenv("MICROSOFT_CLIENT_ID"))
+        and bool(os.getenv("MICROSOFT_CLIENT_SECRET"))
+        and bool(os.getenv("MICROSOFT_TENANT"))
+    )
+
+
+def _is_generic_oauth_ready() -> bool:
+    return (
+        bool(os.getenv("GENERIC_CLIENT_ID"))
+        and bool(os.getenv("GENERIC_CLIENT_SECRET"))
+        and bool(os.getenv("GENERIC_AUTHORIZATION_ENDPOINT"))
+        and bool(os.getenv("GENERIC_TOKEN_ENDPOINT"))
+        and bool(os.getenv("GENERIC_USERINFO_ENDPOINT"))
+    )
+
+
+def _is_saml_ready() -> bool:
+    if not (os.getenv("SAML_IDP_METADATA_URL") or os.getenv("SAML_IDP_METADATA_XML")):
+        return False
+    # SAML's runtime (python3-saml) is an optional dependency; the SAML
+    # handler itself fails closed on every request when it is missing
+    # (SAMLAuthHandler raises before touching the IdP), so metadata alone
+    # is not "ready" either. find_spec raises ModuleNotFoundError (rather
+    # than returning None) when the top-level package is absent entirely,
+    # so this must not be a bare boolean expression or every password
+    # login would 500 on a deployment that configured SAML metadata
+    # without installing the optional extra.
+    try:
+        return importlib.util.find_spec("onelogin.saml2.auth") is not None
+    except ModuleNotFoundError:
+        return False
+
+
+def is_sso_provider_fully_configured() -> bool:
+    """Whether ANY configured SSO provider has every companion setting it
+    needs to actually authenticate a user, not merely a client id.
+
+    A lone ``MICROSOFT_CLIENT_ID`` with no secret or tenant makes
+    ``has_user_setup_sso()`` return True while every real sign-in attempt
+    fails, so a gate that BLOCKS the password fallback (unlike the UI
+    discovery use of ``has_user_setup_sso()``, where a dead login button is
+    merely confusing) must check readiness here, or it can lock every admin
+    out with no way to sign in at all. Checks every provider independently
+    (mirroring ``/sso/readiness``'s per-provider requirements) rather than
+    stopping at the first one with a client id set, so a stray leftover
+    client id for an unused provider can never mask a different, fully
+    configured provider that would otherwise satisfy this gate.
+    """
+    return _is_google_ready() or _is_microsoft_ready() or _is_generic_oauth_ready() or _is_saml_ready()
+
+
 def get_customer_user_header_from_mapping(user_id_mapping) -> list | None:
     """Return the header_name mapped to CUSTOMER role, if any (dict-based)."""
     if not user_id_mapping:
diff --git a/litellm/proxy/auth/login_utils.py b/litellm/proxy/auth/login_utils.py
index fba95972944..8d4f6f81363 100644
--- a/litellm/proxy/auth/login_utils.py
+++ b/litellm/proxy/auth/login_utils.py
@@ -7,7 +7,9 @@ login endpoints (e.g., /login and /v2/login).
 
 import os
 import secrets
+from collections.abc import Mapping
 from datetime import datetime, timedelta, timezone
+from types import MappingProxyType
 from typing import Final, Literal, cast
 
 import jwt
@@ -24,6 +26,7 @@ from litellm.proxy._types import (
     UpdateUserRequest,
     UserAPIKeyAuth,
 )
+from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
 from litellm.proxy.management_endpoints.internal_user_endpoints import user_update
 from litellm.proxy.management_endpoints.key_management_endpoints import (
     generate_key_helper_fn,
@@ -111,6 +114,7 @@ async def authenticate_user(
     password: str,
     master_key: str | None,
     prisma_client: PrismaClient | None,
+    general_settings: Mapping[str, object] = MappingProxyType({}),
 ) -> LoginResult:
     """
     Authenticate a user and generate an API key for UI access.
@@ -124,13 +128,40 @@ async def authenticate_user(
         password: Password from the login form
         master_key: Master key for the proxy (required)
         prisma_client: Prisma database client (optional)
+        general_settings: Proxy general_settings, checked for
+            `disable_password_login_when_sso_enabled`
 
     Returns:
         LoginResult: Object containing authentication data
 
     Raises:
-        ProxyException: If authentication fails or required configuration is missing
+        ProxyException: If authentication fails or required configuration is missing,
+            or if username/password login is disabled while SSO is configured
+
+    Recovery: an admin locked out of the UI by
+    `disable_password_login_when_sso_enabled` can still administer the proxy over
+    the API with the master key (Authorization: Bearer <master_key>), which never
+    goes through this function. To restore UI username/password login, unset the
+    setting in config.yaml (or the DB-persisted general_settings) and restart the
+    proxy; this is a deliberate, auditable config change rather than a hidden
+    bypass.
+
+    The gate below requires the SSO provider to be FULLY configured (every
+    companion secret/endpoint an actual sign-in needs), not merely that a
+    client id is present, so an incomplete SSO setup can never disable the
+    only working login path.
     """
+    if general_settings.get("disable_password_login_when_sso_enabled") is True and is_sso_provider_fully_configured():
+        raise ProxyException(
+            message=(
+                "Username/password login is disabled because SSO is configured "
+                "and 'disable_password_login_when_sso_enabled' is set. Sign in via SSO."
+            ),
+            type=ProxyErrorTypes.auth_error,
+            param="disable_password_login_when_sso_enabled",
+            code=403,
+        )
+
     if master_key is None:
         raise ProxyException(
             message="Master Key not set for Proxy. Please set Master Key to use Admin UI. Set `LITELLM_MASTER_KEY` in .env or set general_settings:master_key in config.yaml.  https://docs.litellm.ai/docs/proxy/virtual_keys. If set, use `--detailed_debug` to debug issue.",
diff --git a/litellm/proxy/auth/password_policy.py b/litellm/proxy/auth/password_policy.py
new file mode 100644
index 00000000000..ab7a565894a
--- /dev/null
+++ b/litellm/proxy/auth/password_policy.py
@@ -0,0 +1,92 @@
+"""Password-strength policy enforcement for locally-managed proxy users.
+
+Applied at every path that persists a new or changed password for a DB-backed
+user (``/user/update``, ``/user/bulk_update``, and the invitation onboarding
+claim flow), so the strength bar is configured in one place instead of
+per-endpoint.
+"""
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Final
+
+from litellm.proxy._types import ProxyErrorTypes, ProxyException
+
+DEFAULT_MIN_LENGTH: Final = 12
+MIN_ALLOWED_LENGTH: Final = 8
+
+
+def _has_uppercase(password: str) -> bool:
+    return any(ch.isupper() for ch in password)
+
+
+def _has_lowercase(password: str) -> bool:
+    return any(ch.islower() for ch in password)
+
+
+def _has_digit(password: str) -> bool:
+    return any(ch.isdigit() for ch in password)
+
+
+def _has_special_character(password: str) -> bool:
+    """Unicode-aware: a letter or digit from ANY script counts as
+    alphanumeric, not just ASCII, so an accented letter (e.g. the second
+    character of "Passwörd1234") cannot be miscounted as the required
+    special character the way an ASCII-only `[^A-Za-z0-9]` regex would."""
+    return any(not ch.isalnum() for ch in password)
+
+
+@dataclass(frozen=True, slots=True)
+class PasswordPolicy:
+    min_length: int
+    require_uppercase: bool
+    require_lowercase: bool
+    require_numbers: bool
+    require_special_characters: bool
+
+
+def _configured_min_length(general_settings: Mapping[str, object]) -> int:
+    """The configured minimum, floored at MIN_ALLOWED_LENGTH so a nonpositive
+    or too-low override (a typo, or `0`/`false` coercing through) cannot
+    silently disable the length requirement rather than merely relaxing it."""
+    min_length_setting: Final = general_settings.get("password_policy_min_length")
+    if isinstance(min_length_setting, bool) or not isinstance(min_length_setting, (int, float)):
+        return DEFAULT_MIN_LENGTH
+    return max(MIN_ALLOWED_LENGTH, int(min_length_setting))
+
+
+def get_password_policy(general_settings: Mapping[str, object]) -> PasswordPolicy:
+    return PasswordPolicy(
+        min_length=_configured_min_length(general_settings),
+        require_uppercase=general_settings.get("password_policy_require_uppercase", True) is not False,
+        require_lowercase=general_settings.get("password_policy_require_lowercase", True) is not False,
+        require_numbers=general_settings.get("password_policy_require_numbers", True) is not False,
+        require_special_characters=(
+            general_settings.get("password_policy_require_special_characters", True) is not False
+        ),
+    )
+
+
+def _policy_violations(password: str, policy: PasswordPolicy) -> tuple[str, ...]:
+    checks: Final = (
+        (len(password) < policy.min_length, f"be at least {policy.min_length} characters long"),
+        (policy.require_uppercase and not _has_uppercase(password), "include an uppercase letter"),
+        (policy.require_lowercase and not _has_lowercase(password), "include a lowercase letter"),
+        (policy.require_numbers and not _has_digit(password), "include a number"),
+        (policy.require_special_characters and not _has_special_character(password), "include a special character"),
+    )
+    return tuple(message for failed, message in checks if failed)
+
+
+def validate_password_policy(password: str, general_settings: Mapping[str, object]) -> None:
+    """Raise ``ProxyException`` (400) if ``password`` fails the configured policy."""
+    policy: Final = get_password_policy(general_settings)
+    violations: Final = _policy_violations(password, policy)
+    if not violations:
+        return
+    raise ProxyException(
+        message="Password does not meet the required policy: must " + ", ".join(violations) + ".",
+        type=ProxyErrorTypes.validation_error,
+        param="password",
+        code=400,
+    )
diff --git a/litellm/proxy/common_utils/semantic_text_index.py b/litellm/proxy/common_utils/semantic_text_index.py
new file mode 100644
index 00000000000..0820459af49
--- /dev/null
+++ b/litellm/proxy/common_utils/semantic_text_index.py
@@ -0,0 +1,142 @@
+"""Embedding-similarity ranking over short texts with a per-model vector cache, shared by agent search and MCP tool search."""
+
+from __future__ import annotations
+
+import math
+from collections.abc import Awaitable, Mapping, Sequence
+from dataclasses import dataclass
+from itertools import chain
+from types import MappingProxyType
+from typing import TYPE_CHECKING, Final, Protocol, TypeAlias
+
+from openai import OpenAIError
+from pydantic import BaseModel, ConfigDict
+
+from litellm.exceptions import BudgetExceededError
+
+if TYPE_CHECKING:
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.router import Router
+
+Vector: TypeAlias = tuple[float, ...]
+
+
+class Embedder(Protocol):
+    def __call__(self, texts: Sequence[str]) -> Awaitable[Sequence[Vector]]: ...
+
+
+@dataclass(frozen=True, slots=True)
+class EmbeddingFailed:
+    reason: str
+
+
+class _EmbeddingItem(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="ignore")
+
+    embedding: tuple[float, ...]
+
+
+class _EmbeddingData(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="ignore")
+
+    data: tuple[_EmbeddingItem, ...]
+
+
+def cosine_similarity(left: Vector, right: Vector) -> float:
+    dot: Final = sum(a * b for a, b in zip(left, right, strict=True))
+    norms: Final = math.sqrt(sum(a * a for a in left)) * math.sqrt(sum(b * b for b in right))
+    return dot / norms if norms else 0.0
+
+
+def embedding_spend_metadata(user_api_key_dict: UserAPIKeyAuth) -> dict[str, object]:  # mutable-ok: router mutates it
+    from litellm.proxy.litellm_pre_call_utils import LiteLLMProxyRequestSetup
+
+    return {  # mutable-ok: the router mutates the metadata dict it is handed
+        **LiteLLMProxyRequestSetup.get_sanitized_user_information_from_key(user_api_key_dict),
+        "user_api_key": user_api_key_dict.api_key,
+    }
+
+
+def router_embedder(router: Router, embedding_model: str, user_api_key_dict: UserAPIKeyAuth) -> Embedder:
+    async def embed(texts: Sequence[str]) -> Sequence[Vector]:
+        batch: Final = list(texts)  # mutable-ok: Router.aembedding accepts only str | list input
+        response: Final = await router.aembedding(
+            model=embedding_model, input=batch, metadata=embedding_spend_metadata(user_api_key_dict)
+        )
+        return tuple(item.embedding for item in _EmbeddingData.model_validate(response.model_dump()).data)
+
+    return embed
+
+
+_NO_VECTORS: Final[Mapping[str, Vector]] = MappingProxyType({})
+
+
+async def _embed_all(embed: Embedder, texts: Sequence[str]) -> tuple[Vector, ...] | EmbeddingFailed:
+    try:
+        vectors: Final = tuple(await embed(texts))
+    except (OpenAIError, ValueError, BudgetExceededError) as exc:
+        return EmbeddingFailed(reason=f"embedding the search query failed: {exc}")
+    if len(vectors) != len(texts):
+        return EmbeddingFailed(reason=f"embedding model returned {len(vectors)} vectors for {len(texts)} inputs")
+    return vectors
+
+
+@dataclass(frozen=True, slots=True)
+class _Embedded:
+    query_vector: Vector
+    vectors: Mapping[str, Vector]
+
+
+def _same_dimension(query_vector: Vector, vectors: Mapping[str, Vector], texts: Sequence[str]) -> bool:
+    return all(len(vectors[text]) == len(query_vector) for text in texts)
+
+
+async def _embed_query_and_texts(
+    embed: Embedder, query: str, texts: Sequence[str], cached: Mapping[str, Vector]
+) -> _Embedded | EmbeddingFailed:
+    missing: Final = tuple(dict.fromkeys(text for text in texts if text not in cached))
+    embedded: Final = await _embed_all(embed, (query, *missing))
+    if isinstance(embedded, EmbeddingFailed):
+        return embedded
+    vectors: Final = MappingProxyType(dict(chain(cached.items(), zip(missing, embedded[1:], strict=True))))
+    if _same_dimension(embedded[0], vectors, texts):
+        return _Embedded(query_vector=embedded[0], vectors=vectors)
+    unique: Final = tuple(dict.fromkeys(texts))
+    reembedded: Final = await _embed_all(embed, (query, *unique))
+    if isinstance(reembedded, EmbeddingFailed):
+        return reembedded
+    return _Embedded(
+        query_vector=reembedded[0], vectors=MappingProxyType(dict(zip(unique, reembedded[1:], strict=True)))
+    )
+
+
+class SemanticTextIndex:
+    """Caches one vector per distinct text per embedding model, so repeat searches only embed the query."""
+
+    def __init__(self) -> None:
+        self._vectors: Mapping[str, Mapping[str, Vector]] = MappingProxyType({})
+
+    def _merged(self, embedding_model: str, embedded: _Embedded) -> Mapping[str, Vector]:
+        kept: Final = MappingProxyType(
+            {
+                text: vector
+                for text, vector in self._vectors.get(embedding_model, _NO_VECTORS).items()
+                if len(vector) == len(embedded.query_vector)
+            }
+        )
+        return MappingProxyType({**kept, **embedded.vectors})
+
+    async def scores(
+        self, query: str, texts: Sequence[str], embed: Embedder, embedding_model: str
+    ) -> tuple[float, ...] | EmbeddingFailed:
+        """Cosine similarity of `query` to each entry of `texts`, in the same order."""
+        if not texts:
+            return ()
+        cached: Final = self._vectors.get(embedding_model, _NO_VECTORS)
+        embedded: Final = await _embed_query_and_texts(embed, query, texts, cached)
+        if isinstance(embedded, EmbeddingFailed):
+            return embedded
+        if not _same_dimension(embedded.query_vector, embedded.vectors, texts):
+            return EmbeddingFailed(reason=f"embedding model {embedding_model} returned vectors of mixed dimensions")
+        self._vectors = MappingProxyType({**self._vectors, embedding_model: self._merged(embedding_model, embedded)})
+        return tuple(cosine_similarity(embedded.query_vector, embedded.vectors[text]) for text in texts)
diff --git a/litellm/proxy/container_endpoints/endpoints.py b/litellm/proxy/container_endpoints/endpoints.py
index 4a088140725..eaa3db336a9 100644
--- a/litellm/proxy/container_endpoints/endpoints.py
+++ b/litellm/proxy/container_endpoints/endpoints.py
@@ -208,7 +208,7 @@ async def list_containers(
 
     # Read query parameters
     query_params: Final = dict(request.query_params)
-    data: Final[dict[str, Any]] = {"query_params": query_params}
+    data: Final[dict[str, Any]] = {"query_params": query_params, "model": query_params.get("model")}
 
     # Extract custom_llm_provider using priority chain
     custom_llm_provider: Final = (
diff --git a/litellm/proxy/db/exception_handler.py b/litellm/proxy/db/exception_handler.py
index 5502543b926..ef1c4a66203 100644
--- a/litellm/proxy/db/exception_handler.py
+++ b/litellm/proxy/db/exception_handler.py
@@ -1,4 +1,4 @@
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Iterator
 from typing import Any, Final, TypeVar
 
 from litellm._logging import verbose_proxy_logger
@@ -9,10 +9,43 @@ from litellm.proxy._types import (
 )
 from litellm.secret_managers.main import str_to_bool
 
-# Bounds the __cause__/__context__ walk in is_database_service_unavailable_error_in_chain.
+# Bounds the __cause__/__context__ walk in find_database_service_unavailable_error_in_chain.
 # Real exception chains are a few links deep; the cap also makes the walk cycle-safe.
 _MAX_EXCEPTION_CHAIN_DEPTH: Final = 20
 
+_TRANSIENT_DB_UNAVAILABLE_MESSAGE: Final = (
+    "Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly."
+)
+
+
+def _exception_chain(e: BaseException) -> Iterator[BaseException]:
+    current = e  # rebind-ok: advances one link per iteration of the bounded walk
+    for _ in range(_MAX_EXCEPTION_CHAIN_DEPTH):
+        yield current
+        following = current.__cause__ or current.__context__
+        if following is None:
+            return
+        current = following
+
+
+def _database_service_unavailable_errors(e: BaseException) -> tuple[Exception, ...]:
+    return tuple(
+        link
+        for link in _exception_chain(e)
+        if isinstance(link, Exception) and PrismaDBExceptionHandler.is_database_service_unavailable_error(link)
+    )
+
+
+def _exception_types(*candidates: object) -> tuple[type[BaseException], ...]:
+    """Keep only the real exception classes among ``candidates``.
+
+    The predicates below resolve prisma's error classes at call time, so a test
+    that swaps ``sys.modules["prisma"]`` for a ``MagicMock`` hands them mocks,
+    and ``isinstance`` against a mock raises ``TypeError`` instead of answering
+    False. Dropping the non-types lets the call fall through to the other checks.
+    """
+    return tuple(c for c in candidates if isinstance(c, type) and issubclass(c, BaseException))
+
 
 class PrismaDBExceptionHandler:
     """
@@ -59,7 +92,7 @@ class PrismaDBExceptionHandler:
 
         if isinstance(e, DB_CONNECTION_ERROR_TYPES):
             return True
-        if isinstance(e, prisma.engine.errors.EngineConnectionError):
+        if isinstance(e, _exception_types(prisma.engine.errors.EngineConnectionError)):
             return True
         return isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection
 
@@ -81,7 +114,7 @@ class PrismaDBExceptionHandler:
         """
         import prisma
 
-        data_layer_errors: Final = (
+        data_layer_errors: Final = _exception_types(
             prisma.errors.DataError,
             prisma.errors.UniqueViolationError,
             prisma.errors.ForeignKeyViolationError,
@@ -94,7 +127,7 @@ class PrismaDBExceptionHandler:
             return False
         if isinstance(e, DB_CONNECTION_ERROR_TYPES):
             return True
-        if isinstance(e, prisma.errors.PrismaError):
+        if isinstance(e, _exception_types(prisma.errors.PrismaError)):
             return True
         if isinstance(e, ProxyException) and e.type == ProxyErrorTypes.no_db_connection:
             return True
@@ -138,13 +171,13 @@ class PrismaDBExceptionHandler:
             return True
         if isinstance(
             e,
-            (
+            _exception_types(
                 prisma.errors.ClientNotConnectedError,
                 prisma.errors.HTTPClientClosedError,
             ),
         ):
             return True
-        if isinstance(e, prisma.errors.PrismaError):
+        if isinstance(e, _exception_types(prisma.errors.PrismaError)):
             error_message: Final = str(e).lower()
             connection_keywords: Final = (
                 "can't reach database server",
@@ -171,7 +204,7 @@ class PrismaDBExceptionHandler:
         """True iff ``e`` is a Postgres deadlock (P2034 / 40P01) surfaced through prisma."""
         import prisma
 
-        if not isinstance(e, prisma.errors.PrismaError):
+        if not isinstance(e, _exception_types(prisma.errors.PrismaError)):
             return False
         if getattr(e, "code", None) == "P2034":
             return True
@@ -202,7 +235,7 @@ class PrismaDBExceptionHandler:
         """
         import prisma
 
-        if isinstance(e, prisma.errors.PrismaError):
+        if isinstance(e, _exception_types(prisma.errors.PrismaError)):
             return False
         tb = getattr(e, "__traceback__", None)
         while tb is not None:
@@ -268,6 +301,51 @@ class PrismaDBExceptionHandler:
             ),
         )
 
+    @staticmethod
+    def is_permanent_database_fault(e: Exception) -> bool:
+        """True for a service-unavailable failure that will not clear on its
+        own: an engine-layer ``PrismaError`` (missing or version-skewed engine
+        binary, engine error status, misused transaction) that is neither the
+        transient ``EngineConnectionError`` nor a reconnectable transport failure.
+
+        Picks only the wording of a 503, never whether one is sent;
+        ``is_database_service_unavailable_error`` stays the status gate.
+        """
+        if PrismaDBExceptionHandler.is_database_connection_error(e):
+            return False
+        if PrismaDBExceptionHandler.is_database_transport_error(e):
+            return False
+        return PrismaDBExceptionHandler.is_database_infrastructure_error(e)
+
+    @staticmethod
+    def database_unavailable_message(e: Exception) -> str:
+        """The 503 detail for a service-unavailable database failure: retry
+        guidance for a transient outage, a pointer at the deployment for a
+        fault that retrying cannot fix. A permanent fault anywhere in the
+        exception chain wins, since the transport error that surfaced it is
+        not what blocks recovery."""
+        fault: Final = PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(e) or e
+        if not PrismaDBExceptionHandler.is_permanent_database_fault(fault):
+            return _TRANSIENT_DB_UNAVAILABLE_MESSAGE
+        return (
+            "Service Unavailable, the authentication database query engine reported "
+            f"{type(fault).__name__}, which is not a transient outage and will not clear by retrying. "
+            "The proxy deployment needs attention."
+        )
+
+    @staticmethod
+    def find_database_service_unavailable_error_in_chain(e: BaseException) -> Exception | None:
+        """The exception in the ``__cause__`` / ``__context__`` chain that
+        ``is_database_service_unavailable_error`` accepts, or ``None``. Callers
+        that word a response by the kind of outage need the wrapped database
+        error itself, not just the fact that one is present. A permanent fault
+        outranks a transient one wherever it sits in the chain: a reconnect that
+        dies on a missing engine binary raises the transport error last, but the
+        binary is what keeps the database down."""
+        outages: Final = _database_service_unavailable_errors(e)
+        permanent: Final = next(filter(PrismaDBExceptionHandler.is_permanent_database_fault, outages), None)
+        return permanent if permanent is not None else next(iter(outages), None)
+
     @staticmethod
     def is_database_service_unavailable_error_in_chain(e: BaseException) -> bool:
         """Like ``is_database_service_unavailable_error`` but also walks the
@@ -285,14 +363,7 @@ class PrismaDBExceptionHandler:
 
         The walk is depth-bounded, which also makes it cycle-safe.
         """
-        current: BaseException | None = e
-        for _ in range(_MAX_EXCEPTION_CHAIN_DEPTH):
-            if not isinstance(current, Exception):
-                return False
-            if PrismaDBExceptionHandler.is_database_service_unavailable_error(current):
-                return True
-            current = current.__cause__ or current.__context__
-        return False
+        return PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(e) is not None
 
     @staticmethod
     def handle_db_exception(e: Exception):
diff --git a/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py b/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
index 64414b90ae7..c2053693f2e 100644
--- a/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
+++ b/litellm/proxy/discovery_endpoints/ui_discovery_endpoints.py
@@ -14,7 +14,7 @@ router: Final = APIRouter()
 @router.get("/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)
 @router.get("/litellm/.well-known/litellm-ui-config", response_model=UiDiscoveryEndpoints)  # if mounted at root path
 async def get_ui_config():
-    from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+    from litellm.proxy.auth.auth_utils import has_user_setup_sso
     from litellm.proxy.proxy_server import general_settings
     from litellm.proxy.utils import get_proxy_base_url, get_server_root_path
 
@@ -28,7 +28,7 @@ async def get_ui_config():
         or general_settings.get("hide_default_credentials_hint", False) is True
     )
 
-    sso_configured: Final = _has_user_setup_sso()
+    sso_configured: Final = has_user_setup_sso()
 
     from litellm.proxy.proxy_server import proxy_config
 
diff --git a/litellm/proxy/guardrails/guardrail_hooks/headroom/headroom.py b/litellm/proxy/guardrails/guardrail_hooks/headroom/headroom.py
index d8c8c2f4974..fc881a60f43 100644
--- a/litellm/proxy/guardrails/guardrail_hooks/headroom/headroom.py
+++ b/litellm/proxy/guardrails/guardrail_hooks/headroom/headroom.py
@@ -10,6 +10,7 @@ from typing import TYPE_CHECKING, Any, ClassVar, Final, Literal, TypeGuard
 import httpx
 from fastapi import HTTPException
 from httpx import Response as HttpxResponse
+from pydantic import TypeAdapter
 
 import litellm
 from litellm._logging import verbose_proxy_logger
@@ -52,6 +53,10 @@ BYPASS_HEADER: Final = "x-headroom-bypass"
 HEADROOM_RETRIEVE_TOOL_NAME: Final = "headroom_retrieve"
 _HASH_PATTERN: Final = re.compile(r"hash=([a-f0-9]{24})")
 _HASH_CACHE_TTL_SECONDS: Final = 15 * 60
+# Narrows the base class's bare-dict ``request_data`` at the boundary so its
+# untranslated messages can be read with concrete types (values pass through by
+# reference, so this is a shallow top-level reconstruction).
+_REQUEST_DATA_ADAPTER: Final = TypeAdapter(dict[str, object])
 
 
 def _is_str_object_dict(value: object) -> TypeGuard[dict[str, object]]:  # guard-ok: isinstance narrows correctly; predicate is trivially correct  # fmt: skip
@@ -116,16 +121,119 @@ def _restore_content_shapes(
     return restored
 
 
-def _protected_indices(messages: Sequence[Mapping[str, object]]) -> frozenset[int]:
+def _tool_call_name(tool_call: Mapping[str, object]) -> str | None:
+    function: Final = tool_call.get("function")
+    if not _is_str_object_dict(function):
+        return None
+    name: Final = function.get("name")
+    return name if isinstance(name, str) else None
+
+
+def _is_retrieve_tool_name(name: str | None) -> bool:
+    """Match the retrieve tool whether called directly or via the MCP gateway.
+
+    Server-side the tool is ``headroom_retrieve``; exposed through LiteLLM's MCP
+    gateway a client calls it as ``mcp__<server>__headroom_retrieve``.
+    """
+    return name is not None and (
+        name == HEADROOM_RETRIEVE_TOOL_NAME or name.endswith(f"__{HEADROOM_RETRIEVE_TOOL_NAME}")
+    )
+
+
+def _retrieve_call_ids_in_message(message: Mapping[str, object]) -> frozenset[str]:
+    if message.get("role") != "assistant":
+        return frozenset()
+    tool_calls: Final = message.get("tool_calls")
+    if not _is_object_list(tool_calls):
+        return frozenset()
+    return frozenset(
+        str(tool_call["id"])
+        for tool_call in tool_calls
+        if _is_str_object_dict(tool_call) and tool_call.get("id") and _is_retrieve_tool_name(_tool_call_name(tool_call))
+    )
+
+
+def _anthropic_tool_use_retrieve_id(block: object) -> str | None:
+    if not _is_str_object_dict(block) or block.get("type") != "tool_use":
+        return None
+    name: Final = block.get("name")
+    call_id: Final = block.get("id")
+    if isinstance(name, str) and call_id is not None and _is_retrieve_tool_name(name):
+        return str(call_id)
+    return None
+
+
+def _anthropic_retrieve_ids_in_message(message: Mapping[str, object]) -> frozenset[str]:
+    content: Final = message.get("content")
+    if not _is_object_list(content):
+        return frozenset()
+    return frozenset(call_id for block in content if (call_id := _anthropic_tool_use_retrieve_id(block)) is not None)
+
+
+def _raw_retrieve_call_ids(messages: object) -> frozenset[str]:
+    """Retrieve-tool call ids read from the request's own, untranslated messages.
+
+    The guardrail otherwise scans an OpenAI-translated view where a tool name
+    over 64 chars is truncated to ``{prefix}_{hash}``, which drops the
+    ``__headroom_retrieve`` suffix a long ``mcp__<server>__`` prefix pushes past
+    the limit. Tool-call ids are never truncated, so pairing the tool result to
+    an id read from the original request keeps the match intact. Both wire
+    shapes are handled: OpenAI ``tool_calls`` and Anthropic ``tool_use`` blocks.
+    """
+    if not _is_object_list(messages):
+        return frozenset()
+    return frozenset(
+        call_id
+        for message in messages
+        if _is_str_object_dict(message)
+        for call_id in _retrieve_call_ids_in_message(message) | _anthropic_retrieve_ids_in_message(message)
+    )
+
+
+def _retrieval_result_indices(
+    messages: Sequence[Mapping[str, object]], extra_retrieve_call_ids: frozenset[str] = frozenset()
+) -> frozenset[int]:
+    """Indices of tool-result rows that carry ``headroom_retrieve`` output.
+
+    When the retrieve tool is exposed to a client that runs its own tool loop
+    (the LiteLLM MCP gateway path), the client executes the call and sends the
+    recovered original content back as a tool result on the next turn. That
+    content is exactly what a prior compression stubbed, so compressing it again
+    re-derives the identical content hash: a no-op that strands the model on the
+    marker and loops the agent. Hold those rows back so the expansion survives.
+
+    ``extra_retrieve_call_ids`` carries ids recovered from the untruncated
+    request so the pairing survives tool-name truncation (see
+    ``_raw_retrieve_call_ids``).
+    """
+    retrieve_call_ids: Final = extra_retrieve_call_ids | frozenset(
+        call_id for message in messages for call_id in _retrieve_call_ids_in_message(message)
+    )
+    if not retrieve_call_ids:
+        return frozenset()
+    return frozenset(
+        index
+        for index, message in enumerate(messages)
+        if message.get("role") in ("tool", "function") and str(message.get("tool_call_id")) in retrieve_call_ids
+    )
+
+
+def _protected_indices(
+    messages: Sequence[Mapping[str, object]], extra_retrieve_call_ids: frozenset[str] = frozenset()
+) -> frozenset[int]:
     """Indices headroom must not send to the compression service.
 
     ``get_protected_indices`` is litellm's own compression policy: the system
-    rows, the last user row, the last assistant row. It is expanded over whole
+    rows, the last user row, the last assistant row. Rows carrying just-retrieved
+    ``headroom_retrieve`` output are added so re-compression can't collapse them
+    back to the marker they were expanded from. The union is expanded over whole
     tool exchanges the way ``compress()`` expands it, so a protected assistant
     tool call cannot end up answered by a marker standing in for the result the
     model just asked for.
     """
-    protected: Final = frozenset(get_protected_indices(messages))
+    protected: Final = frozenset(get_protected_indices(messages)) | _retrieval_result_indices(
+        messages, extra_retrieve_call_ids
+    )
     return protected | frozenset(
         index
         for group in group_tool_exchanges(messages)
@@ -634,7 +742,11 @@ class HeadroomGuardrail(CustomGuardrail):
         # /v1/compress grows a field for sending the live turn as the retrieval
         # query without compressing it: query-aware compression reads the newest
         # user message, so it is withheld here at some cost to history ranking.
-        protected_indices: Final = _protected_indices(messages)
+        # request_data is a bare dict on the base signature; narrow it before
+        # reading the untranslated messages so long tool names can be recovered.
+        raw_messages: Final = _REQUEST_DATA_ADAPTER.validate_python(request_data).get("messages")
+        raw_retrieve_call_ids: Final = _raw_retrieve_call_ids(raw_messages)
+        protected_indices: Final = _protected_indices(messages, raw_retrieve_call_ids)
         compressible: Final = [m for i, m in enumerate(messages) if i not in protected_indices]
         if not compressible:
             return inputs
diff --git a/litellm/proxy/guardrails/guardrail_hooks/presidio.py b/litellm/proxy/guardrails/guardrail_hooks/presidio.py
index da51a905ae3..70ea21320ee 100644
--- a/litellm/proxy/guardrails/guardrail_hooks/presidio.py
+++ b/litellm/proxy/guardrails/guardrail_hooks/presidio.py
@@ -1633,6 +1633,8 @@ class _OPTIONAL_PresidioPIIMasking(CustomGuardrail):
         Update the guardrails litellm params in memory
         """
         super().update_in_memory_litellm_params(litellm_params)
+        if self.apply_to_output:
+            self.output_parse_pii = False
         if litellm_params.pii_entities_config:
             self.pii_entities_config = litellm_params.pii_entities_config
         if litellm_params.presidio_score_thresholds:
diff --git a/litellm/proxy/guardrails/guardrail_initializers.py b/litellm/proxy/guardrails/guardrail_initializers.py
index 76dea1b7784..16369abbfb0 100644
--- a/litellm/proxy/guardrails/guardrail_initializers.py
+++ b/litellm/proxy/guardrails/guardrail_initializers.py
@@ -2,6 +2,7 @@
 from typing import Any, Final
 
 import litellm
+from litellm.integrations.custom_guardrail import CustomGuardrail
 from litellm.proxy._types import CommonProxyErrors
 from litellm.types.guardrails import *
 
@@ -85,7 +86,7 @@ def initialize_lakera_v2(litellm_params: LitellmParams, guardrail: Guardrail):
     return _lakera_v2_callback
 
 
-def initialize_presidio(litellm_params: LitellmParams, guardrail: Guardrail):
+def initialize_presidio(litellm_params: LitellmParams, guardrail: Guardrail) -> tuple[CustomGuardrail, ...]:
     from litellm.proxy.guardrails.guardrail_hooks.presidio import (
         _OPTIONAL_PresidioPIIMasking,
     )
@@ -94,7 +95,7 @@ def initialize_presidio(litellm_params: LitellmParams, guardrail: Guardrail):
     run_input: Final = filter_scope in ("input", "both")
     run_output: Final = filter_scope in ("output", "both")
 
-    def _make_presidio_callback(**overrides):
+    def _make_presidio_callback(**overrides) -> CustomGuardrail:
         params: Final = dict(
             guardrail_name=guardrail.get("guardrail_name", ""),
             event_hook=litellm_params.mode,
@@ -120,27 +121,27 @@ def initialize_presidio(litellm_params: LitellmParams, guardrail: Guardrail):
         litellm.logging_callback_manager.add_litellm_callback(callback)
         return callback
 
-    primary_callback = None
-
-    if run_input:
-        primary_callback = _make_presidio_callback()
-
-        if litellm_params.output_parse_pii:
-            _make_presidio_callback(
-                output_parse_pii=True,
-                event_hook=GuardrailEventHooks.post_call.value,
-            )
-
-    if run_output:
-        output_callback: Final = _make_presidio_callback(
+    input_callback: Final = _make_presidio_callback() if run_input else None
+    unmask_output_callback: Final = (
+        _make_presidio_callback(
+            output_parse_pii=True,
+            event_hook=GuardrailEventHooks.post_call.value,
+        )
+        if run_input and litellm_params.output_parse_pii
+        else None
+    )
+    mask_output_callback: Final = (
+        _make_presidio_callback(
             apply_to_output=True,
             event_hook=GuardrailEventHooks.post_call.value,
             output_parse_pii=False,
         )
-        if primary_callback is None:
-            primary_callback = output_callback
-
-    return primary_callback
+        if run_output
+        else None
+    )
+    return tuple(
+        callback for callback in (input_callback, unmask_output_callback, mask_output_callback) if callback is not None
+    )
 
 
 def initialize_hide_secrets(litellm_params: LitellmParams, guardrail: Guardrail):
diff --git a/litellm/proxy/guardrails/guardrail_registry.py b/litellm/proxy/guardrails/guardrail_registry.py
index dc13c09dd38..bd35782444b 100644
--- a/litellm/proxy/guardrails/guardrail_registry.py
+++ b/litellm/proxy/guardrails/guardrail_registry.py
@@ -3,10 +3,10 @@
 import asyncio
 import importlib
 import os
-from collections.abc import Callable, Iterator, Mapping
+from collections.abc import Callable, Iterator, Mapping, Sequence
 from datetime import datetime, timezone
 from itertools import chain, count
-from typing import TYPE_CHECKING, Final, Literal, Optional, Protocol, cast
+from typing import TYPE_CHECKING, Final, Literal, Optional, Protocol, TypeAlias, cast
 
 from pydantic import ValidationError
 
@@ -90,6 +90,8 @@ guardrail_initializer_registry: Final = {
 
 CONFIG_GUARDRAIL_ID_NAMESPACE: Final = uuid.UUID("625f63f4-935a-50e5-98b5-fbe77babc74a")
 
+GuardrailCallbacks: TypeAlias = tuple[CustomGuardrail, ...]
+
 guardrail_class_registry: Final[dict[str, type[CustomGuardrail]]] = {
     SupportedGuardrailIntegrations.BEDROCK.value: BedrockGuardrail,
     SupportedGuardrailIntegrations.GRAYSWAN.value: GraySwanGuardrail,
@@ -424,6 +426,41 @@ def _apply_configured_bool_overrides(instance: CustomGuardrail, litellm_params:
         instance.scan_raw_request = bool(litellm_params.scan_raw_request)
 
 
+def _as_callback_tuple(
+    initialized: CustomGuardrail | Sequence[CustomGuardrail] | None,
+) -> GuardrailCallbacks:
+    if initialized is None:
+        return ()
+    if isinstance(initialized, (list, tuple)):
+        return tuple(initialized)
+    return (initialized,)
+
+
+def _configure_callback_scoping(
+    custom_guardrail_callback: CustomGuardrail, guardrail_name: str, litellm_params: LitellmParams
+) -> None:
+    for scoping_param in (
+        "skip_system_message_in_guardrail",
+        "skip_tool_message_in_guardrail",
+        "scan_only_tool_results",
+    ):
+        setattr(custom_guardrail_callback, scoping_param, getattr(litellm_params, scoping_param, None))
+    scan_only_tool_results_enabled: Final = effective_scan_only_tool_results_for_guardrail(custom_guardrail_callback)
+    if scan_only_tool_results_enabled and not custom_guardrail_callback.supports_scan_only_tool_results():
+        raise ValueError(
+            f"Guardrail {guardrail_name}: scan_only_tool_results is enabled, but this "
+            "guardrail's role filtering never scans tool results, so no request content would ever "
+            "be scanned. Remove scan_only_tool_results or the guardrail's role-filtering option."
+        )
+    if scan_only_tool_results_enabled and effective_skip_tool_message_for_guardrail(custom_guardrail_callback):
+        raise ValueError(
+            f"Guardrail {guardrail_name}: scan_only_tool_results and "
+            "skip_tool_message_in_guardrail are enabled together, which excludes every message from "
+            "scanning, so no request content would ever be scanned. Remove one of the two."
+        )
+    _apply_configured_bool_overrides(custom_guardrail_callback, litellm_params)
+
+
 class InMemoryGuardrailHandler:
     """
     Class that handles initializing guardrails and adding them to the CallbackManager
@@ -440,6 +477,8 @@ class InMemoryGuardrailHandler:
         Guardrail id to CustomGuardrail object mapping
         """
 
+        self.guardrail_id_to_sibling_callbacks: dict[str, GuardrailCallbacks] = {}  # mutable-ok: per-id registry
+
         self._sources: dict[str, Literal["db", "config"]] = {}
         """
         Guardrail id to provenance marker. "db" entries are reconciled against
@@ -474,7 +513,6 @@ class InMemoryGuardrailHandler:
             self._sources[guardrail_id] = source
             return self.IN_MEMORY_GUARDRAILS[guardrail_id]
 
-        custom_guardrail_callback: CustomGuardrail | None = None
         litellm_params_data: Final = guardrail["litellm_params"]
         verbose_proxy_logger.debug("litellm_params= %s", litellm_params_data)
 
@@ -498,54 +536,15 @@ class InMemoryGuardrailHandler:
         if guardrail_type is None:
             raise ValueError("guardrail_type is required")
 
-        initializer: Final = guardrail_initializer_registry.get(guardrail_type)
-
-        if initializer:
-            # Try to call with llm_router first, fall back to without if it fails
-            import inspect
-
-            sig: Final = inspect.signature(initializer)
-            if "llm_router" in sig.parameters:
-                custom_guardrail_callback = initializer(
-                    litellm_params,
-                    guardrail,
-                    llm_router,
-                )
-            else:
-                custom_guardrail_callback = initializer(litellm_params, guardrail)
-        elif isinstance(guardrail_type, str) and "." in guardrail_type:
-            custom_guardrail_callback = self.initialize_custom_guardrail(
-                guardrail=guardrail,
-                guardrail_type=guardrail_type,
-                litellm_params=litellm_params,
-                config_file_path=config_file_path,
-            )
-        else:
-            raise ValueError(f"Unsupported guardrail: {guardrail_type}")
-
-        if custom_guardrail_callback is not None:
-            for scoping_param in (
-                "skip_system_message_in_guardrail",
-                "skip_tool_message_in_guardrail",
-                "scan_only_tool_results",
-            ):
-                setattr(custom_guardrail_callback, scoping_param, getattr(litellm_params, scoping_param, None))
-            scan_only_tool_results_enabled: Final = effective_scan_only_tool_results_for_guardrail(
-                custom_guardrail_callback
-            )
-            if scan_only_tool_results_enabled and not custom_guardrail_callback.supports_scan_only_tool_results():
-                raise ValueError(
-                    f"Guardrail {guardrail['guardrail_name']}: scan_only_tool_results is enabled, but this "
-                    "guardrail's role filtering never scans tool results, so no request content would ever "
-                    "be scanned. Remove scan_only_tool_results or the guardrail's role-filtering option."
-                )
-            if scan_only_tool_results_enabled and effective_skip_tool_message_for_guardrail(custom_guardrail_callback):
-                raise ValueError(
-                    f"Guardrail {guardrail['guardrail_name']}: scan_only_tool_results and "
-                    "skip_tool_message_in_guardrail are enabled together, which excludes every message from "
-                    "scanning, so no request content would ever be scanned. Remove one of the two."
-                )
-            _apply_configured_bool_overrides(custom_guardrail_callback, litellm_params)
+        created_callbacks: Final = self._create_callbacks(
+            guardrail=guardrail,
+            guardrail_type=guardrail_type,
+            litellm_params=litellm_params,
+            config_file_path=config_file_path,
+            llm_router=llm_router,
+        )
+        for custom_guardrail_callback in created_callbacks:
+            _configure_callback_scoping(custom_guardrail_callback, guardrail["guardrail_name"], litellm_params)
 
         parsed_guardrail: Final = Guardrail(
             guardrail_id=guardrail.get("guardrail_id"),
@@ -556,11 +555,44 @@ class InMemoryGuardrailHandler:
 
         # store references to the guardrail in memory
         self.IN_MEMORY_GUARDRAILS[guardrail_id] = parsed_guardrail
-        self.guardrail_id_to_custom_guardrail[guardrail_id] = custom_guardrail_callback
+        self.guardrail_id_to_custom_guardrail[guardrail_id] = created_callbacks[0] if created_callbacks else None
+        self.guardrail_id_to_sibling_callbacks[guardrail_id] = created_callbacks[1:]
         self._sources[guardrail_id] = source
 
         return parsed_guardrail
 
+    def _create_callbacks(
+        self,
+        guardrail: Guardrail,
+        guardrail_type: str,
+        litellm_params: LitellmParams,
+        config_file_path: str | None,
+        llm_router: Optional["Router"],
+    ) -> GuardrailCallbacks:
+        initializer: Final = guardrail_initializer_registry.get(guardrail_type)
+        if initializer:
+            import inspect
+
+            sig: Final = inspect.signature(initializer)
+            if "llm_router" in sig.parameters:
+                return _as_callback_tuple(initializer(litellm_params, guardrail, llm_router))
+            return _as_callback_tuple(initializer(litellm_params, guardrail))
+        if isinstance(guardrail_type, str) and "." in guardrail_type:
+            return _as_callback_tuple(
+                self.initialize_custom_guardrail(
+                    guardrail=guardrail,
+                    guardrail_type=guardrail_type,
+                    litellm_params=litellm_params,
+                    config_file_path=config_file_path,
+                )
+            )
+        raise ValueError(f"Unsupported guardrail: {guardrail_type}")
+
+    def _tracked_callbacks(self, guardrail_id: str) -> GuardrailCallbacks:
+        primary: Final = self.guardrail_id_to_custom_guardrail.get(guardrail_id)
+        siblings: Final = self.guardrail_id_to_sibling_callbacks.get(guardrail_id, ())
+        return (() if primary is None else (primary,)) + siblings
+
     def initialize_custom_guardrail(
         self,
         guardrail: Guardrail,
@@ -630,10 +662,15 @@ class InMemoryGuardrailHandler:
         self.IN_MEMORY_GUARDRAILS[guardrail_id] = guardrail
         self._sources[guardrail_id] = source
 
-        custom_guardrail_callback: Final = self.guardrail_id_to_custom_guardrail.get(guardrail_id)
-        if custom_guardrail_callback:
-            updated_litellm_params: Final = cast(LitellmParams, guardrail.get("litellm_params", {}))
-            custom_guardrail_callback.update_in_memory_litellm_params(litellm_params=updated_litellm_params)
+        tracked_callbacks: Final = self._tracked_callbacks(guardrail_id)
+        if not tracked_callbacks:
+            return
+        updated_litellm_params: Final = cast(LitellmParams, guardrail.get("litellm_params", {}))
+        tracked_callbacks[0].update_in_memory_litellm_params(litellm_params=updated_litellm_params)
+        for sibling_callback in tracked_callbacks[1:]:
+            sibling_stage = sibling_callback.event_hook
+            sibling_callback.update_in_memory_litellm_params(litellm_params=updated_litellm_params)
+            sibling_callback.event_hook = sibling_stage
 
     def delete_in_memory_guardrail(self, guardrail_id: str) -> None:
         """
@@ -648,11 +685,11 @@ class InMemoryGuardrailHandler:
         self.IN_MEMORY_GUARDRAILS.pop(guardrail_id, None)
         self._sources.pop(guardrail_id, None)
 
-        custom_guardrail_callback: Final = self.guardrail_id_to_custom_guardrail.pop(guardrail_id, None)
-        if custom_guardrail_callback is None:
-            return
-
-        litellm.logging_callback_manager.remove_callback_from_all_lists(custom_guardrail_callback)
+        tracked_callbacks: Final = self._tracked_callbacks(guardrail_id)
+        self.guardrail_id_to_custom_guardrail.pop(guardrail_id, None)
+        self.guardrail_id_to_sibling_callbacks.pop(guardrail_id, None)
+        for custom_guardrail_callback in tracked_callbacks:
+            litellm.logging_callback_manager.remove_callback_from_all_lists(custom_guardrail_callback)
 
     def list_in_memory_guardrails(self) -> list[Guardrail]:
         """
diff --git a/litellm/proxy/hooks/model_max_budget_limiter.py b/litellm/proxy/hooks/model_max_budget_limiter.py
index c5d10b2749b..efaaab277a9 100644
--- a/litellm/proxy/hooks/model_max_budget_limiter.py
+++ b/litellm/proxy/hooks/model_max_budget_limiter.py
@@ -1,6 +1,6 @@
 import json
 import time
-from collections.abc import Iterable, Mapping
+from collections.abc import Iterable, Mapping, Sequence
 from dataclasses import dataclass
 from types import MappingProxyType
 from typing import Final
@@ -199,18 +199,10 @@ async def build_model_max_budget_usage(
         )
         for budget_model, budget_config in budgets
     )
-    batched: Final = await cache.async_batch_get_cache(
-        keys=list(spend_keys)  # mutable-ok: async_batch_get_cache annotates keys as list, so one must exist here
-    )
-    # async_batch_get_cache returns None if it fails internally, and its result is
-    # index-aligned with `keys` otherwise. An unusable result reads as a miss,
-    # which is what a never-written counter already reads as.
-    current_spends: Final = (
-        tuple(batched) if isinstance(batched, list) and len(batched) == len(budgets) else (None,) * len(budgets)
-    )
+    current_spends: Final = await _current_window_spends(cache=cache, spend_keys=spend_keys)
     return {
         budget_model: {
-            "current_spend": round(_as_spend(current_spend), 4),
+            "current_spend": round(current_spend, 4),
             "budget_limit": budget_config.max_budget,
             "time_period": budget_config.budget_duration,
         }
@@ -218,6 +210,22 @@ async def build_model_max_budget_usage(
     }
 
 
+async def _current_window_spends(cache: DualCache, spend_keys: Sequence[str]) -> tuple[float, ...]:
+    """Redis holds the window total across replicas; the in-memory copy is one replica's share."""
+    keys: Final = list(spend_keys)  # mutable-ok: both batch readers annotate their key argument as list
+    redis_cache: Final = cache.redis_cache
+    if redis_cache is not None:
+        shared: Final = await redis_cache.async_batch_get_cache(key_list=keys)
+        return tuple(_as_spend(shared.get(key)) for key in keys)
+    # async_batch_get_cache returns None if it fails internally, and its result is
+    # index-aligned with `keys` otherwise. An unusable result reads as a miss,
+    # which is what a never-written counter already reads as.
+    batched: Final = await cache.async_batch_get_cache(keys=keys)
+    if not isinstance(batched, list) or len(batched) != len(keys):
+        return (0.0,) * len(keys)
+    return tuple(_as_spend(current_spend) for current_spend in batched)
+
+
 def _usable_budget_config(raw_budget_config: object) -> BudgetConfig | None:
     try:
         budget_config: Final = BudgetConfig.model_validate(raw_budget_config)
@@ -404,7 +412,10 @@ class _PROXY_VirtualKeyModelMaxBudgetLimiter(RouterBudgetLimiting):
         return current_spend + _as_spend(await self._cached_spend(legacy_spend_key))
 
     async def _cached_spend(self, spend_key: str) -> float | None:
-        return await self.dual_cache.async_get_cache(key=spend_key)
+        redis_cache: Final = self.dual_cache.redis_cache
+        if redis_cache is None:
+            return await self.dual_cache.async_get_cache(key=spend_key)
+        return await redis_cache.async_get_cache(key=spend_key)
 
     async def async_filter_deployments(
         self,
diff --git a/litellm/proxy/management_endpoints/internal_user_endpoints.py b/litellm/proxy/management_endpoints/internal_user_endpoints.py
index c08ca5b7783..5326074ad3c 100644
--- a/litellm/proxy/management_endpoints/internal_user_endpoints.py
+++ b/litellm/proxy/management_endpoints/internal_user_endpoints.py
@@ -27,6 +27,7 @@ from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_checks import get_team_object, get_user_object
+from litellm.proxy.auth.password_policy import validate_password_policy
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.proxy.common_utils.user_api_key_cache import (
     object_permission_cache_key,
@@ -154,9 +155,10 @@ def _team_membership_table(
     return team_membership_table
 
 
-def _hash_password_in_dict(data: dict) -> None:
-    """Hash password field in-place if present."""
+def _hash_password_in_dict(data: dict, general_settings: Mapping[str, object]) -> None:
+    """Validate and hash password field in-place if present."""
     if "password" in data and data["password"] is not None:
+        validate_password_policy(data["password"], general_settings)
         data["password"] = hash_password(data["password"])
 
 
@@ -500,7 +502,7 @@ async def new_user(
     ```
     """
     try:
-        from litellm.proxy.proxy_server import _license_check, prisma_client
+        from litellm.proxy.proxy_server import _license_check, general_settings, prisma_client
 
         if prisma_client is None:
             raise HTTPException(status_code=400, detail=CommonProxyErrors.db_not_connected_error.value)
@@ -548,7 +550,7 @@ async def new_user(
         # generate_key_helper_fn only forwards object_permission_id, so without this the entitlement
         # the caller sent would be dropped on the floor.
         data_json = await _set_object_permission(data_json=data_json, prisma_client=prisma_client)
-        _hash_password_in_dict(data_json)
+        _hash_password_in_dict(data_json, general_settings)
         teams = data.teams
         if teams is None:
             teams = check_if_default_team_set()
@@ -1405,7 +1407,7 @@ async def _update_single_user_helper(
 
     Returns the updated user data or raises an exception on failure.
     """
-    from litellm.proxy.proxy_server import litellm_proxy_admin_name, prisma_client
+    from litellm.proxy.proxy_server import general_settings, litellm_proxy_admin_name, prisma_client
 
     if prisma_client is None:
         raise Exception("Not connected to DB!")
@@ -1420,7 +1422,7 @@ async def _update_single_user_helper(
 
     data_json: Final[dict] = user_request.model_dump(exclude_unset=True)
     non_default_values = _update_internal_user_params(data_json=data_json, data=user_request)
-    _hash_password_in_dict(non_default_values)
+    _hash_password_in_dict(non_default_values, general_settings)
 
     existing_user_row: BaseModel | None = None
     if user_request.user_id:
diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index c3403cf477c..d7d20d168b5 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -3785,15 +3785,22 @@ async def info_key_fn_v2(
 @router.get("/key/info", tags=["key management"], dependencies=[Depends(user_api_key_auth)])
 @management_endpoint_wrapper
 async def info_key_fn(
-    key: str | None = fastapi.Query(default=None, description="Key in the request parameters"),
+    key: str | None = fastapi.Query(
+        default=None,
+        description=(
+            "Key to look up. Pass the key's sha256 hash so the raw key stays out of URLs and access "
+            "logs. Example key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa'"
+        ),
+    ),
     user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
 ):
     """
     Retrieve information about a key.
 
     Parameters:
-    - key: str | None (query parameter) - The key to look up. Accepts the plaintext key or its hash.
-      Defaults to the key in the Authorization header.
+    - key: str | None (query parameter) - The key to look up. Accepts the plaintext key or its hash;
+      prefer the hash, since a query parameter is recorded verbatim by any HTTP access log in front
+      of the proxy. Defaults to the key in the Authorization header.
 
     Returns:
     - key: str - The key that was looked up, echoed back as it was passed in
@@ -3825,7 +3832,7 @@ async def info_key_fn(
 
     Example Curl:
     ```
-    curl -X GET "http://0.0.0.0:4000/key/info?key=sk-test-example-key-123" \
+    curl -X GET "http://0.0.0.0:4000/key/info?key=d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa" \
 -H "Authorization: Bearer sk-1234"
     ```
 
diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py
index 606569c5b8b..6b98d9f9a26 100644
--- a/litellm/proxy/management_endpoints/ui_sso.py
+++ b/litellm/proxy/management_endpoints/ui_sso.py
@@ -89,7 +89,7 @@ from litellm.proxy._types import (
 from litellm.proxy.auth.auth_checks import ExperimentalUIJWTToken, get_user_object
 from litellm.proxy.auth.auth_utils import (
     _get_request_ip_address,
-    _has_user_setup_sso,
+    has_user_setup_sso,
 )
 from litellm.proxy.auth.handle_jwt import JWTHandler
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
@@ -2617,7 +2617,7 @@ async def get_ui_settings(request: Request):
     _proxy_base_url: Final = os.getenv("PROXY_BASE_URL", None)
     _logout_url: Final = os.getenv("PROXY_LOGOUT_URL", None)
     _api_doc_base_url: Final = os.getenv("LITELLM_UI_API_DOC_BASE_URL", None)
-    _is_sso_enabled: Final = _has_user_setup_sso()
+    _is_sso_enabled: Final = has_user_setup_sso()
     disable_expensive_db_queries: Final = (
         proxy_state.get_proxy_state_variable("spend_logs_row_count") > MAX_SPENDLOG_ROWS_TO_QUERY
     )
diff --git a/litellm/proxy/openai_files_endpoints/files_endpoints.py b/litellm/proxy/openai_files_endpoints/files_endpoints.py
index 9bc90260de1..bf07f4748ef 100644
--- a/litellm/proxy/openai_files_endpoints/files_endpoints.py
+++ b/litellm/proxy/openai_files_endpoints/files_endpoints.py
@@ -70,6 +70,15 @@ from litellm.proxy.openai_files_endpoints.common_utils import (
     validate_managed_files_requirement,
     validate_managed_id_requirement,
 )
+from litellm.proxy.openai_files_endpoints.general_upload_validation import (
+    MB,
+    check_blocked_extension,
+    check_unsafe_filename,
+    check_upload_file_size,
+    coerce_optional_int_setting,
+    coerce_optional_str_list_setting,
+    raise_upload_validation_failure,
+)
 from litellm.proxy.utils import ProxyLogging, is_known_model
 from litellm.repositories.table_repositories import ManagedFileRepository
 from litellm.router import Router
@@ -397,13 +406,23 @@ async def create_file(
     # descriptor and its disk blocks until the collector runs.
     spools: Final[list[BinaryIO]] = []  # mutable-ok: filled as the scan opens handles
     try:
+        unsafe_filename_failure: Final = check_unsafe_filename(file.filename)
+        if unsafe_filename_failure is not None:
+            raise_upload_validation_failure(unsafe_filename_failure)
+
+        max_file_size_mb: Final = coerce_optional_int_setting(general_settings.get("max_file_size_mb"))
+
         # Batch uploads can be gigabytes. Starlette has already spooled the upload
         # to disk, so stream from that handle instead of reading it into memory.
-        # Other uploads are small and stay in-memory bytes.
+        # Other uploads stay in-memory bytes, bounded to max_file_size_mb (plus one
+        # byte, to still tell "exactly at the limit" from "over it") when it is set,
+        # so an oversized upload cannot be read to completion before it is rejected.
         file_source: bytes | BinaryIO
         if purpose == "batch":
             await file.seek(0)
             file_source = file.file
+        elif max_file_size_mb is not None and max_file_size_mb > 0:
+            file_source = await file.read(max_file_size_mb * MB + 1)
         else:
             file_source = await file.read()
         custom_llm_provider = (
@@ -442,6 +461,15 @@ async def create_file(
         # Cast purpose to OpenAIFilesPurpose type
         purpose = cast(OpenAIFilesPurpose, purpose)
 
+        general_size_failure: Final = check_upload_file_size(file_source, max_file_size_mb)
+        if general_size_failure is not None:
+            raise_upload_validation_failure(general_size_failure)
+
+        blocked_extensions: Final = coerce_optional_str_list_setting(general_settings.get("blocked_file_extensions"))
+        blocked_extension_failure: Final = check_blocked_extension(file.filename, blocked_extensions)
+        if blocked_extension_failure is not None:
+            raise_upload_validation_failure(blocked_extension_failure)
+
         if purpose == "batch":
             batch_file_failure: Final = await asyncio.to_thread(
                 check_batch_file_upload,
diff --git a/litellm/proxy/openai_files_endpoints/general_upload_validation.py b/litellm/proxy/openai_files_endpoints/general_upload_validation.py
new file mode 100644
index 00000000000..9d450cb5b8d
--- /dev/null
+++ b/litellm/proxy/openai_files_endpoints/general_upload_validation.py
@@ -0,0 +1,150 @@
+"""
+Upload validation applied to every purpose at POST /v1/files.
+
+batch_file_validation.py checks the JSONL shape of purpose="batch" uploads; this
+module applies the same fast-fail-before-forwarding shape (size cap, blocked
+extensions, path-traversal filenames) regardless of purpose.
+"""
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import BinaryIO, Final, NoReturn, assert_never
+
+from litellm.proxy._types import ProxyException
+from litellm.proxy.common_utils.path_utils import safe_filename
+
+MB: Final = 1024 * 1024
+
+
+def coerce_optional_int_setting(raw: object) -> int | None:
+    """A general_settings value declared as an optional integer, e.g. max_file_size_mb.
+
+    bool is an int subclass, so an explicit isinstance(raw, bool) exclusion is needed
+    or a YAML `true`/`false` would silently pass as 1/0.
+    """
+    if raw is None:
+        return None
+    if isinstance(raw, int) and not isinstance(raw, bool):
+        return raw
+    raise TypeError(f"expected an integer, got {raw!r}")
+
+
+def coerce_optional_str_list_setting(raw: object) -> tuple[str, ...]:
+    """A general_settings value declared as an optional list of strings, e.g. blocked_file_extensions."""
+    if raw is None:
+        return ()
+    if not isinstance(raw, list) or not all(isinstance(item, str) for item in raw):
+        raise TypeError(f"expected a list of strings, got {raw!r}")
+    return tuple(raw)
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileTooLarge:
+    size_bytes: int
+    limit_mb: int
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileBlockedExtension:
+    extension: str
+
+
+@dataclass(frozen=True, slots=True)
+class UploadedFileUnsafeFilename:
+    filename: str
+
+
+UploadValidationFailure = UploadedFileTooLarge | UploadedFileBlockedExtension | UploadedFileUnsafeFilename
+
+
+def _file_size_bytes(file_source: bytes | BinaryIO) -> int:
+    if isinstance(file_source, bytes):
+        return len(file_source)
+    original_position: Final = file_source.tell()
+    file_source.seek(0, 2)
+    size: Final = file_source.tell()
+    file_source.seek(original_position)
+    return size
+
+
+def check_upload_file_size(
+    file_source: bytes | BinaryIO,
+    max_file_size_mb: int | None,
+) -> UploadedFileTooLarge | None:
+    if max_file_size_mb is None or max_file_size_mb <= 0:
+        return None
+    size_bytes: Final = _file_size_bytes(file_source)
+    if size_bytes > max_file_size_mb * MB:
+        return UploadedFileTooLarge(size_bytes=size_bytes, limit_mb=max_file_size_mb)
+    return None
+
+
+def check_blocked_extension(
+    filename: str | None,
+    blocked_extensions: tuple[str, ...],
+) -> UploadedFileBlockedExtension | None:
+    if not blocked_extensions or not filename:
+        return None
+    try:
+        extension: Final = Path(safe_filename(filename)).suffix.lower()
+    except ValueError:
+        return None
+    # The uploaded name's extension is normalized above; blocked_extensions comes
+    # straight from config.yaml or the DB and is normalized here too, so a
+    # differently-cased entry (".EXE") still catches a lowercase upload.
+    normalized_blocked: Final = frozenset(item.lower() for item in blocked_extensions)
+    if extension and extension in normalized_blocked:
+        return UploadedFileBlockedExtension(extension=extension)
+    return None
+
+
+def check_unsafe_filename(filename: str | None) -> UploadedFileUnsafeFilename | None:
+    """Reject a filename before it can influence any storage path or backend call.
+
+    Only flags a genuine traversal component ("..") or a null byte, so an ordinary
+    name like "report.v2.pdf" or ".env" is never rejected.
+    """
+    if not filename:
+        return None
+    if "\x00" in filename:
+        return UploadedFileUnsafeFilename(filename=filename)
+    normalized: Final = filename.replace("\\", "/")
+    if any(part == ".." for part in normalized.split("/")):
+        return UploadedFileUnsafeFilename(filename=filename)
+    return None
+
+
+def raise_upload_validation_failure(failure: UploadValidationFailure) -> NoReturn:
+    match failure:
+        case UploadedFileTooLarge(size_bytes=size_bytes, limit_mb=limit_mb):
+            raise ProxyException(
+                message=(
+                    f"Uploaded file exceeds the configured max_file_size_mb of {limit_mb} MB "
+                    f"(read stopped at {size_bytes / MB:.1f} MB). The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=413,
+            )
+        case UploadedFileBlockedExtension(extension=extension):
+            raise ProxyException(
+                message=(
+                    f"File extension '{extension}' is blocked by this proxy's blocked_file_extensions "
+                    "setting. The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=400,
+            )
+        case UploadedFileUnsafeFilename(filename=filename):
+            raise ProxyException(
+                message=(
+                    f"Filename '{filename}' is not allowed: directory traversal sequences are not "
+                    "permitted in uploaded file names. The file was not forwarded to the provider."
+                ),
+                type="invalid_request_error",
+                param="file",
+                code=400,
+            )
+        case _:
+            assert_never(failure)
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 672d94077b2..1e0792cb8a5 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -39,7 +39,7 @@ from typing import (
 import anyio
 import websockets
 import websockets.exceptions
-from pydantic import BaseModel, Json, JsonValue, ValidationError
+from pydantic import BaseModel, Json, JsonValue, TypeAdapter, ValidationError
 from typing_extensions import NotRequired, ReadOnly, assert_never
 
 from litellm._uuid import uuid
@@ -60,6 +60,7 @@ from litellm.constants import (
     LITELLM_SETTINGS_SAFE_DB_OVERRIDES,
     LITELLM_UI_ALLOW_HEADERS,
     LITELLM_UI_SESSION_DURATION,
+    RUNTIME_UPDATABLE_ROUTER_SETTINGS,
 )
 from litellm.litellm_core_utils.litellm_logging import (
     _init_custom_logger_compatible_class,
@@ -253,6 +254,7 @@ from litellm.constants import (
     PROXY_BUDGET_RESCHEDULER_MAX_TIME,
     PROXY_BUDGET_RESCHEDULER_MIN_TIME,
     PROXY_CONFIG_RELOAD_INTERVAL_SECONDS,
+    ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG,
     USER_SPEND_ALERTS_JOB_ID,
     WEEKLY_SPEND_REPORT_JOB_ID,
 )
@@ -308,6 +310,7 @@ from litellm.proxy.auth.model_checks import (
     get_mcp_server_ids,
     get_team_models,
 )
+from litellm.proxy.auth.password_policy import validate_password_policy
 from litellm.proxy.auth.user_api_key_auth import (
     _fetch_global_spend_with_event_coordination,
     user_api_key_auth,
@@ -2278,7 +2281,7 @@ user_api_key_cache: UserApiKeyCache = UserApiKeyCache(
 )
 spend_counter_cache: Final = DualCache(default_in_memory_ttl=UserAPIKeyCacheTTLEnum.in_memory_cache_ttl.value)
 cli_sso_session_cache: Final = DualCache(default_in_memory_ttl=CLI_SSO_SESSION_TTL_SECONDS)
-model_max_budget_limiter: Final = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=user_api_key_cache)
+model_max_budget_limiter: Final = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=spend_counter_cache)
 litellm.logging_callback_manager.add_litellm_callback(model_max_budget_limiter)
 redis_usage_cache: RedisCache | None = None  # redis cache used for tracking spend, tpm/rpm limits
 polling_via_cache_enabled: Literal["all"] | list[str] | bool = False
@@ -4741,6 +4744,63 @@ class ProxyConfig:
         )
         return coordination_redis_cache
 
+    @staticmethod
+    async def _init_coordination_redis_env_fallback(litellm_settings: Mapping[str, object]) -> RedisCache | None:
+        """
+        Last-resort coordination Redis, tried after an explicit
+        `general_settings.coordination_redis` block and `litellm_settings.cache`
+        have both had a chance to resolve one. Without this, a deployment that
+        only exports REDIS_HOST/REDIS_PORT (no cache block, no coordination_redis
+        block) gets NO cross-pod coordination at all: spend counters, budget-window
+        enforcement, and the reset_spend cache-eviction broadcast all silently stay
+        per-pod local, so a key reset on one pod never clears another pod's stale
+        enforcement.
+
+        Unlike the explicit block and cache-backend paths (a deliberate opt-in, so a
+        bad connection target or a malformed REDIS_CLUSTER_NODES/REDIS_SENTINEL_NODES
+        value should fail loudly), this one is inferred from bare env vars that may be
+        set for an unrelated reason -- e.g. a REDIS_HOST left over from a different
+        job/service, or a REDIS_CLUSTER_NODES value nothing here ever asked to be
+        parsed. Wrongly guessing "coordination available" must not turn a previously
+        harmless in-memory-only proxy into one that fails to boot or raises on every
+        cache write, so a malformed value or a failed/slow ping are both treated the
+        same as no REDIS_* vars at all.
+        """
+        try:
+            env_coordination_redis_cache: Final = _build_redis_usage_cache_from_environment()
+        except Exception as e:  # noqa: BLE001  # a malformed inferred Redis env var must not block startup
+            verbose_proxy_logger.warning(
+                "coordination_redis: could not build a Redis client from REDIS_* environment variables "
+                "(%s); cross-pod coordination stays in-memory. Set general_settings.coordination_redis "
+                "explicitly to require it.",
+                e,
+            )
+            return None
+        if env_coordination_redis_cache is None:
+            return None
+        try:
+            reachable: Final = await asyncio.wait_for(env_coordination_redis_cache.ping(), timeout=2.0)
+        except Exception as e:  # noqa: BLE001  # an unreachable inferred Redis must not block startup or writes
+            verbose_proxy_logger.warning(
+                "coordination_redis: REDIS_* environment variables named a Redis that is not reachable "
+                "(%s); cross-pod coordination stays in-memory. Set general_settings.coordination_redis "
+                "explicitly to require it.",
+                e,
+            )
+            return None
+        if not reachable:
+            return None
+        _attach_redis_usage_cache(
+            env_coordination_redis_cache,
+            enable_redis_auth_cache=litellm_settings.get("enable_redis_auth_cache", False) is True,
+        )
+        verbose_proxy_logger.info(
+            "coordination_redis: using a standalone Redis built from REDIS_* "
+            "environment variables for usage tracking, rate limiting, and "
+            "cross-pod coordination."
+        )
+        return env_coordination_redis_cache
+
     def _init_cache(
         self,
         cache_params: dict,
@@ -5409,6 +5469,13 @@ class ProxyConfig:
                         reset_audit_log_callback_cache()
                         _in_memory_loggers[:] = [cb for cb in _in_memory_loggers if not isinstance(cb, S3V2Logger)]
 
+        if redis_usage_cache is None:
+            env_coordination_redis_cache: Final = await self._init_coordination_redis_env_fallback(
+                litellm_settings=litellm_settings
+            )
+            if env_coordination_redis_cache is not None:
+                _set_redis_usage_cache(env_coordination_redis_cache)
+
         ## GENERAL SERVER SETTINGS (e.g. master key,..) # do this after initializing litellm, to ensure sentry logging works for proxylogging
         general_settings = config.get("general_settings", {})
         if general_settings is None:
@@ -5713,13 +5780,9 @@ class ProxyConfig:
         router_settings: Final = config.get("router_settings", None)
 
         if router_settings and isinstance(router_settings, dict):
-            # model list and search_tools already set
-            exclude_args: Final = {
-                "model_list",
-                "search_tools",
-            }
-
-            available_args: Final = [x for x in litellm.Router.get_valid_args() if x not in exclude_args]
+            available_args: Final = [
+                x for x in litellm.Router.get_valid_args() if x not in ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG
+            ]
 
             for k, v in router_settings.items():
                 if k in available_args:
@@ -6646,6 +6709,12 @@ class ProxyConfig:
         if "max_batch_file_size_mb" not in self._yaml_general_settings_keys:
             general_settings["max_batch_file_size_mb"] = _general_settings.get("max_batch_file_size_mb")
 
+        if "max_file_size_mb" not in self._yaml_general_settings_keys:
+            general_settings["max_file_size_mb"] = _general_settings.get("max_file_size_mb")
+
+        if "blocked_file_extensions" not in self._yaml_general_settings_keys:
+            general_settings["blocked_file_extensions"] = _general_settings.get("blocked_file_extensions")
+
         ## ALERTING ARGS ##
         if "alerting_args" in _general_settings:
             general_settings["alerting_args"] = _general_settings["alerting_args"]
@@ -15238,6 +15307,7 @@ async def login(request: Request):
         password=password,
         master_key=master_key,
         prisma_client=prisma_client,
+        general_settings=general_settings,
     )
 
     # Create UI token object
@@ -15312,6 +15382,7 @@ async def login_v2(request: Request):
             password=password,
             master_key=master_key,
             prisma_client=prisma_client,
+            general_settings=general_settings,
         )
 
         returned_ui_token_object: Final = create_ui_token_object(
@@ -15382,6 +15453,7 @@ async def login_v3(request: Request):
             password=password,
             master_key=master_key,
             prisma_client=prisma_client,
+            general_settings=general_settings,
         )
 
         returned_ui_token_object: Final = create_ui_token_object(
@@ -15751,6 +15823,7 @@ async def claim_onboarding_link(data: InvitationClaim, request: Request):
             detail={"error": "Invalid onboarding session for invitation link."},
         )
 
+    validate_password_policy(data.password, general_settings)
     hashed_pw: Final = hash_password(data.password)
     current_time = litellm.utils.get_utc_datetime()
     async with prisma_client.db.tx() as tx:
@@ -16218,6 +16291,7 @@ async def invitation_delete(
 )
 async def update_config(
     config_info: ConfigYAML,
+    request: Request,
     user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
 ):
     """
@@ -16233,6 +16307,26 @@ async def update_config(
         if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
             raise HTTPException(status_code=403, detail="Only proxy admins can update config")
 
+        request_body: Final[Mapping[str, JsonValue]] = TypeAdapter(Mapping[str, JsonValue]).validate_python(
+            await request.json()
+        )
+        raw_router_settings: Final = request_body.get("router_settings")
+        if isinstance(raw_router_settings, dict):
+            supported_router_settings: Final = RUNTIME_UPDATABLE_ROUTER_SETTINGS | (
+                frozenset(litellm.Router.get_valid_args()) - ROUTER_SETTINGS_MANAGED_OUTSIDE_CONFIG
+            )
+            unsupported_router_settings: Final = sorted(set(raw_router_settings) - supported_router_settings)
+            if unsupported_router_settings:
+                raise HTTPException(
+                    status_code=400,
+                    detail={
+                        "error": (
+                            f"Unsupported router settings: {', '.join(unsupported_router_settings)} "
+                            "are not valid router settings"
+                        )
+                    },
+                )
+
         if prisma_client is None:
             raise Exception("No DB Connected")
 
@@ -16334,11 +16428,19 @@ async def update_config(
             )
 
         # router_settings: merge existing + request, request wins.
-        if config_info.router_settings is not None:
+        if isinstance(raw_router_settings, dict):
             existing = await _read_section("router_settings")
             before_router_settings: Final = copy.deepcopy(existing)
-            updates = config_info.router_settings.dict(exclude_none=True)
-            new_router_settings: Final = {**existing, **updates}
+            typed_router_settings: Final = (
+                config_info.router_settings.dict(exclude_none=True) if config_info.router_settings is not None else {}
+            )
+            raw_router_settings_without_none: Final = {
+                key: value
+                for key, value in raw_router_settings.items()
+                if key not in typed_router_settings and value is not None
+            }
+            router_settings_updates: Final = {**typed_router_settings, **raw_router_settings_without_none}
+            new_router_settings: Final = {**existing, **router_settings_updates}
             await _upsert_section("router_settings", new_router_settings)
             asyncio.create_task(
                 create_config_audit_log(
@@ -16385,6 +16487,8 @@ _GENERAL_SETTINGS_CONFIG_LIST_FIELD_TYPES: Final[Mapping[str, str]] = MappingPro
         "global_max_parallel_requests": "Integer",
         "max_request_size_mb": "Integer",
         "max_batch_file_size_mb": "Integer",
+        "max_file_size_mb": "Integer",
+        "blocked_file_extensions": "List",
         "max_response_size_mb": "Integer",
         "proxy_config_reload_interval_seconds": "Integer",
         "pass_through_endpoints": "PydanticModel",
diff --git a/litellm/proxy/public_endpoints/agent_create_fields.json b/litellm/proxy/public_endpoints/agent_create_fields.json
index 36484cc1065..cc2fc17d759 100644
--- a/litellm/proxy/public_endpoints/agent_create_fields.json
+++ b/litellm/proxy/public_endpoints/agent_create_fields.json
@@ -107,7 +107,9 @@
         "required": true,
         "field_type": "text",
         "default_value": null,
-        "include_in_litellm_params": false
+        "include_in_litellm_params": false,
+        "validation_pattern": "^arn:aws[a-zA-Z0-9-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:runtime/.+$",
+        "validation_message": "Enter the complete Bedrock AgentCore runtime ARN, including the runtime ID after \"runtime/\" (e.g. arn:aws:bedrock-agentcore:us-west-2:123456789012:runtime/my-agent-runtime)."
       }
     ],
     "litellm_params_template": {
diff --git a/litellm/proxy/rag_endpoints/endpoints.py b/litellm/proxy/rag_endpoints/endpoints.py
index db574f859b3..0ab7d99e4e4 100644
--- a/litellm/proxy/rag_endpoints/endpoints.py
+++ b/litellm/proxy/rag_endpoints/endpoints.py
@@ -9,6 +9,7 @@ Provides:
 import base64
 import json
 from collections.abc import Mapping
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final
 
 import orjson
@@ -19,6 +20,9 @@ from starlette.datastructures import UploadFile
 import litellm
 from litellm._logging import verbose_proxy_logger
 from litellm.constants import DEFAULT_MAX_RECURSE_DEPTH
+from litellm.integrations.vector_store_integrations.vector_store_pre_call_hook import (
+    LiteLLM_ManagedVectorStore,
+)
 from litellm.litellm_core_utils.streaming_handler import CustomStreamWrapper
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_utils import is_request_body_safe
@@ -36,6 +40,10 @@ from litellm.proxy.rag_endpoints.upload_security import (
     RejectedUpload,
     validate_upload,
 )
+from litellm.proxy.vector_store_endpoints.endpoints import (
+    build_request_data_from_managed_vector_store,
+    reject_caller_embedding_selection_params,
+)
 from litellm.proxy.vector_store_endpoints.utils import (
     assert_user_can_access_vector_store_id,
 )
@@ -120,12 +128,21 @@ def _collect_vector_store_ids_from_payload(payload: object) -> set[str]:
 async def _authorize_nested_vector_store_ids(
     payload: object,
     user_api_key_dict: UserAPIKeyAuth,
-) -> None:
-    for vector_store_id in sorted(_collect_vector_store_ids_from_payload(payload)):
-        await assert_user_can_access_vector_store_id(
-            vector_store_id=vector_store_id,
-            user_api_key_dict=user_api_key_dict,
-        )
+) -> Mapping[str, LiteLLM_ManagedVectorStore]:
+    """Authorize every nested vector store id and return the managed stores it resolved."""
+    return MappingProxyType(
+        {
+            vector_store_id: store
+            for vector_store_id in sorted(_collect_vector_store_ids_from_payload(payload))
+            if (
+                store := await assert_user_can_access_vector_store_id(
+                    vector_store_id=vector_store_id,
+                    user_api_key_dict=user_api_key_dict,
+                )
+            )
+            is not None
+        }
+    )
 
 
 def _build_file_metadata_entry(
@@ -700,11 +717,27 @@ async def rag_query(
                 status_code=400,
                 detail={"error": "retrieval_config must contain 'vector_store_id'"},
             )
-        await _authorize_nested_vector_store_ids(
+        reject_caller_embedding_selection_params(payload=retrieval_config, source="retrieval_config")
+        resolved_stores: Final = await _authorize_nested_vector_store_ids(
             payload=retrieval_config,
             user_api_key_dict=user_api_key_dict,
         )
 
+        # Merge litellm-managed vector store params (provider, region, embedding
+        # model, credentials, ...) from the registry: the same source the direct
+        # /vector_stores/{id}/search endpoint uses. Store-managed keys win on
+        # conflict so callers cannot override the store's provider or credentials.
+        managed_store: Final = resolved_stores.get(retrieval_config["vector_store_id"])
+        store_data: Final = (
+            await build_request_data_from_managed_vector_store(managed_store)
+            if managed_store is not None
+            else MappingProxyType({})
+        )
+        merged_retrieval_config: Final = {
+            **retrieval_config,
+            **store_data,
+        }  # mutable-ok: litellm.aquery requires a plain dict payload
+
         # Add litellm data
         request_data: dict[str, object] = {}
         request_data = await add_litellm_data_to_request(
@@ -716,13 +749,18 @@ async def rag_query(
             proxy_config=proxy_config,
         )
 
-        verbose_proxy_logger.debug("RAG Query - model: %s, retrieval_config: %s", model, retrieval_config)
+        verbose_proxy_logger.debug(
+            "RAG Query - model: %s, vector_store_id: %s, custom_llm_provider: %s",
+            model,
+            retrieval_config["vector_store_id"],
+            merged_retrieval_config.get("custom_llm_provider"),
+        )
 
         # Call query
         response: Final = await litellm.aquery(
             model=model,
             messages=messages,
-            retrieval_config=retrieval_config,
+            retrieval_config=merged_retrieval_config,
             rerank=rerank,
             stream=stream,
             router=llm_router,
diff --git a/litellm/proxy/spend_tracking/spend_management_endpoints.py b/litellm/proxy/spend_tracking/spend_management_endpoints.py
index e26e7596e4d..a1f259861e3 100644
--- a/litellm/proxy/spend_tracking/spend_management_endpoints.py
+++ b/litellm/proxy/spend_tracking/spend_management_endpoints.py
@@ -1230,7 +1230,10 @@ async def get_global_spend_report(
     ),
     api_key: str | None = fastapi.Query(
         default=None,
-        description="View spend for a specific api_key. Example api_key='sk-1234",
+        description=(
+            "View spend for a specific api_key. Pass the key's sha256 hash so the raw key stays "
+            "out of URLs and access logs. Example api_key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa'"
+        ),
     ),
     internal_user_id: str | None = fastapi.Query(
         default=None,
@@ -1711,7 +1714,11 @@ async def get_key_spend_report(
     api_key: Annotated[
         str | None,
         fastapi.Query(
-            description="View spend for a specific api_key. Proxy admin only; other callers are scoped to their own key."
+            description=(
+                "View spend for a specific api_key. Proxy admin only; other callers are scoped to their "
+                "own key. Pass the key's sha256 hash so the raw key stays out of URLs and access logs. "
+                "Example api_key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa'"
+            )
         ),
     ] = None,
 ) -> Sequence[Mapping[str, object]]:
@@ -2994,7 +3001,7 @@ async def view_spend_logs(
 
     Example Request for specific api_key
     ```
-    curl -X GET "http://0.0.0.0:8000/spend/logs?api_key=sk-test-example-key-123" \
+    curl -X GET "http://0.0.0.0:8000/spend/logs?api_key=d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa" \
 -H "Authorization: Bearer sk-1234"
     ```
 
diff --git a/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py b/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
index 52258602581..c12d071dd36 100644
--- a/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
+++ b/litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
@@ -21,6 +21,7 @@ from typing_extensions import NotRequired, ReadOnly, TypedDict
 import litellm
 from litellm._logging import verbose_proxy_logger
 from litellm.litellm_core_utils.sensitive_data_masker import mask_sensitive_keys
+from litellm.proxy._experimental.mcp_server.tool_search import MCP_TOOL_SEARCH_SETTINGS_KEY
 from litellm.proxy._types import *
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.proxy.config_resolvers.sso import (
@@ -38,6 +39,7 @@ from litellm.repositories.table_repositories import (
     UISettingsRepository,
 )
 from litellm.repositories.team_repository import TeamRepository
+from litellm.types.mcp import MCPToolSearchSettings
 from litellm.types.proxy.management_endpoints.ui_sso import (
     DefaultTeamSSOParams,
     SSOConfig,
@@ -448,6 +450,10 @@ class MCPSemanticFilterSettingsResponse(SettingsResponse):
     """Response model for MCP semantic filter settings"""
 
 
+class MCPToolSearchSettingsResponse(SettingsResponse):
+    """Response model for native MCP tool search settings"""
+
+
 @router.get(
     "/get/allowed_ips",
     tags=["Budget & Spend Tracking"],
@@ -835,7 +841,7 @@ async def update_default_team_member_budget(teams: list[NewUserRequestTeam], use
 
 
 async def _update_litellm_setting(
-    settings: DefaultInternalUserParams | DefaultTeamSSOParams | MCPSemanticFilterSettings,
+    settings: DefaultInternalUserParams | DefaultTeamSSOParams | MCPSemanticFilterSettings | MCPToolSearchSettings,
     settings_key: str,
     success_message: str,
     user_api_key_dict: UserAPIKeyAuth,
@@ -861,7 +867,7 @@ async def _update_litellm_setting(
             detail={"error": "Set `'STORE_MODEL_IN_DB='True'` in your env to enable this feature."},
         )
 
-    in_memory_var: Final = settings.model_dump(exclude_none=True)
+    in_memory_var: Final = settings.model_dump(mode="json", exclude_none=True)
 
     # Load existing config first, then set in-memory value after,
     # because get_config() may overwrite litellm.<key> with stale DB values
@@ -1359,6 +1365,59 @@ async def update_mcp_semantic_filter_settings(
     return result
 
 
+@router.get(
+    "/get/mcp_tool_search_settings",
+    tags=["Settings"],  # mutable-ok: FastAPI's route decorator only accepts a list
+    dependencies=[Depends(user_api_key_auth)],  # mutable-ok: FastAPI's route decorator only accepts a list
+    response_model=MCPToolSearchSettingsResponse,
+)
+async def get_mcp_tool_search_settings(
+    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+) -> Mapping[str, object]:
+    """
+    Get the `litellm_settings.mcp_tool_search` configuration used by the native `mcp_tool_search` virtual tool.
+    """
+    from litellm.proxy.proxy_server import prisma_client, proxy_config
+
+    if prisma_client is None:
+        raise HTTPException(status_code=500, detail="Database not connected. Please connect a database.")
+
+    config: Final = await proxy_config.get_config()
+
+    return await _get_settings_with_schema(
+        settings_key=MCP_TOOL_SEARCH_SETTINGS_KEY,
+        settings_class=MCPToolSearchSettings,
+        config=config,
+    )
+
+
+@router.patch(
+    "/update/mcp_tool_search_settings",
+    tags=["Settings"],  # mutable-ok: FastAPI's route decorator only accepts a list
+    dependencies=[Depends(user_api_key_auth)],  # mutable-ok: FastAPI's route decorator only accepts a list
+)
+async def update_mcp_tool_search_settings(
+    settings: MCPToolSearchSettings,
+    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+) -> Mapping[str, object]:
+    """
+    Update `litellm_settings.mcp_tool_search` in the database.
+    Settings will be picked up by all pods within approximately 10 seconds via background polling.
+    """
+    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admins can update MCP tool search settings.",
+        )
+
+    return await _update_litellm_setting(
+        settings=settings,
+        settings_key=MCP_TOOL_SEARCH_SETTINGS_KEY,
+        success_message="MCP tool search settings updated successfully. Changes will be applied across all pods within 10 seconds.",
+        user_api_key_dict=user_api_key_dict,
+    )
+
+
 UI_SETTINGS_CACHE_KEY: Final = "ui_settings:settings_dict"
 UI_SETTINGS_CACHE_TTL: Final = 600  # 10 minutes
 
@@ -1594,7 +1653,10 @@ async def update_ui_settings(
     tags=["UI Theme Settings"],
     dependencies=[Depends(user_api_key_auth)],
 )
-async def upload_logo(file: UploadFile = File(...)):
+async def upload_logo(
+    file: UploadFile = File(...),
+    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
+):
     """
     Upload a custom logo for the admin UI.
     Accepts image files (PNG, JPG, JPEG, SVG) and stores them for use in the UI.
@@ -1602,6 +1664,12 @@ async def upload_logo(file: UploadFile = File(...)):
     import os
     from pathlib import Path
 
+    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admins can upload a UI logo.",
+        )
+
     # Validate file type
     allowed_extensions: Final = {".png", ".jpg", ".jpeg", ".svg"}
     file_extension: Final = Path(file.filename or "").suffix.lower()
@@ -1612,9 +1680,11 @@ async def upload_logo(file: UploadFile = File(...)):
             detail=f"Invalid file type. Allowed types: {', '.join(allowed_extensions)}",
         )
 
-    # Validate file size (max 5MB)
-    file_content: Final = await file.read()
-    if len(file_content) > 5 * 1024 * 1024:  # 5MB
+    # Read bounded to one byte past the limit, so an oversized upload is never
+    # fully buffered in memory before being rejected.
+    max_logo_size_bytes: Final = 5 * 1024 * 1024
+    file_content: Final = await file.read(max_logo_size_bytes + 1)
+    if len(file_content) > max_logo_size_bytes:
         raise HTTPException(status_code=400, detail="File size too large. Maximum size is 5MB.")
 
     # Create uploads directory if it doesn't exist
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index 051d36c4d0f..cab2bd6d9db 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -1524,6 +1524,7 @@ class ProxyLogging:
                 prompt_label=data.pop("prompt_label", None) or {},
                 prompt_version=data.pop("prompt_version", None) or {},
                 request_kwargs=data,
+                injected_for_every_deployment=True,
             )
 
             data.update(optional_params)
diff --git a/litellm/proxy/vector_store_endpoints/endpoints.py b/litellm/proxy/vector_store_endpoints/endpoints.py
index a59d7a277cc..7d64e648e08 100644
--- a/litellm/proxy/vector_store_endpoints/endpoints.py
+++ b/litellm/proxy/vector_store_endpoints/endpoints.py
@@ -1,3 +1,5 @@
+from collections.abc import Mapping
+from types import MappingProxyType
 from typing import (
     Annotated,
     Any,  # noqa: TID251  # jsonify_object in proxy/utils.py is annotated with a bare dict
@@ -27,11 +29,69 @@ from litellm.types.vector_stores import IndexCreateRequest, IndexListResponse
 from litellm.vector_stores.vector_store_registry import VectorStoreIndexRegistry
 
 router: Final = APIRouter()
+
+BLOCKED_QUERY_EMBEDDING_SELECTION_PARAMS: Final = frozenset(
+    {
+        "embedding_model",
+        "litellm_embedding_model",
+        "litellm_embedding_config",
+        "litellm_credential_name",
+    }
+)
+
+
+def reject_caller_embedding_selection_params(payload: Mapping[str, object], source: str) -> None:
+    blocked: Final = sorted(BLOCKED_QUERY_EMBEDDING_SELECTION_PARAMS & payload.keys())
+    if blocked:
+        raise HTTPException(
+            status_code=400,
+            detail={
+                "error": f"'{blocked[0]}' cannot be set in {source}. "
+                "Embedding configuration comes from the vector store's server-side registration."
+            },
+        )
+
+
 ########################################################
 # OpenAI Compatible Endpoints
 ########################################################
 
 
+async def build_request_data_from_managed_vector_store(
+    vector_store: LiteLLM_ManagedVectorStore,
+) -> Mapping[str, object]:
+    """
+    Build request params (provider, credential ref, litellm_params) from an
+    already-resolved managed vector store.
+
+    ``litellm_embedding_config`` is resolved here, at request-handling time,
+    instead of at row-creation time: the resolved api_key/api_base/api_version
+    lives only in the returned per-request mapping and is never persisted back
+    to the registry cache. Legacy rows that already carry a resolved
+    (cleartext) config skip the lookup and pass through unchanged.
+    """
+    top_level: Final = MappingProxyType(
+        {
+            key: vector_store.get(key)
+            for key in ("custom_llm_provider", "litellm_credential_name")
+            if key in vector_store
+        }
+    )
+    litellm_params: Final = vector_store.get("litellm_params") or MappingProxyType({})
+    embedding_model: Final = litellm_params.get("litellm_embedding_model")
+    if not embedding_model or litellm_params.get("litellm_embedding_config"):
+        return MappingProxyType({**top_level, **litellm_params})
+
+    from litellm.proxy.proxy_server import prisma_client
+
+    resolved_config: Final = await _resolve_embedding_config(
+        embedding_model=embedding_model, prisma_client=prisma_client
+    )
+    if not resolved_config:
+        return MappingProxyType({**top_level, **litellm_params})
+    return MappingProxyType({**top_level, **litellm_params, "litellm_embedding_config": resolved_config})
+
+
 async def _update_request_data_with_litellm_managed_vector_store_registry(
     data: dict,
     vector_store_id: str,
@@ -51,47 +111,14 @@ async def _update_request_data_with_litellm_managed_vector_store_registry(
     vector_store_to_run: Final[LiteLLM_ManagedVectorStore | None] = await get_litellm_managed_vector_store(
         vector_store_id=vector_store_id
     )
-    if vector_store_to_run is not None:
-        if user_api_key_dict is not None:
-            await assert_user_can_access_vector_store(
-                vector_store=vector_store_to_run,
-                user_api_key_dict=user_api_key_dict,
-            )
-
-        if "custom_llm_provider" in vector_store_to_run:
-            data["custom_llm_provider"] = vector_store_to_run.get("custom_llm_provider")
-
-        if "litellm_credential_name" in vector_store_to_run:
-            data["litellm_credential_name"] = vector_store_to_run.get("litellm_credential_name")
-
-        if "litellm_params" in vector_store_to_run:
-            litellm_params = vector_store_to_run.get("litellm_params", {}) or {}
-            # Resolve ``litellm_embedding_config`` here, at request-handling
-            # time, instead of at row-creation time. The resolved
-            # ``api_key`` / ``api_base`` / ``api_version`` lives only in
-            # this per-request ``data`` dict and is never persisted.
-            # Legacy rows that already carry a resolved (cleartext)
-            # ``litellm_embedding_config`` skip the lookup and pass through
-            # unchanged so the embed call keeps working.
-            embedding_model: Final = litellm_params.get("litellm_embedding_model")
-            if embedding_model and not litellm_params.get("litellm_embedding_config"):
-                from litellm.proxy.proxy_server import prisma_client
-
-                resolved_config: Final = await _resolve_embedding_config(
-                    embedding_model=embedding_model, prisma_client=prisma_client
-                )
-                if resolved_config:
-                    # Build a fresh dict via spread instead of mutating
-                    # ``litellm_params`` in place — the registry hands back
-                    # a reference to its cached object, so an in-place
-                    # update would persist the resolved cleartext into the
-                    # in-memory cache for the lifetime of the process.
-                    litellm_params = {
-                        **litellm_params,
-                        "litellm_embedding_config": resolved_config,
-                    }
-            data.update(litellm_params)
-    return data
+    if vector_store_to_run is None:
+        return data
+    if user_api_key_dict is not None:
+        await assert_user_can_access_vector_store(
+            vector_store=vector_store_to_run,
+            user_api_key_dict=user_api_key_dict,
+        )
+    return {**data, **(await build_request_data_from_managed_vector_store(vector_store_to_run))}
 
 
 @router.post(
@@ -130,6 +157,7 @@ async def vector_store_search(
     )
 
     data = await _read_request_body(request=request)
+    reject_caller_embedding_selection_params(payload=data, source="the search request body")
     data["vector_store_id"] = vector_store_id
 
     # Check for legacy vector store registry (non-managed vector stores)
diff --git a/litellm/proxy/vector_store_endpoints/management_endpoints.py b/litellm/proxy/vector_store_endpoints/management_endpoints.py
index 183a03cc13c..244798ba05e 100644
--- a/litellm/proxy/vector_store_endpoints/management_endpoints.py
+++ b/litellm/proxy/vector_store_endpoints/management_endpoints.py
@@ -470,7 +470,7 @@ async def create_vector_store_in_db(
     # exposed every env-stored embedding-model credential on the
     # ``/vector_store/{new,info,update,list}`` responses. Keep the user's
     # raw ``litellm_embedding_model`` reference; resolution now happens in
-    # ``_update_request_data_with_litellm_managed_vector_store_registry``
+    # ``build_request_data_from_managed_vector_store``
     # at request-handling time so the cleartext config exists only in
     # per-request memory and never reaches the database.
     if litellm_params:
@@ -864,7 +864,7 @@ async def update_vector_store(
         # embedding-config auto-resolve previously persisted cleartext
         # credentials into the row; resolution now happens at request-
         # handling time in
-        # ``_update_request_data_with_litellm_managed_vector_store_registry``
+        # ``build_request_data_from_managed_vector_store``
         # so this row only ever stores the user-supplied
         # ``litellm_embedding_model`` reference.
         if "litellm_params" in update_data:
diff --git a/litellm/rag/main.py b/litellm/rag/main.py
index 7bc1a6a52a3..94bfc305a6a 100644
--- a/litellm/rag/main.py
+++ b/litellm/rag/main.py
@@ -14,6 +14,7 @@ import contextvars
 from collections.abc import Coroutine, Iterator
 from contextlib import contextmanager
 from functools import partial
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final
 
 import httpx
@@ -50,6 +51,21 @@ INGESTION_REGISTRY: Final[dict[str, type[BaseRAGIngestion]]] = {
     "vertex_ai": VertexAIRAGIngestion,
 }
 
+# Only these retrieval_config keys are forwarded to vector_stores.asearch as
+# provider-specific params. The explicit allowlist keeps caller-controlled
+# connection overrides (api_base, api_key, ...) away from the search call,
+# where they could redirect store credentials to an attacker-chosen host.
+_FORWARDABLE_RETRIEVAL_CONFIG_KEYS: Final = frozenset(
+    {
+        "aws_region_name",
+        "vector_bucket_name",
+        "embedding_model",
+        "litellm_embedding_model",
+        "litellm_embedding_config",
+        "litellm_credential_name",
+    }
+)
+
 
 def get_ingestion_class(provider: str) -> type[BaseRAGIngestion]:
     """
@@ -224,13 +240,20 @@ async def _execute_query_pipeline(
         raise ValueError("No query found in messages for RAG query")
 
     # 2. Search vector store
+    # Forward allowlisted provider retrieval_config extras (region, embedding
+    # model, bucket, credential refs) to the search call; kwargs win on conflict.
+    provider_search_params: Final = MappingProxyType(
+        {k: v for k, v in retrieval_config.items() if k in _FORWARDABLE_RETRIEVAL_CONFIG_KEYS}
+    )
+    forwarded_search_params: Final = MappingProxyType({**provider_search_params, **kwargs})
     with _suppressed_sub_call_billing():
         search_response: Final = await litellm.vector_stores.asearch(
             vector_store_id=retrieval_config["vector_store_id"],
             query=query_text,
             max_num_results=retrieval_config.get("top_k", 10),
             custom_llm_provider=retrieval_config.get("custom_llm_provider", "openai"),
-            **kwargs,
+            router=router,
+            **forwarded_search_params,
         )
 
     search_provider: Final = retrieval_config.get("custom_llm_provider", "openai")
diff --git a/litellm/router.py b/litellm/router.py
index 3068433b9c3..9353e391e76 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -30,7 +30,7 @@ import anyio
 import httpx
 import openai
 from openai import AsyncOpenAI
-from pydantic import BaseModel
+from pydantic import BaseModel, TypeAdapter, ValidationError
 from typing_extensions import overload
 
 import litellm
@@ -50,6 +50,7 @@ from litellm.constants import (
     DEFAULT_HEALTH_CHECK_INTERVAL,
     DEFAULT_HEALTH_CHECK_STALENESS_MULTIPLIER,
     DEFAULT_MAX_LRU_CACHE_SIZE,
+    RUNTIME_UPDATABLE_ROUTER_SETTINGS,
     SESSION_DEPLOYMENT_AFFINITY_TTL_METADATA_KEY,
 )
 from litellm.integrations.custom_logger import CustomLogger
@@ -354,6 +355,13 @@ _PreRoutingStrategyT = TypeVar("_PreRoutingStrategyT")
 _ALIAS_PARAMS_NEVER_FORWARDED: Final = frozenset({"model", "api_base", "api_key", "api_version"})
 _ALIAS_MARKER_FORWARDED_PARAMS_KWARG: Final = "_alias_marker_forwarded_params"
 
+_RUNTIME_TOGGLEABLE_PRE_CALL_CHECKS: Final[Mapping[str, type[CustomLogger]]] = MappingProxyType(
+    {
+        "prompt_caching": PromptCachingDeploymentCheck,
+        "enforce_model_rate_limits": ModelRateLimitingCheck,
+    }
+)
+
 
 def _stream_chunks_have_generated_content(chunks: Sequence[ModelResponseStream]) -> bool:
     for chunk in chunks:
@@ -375,6 +383,28 @@ def _stream_chunks_have_generated_content(chunks: Sequence[ModelResponseStream])
     return False
 
 
+_NO_SESSION_KWARGS: Final[Mapping[str, Mapping[str, object]]] = MappingProxyType({})
+_SESSION_ADAPTER: Final = TypeAdapter(Mapping[str, object])
+
+
+def _with_router_resolved_session_model(session: object, model_name: str) -> Mapping[str, Mapping[str, object]]:
+    """
+    Realtime client-secret requests carry the model inside ``session`` as well, and the caller's copy of it still
+    holds the pre-routing model group name, so it has to follow the deployment the router just picked.
+
+    Returns kwargs to merge into the downstream call, empty when there is no session model to resolve.
+    """
+    try:
+        typed_session: Final = _SESSION_ADAPTER.validate_python(session)
+    except ValidationError:
+        return _NO_SESSION_KWARGS
+    if "model" not in typed_session:
+        return _NO_SESSION_KWARGS
+    return MappingProxyType(
+        {"session": {**typed_session, "model": model_name}}  # mutable-ok: callees deepcopy and JSON-dump session
+    )
+
+
 # Router._aanthropic_messages_streaming_iterator buffers lifecycle chunks
 # until real content commits the primary stream; a hostile or slow-starting
 # upstream that never emits content or an error could otherwise grow that
@@ -2072,11 +2102,39 @@ class Router:
             if _callback is None:
                 continue
 
+            if self.optional_callbacks is not None and any(
+                isinstance(callback, type(_callback)) for callback in self.optional_callbacks
+            ):
+                continue
             if self.optional_callbacks is None:
                 self.optional_callbacks = []
             self.optional_callbacks.append(_callback)
             litellm.logging_callback_manager.add_litellm_callback(_callback)
 
+    def set_optional_pre_call_checks(self, optional_pre_call_checks: OptionalPreCallChecks | None) -> None:
+        if optional_pre_call_checks is None:
+            return
+        requested: Final = frozenset(optional_pre_call_checks)
+        for name, callback_cls in _RUNTIME_TOGGLEABLE_PRE_CALL_CHECKS.items():
+            if name not in requested:
+                self._remove_optional_callbacks_of_type(callback_cls)
+        self.add_optional_pre_call_checks(optional_pre_call_checks)
+
+    def _remove_optional_callbacks_of_type(self, callback_cls: type[CustomLogger]) -> None:
+        if self.optional_callbacks is None or not any(type(cb) is callback_cls for cb in self.optional_callbacks):
+            return
+        self.optional_callbacks = [cb for cb in self.optional_callbacks if type(cb) is not callback_cls]
+        if any(
+            router is not self and any(type(cb) is callback_cls for cb in (router.optional_callbacks or []))
+            for router in tuple(_live_routers)
+        ):
+            return
+        for cb in tuple(litellm.callbacks):
+            if type(cb) is callback_cls:
+                litellm.logging_callback_manager.remove_callback_from_list_by_object(
+                    litellm.callbacks, cb, require_self=False
+                )
+
     def print_deployment(self, deployment: dict):
         """
         returns a copy of the deployment with the api key masked
@@ -2324,7 +2382,7 @@ class Router:
     @overload
     async def acompletion(
         self, model: str, messages: list[AllMessageValues], stream: Literal[True, False] = False, **kwargs
-    ) -> CustomStreamWrapper | ModelResponse: 
+    ) -> CustomStreamWrapper | ModelResponse:
         ...
 
     # fmt: on
@@ -4007,6 +4065,7 @@ class Router:
             prompt_variables=prompt_variables,
             prompt_label=prompt_label,
             request_kwargs=kwargs,
+            injected_for_every_deployment=True,
         )
 
         # Filter out prompt management specific parameters from data before merging
@@ -4894,6 +4953,7 @@ class Router:
                 "caching": self.cache_responses,
                 **kwargs,
                 "model": model_name,
+                **_with_router_resolved_session_model(kwargs.get("session"), model_name),
             }
             # Only set custom_llm_provider if it's not None
             if custom_llm_provider is not None:
@@ -6374,8 +6434,6 @@ class Router:
             "responses",
             "generate_content",
             "generate_content_stream",
-            "vector_store_search",
-            "vector_store_create",
             "ocr",
             "search",
             "video_generation",
@@ -6399,6 +6457,8 @@ class Router:
             return sync_wrapper
 
         if call_type in (
+            "vector_store_search",
+            "vector_store_create",
             "vector_store_retrieve",
             "vector_store_list",
             "vector_store_update",
@@ -6410,11 +6470,16 @@ class Router:
                 client: object | None = None,
                 **kwargs,
             ):
-                if custom_llm_provider and "custom_llm_provider" not in kwargs:
-                    kwargs["custom_llm_provider"] = custom_llm_provider
-                if kwargs.get("model"):
-                    return self._generic_api_call_with_fallbacks(original_function=original_function, **kwargs)
-                return original_function(**kwargs)
+                provider_kwargs: Final = (
+                    MappingProxyType({**kwargs, "custom_llm_provider": custom_llm_provider})
+                    if custom_llm_provider and "custom_llm_provider" not in kwargs
+                    else MappingProxyType(kwargs)
+                )
+                if provider_kwargs.get("model"):
+                    return self._generic_api_call_with_fallbacks(original_function=original_function, **provider_kwargs)
+                if call_type == "vector_store_search":
+                    return original_function(**MappingProxyType({**provider_kwargs, "router": self}))
+                return original_function(**provider_kwargs)
 
             return vector_store_sync_wrapper
 
@@ -6590,6 +6655,7 @@ class Router:
                 return await self._init_vector_store_api_endpoints(
                     original_function=original_function,
                     custom_llm_provider=custom_llm_provider,
+                    call_type=call_type,
                     **kwargs,
                 )
             elif call_type in ("afile_delete", "afile_content"):
@@ -6630,6 +6696,7 @@ class Router:
         self,
         original_function: Callable,
         custom_llm_provider: str | None = None,
+        call_type: str | None = None,
         **kwargs,
     ):
         """
@@ -6648,6 +6715,13 @@ class Router:
                 **kwargs,
             )
 
+        # For search, pass the router so provider transforms can resolve
+        # router-managed embedding models (e.g. S3 Vectors query embeddings).
+        # The merge also overrides any client-supplied `router` key.
+        if call_type == "avector_store_search":
+            search_kwargs: Final = MappingProxyType({**kwargs, "router": self})
+            return await original_function(**search_kwargs)
+
         # Otherwise, call the original function directly
         return await original_function(**kwargs)
 
@@ -6664,7 +6738,10 @@ class Router:
         metadata. When present, decode the ID, replace ``container_id`` with the
         upstream value, and route through ``_ageneric_api_call_with_fallbacks`` so
         deployment credentials (e.g. regional ``api_base`` for Azure) match
-        :meth:`_init_responses_api_endpoints`. Otherwise call the handler directly.
+        :meth:`_init_responses_api_endpoints`. Create/list calls carry no container ID, so
+        they route through the deployment named by ``model`` when the caller passes one,
+        falling back to the direct call when no deployment matches. Otherwise call the
+        handler directly with global provider credentials.
         """
         if custom_llm_provider and "custom_llm_provider" not in kwargs:
             kwargs["custom_llm_provider"] = custom_llm_provider
@@ -6696,6 +6773,14 @@ class Router:
                     **kwargs,
                 )
 
+        requested_model: Final = kwargs.get("model")
+        if isinstance(requested_model, str) and requested_model.strip():
+            return await self._ageneric_api_call_with_fallbacks(
+                original_function=original_function,
+                passthrough_on_no_deployment=True,
+                **kwargs,
+            )
+
         return await original_function(**kwargs)
 
     async def _init_responses_api_endpoints(
@@ -11351,27 +11436,6 @@ class Router:
         """
         Update the router settings.
         """
-        # only the following settings are allowed to be configured
-        _allowed_settings: Final = [
-            "routing_strategy_args",
-            "routing_strategy",
-            "routing_groups",
-            "allowed_fails",
-            "cooldown_time",
-            "num_retries",
-            "timeout",
-            "max_retries",
-            "retry_after",
-            "fallbacks",
-            "context_window_fallbacks",
-            "retry_policy",
-            "model_group_retry_policy",
-            "model_group_alias",
-            "enable_weighted_failover",
-            "enable_tag_filtering",
-            "tag_routing_prefix",
-        ]
-
         _int_settings: Final = [
             "timeout",
             "num_retries",
@@ -11384,13 +11448,15 @@ class Router:
         rebuild_routing_groups = False
         relink_lar1_from_args = False
         for var in kwargs:
-            if var in _allowed_settings:
+            if var in RUNTIME_UPDATABLE_ROUTER_SETTINGS:
                 if var in _int_settings:
                     _casted_value = int(kwargs[var])
                     setattr(self, var, _casted_value)
                 elif var == "routing_groups":
                     self._routing_groups_input = kwargs[var]
                     rebuild_routing_groups = True
+                elif var == "optional_pre_call_checks":
+                    self.set_optional_pre_call_checks(kwargs[var])
                 elif var == "retry_policy":
                     value = kwargs[var]
                     if isinstance(value, dict):
diff --git a/litellm/types/mcp.py b/litellm/types/mcp.py
index 1b8baf2da09..a59fcb1bcb5 100644
--- a/litellm/types/mcp.py
+++ b/litellm/types/mcp.py
@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING, Any, Final, Literal
 from urllib.parse import urlsplit
 
 import httpx
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict, Field
 from typing_extensions import TypedDict
 
 from litellm.types.llms.base import HiddenParams
@@ -91,6 +91,33 @@ class MCPPublicServer(BaseModel):
     mcp_info: dict[str, Any] | None = None
 
 
+class MCPToolSearchSettings(BaseModel):
+    """`litellm_settings.mcp_tool_search`: how the native `mcp_tool_search` virtual tool ranks the caller's tools."""
+
+    model_config = ConfigDict(frozen=True)
+
+    embedding_model: str | None = Field(
+        default=None,
+        description="Embedding model from model_list used to rank tools by meaning. Unset keeps keyword matching.",
+    )
+    top_k: int = Field(
+        default=5,
+        ge=1,
+        le=100,
+        description="Most ranked tools a search returns. A smaller top_k in the tool call wins. Core tools do not count.",
+    )
+    similarity_threshold: float = Field(
+        default=0.0,
+        ge=0.0,
+        le=1.0,
+        description="Lowest cosine similarity a tool needs to appear in semantic results (0.0 = no cutoff).",
+    )
+    core_tools: tuple[str, ...] = Field(
+        default=(),
+        description="Tool names always returned first when the caller can access them, e.g. `my_server-get_rates`.",
+    )
+
+
 # OAuth 2.0 token-endpoint client authentication method (RFC 6749 section 2.3.1).
 MCPTokenEndpointAuthMethod = Literal["client_secret_basic", "client_secret_post"]
 
diff --git a/litellm/types/proxy/public_endpoints/public_endpoints.py b/litellm/types/proxy/public_endpoints/public_endpoints.py
index f6ee054ceaa..c7f80a61e0f 100644
--- a/litellm/types/proxy/public_endpoints/public_endpoints.py
+++ b/litellm/types/proxy/public_endpoints/public_endpoints.py
@@ -43,6 +43,8 @@ class AgentCredentialField(BaseModel):
     options: list[str] | None = None
     default_value: str | None = None
     include_in_litellm_params: bool | None = None
+    validation_pattern: str | None = None
+    validation_message: str | None = None
 
 
 class AgentCreateInfo(BaseModel):
diff --git a/litellm/types/router.py b/litellm/types/router.py
index e0957383aac..2a5f264cee3 100644
--- a/litellm/types/router.py
+++ b/litellm/types/router.py
@@ -106,6 +106,20 @@ class RetryPolicy(BaseModel):
     InternalServerErrorRetries: int | None = None
 
 
+OptionalPreCallChecks = list[
+    Literal[
+        "prompt_caching",
+        "router_budget_limiting",
+        "responses_api_deployment_check",
+        "deployment_affinity",
+        "session_affinity",
+        "forward_client_headers_by_model_group",
+        "enforce_model_rate_limits",
+        "encrypted_content_affinity",
+    ]
+]
+
+
 class UpdateRouterConfig(BaseModel):
     """
     Set of params that you can modify via `router.update_settings()`.
@@ -128,6 +142,7 @@ class UpdateRouterConfig(BaseModel):
     model_group_alias: dict[str, str | dict] | None = {}
     enable_tag_filtering: bool | None = None
     tag_routing_prefix: str | None = None
+    optional_pre_call_checks: OptionalPreCallChecks | None = None
 
     model_config = ConfigDict(protected_namespaces=())
 
@@ -869,20 +884,6 @@ class FallbackAccessCheck(Protocol):
     async def __call__(self, *, model: str, request_kwargs: Mapping[str, object], llm_router: "Router") -> bool: ...
 
 
-OptionalPreCallChecks = list[
-    Literal[
-        "prompt_caching",
-        "router_budget_limiting",
-        "responses_api_deployment_check",
-        "deployment_affinity",
-        "session_affinity",
-        "forward_client_headers_by_model_group",
-        "enforce_model_rate_limits",
-        "encrypted_content_affinity",
-    ]
-]
-
-
 class LiteLLM_RouterFileObject(TypedDict, total=False):
     """
     Tracking the litellm params hash, used for mapping the file id to the right model
diff --git a/litellm/utils.py b/litellm/utils.py
index 252b6756937..ba456fc353b 100644
--- a/litellm/utils.py
+++ b/litellm/utils.py
@@ -5106,49 +5106,6 @@ def get_response_string(response_obj: ModelResponse | ModelResponseStream) -> st
     return "".join(response_parts)
 
 
-def get_api_key(llm_provider: str, dynamic_api_key: str | None):
-    api_key = dynamic_api_key or litellm.api_key
-    # openai
-    if llm_provider == "openai" or llm_provider == "text-completion-openai":
-        api_key = api_key or litellm.openai_key or get_secret("OPENAI_API_KEY")
-    # anthropic
-    elif llm_provider == "anthropic" or llm_provider == "anthropic_text":
-        api_key = api_key or litellm.anthropic_key or get_secret("ANTHROPIC_API_KEY")
-    # ai21
-    elif llm_provider == "ai21":
-        api_key = api_key or litellm.ai21_key or get_secret("AI21_API_KEY")
-    # aleph_alpha
-    elif llm_provider == "aleph_alpha":
-        api_key = api_key or litellm.aleph_alpha_key or get_secret("ALEPH_ALPHA_API_KEY")
-    # baseten
-    elif llm_provider == "baseten":
-        api_key = api_key or litellm.baseten_key or get_secret("BASETEN_API_KEY")
-    # cohere
-    elif llm_provider == "cohere" or llm_provider == "cohere_chat":
-        api_key = api_key or litellm.cohere_key or get_secret("COHERE_API_KEY")
-    # huggingface
-    elif llm_provider == "huggingface":
-        api_key = api_key or litellm.huggingface_key or get_secret("HUGGINGFACE_API_KEY")
-    # nlp_cloud
-    elif llm_provider == "nlp_cloud":
-        api_key = api_key or litellm.nlp_cloud_key or get_secret("NLP_CLOUD_API_KEY")
-    # replicate
-    elif llm_provider == "replicate":
-        api_key = api_key or litellm.replicate_key or get_secret("REPLICATE_API_KEY")
-    # together_ai
-    elif llm_provider == "together_ai":
-        api_key = (
-            api_key or litellm.togetherai_api_key or get_secret("TOGETHERAI_API_KEY") or get_secret("TOGETHER_AI_TOKEN")
-        )
-    # nebius
-    elif llm_provider == "nebius":
-        api_key = api_key or litellm.nebius_key or get_secret("NEBIUS_API_KEY")
-    # wandb
-    elif llm_provider == "wandb":
-        api_key = api_key or litellm.wandb_key or get_secret("WANDB_API_KEY")
-    return api_key
-
-
 def get_utc_datetime():
     import datetime as dt
     from datetime import datetime
diff --git a/litellm/vector_stores/main.py b/litellm/vector_stores/main.py
index 9b0ff71730a..cd576755f5f 100644
--- a/litellm/vector_stores/main.py
+++ b/litellm/vector_stores/main.py
@@ -7,7 +7,7 @@ import builtins
 import contextvars
 from collections.abc import Coroutine, Mapping
 from functools import partial
-from typing import Final
+from typing import TYPE_CHECKING, Final
 
 import httpx
 
@@ -29,6 +29,9 @@ from litellm.types.vector_stores import (
 from litellm.utils import ProviderConfigManager, client
 from litellm.vector_stores.utils import VectorStoreRequestUtils
 
+if TYPE_CHECKING:
+    from litellm.router import Router
+
 ####### ENVIRONMENT VARIABLES ###################
 # Initialize any necessary instances or variables here
 base_llm_http_handler = BaseLLMHTTPHandler()
@@ -280,6 +283,7 @@ async def asearch(
     timeout: float | httpx.Timeout | None = None,
     # LiteLLM specific params,
     custom_llm_provider: str | None = None,
+    router: "Router | None" = None,
     **kwargs,
 ) -> VectorStoreSearchResponse:
     """
@@ -308,6 +312,7 @@ async def asearch(
             extra_body=extra_body,
             timeout=timeout,
             custom_llm_provider=custom_llm_provider,
+            router=router,
             **kwargs,
         )
 
@@ -347,6 +352,7 @@ def search(
     timeout: float | httpx.Timeout | None = None,
     # LiteLLM specific params,
     custom_llm_provider: str | None = None,
+    router: "Router | None" = None,
     **kwargs,
 ) -> VectorStoreSearchResponse | Coroutine[object, object, VectorStoreSearchResponse]:
     """
@@ -450,6 +456,7 @@ def search(
             timeout=timeout or request_timeout,
             _is_async=_is_async,
             client=kwargs.get("client"),
+            router=router,
         )
 
         return response
diff --git a/model_prices_and_context_window.json b/model_prices_and_context_window.json
index 10e8b56d925..d8a8f84b032 100644
--- a/model_prices_and_context_window.json
+++ b/model_prices_and_context_window.json
@@ -10177,7 +10177,7 @@
         "cache_read_input_token_cost": 2.8e-08,
         "supports_prompt_caching": true
     },
-    "azure_ai/deepseek-v4-flash-0731": {
+    "azure_ai/DeepSeek-V4-Flash-0731": {
         "cache_read_input_token_cost": 1.4e-08,
         "deprecation_date": "2026-12-03",
         "input_cost_per_token": 4.4e-07,
@@ -33093,6 +33093,88 @@
         "supports_web_search": true,
         "supports_xhigh_reasoning_effort": true
     },
+    "meta/muse-spark-1.3": {
+        "cache_read_input_token_cost": 1.5e-07,
+        "input_cost_per_token": 1.25e-06,
+        "litellm_provider": "meta",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 131072,
+        "max_tokens": 131072,
+        "mode": "chat",
+        "output_cost_per_token": 4.25e-06,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.0025,
+            "search_context_size_low": 0.0025,
+            "search_context_size_medium": 0.0025
+        },
+        "source": "https://ai.developer.meta.com/docs/pricing-rate-limits",
+        "supported_endpoints": [
+            "/v1/chat/completions",
+            "/v1/responses",
+            "/v1/messages"
+        ],
+        "supported_modalities": [
+            "text",
+            "image",
+            "video"
+        ],
+        "supported_output_modalities": [
+            "text"
+        ],
+        "supports_function_calling": true,
+        "supports_minimal_reasoning_effort": true,
+        "supports_parallel_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_system_messages": true,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_web_search": true,
+        "supports_xhigh_reasoning_effort": true
+    },
+    "meta/muse-spark-1.3-contributor": {
+        "cache_read_input_token_cost": 2e-09,
+        "input_cost_per_token": 1e-07,
+        "litellm_provider": "meta",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 131072,
+        "max_tokens": 131072,
+        "mode": "chat",
+        "output_cost_per_token": 2e-07,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.0025,
+            "search_context_size_low": 0.0025,
+            "search_context_size_medium": 0.0025
+        },
+        "source": "https://ai.developer.meta.com/docs/pricing-rate-limits",
+        "supported_endpoints": [
+            "/v1/chat/completions",
+            "/v1/responses",
+            "/v1/messages"
+        ],
+        "supported_modalities": [
+            "text",
+            "image",
+            "video"
+        ],
+        "supported_output_modalities": [
+            "text"
+        ],
+        "supports_function_calling": true,
+        "supports_minimal_reasoning_effort": true,
+        "supports_parallel_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_system_messages": true,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_web_search": true,
+        "supports_xhigh_reasoning_effort": true
+    },
     "meta_llama/Llama-3.3-70B-Instruct": {
         "litellm_provider": "meta_llama",
         "max_input_tokens": 128000,
diff --git a/pyproject.toml b/pyproject.toml
index 2866e27e84c..60162544612 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -161,7 +161,7 @@ proxy-runtime = [
     "mangum>=0.17.0,<1.0",
     "azure-ai-contentsafety>=1.0.0,<2.0",
     "azure-storage-file-datalake>=12.20.0,<13.0",
-    "pypdf>=6.12.0,<7.0",
+    "pypdf>=6.16.1,<7.0",
     "llm-sandbox>=0.3.39,<1.0",
     "detect-secrets>=1.5.0,<2.0",
 ]
@@ -292,7 +292,7 @@ exclude = [
 
 [tool.uv]
 constraint-dependencies = [
-    "tornado>=6.5.6",
+    "tornado>=6.5.8",
     "aiohttp>=3.14.2,<4.0",
     "packaging>=24.0",
     "soupsieve>=2.8.4",
diff --git a/ruff-strict-budget.json b/ruff-strict-budget.json
index 9b1cc977a64..ae91b711e13 100644
--- a/ruff-strict-budget.json
+++ b/ruff-strict-budget.json
@@ -9,7 +9,7 @@
     "limit": 809
   },
   "ANN201": {
-    "limit": 2001
+    "limit": 2000
   },
   "ANN202": {
     "limit": 835
@@ -108,7 +108,7 @@
     "limit": 3
   },
   "F401": {
-    "limit": 13
+    "limit": 12
   },
   "LOG015": {
     "limit": 5
@@ -147,7 +147,7 @@
     "limit": 3
   },
   "PLR1714": {
-    "limit": 256
+    "limit": 253
   },
   "PLW0127": {
     "limit": 57
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 00000000000..a1598ccbb34
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.98.0"
+profile = "minimal"
+components = ["rustfmt", "clippy"]
diff --git a/tests/code_coverage_tests/recursive_detector.py b/tests/code_coverage_tests/recursive_detector.py
index 790956156b0..0578dc60119 100644
--- a/tests/code_coverage_tests/recursive_detector.py
+++ b/tests/code_coverage_tests/recursive_detector.py
@@ -64,6 +64,8 @@ IGNORE_FUNCTIONS = [
     "_flatten_form_field",  # bounded by the nesting depth of the already-parsed request body (a finite JSON tree, no cycles possible).
     "_flatten_form_data_field",  # bounded by the nesting depth of the already-parsed request body (a finite JSON tree, no cycles possible).
     "_json_safe",  # max depth set (_MAX_DEPTH) plus a seen-ids cycle guard for self-referential input.
+    "_redact_agent_params_tree",  # max depth set (default 10), same shape as _redact_sensitive_litellm_params.
+    "_restore_redacted_nested_value",  # max depth set (default 10), mirrors _redact_agent_params_tree on the write side.
 ]
 
 
diff --git a/tests/proxy_migration_tests/test_prisma_toolchain.py b/tests/proxy_migration_tests/test_prisma_toolchain.py
index d12a2c4dd4e..733870f3239 100644
--- a/tests/proxy_migration_tests/test_prisma_toolchain.py
+++ b/tests/proxy_migration_tests/test_prisma_toolchain.py
@@ -7,26 +7,36 @@ attempt fails identically. These tests pin the two behaviours that keep a
 container recoverable: an incomplete cache is deleted before Prisma is
 invoked, and the install gets a budget of its own rather than sharing the one
 that bounds each migration command.
+
+``prisma migrate deploy`` gets a budget of its own for the same reason: its
+runtime grows with the number of pending migrations, so a fresh database that
+replays every migration overran the per-command budget on slow machines and
+the proxy gave up after four identical timeouts.
 """
 
 import ast
 import json
+import logging
 import os
 import sys
 import time
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
 
 from litellm_proxy_extras.prisma_toolchain import (
     DEFAULT_PRISMA_COMMAND_TIMEOUT,
+    DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT,
     PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR,
     PRISMA_COMMAND_TIMEOUT_ENV_VAR,
+    PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR,
     ensure_prisma_toolchain,
     heal_incomplete_nodeenv_cache,
     node_binary_path,
     prisma_bootstrap_timeout,
     prisma_command_timeout,
+    prisma_migrate_deploy_timeout,
 )
 from litellm_proxy_extras.utils import ProxyExtrasDBManager
 
@@ -42,14 +52,27 @@ import time
 
 args = sys.argv[1:]
 cache_dir = os.environ["PRISMA_NODEENV_CACHE_DIR"]
-with pathlib.Path(os.environ["FAKE_PRISMA_LOG"]).open("a") as log:
+log_path = pathlib.Path(os.environ["FAKE_PRISMA_LOG"])
+earlier_same_command = sum(
+    1
+    for line in (log_path.read_text().splitlines() if log_path.exists() else [])
+    if json.loads(line)["args"][:2] == args[:2]
+)
+with log_path.open("a") as log:
     log.write(
         json.dumps({{"args": args, "cache_dir_present": os.path.isdir(cache_dir)}})
         + "\\n"
     )
 time.sleep(float(os.environ.get("FAKE_PRISMA_SLEEP", "0")))
 if args[:2] == ["migrate", "deploy"]:
+    if earlier_same_command == 0:
+        time.sleep(float(os.environ.get("FAKE_PRISMA_FIRST_DEPLOY_SLEEP", "0")))
+    elif os.environ.get("FAKE_PRISMA_LATER_DEPLOY_STDERR"):
+        print(os.environ["FAKE_PRISMA_LATER_DEPLOY_STDERR"], file=sys.stderr)
+        sys.exit(1)
     print("No pending migrations to apply")
+if args[:2] == ["db", "push"] and earlier_same_command == 0:
+    time.sleep(float(os.environ.get("FAKE_PRISMA_FIRST_PUSH_SLEEP", "0")))
 sys.exit(0)
 """
 
@@ -80,9 +103,14 @@ def toolchain_env(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> tuple[Path
     monkeypatch.setenv("PATH", f"{bin_dir}{os.pathsep}{os.environ['PATH']}")
     monkeypatch.delenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, raising=False)
     monkeypatch.delenv(PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR, raising=False)
+    monkeypatch.delenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, raising=False)
     return cache_dir, log_path
 
 
+def _deploy_calls(log_path: Path) -> list[list[str]]:
+    return [call["args"] for call in _fake_prisma_calls(log_path) if call["args"][:2] == ["migrate", "deploy"]]
+
+
 def _make_incomplete_cache(cache_dir: Path) -> None:
     (cache_dir / "lib").mkdir(parents=True)
     (cache_dir / "bin").mkdir()
@@ -209,25 +237,111 @@ def test_setup_database_prepares_the_toolchain_before_migrating(
     assert calls[0]["cache_dir_present"] is False
 
 
+@pytest.mark.parametrize("use_v2_resolver", [False, True], ids=["v1", "v2"])
+def test_migrate_deploy_is_not_bounded_by_the_per_command_timeout(
+    toolchain_env: tuple[Path, Path],
+    monkeypatch: pytest.MonkeyPatch,
+    use_v2_resolver: bool,
+) -> None:
+    """A fresh database replays every migration, which takes longer than any bookkeeping command."""
+    _, log_path = toolchain_env
+    monkeypatch.setenv("DATABASE_URL", "postgresql://u:p@localhost:9/x")
+    monkeypatch.setenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, "1")
+    monkeypatch.setenv("FAKE_PRISMA_FIRST_DEPLOY_SLEEP", "3")
+
+    assert ProxyExtrasDBManager.setup_database(use_migrate=True, use_v2_resolver=use_v2_resolver) is True
+    assert _deploy_calls(log_path) == [["migrate", "deploy"]]
+
+
+def test_migrate_deploy_stops_at_its_own_timeout(
+    toolchain_env: tuple[Path, Path], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The deploy budget still bounds a deploy that hangs, so boot cannot wait forever."""
+    _, log_path = toolchain_env
+    monkeypatch.setenv("DATABASE_URL", "postgresql://u:p@localhost:9/x")
+    monkeypatch.setenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, "1")
+    monkeypatch.setenv("FAKE_PRISMA_FIRST_DEPLOY_SLEEP", "60")
+    monkeypatch.setenv("FAKE_PRISMA_LATER_DEPLOY_STDERR", "Error: P3018 permission denied for schema public")
+
+    started = time.monotonic()
+    with pytest.raises(RuntimeError, match="insufficient permissions"):
+        ProxyExtrasDBManager.setup_database(use_migrate=True, use_v2_resolver=True)
+    elapsed = time.monotonic() - started
+
+    assert len(_deploy_calls(log_path)) == 2
+    assert elapsed < 30
+
+
+def test_db_push_timeout_hint_names_the_per_command_budget(
+    toolchain_env: tuple[Path, Path], monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+) -> None:
+    """``db push`` keeps the per-command budget, so its timeout hint has to name that variable."""
+    _, log_path = toolchain_env
+    monkeypatch.setenv("DATABASE_URL", "postgresql://u:p@localhost:9/x")
+    monkeypatch.setenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, "1")
+    monkeypatch.setenv("FAKE_PRISMA_FIRST_PUSH_SLEEP", "3")
+
+    with caplog.at_level(logging.WARNING, logger="litellm_proxy_extras"):
+        assert ProxyExtrasDBManager.setup_database(use_migrate=False, use_v2_resolver=False) is True
+
+    assert [call["args"][:2] for call in _fake_prisma_calls(log_path)].count(["db", "push"]) == 2
+    assert [record.getMessage() for record in caplog.records if "timed out" in record.getMessage()] == [
+        f"Attempt 1 timed out. Raise {PRISMA_COMMAND_TIMEOUT_ENV_VAR} if this database needs longer to apply its schema."
+    ]
+
+
+@pytest.mark.parametrize(
+    ("command_timeout", "deploy_timeout", "expected"),
+    [
+        ("900", None, 900.0),
+        ("12", None, DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT),
+        ("900", "1200", 1200.0),
+        ("900", "300", 300.0),
+    ],
+    ids=["raised_command_budget_carries_over", "lowered_command_budget_does_not", "override_wins_upward", "override_wins_downward"],
+)
+def test_migrate_deploy_budget_keeps_a_raised_command_budget(
+    command_timeout: str, deploy_timeout: str | None, expected: float, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Deployments that raised the per-command budget to survive a long deploy keep that budget for deploy."""
+    monkeypatch.setenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, command_timeout)
+    if deploy_timeout is None:
+        monkeypatch.delenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, raising=False)
+    else:
+        monkeypatch.setenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, deploy_timeout)
+
+    assert prisma_migrate_deploy_timeout() == expected
+
+
 @pytest.mark.parametrize(
     "raw",
     ["", "0", "-5", "not-a-number", "nan", "inf", "-inf", "1e400"],
 )
+@pytest.mark.parametrize(
+    ("env_var", "read_timeout", "default"),
+    [
+        (PRISMA_COMMAND_TIMEOUT_ENV_VAR, prisma_command_timeout, DEFAULT_PRISMA_COMMAND_TIMEOUT),
+        (PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, prisma_migrate_deploy_timeout, DEFAULT_PRISMA_MIGRATE_DEPLOY_TIMEOUT),
+    ],
+    ids=["command", "migrate_deploy"],
+)
 def test_unusable_timeout_override_falls_back_to_the_default(
-    raw: str, monkeypatch: pytest.MonkeyPatch
+    raw: str, env_var: str, read_timeout: Callable[[], float], default: float, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     """A non-finite override would silently disable the timeout it configures."""
-    monkeypatch.setenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, raw)
+    monkeypatch.setenv(env_var, raw)
 
-    assert prisma_command_timeout() == DEFAULT_PRISMA_COMMAND_TIMEOUT
+    assert read_timeout() == default
 
 
 def test_timeout_overrides_are_independent(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv(PRISMA_COMMAND_TIMEOUT_ENV_VAR, "12")
     monkeypatch.setenv(PRISMA_BOOTSTRAP_TIMEOUT_ENV_VAR, "900")
+    monkeypatch.setenv(PRISMA_MIGRATE_DEPLOY_TIMEOUT_ENV_VAR, "1200")
 
     assert prisma_command_timeout() == 12
     assert prisma_bootstrap_timeout() == 900
+    assert prisma_migrate_deploy_timeout() == 1200
 
 
 @pytest.mark.parametrize("module", ["utils.py", "replica_identity.py"])
diff --git a/tests/proxy_unit_tests/test_proxy_server.py b/tests/proxy_unit_tests/test_proxy_server.py
index 47554913419..54cce9cdd78 100644
--- a/tests/proxy_unit_tests/test_proxy_server.py
+++ b/tests/proxy_unit_tests/test_proxy_server.py
@@ -3076,7 +3076,9 @@ async def test_update_config_success_callback_normalization():
     admin_user = UserAPIKeyAuth(
         user_role=LitellmUserRoles.PROXY_ADMIN, api_key="sk-test"
     )
-    await proxy_server.update_config(config_update, user_api_key_dict=admin_user)
+    request = MagicMock()
+    request.json = AsyncMock(return_value={"litellm_settings": {"success_callback": ["SQS", "sQs"]}})
+    await proxy_server.update_config(config_update, request=request, user_api_key_dict=admin_user)
 
     assert (
         "litellm_settings" in upserted
diff --git a/tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py b/tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
index 3785ccdcfba..096efc33aaf 100644
--- a/tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
+++ b/tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
@@ -1,3 +1,5 @@
+import asyncio
+from types import MappingProxyType
 from unittest.mock import AsyncMock, patch
 
 
@@ -5,6 +7,7 @@ import pytest
 
 import litellm
 from litellm.caching.caching import DualCache
+from litellm.caching.redis_cache import RedisCache
 from datetime import datetime, timezone
 
 from litellm.litellm_core_utils.duration_parser import duration_in_seconds
@@ -1332,3 +1335,85 @@ async def test_the_user_scope_has_no_pre_upgrade_counter_to_carry():
         await limiter.is_user_within_model_budget(
             user_id="u1", user_model_max_budget=model_max_budget, model="openai/gpt-4"
         )
+
+
+class _SharedFakeRedis(RedisCache):
+    """Stand-in for the one Redis every replica's DualCache is attached to.
+
+    Only the methods the limiter and DualCache call are implemented, and
+    ``super().__init__`` is skipped so no connection is opened.
+    """
+
+    def __init__(self):
+        self._store = MappingProxyType({})
+
+    async def async_set_cache(self, key, value, **kwargs):
+        self._store = MappingProxyType({**self._store, key: value})
+
+    async def async_get_cache(self, key, **kwargs):
+        return self._store.get(key)
+
+    async def async_batch_get_cache(self, key_list, **kwargs):
+        return {key: self._store.get(key) for key in key_list}
+
+    async def async_increment_pipeline(self, increment_list, **kwargs):
+        for op in increment_list:
+            total = self._store.get(op["key"], 0.0) + op["increment_value"]
+            self._store = MappingProxyType({**self._store, op["key"]: total})
+        return [self._store[op["key"]] for op in increment_list]
+
+
+async def _log_spend(limiter, *, key_hash, model_max_budget, response_cost):
+    await limiter.async_log_success_event(
+        _success_kwargs(
+            model_group="gpt-4",
+            response_cost=response_cost,
+            key_hash=key_hash,
+            key_model_max_budget=model_max_budget,
+        ),
+        response_obj=None,
+        start_time=None,
+        end_time=None,
+    )
+    # The Redis push is scheduled as a task rather than awaited inline.
+    await asyncio.gather(*(t for t in asyncio.all_tasks() if t is not asyncio.current_task()))
+
+
+@pytest.mark.asyncio
+async def test_spend_logged_on_one_replica_is_enforced_and_reported_on_another():
+    """
+    Each replica increments its own in-memory copy of the per-model counter and
+    pushes the increment to the shared Redis, so only Redis holds the window's
+    total. A replica that has served part of the traffic must still enforce and
+    report the total, not its own share.
+
+    Regression: reads went to the in-memory tier first, so a replica whose local
+    copy sat under the cap kept admitting requests and /key/info on it reported
+    that local share, while the shared counter was already over the cap.
+    """
+    shared_redis = _SharedFakeRedis()
+    replica_a = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=DualCache(redis_cache=shared_redis))
+    replica_b = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=DualCache(redis_cache=shared_redis))
+    key_hash = "vk-shared"
+    model_max_budget = {"gpt-4": {"budget_limit": 1.0, "time_period": "30d"}}
+    user_api_key = UserAPIKeyAuth(token=key_hash, model_max_budget=model_max_budget)
+
+    await _log_spend(replica_b, key_hash=key_hash, model_max_budget=model_max_budget, response_cost=0.25)
+    await _log_spend(replica_a, key_hash=key_hash, model_max_budget=model_max_budget, response_cost=0.5)
+    await _log_spend(replica_a, key_hash=key_hash, model_max_budget=model_max_budget, response_cost=0.5)
+
+    with pytest.raises(litellm.BudgetExceededError):
+        await replica_b.is_key_within_model_budget(user_api_key, "gpt-4")
+
+    usage_on_b = await build_model_max_budget_usage(
+        entity_type=Litellm_EntityType.KEY,
+        entity_id=key_hash,
+        model_max_budget=model_max_budget,
+        cache=replica_b.dual_cache,
+    )
+    assert usage_on_b["gpt-4"]["current_spend"] == 1.25
+
+    # Control: a replica that never served this key reads the same total.
+    replica_c = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=DualCache(redis_cache=shared_redis))
+    with pytest.raises(litellm.BudgetExceededError):
+        await replica_c.is_key_within_model_budget(user_api_key, "gpt-4")
diff --git a/tests/router_unit_tests/test_router_endpoints.py b/tests/router_unit_tests/test_router_endpoints.py
index d37af5b456a..a06aaa363ad 100644
--- a/tests/router_unit_tests/test_router_endpoints.py
+++ b/tests/router_unit_tests/test_router_endpoints.py
@@ -1324,6 +1324,98 @@ async def test_init_containers_api_endpoints_managed_id_without_model_id_applies
     assert call_kw["custom_llm_provider"] == "azure"
 
 
+@pytest.mark.asyncio
+async def test_init_containers_api_endpoints_create_with_model_uses_deployment_credentials(monkeypatch):
+    """
+    ``POST /v1/containers`` carries no container ID, so a ``model`` in the request
+    body is the only way to pick a deployment. The upstream call must receive that
+    deployment's ``api_key``/``api_base`` instead of falling back to the global
+    ``OPENAI_API_KEY`` (which may be unset on the proxy).
+    """
+    monkeypatch.delenv("OPENAI_API_KEY", raising=False)
+    router = Router(
+        model_list=[
+            {
+                "model_name": "gpt-5.4",
+                "litellm_params": {
+                    "model": "openai/gpt-5.4",
+                    "api_key": "sk-model-list-key",
+                    "api_base": "https://custom.openai.example/v1",
+                },
+            }
+        ]
+    )
+    mock_original_function = AsyncMock(return_value={"id": "cntr_test", "name": "Test Container"})
+
+    await router._init_containers_api_endpoints(
+        original_function=mock_original_function,
+        custom_llm_provider="openai",
+        name="Test Container",
+        model="gpt-5.4",
+    )
+
+    mock_original_function.assert_called_once()
+    call_kw = mock_original_function.call_args.kwargs
+    assert call_kw["api_key"] == "sk-model-list-key"
+    assert call_kw["api_base"] == "https://custom.openai.example/v1"
+    assert call_kw["model"] == "openai/gpt-5.4"
+    assert call_kw["name"] == "Test Container"
+
+
+@pytest.mark.asyncio
+async def test_init_containers_api_endpoints_create_without_model_calls_directly():
+    """
+    Without ``model`` (or with ``model=None`` as the proxy forwards it), create/list
+    must keep calling the handler directly with global provider credentials.
+    """
+    router = Router(model_list=[])
+    router._ageneric_api_call_with_fallbacks = AsyncMock()
+    mock_original_function = AsyncMock(return_value={"id": "cntr_test"})
+
+    await router._init_containers_api_endpoints(
+        original_function=mock_original_function,
+        custom_llm_provider="openai",
+        name="Test Container",
+        model=None,
+    )
+
+    router._ageneric_api_call_with_fallbacks.assert_not_called()
+    mock_original_function.assert_called_once_with(custom_llm_provider="openai", name="Test Container", model=None)
+
+
+@pytest.mark.asyncio
+async def test_init_containers_api_endpoints_create_with_unknown_model_passes_through(monkeypatch):
+    """
+    A ``model`` that names no configured deployment must not turn into a 400. The call
+    falls through to the handler with the caller's model and no injected deployment
+    credentials, matching the behaviour before model-based routing existed.
+    """
+    monkeypatch.delenv("OPENAI_API_KEY", raising=False)
+    router = Router(
+        model_list=[
+            {
+                "model_name": "gpt-5.4",
+                "litellm_params": {"model": "openai/gpt-5.4", "api_key": "sk-model-list-key"},
+            }
+        ]
+    )
+    mock_original_function = AsyncMock(return_value={"id": "cntr_test"})
+
+    await router._init_containers_api_endpoints(
+        original_function=mock_original_function,
+        custom_llm_provider="openai",
+        name="Test Container",
+        model="does-not-exist",
+    )
+
+    mock_original_function.assert_called_once()
+    call_kw = mock_original_function.call_args.kwargs
+    assert call_kw["model"] == "does-not-exist"
+    assert call_kw["name"] == "Test Container"
+    assert "api_key" not in call_kw
+    assert "api_base" not in call_kw
+
+
 def test_router_model_group_encrypted_content_affinity_callback_registration():
     from litellm.router_utils.pre_call_checks.deployment_affinity_check import (
         DeploymentAffinityCheck,
diff --git a/tests/test_litellm/a2a_protocol/providers/bedrock_agentcore/test_bedrock_agentcore_a2a.py b/tests/test_litellm/a2a_protocol/providers/bedrock_agentcore/test_bedrock_agentcore_a2a.py
index 5503a5668bf..a8fe464ec32 100644
--- a/tests/test_litellm/a2a_protocol/providers/bedrock_agentcore/test_bedrock_agentcore_a2a.py
+++ b/tests/test_litellm/a2a_protocol/providers/bedrock_agentcore/test_bedrock_agentcore_a2a.py
@@ -11,7 +11,9 @@ Verifies that:
 
 import json
 
+import httpx
 import pytest
+import respx
 from unittest.mock import AsyncMock, MagicMock, patch
 
 
@@ -295,6 +297,195 @@ class TestTransformation:
         assert headers["Authorization"].startswith("AWS4-HMAC-SHA256")
 
 
+SESSION_HEADER = "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id"
+CONTEXT_ID = "conversation-alpha-0001-0000000000000000"
+KEY_HASH = "hashed-key-of-caller-one"
+
+
+def _params_with_context(context_id: object) -> dict:
+    return {"message": {**SAMPLE_PARAMS["message"], "contextId": context_id}}
+
+
+def _scoped(context_id: str, key_hash: str) -> str:
+    import hashlib
+
+    return f"{hashlib.sha256(key_hash.encode()).hexdigest()[:16]}-{context_id}"
+
+
+def _session_header(params: dict, litellm_params: dict) -> str:
+    from litellm.a2a_protocol.providers.bedrock_agentcore.transformation import (
+        BedrockAgentCoreA2ATransformation,
+    )
+
+    _, headers, _ = BedrockAgentCoreA2ATransformation.get_url_and_signed_request(
+        request_id="req-001",
+        params=params,
+        litellm_params=litellm_params,
+    )
+    return headers[SESSION_HEADER]
+
+
+@pytest.fixture
+def httpx_transport(monkeypatch):
+    import litellm
+
+    monkeypatch.setattr(litellm, "disable_aiohttp_transport", True)
+    monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
+    litellm.in_memory_llm_clients_cache.flush_cache()
+    yield
+    litellm.in_memory_llm_clients_cache.flush_cache()
+
+
+class TestRequestScopedRuntimeSession:
+    """message.contextId selects the AgentCore runtime session, scoped to the calling key."""
+
+    def test_context_id_scoped_to_calling_key(self):
+        from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+            A2A_USER_API_KEY_HASH_PARAM,
+        )
+
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: KEY_HASH}
+        assert _session_header(_params_with_context(CONTEXT_ID), litellm_params) == _scoped(CONTEXT_ID, KEY_HASH)
+
+    def test_context_id_used_verbatim_without_principal(self):
+        assert _session_header(_params_with_context(CONTEXT_ID), SAMPLE_LITELLM_PARAMS) == CONTEXT_ID
+
+    def test_same_context_id_reuses_session_and_other_context_isolated(self):
+        first = _session_header(_params_with_context(CONTEXT_ID), SAMPLE_LITELLM_PARAMS)
+        second = _session_header(_params_with_context(CONTEXT_ID), SAMPLE_LITELLM_PARAMS)
+        other = _session_header(
+            _params_with_context("conversation-beta-00002-0000000000000000"),
+            SAMPLE_LITELLM_PARAMS,
+        )
+        assert first == second
+        assert other != first
+
+    def test_same_context_id_from_different_keys_is_isolated(self):
+        from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+            A2A_USER_API_KEY_HASH_PARAM,
+        )
+
+        params = _params_with_context(CONTEXT_ID)
+        caller_one = _session_header(params, {**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: KEY_HASH})
+        caller_two = _session_header(
+            params, {**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: "hashed-key-of-caller-two"}
+        )
+        assert caller_one != caller_two
+        assert caller_one.endswith(f"-{CONTEXT_ID}")
+        assert caller_two.endswith(f"-{CONTEXT_ID}")
+
+    def test_context_id_takes_precedence_over_configured_session(self):
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, "runtimeSessionId": "a" * 40}
+        assert _session_header(_params_with_context(CONTEXT_ID), litellm_params) == CONTEXT_ID
+
+    def test_configured_session_is_fallback_without_context_id(self):
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, "runtimeSessionId": "a" * 40}
+        assert _session_header(SAMPLE_PARAMS, litellm_params) == "a" * 40
+        assert _session_header(_params_with_context(""), litellm_params) == "a" * 40
+
+    def test_no_context_id_and_no_config_generates_new_session_per_request(self):
+        first = _session_header(SAMPLE_PARAMS, SAMPLE_LITELLM_PARAMS)
+        second = _session_header(SAMPLE_PARAMS, SAMPLE_LITELLM_PARAMS)
+        assert first != second
+        assert 33 <= len(first) <= 256
+
+    @pytest.mark.parametrize(
+        "context_id",
+        [
+            "short-context-id",
+            "x" * 257,
+        ],
+    )
+    def test_invalid_context_id_rejected_with_clear_error(self, context_id):
+        import litellm
+
+        with pytest.raises(litellm.BadRequestError, match="Invalid AgentCore runtime session id") as exc_info:
+            _session_header(_params_with_context(context_id), SAMPLE_LITELLM_PARAMS)
+        assert exc_info.value.status_code == 400
+        assert "33-256" in str(exc_info.value)
+
+    def test_scoped_context_id_shorter_than_33_rejected(self):
+        import litellm
+        from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+            A2A_USER_API_KEY_HASH_PARAM,
+        )
+
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: KEY_HASH}
+        with pytest.raises(litellm.BadRequestError, match=_scoped("c" * 15, KEY_HASH)):
+            _session_header(_params_with_context("c" * 15), litellm_params)
+        assert _session_header(_params_with_context("c" * 16), litellm_params) == _scoped("c" * 16, KEY_HASH)
+
+    def test_invalid_configured_session_rejected(self):
+        import litellm
+
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, "runtimeSessionId": "too-short"}
+        with pytest.raises(litellm.BadRequestError, match="Invalid AgentCore runtime session id"):
+            _session_header(SAMPLE_PARAMS, litellm_params)
+
+    def test_non_string_context_id_falls_back(self):
+        litellm_params = {**SAMPLE_LITELLM_PARAMS, "runtimeSessionId": "a" * 40}
+        assert _session_header(_params_with_context(12345), litellm_params) == "a" * 40
+
+    def test_spoofed_session_header_does_not_override_context_id(self):
+        from litellm.a2a_protocol.providers.bedrock_agentcore.transformation import (
+            BedrockAgentCoreA2ATransformation,
+        )
+
+        _, headers, _ = BedrockAgentCoreA2ATransformation.get_url_and_signed_request(
+            request_id="req-001",
+            params=_params_with_context(CONTEXT_ID),
+            litellm_params=SAMPLE_LITELLM_PARAMS,
+            agent_extra_headers={SESSION_HEADER: "s" * 40},
+        )
+        assert headers[SESSION_HEADER] == CONTEXT_ID
+
+    @pytest.mark.asyncio
+    async def test_context_id_session_header_on_outbound_non_streaming_post(self, httpx_transport):
+        from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+            A2A_USER_API_KEY_HASH_PARAM,
+        )
+        from litellm.a2a_protocol.providers.bedrock_agentcore.config import (
+            BedrockAgentCoreA2AConfig,
+        )
+
+        with respx.mock(assert_all_called=True) as router:
+            route = router.post(url__regex=r".*/invocations.*").mock(
+                return_value=httpx.Response(200, json={"jsonrpc": "2.0", "id": "req-001", "result": {}})
+            )
+            await BedrockAgentCoreA2AConfig().handle_non_streaming(
+                request_id="req-001",
+                params=_params_with_context(CONTEXT_ID),
+                litellm_params={**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: KEY_HASH},
+            )
+
+        assert route.calls.last.request.headers[SESSION_HEADER] == _scoped(CONTEXT_ID, KEY_HASH)
+
+    @pytest.mark.asyncio
+    async def test_context_id_session_header_on_outbound_streaming_post(self, httpx_transport):
+        from litellm.a2a_protocol.litellm_completion_bridge.handler import (
+            A2A_USER_API_KEY_HASH_PARAM,
+        )
+        from litellm.a2a_protocol.providers.bedrock_agentcore.config import (
+            BedrockAgentCoreA2AConfig,
+        )
+
+        with respx.mock(assert_all_called=True) as router:
+            route = router.post(url__regex=r".*/invocations.*").mock(
+                return_value=httpx.Response(200, json={"jsonrpc": "2.0", "id": "req-001", "result": {}})
+            )
+            events = [
+                event
+                async for event in BedrockAgentCoreA2AConfig().handle_streaming(
+                    request_id="req-001",
+                    params=_params_with_context(CONTEXT_ID),
+                    litellm_params={**SAMPLE_LITELLM_PARAMS, A2A_USER_API_KEY_HASH_PARAM: KEY_HASH},
+                )
+            ]
+
+        assert events == [{"jsonrpc": "2.0", "id": "req-001", "result": {}}]
+        assert route.calls.last.request.headers[SESSION_HEADER] == _scoped(CONTEXT_ID, KEY_HASH)
+
+
 class TestNonStreaming:
     """Test end-to-end non-streaming flow."""
 
diff --git a/tests/test_litellm/containers/test_container_api.py b/tests/test_litellm/containers/test_container_api.py
index 885c4cd294a..16a3844431e 100644
--- a/tests/test_litellm/containers/test_container_api.py
+++ b/tests/test_litellm/containers/test_container_api.py
@@ -152,6 +152,42 @@ class TestContainerAPI:
             assert response.id == "cntr_async_123"
             assert response.name == "Async Test Container"
 
+    @pytest.mark.asyncio
+    async def test_acreate_container_encodes_router_model_id(self):
+        """
+        The async handler returns a coroutine, so the managed-ID encoding must run
+        after it resolves. Otherwise follow-up calls (retrieve/delete/files) lose the
+        deployment and fall back to global provider credentials.
+        """
+        upstream_response = ContainerObject(
+            id="cntr_upstream_123",
+            object="container",
+            created_at=1747857508,
+            status="running",
+            expires_after={"anchor": "last_active_at", "minutes": 20},
+            last_active_at=1747857508,
+            name="Routed Container",
+        )
+
+        async def _resolve_upstream():
+            return upstream_response
+
+        with patch.object(  # test-quality-ok: create_container exposes no client seam, only the handler
+            base_llm_http_handler,
+            "container_create_handler",
+            side_effect=lambda **kwargs: _resolve_upstream() if kwargs["_is_async"] else upstream_response,
+        ):
+            response = await acreate_container(
+                name="Routed Container",
+                custom_llm_provider="openai",
+                litellm_metadata={"model_info": {"id": "deployment-abc"}},
+            )
+
+        decoded = ResponsesAPIRequestUtils._decode_container_id(response.id)
+        assert decoded["model_id"] == "deployment-abc"
+        assert decoded["custom_llm_provider"] == "openai"
+        assert decoded["response_id"] == "cntr_upstream_123"
+
     @pytest.mark.asyncio
     async def test_alist_containers_basic(self):
         """Test basic async container listing functionality."""
diff --git a/tests/test_litellm/integrations/otel/test_langfuse_logger.py b/tests/test_litellm/integrations/otel/test_langfuse_logger.py
new file mode 100644
index 00000000000..8f93a9a564f
--- /dev/null
+++ b/tests/test_litellm/integrations/otel/test_langfuse_logger.py
@@ -0,0 +1,359 @@
+"""Tests for ``LangfuseOpenTelemetryV2``: the root observation's input and output are stamped from the
+request-task hooks, while the root span is still recording, so Langfuse can show them on the trace."""
+
+import asyncio
+import json
+from collections.abc import AsyncIterator, Sequence
+from typing import Final
+
+import pytest
+
+pytest.importorskip("opentelemetry")
+
+from opentelemetry.sdk.trace.export.in_memory_span_exporter import InMemorySpanExporter  # noqa: E402
+
+import litellm  # noqa: E402
+from litellm.caching.dual_cache import DualCache  # noqa: E402
+from litellm.integrations.otel.logger import build_otel_v2_logger  # noqa: E402
+from litellm.integrations.otel.model.config import OpenTelemetryV2Config, is_otel_v2_enabled  # noqa: E402
+from litellm.integrations.otel.model.spans import LITELLM_PROXY_REQUEST_SPAN_NAME, SpanRole  # noqa: E402
+from litellm.integrations.otel.plumbing import context as otel_context  # noqa: E402
+from litellm.integrations.otel.plumbing import providers  # noqa: E402
+from litellm.integrations.otel.plumbing.context import set_request_root_span  # noqa: E402
+from litellm.litellm_core_utils.litellm_logging import _maybe_construct_otel_v2  # noqa: E402
+from litellm.proxy._types import UserAPIKeyAuth  # noqa: E402
+from litellm.proxy.utils import ProxyLogging  # noqa: E402
+from litellm.types.llms.openai import (  # noqa: E402
+    ResponseCompletedEvent,
+    ResponsesAPIResponse,
+    ResponsesAPIStreamEvents,
+)
+from litellm.types.utils import (  # noqa: E402
+    Choices,
+    Delta,
+    Embedding,
+    EmbeddingResponse,
+    Message,
+    ModelResponse,
+    ModelResponseStream,
+    StreamingChoices,
+)
+
+INPUT_ATTR: Final = "langfuse.observation.input"
+OUTPUT_ATTR: Final = "langfuse.observation.output"
+CHAT_DATA: Final = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "ping"}]}
+
+
+@pytest.fixture(autouse=True)
+def _reset_request_root_span():
+    otel_context._request_root_span.set(None)
+    yield
+    otel_context._request_root_span.set(None)
+
+
+def _logger(*, capture: str = "span_only", mappers: Sequence[str] = ("genai", "langfuse")):
+    cfg = OpenTelemetryV2Config(exporter="in_memory", mapper_names=list(mappers), capture_message_content=capture)
+    exporter = InMemorySpanExporter()
+    tracer_provider = providers.build_tracer_provider(cfg, exporter=exporter)
+    return build_otel_v2_logger(config=cfg, tracer_provider=tracer_provider), exporter
+
+
+def _start_root(logger):
+    root = logger._emitter.start_span(SpanRole.PROXY_REQUEST, LITELLM_PROXY_REQUEST_SPAN_NAME)
+    set_request_root_span(root)
+    return root
+
+
+def _root_attrs(exporter):
+    by_name = {span.name: span for span in exporter.get_finished_spans()}
+    return dict(by_name[LITELLM_PROXY_REQUEST_SPAN_NAME].attributes or {})
+
+
+def _run_request(logger, data: dict, call_type: str, response: object):
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), data, call_type))
+    asyncio.run(logger.async_post_call_success_hook(data=data, user_api_key_dict=UserAPIKeyAuth(), response=response))
+    root.end()
+
+
+async def _relay(logger, chunks: Sequence[object], data: dict) -> list[object]:
+    async def source() -> AsyncIterator[object]:
+        for chunk in chunks:
+            yield chunk
+
+    return [chunk async for chunk in logger.async_post_call_streaming_iterator_hook(UserAPIKeyAuth(), source(), data)]
+
+
+def _run_stream(logger, data: dict, chunks: Sequence[object]) -> list[object]:
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), data, "acompletion"))
+    relayed = asyncio.run(_relay(logger, chunks, data))
+    root.end()
+    return relayed
+
+
+def _chat_chunk(content: str | None, finish_reason: str | None = None) -> ModelResponseStream:
+    return ModelResponseStream(
+        id="chatcmpl-1",
+        created=1,
+        model="gpt-5.4-mini",
+        choices=[StreamingChoices(index=0, delta=Delta(content=content), finish_reason=finish_reason)],
+    )
+
+
+def _responses_api_response() -> ResponsesAPIResponse:
+    return ResponsesAPIResponse(
+        id="resp_1",
+        created_at=1,
+        output=[
+            {
+                "type": "message",
+                "id": "msg_1",
+                "status": "completed",
+                "role": "assistant",
+                "content": [{"type": "output_text", "text": "pong", "annotations": []}],
+            }
+        ],
+    )
+
+
+def _anthropic_sse_frames() -> tuple[bytes, ...]:
+    events = (
+        {
+            "type": "message_start",
+            "message": {
+                "id": "msg_1",
+                "type": "message",
+                "role": "assistant",
+                "model": "claude-sonnet-4-5",
+                "content": [],
+                "stop_reason": None,
+                "usage": {"input_tokens": 1, "output_tokens": 0},
+            },
+        },
+        {"type": "content_block_start", "index": 0, "content_block": {"type": "text", "text": ""}},
+        {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "po"}},
+        {"type": "content_block_delta", "index": 0, "delta": {"type": "text_delta", "text": "ng"}},
+        {"type": "content_block_stop", "index": 0},
+        {"type": "message_delta", "delta": {"stop_reason": "end_turn"}, "usage": {"output_tokens": 2}},
+        {"type": "message_stop"},
+    )
+    return tuple(f"event: {event['type']}\ndata: {json.dumps(event)}\n\n".encode() for event in events)
+
+
+def test_chat_request_stamps_root_observation_input_and_output():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+
+    _run_request(logger, CHAT_DATA, "acompletion", response)
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [{"role": "user", "content": "ping"}]
+    output = json.loads(attrs[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_responses_request_folds_instructions_into_input_and_stamps_output_items():
+    logger, exporter = _logger()
+    data = {"model": "gpt-5.4-mini", "instructions": "be terse", "input": "ping"}
+
+    _run_request(logger, data, "aresponses", _responses_api_response())
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [
+        {"role": "system", "content": "be terse"},
+        {"role": "user", "content": "ping"},
+    ]
+    output = json.loads(attrs[OUTPUT_ATTR])
+    assert output[0]["role"] == "assistant"
+    assert output[0]["content"][0]["text"] == "pong"
+
+
+def test_anthropic_messages_request_folds_system_into_input_and_stamps_content_blocks():
+    logger, exporter = _logger()
+    data = {"model": "claude-sonnet-4-5", "system": "be terse", "messages": [{"role": "user", "content": "ping"}]}
+    response = {"type": "message", "role": "assistant", "content": [{"type": "text", "text": "pong"}]}
+
+    _run_request(logger, data, "aanthropic_messages", response)
+
+    attrs = _root_attrs(exporter)
+    assert json.loads(attrs[INPUT_ATTR]) == [
+        {"role": "system", "content": "be terse"},
+        {"role": "user", "content": "ping"},
+    ]
+    assert json.loads(attrs[OUTPUT_ATTR]) == [{"role": "assistant", "content": [{"type": "text", "text": "pong"}]}]
+
+
+def test_chat_stream_relays_chunks_untouched_and_stamps_assembled_output():
+    logger, exporter = _logger()
+    chunks = (_chat_chunk("po"), _chat_chunk("ng"), _chat_chunk(None, finish_reason="stop"))
+
+    relayed = _run_stream(logger, CHAT_DATA, chunks)
+
+    assert [id(chunk) for chunk in relayed] == [id(chunk) for chunk in chunks]
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_responses_stream_stamps_output_from_the_completed_event():
+    logger, exporter = _logger()
+    completed = ResponseCompletedEvent(
+        type=ResponsesAPIStreamEvents.RESPONSE_COMPLETED, response=_responses_api_response()
+    )
+    chunks = ({"type": "response.created"}, {"type": "response.output_text.delta", "delta": "pong"}, completed)
+
+    relayed = _run_stream(logger, {"model": "gpt-5.4-mini", "input": "ping"}, chunks)
+
+    assert relayed == list(chunks)
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert output[0]["content"][0]["text"] == "pong"
+
+
+def test_anthropic_sse_stream_stamps_output_from_the_assembled_frames():
+    logger, exporter = _logger()
+    frames = _anthropic_sse_frames()
+
+    relayed = _run_stream(
+        logger, {"model": "claude-sonnet-4-5", "messages": [{"role": "user", "content": "ping"}]}, frames
+    )
+
+    assert relayed == list(frames)
+    output = json.loads(_root_attrs(exporter)[OUTPUT_ATTR])
+    assert [(turn["role"], turn["content"]) for turn in output] == [("assistant", "pong")]
+
+
+def test_root_observation_io_survives_the_root_ending_before_the_success_callback():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), CHAT_DATA, "acompletion"))
+    logger.log_pre_api_call(
+        model="gpt-5.4-mini",
+        messages=[],
+        kwargs={"litellm_call_id": "call_1", "litellm_params": {"metadata": {}}},
+    )
+    asyncio.run(
+        logger.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+    )
+    root.end()
+
+    payload = {
+        "call_type": "acompletion",
+        "custom_llm_provider": "openai",
+        "model": "gpt-5.4-mini",
+        "messages": CHAT_DATA["messages"],
+        "response": response.model_dump(),
+        "status": "success",
+        "litellm_call_id": "call_1",
+        "metadata": {},
+        "hidden_params": {},
+    }
+    asyncio.run(
+        logger.async_log_success_event(
+            {"standard_logging_object": payload, "litellm_params": {"metadata": {}}}, response, None, None
+        )
+    )
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR in attrs and OUTPUT_ATTR in attrs
+    generation = next(span for span in exporter.get_finished_spans() if span.name != LITELLM_PROXY_REQUEST_SPAN_NAME)
+    assert OUTPUT_ATTR in dict(generation.attributes or {})
+
+
+def test_root_input_is_the_request_as_the_pre_call_chain_left_it():
+    logger, exporter = _logger()
+    raw = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "my ssn is 123-45-6789"}]}
+    masked = {"model": "gpt-5.4-mini", "messages": [{"role": "user", "content": "my ssn is [REDACTED]"}]}
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="noted"))])
+    root = _start_root(logger)
+    asyncio.run(logger.async_pre_call_hook(UserAPIKeyAuth(), DualCache(), raw, "acompletion"))
+    asyncio.run(logger.async_post_call_success_hook(data=masked, user_api_key_dict=UserAPIKeyAuth(), response=response))
+    root.end()
+
+    assert json.loads(_root_attrs(exporter)[INPUT_ATTR]) == masked["messages"]
+
+
+def test_root_already_ended_is_left_alone():
+    logger, exporter = _logger()
+    response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+    root = _start_root(logger)
+    root.end()
+
+    asyncio.run(
+        logger.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+    )
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+def test_responses_without_a_message_body_stamp_neither_input_nor_output():
+    logger, exporter = _logger()
+    embedding = EmbeddingResponse(model="e", data=[Embedding(embedding=[0.1], index=0, object="embedding")])
+
+    _run_request(logger, {"model": "e", "input": "ping"}, "aembedding", embedding)
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+def test_unrenderable_output_never_raises_into_the_request():
+    logger, exporter = _logger()
+
+    _run_request(logger, CHAT_DATA, "acompletion", object())
+
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+@pytest.mark.parametrize(
+    ("capture", "mappers"),
+    [("no_content", ("genai", "langfuse")), ("span_only", ("genai",))],
+)
+def test_factory_keeps_the_base_logger_unless_langfuse_content_capture_is_on(capture, mappers):
+    logger, exporter = _logger(capture=capture, mappers=mappers)
+
+    _run_request(logger, CHAT_DATA, "acompletion", ModelResponse())
+    attrs = _root_attrs(exporter)
+    assert INPUT_ATTR not in attrs and OUTPUT_ATTR not in attrs
+
+
+@pytest.mark.parametrize(
+    ("capture", "mappers", "relays_streams"),
+    [
+        ("span_only", ("genai", "langfuse"), True),
+        ("no_content", ("genai", "langfuse"), False),
+        ("span_only", ("genai",), False),
+    ],
+)
+def test_only_langfuse_content_capture_takes_proxy_streams_off_the_fast_path(
+    monkeypatch, capture, mappers, relays_streams
+):
+    logger, _ = _logger(capture=capture, mappers=mappers)
+    monkeypatch.setattr(litellm, "callbacks", [logger])
+
+    assert ProxyLogging._callback_capabilities().has_iterator_override is relays_streams
+
+
+def test_langfuse_otel_preset_builds_a_logger_that_stamps_the_root(monkeypatch):
+    monkeypatch.setenv("LITELLM_OTEL_V2", "true")
+    monkeypatch.setenv("LANGFUSE_PUBLIC_KEY", "pk")
+    monkeypatch.setenv("LANGFUSE_SECRET_KEY", "sk")
+    monkeypatch.setenv("LANGFUSE_HOST", "https://cloud.langfuse.com")
+    monkeypatch.setenv("OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", "span_only")
+    is_otel_v2_enabled.cache_clear()
+
+    loggers: list = []
+    try:
+        built = _maybe_construct_otel_v2("langfuse_otel", loggers)
+        assert built is not None
+        assert _maybe_construct_otel_v2("langfuse_otel", loggers) is built
+        root = _start_root(built)
+        response = ModelResponse(choices=[Choices(message=Message(role="assistant", content="pong"))])
+        asyncio.run(
+            built.async_post_call_success_hook(data=CHAT_DATA, user_api_key_dict=UserAPIKeyAuth(), response=response)
+        )
+        attrs = dict(root.attributes or {})
+        assert INPUT_ATTR in attrs and OUTPUT_ATTR in attrs
+    finally:
+        is_otel_v2_enabled.cache_clear()
diff --git a/tests/test_litellm/integrations/test_anthropic_cache_control_hook.py b/tests/test_litellm/integrations/test_anthropic_cache_control_hook.py
index e995cbae782..de8b654987b 100644
--- a/tests/test_litellm/integrations/test_anthropic_cache_control_hook.py
+++ b/tests/test_litellm/integrations/test_anthropic_cache_control_hook.py
@@ -2858,6 +2858,27 @@ class TestRecordGatewayInjection:
         AnthropicCacheControlHook.record_gateway_injection(kwargs, 0)
         assert kwargs["litellm_metadata"][self.KEY] == self.DEPLOYMENT
 
+    def test_an_every_deployment_mark_survives_a_later_per_deployment_stamp(self):
+        """A per-leg stamp like the Bedrock converse tool_config one describes one leg of
+        a payload every leg sends, so narrowing an every-deployment mark to that leg's
+        deployment would uncredit whichever leg gets billed after a failover."""
+        kwargs: dict = {"litellm_metadata": {self.KEY: ""}, "model_info": {"id": self.DEPLOYMENT}}
+        AnthropicCacheControlHook.record_gateway_injection(kwargs, 1)
+        assert kwargs["litellm_metadata"][self.KEY] == ""
+
+    def test_a_pre_choice_pass_stamps_the_sentinel_over_a_provisional_deployment(self):
+        """The router's prompt-management factory stamps a provisional deployment's
+        model_info into kwargs before the prompt pass runs, and any other deployment can
+        end up billed, so the pass declares every-deployment scope explicitly."""
+        kwargs: dict = {"litellm_metadata": {}, "model_info": {"id": self.DEPLOYMENT}}
+        AnthropicCacheControlHook.record_gateway_injection(kwargs, 1, injected_for_every_deployment=True)
+        assert kwargs["litellm_metadata"][self.KEY] == ""
+
+    def test_a_per_deployment_mark_still_follows_the_latest_leg(self):
+        kwargs: dict = {"litellm_metadata": {self.KEY: "dep-old"}, "model_info": {"id": self.DEPLOYMENT}}
+        AnthropicCacheControlHook.record_gateway_injection(kwargs, 1)
+        assert kwargs["litellm_metadata"][self.KEY] == self.DEPLOYMENT
+
     def test_v1_messages_auto_injection_stamps_the_marker(self, monkeypatch):
         monkeypatch.setattr(litellm, "enable_anthropic_prompt_caching", True)
         kwargs: dict = {"litellm_metadata": {}, "model_info": {"id": self.DEPLOYMENT}}
diff --git a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
index 366f61ded49..f1de7390b5b 100644
--- a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
+++ b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
@@ -6002,7 +6002,9 @@ async def test_prompt_hook_injection_marker_recorded_for_every_surface(logging_o
     """The savings gate reads litellm_gateway_injected_cache from the request's
     metadata bucket. Recording lives in the shared prompt-hook wrappers, so chat,
     /v1/responses, router prompt deployments, and proxy prompt templates all mark
-    injected requests the same way; a hook that injects nothing leaves no marker."""
+    injected requests the same way; a hook that injects nothing leaves no marker.
+    A pass that runs before deployment choice declares it and gets the every-deployment
+    sentinel, which a later per-deployment pass never narrows."""
     from litellm.integrations.custom_prompt_management import CustomPromptManagement
 
     class _InjectingHook(CustomPromptManagement):
@@ -6086,6 +6088,28 @@ async def test_prompt_hook_injection_marker_recorded_for_every_surface(logging_o
     )
     assert "litellm_gateway_injected_cache" not in untouched["metadata"]
 
+    pre_choice = {"metadata": {}, "model_info": {"id": "dep-of-this-attempt"}}
+    logging_obj.get_chat_completion_prompt(
+        model="claude-sonnet-5",
+        messages=[{"role": "user", "content": "hi"}],
+        non_default_params={},
+        prompt_variables=None,
+        prompt_management_logger=_InjectingHook(),
+        request_kwargs=pre_choice,
+        injected_for_every_deployment=True,
+    )
+    assert pre_choice["metadata"]["litellm_gateway_injected_cache"] == ""
+
+    await logging_obj.async_get_chat_completion_prompt(
+        model="claude-sonnet-5",
+        messages=[{"role": "user", "content": "a fresh turn"}],
+        non_default_params={},
+        prompt_variables=None,
+        prompt_management_logger=_InjectingHook(),
+        request_kwargs=pre_choice,
+    )
+    assert pre_choice["metadata"]["litellm_gateway_injected_cache"] == ""
+
 
 def test_get_standard_logging_object_payload_reads_overhead_from_logging_obj_for_dict_results(logging_obj):
     """LIT-5466: /v1/messages returns a plain dict with no _hidden_params, so the overhead
diff --git a/tests/test_litellm/llms/base_llm/files/test_azure_blob_storage_backend.py b/tests/test_litellm/llms/base_llm/files/test_azure_blob_storage_backend.py
index b924ea8f93f..7e1139ca79a 100644
--- a/tests/test_litellm/llms/base_llm/files/test_azure_blob_storage_backend.py
+++ b/tests/test_litellm/llms/base_llm/files/test_azure_blob_storage_backend.py
@@ -184,6 +184,50 @@ async def test_download_file_drops_query_string_from_the_stored_url(mock_env_var
     )
 
 
+@pytest.mark.parametrize(
+    "malicious_filename",
+    [
+        "report.jsonl/../../etc/cron.d/evil",
+        "a.b/../../../root/.ssh/authorized_keys",
+    ],
+)
+@pytest.mark.parametrize("strategy", ["uuid", "timestamp"])
+@pytest.mark.asyncio
+async def test_generate_file_name_strips_path_traversal_from_extension(mock_env_vars, malicious_filename, strategy):
+    """
+    original_filename.split(".")[-1] does not parse path structure, so a filename whose
+    last "." is followed by a directory traversal sequence used to put that sequence
+    straight into the blob path built from this name. The mutant this pins is reverting
+    _safe_extension() back to that bare split.
+    """
+    backend = _make_backend()
+    generated = backend._generate_file_name(malicious_filename, strategy)
+    assert "/" not in generated
+    assert ".." not in generated
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_uuid_strategy_preserves_ordinary_extension(mock_env_vars):
+    backend = _make_backend()
+    generated = backend._generate_file_name("data.jsonl", "uuid")
+    assert generated.endswith(".jsonl")
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_original_filename_strategy_strips_directory_components(mock_env_vars):
+    """The blob name must never carry a directory the caller supplied, traversal or not."""
+    backend = _make_backend()
+    generated = backend._generate_file_name("../../etc/passwd", "original_filename")
+    assert generated == "passwd"
+
+
+@pytest.mark.asyncio
+async def test_generate_file_name_null_byte_filename_falls_back_to_safe_default(mock_env_vars):
+    backend = _make_backend()
+    generated = backend._generate_file_name("report.pdf\x00.exe", "uuid")
+    assert "\x00" not in generated
+
+
 @pytest.mark.parametrize(
     "env_fixture, expected_suffix",
     [("mock_env_vars", "core.windows.net"), ("mock_gov_env_vars", GOV_SUFFIX)],
diff --git a/tests/test_litellm/llms/s3_vectors/vector_stores/test_s3_vectors_transformation.py b/tests/test_litellm/llms/s3_vectors/vector_stores/test_s3_vectors_transformation.py
index 7085e45cdc3..4b58d220623 100644
--- a/tests/test_litellm/llms/s3_vectors/vector_stores/test_s3_vectors_transformation.py
+++ b/tests/test_litellm/llms/s3_vectors/vector_stores/test_s3_vectors_transformation.py
@@ -1,4 +1,4 @@
-from unittest.mock import MagicMock, Mock
+from unittest.mock import AsyncMock, MagicMock, Mock, patch
 
 import httpx
 import pytest
@@ -9,6 +9,18 @@ from litellm.llms.s3_vectors.vector_stores.transformation import (
 from litellm.types.vector_stores import VectorStoreSearchResponse
 
 
+def _mock_router(model_names, sync=False):
+    """Router mock serving the given embedding model names."""
+    router = MagicMock()
+    router.get_model_list.return_value = [{"model_name": name} for name in model_names]
+    embedding_response = Mock(data=[{"embedding": [0.1, 0.2, 0.3]}])
+    if sync:
+        router.embedding = MagicMock(return_value=embedding_response)
+    else:
+        router.aembedding = AsyncMock(return_value=embedding_response)
+    return router
+
+
 class TestS3VectorsVectorStoreConfig:
     def test_init(self):
         """Test that S3VectorsVectorStoreConfig initializes correctly"""
@@ -28,19 +40,174 @@ class TestS3VectorsVectorStoreConfig:
         url = config.get_complete_url(None, litellm_params)
         assert url == "https://s3vectors.us-west-2.api.aws"
 
-    def test_get_complete_url_missing_region(self):
-        """Test that missing region raises error"""
+    def test_get_complete_url_missing_region(self, monkeypatch):
+        """Missing region falls back to the default region (parity with ingestion)"""
+        monkeypatch.delenv("AWS_REGION_NAME", raising=False)
+        monkeypatch.delenv("AWS_REGION", raising=False)
         config = S3VectorsVectorStoreConfig()
-        litellm_params = {}
-        with pytest.raises(ValueError, match="aws_region_name is required"):
-            config.get_complete_url(None, litellm_params)
+        url = config.get_complete_url(None, {})
+        assert url == "https://s3vectors.us-west-2.api.aws"
+
+    def test_get_complete_url_uses_env_region(self, monkeypatch):
+        """Missing region param resolves from AWS_REGION_NAME env var"""
+        monkeypatch.setenv("AWS_REGION_NAME", "eu-west-1")
+        monkeypatch.delenv("AWS_REGION", raising=False)
+        config = S3VectorsVectorStoreConfig()
+        url = config.get_complete_url(None, {})
+        assert url == "https://s3vectors.eu-west-1.api.aws"
+
+    def test_get_complete_url_invalid_region_format(self):
+        """Invalid region format raises"""
+        config = S3VectorsVectorStoreConfig()
+        with pytest.raises(ValueError, match="Invalid AWS region format"):
+            config.get_complete_url(None, {"aws_region_name": "Bad_Region!"})
 
-    @pytest.mark.skip(reason="Requires embedding API call, tested in integration tests")
     def test_transform_search_request(self):
-        """Test search request transformation"""
-        # This test requires making an actual embedding API call
-        # It's better tested in integration tests
-        pass
+        """Full request-body transformation with a router-injected embedding"""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+        router = _mock_router(["text-embedding-3-small"], sync=True)
+
+        url, request_body = config.transform_search_vector_store_request(
+            vector_store_id="test-bucket:test-index",
+            query="test query",
+            vector_store_search_optional_params={"max_num_results": 7},
+            api_base="https://s3vectors.us-west-2.api.aws",
+            litellm_logging_obj=mock_logging_obj,
+            litellm_params={},
+            extra_body=None,
+            router=router,
+        )
+
+        assert url == "https://s3vectors.us-west-2.api.aws/QueryVectors"
+        assert request_body == {
+            "vectorBucketName": "test-bucket",
+            "indexName": "test-index",
+            "queryVector": {"float32": [0.1, 0.2, 0.3]},
+            "topK": 7,
+            "returnDistance": True,
+            "returnMetadata": True,
+        }
+        assert mock_logging_obj.model_call_details["query"] == "test query"
+
+    @pytest.mark.asyncio
+    async def test_atransform_search_uses_router_for_virtual_model(self):
+        """Regression: router-served embedding models must resolve via the router,
+        not a bare litellm.aembedding call (which has no deployment credentials)."""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+        router = _mock_router(["my-embedding-model"])
+
+        with patch("litellm.aembedding", new=AsyncMock()) as mock_bare_aembedding:  # test-quality-ok: guards that the bare-embedding path is not taken; dispatch seam is the behavior under test
+            url, request_body = await config.atransform_search_vector_store_request(
+                vector_store_id="test-bucket:test-index",
+                query="test query",
+                vector_store_search_optional_params={},
+                api_base="https://s3vectors.us-west-2.api.aws",
+                litellm_logging_obj=mock_logging_obj,
+                litellm_params={"embedding_model": "my-embedding-model"},
+                extra_body=None,
+                router=router,
+            )
+
+        router.aembedding.assert_awaited_once_with(model="my-embedding-model", input=["test query"])
+        mock_bare_aembedding.assert_not_awaited()
+        assert request_body["queryVector"]["float32"] == [0.1, 0.2, 0.3]
+        assert request_body["topK"] == 5  # default
+
+    @pytest.mark.asyncio
+    async def test_atransform_search_falls_back_when_router_does_not_serve_model(self):
+        """Router present but embedding_model is not a router deployment ->
+        bare litellm.aembedding keeps working (provider-prefixed + env creds stores)."""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+        router = _mock_router(["some-other-model"])
+
+        mock_bare = AsyncMock(return_value=Mock(data=[{"embedding": [0.4, 0.5]}]))
+        with patch("litellm.aembedding", new=mock_bare):  # test-quality-ok: stubs the bare-embedding fallback whose request body the test asserts on
+            _, request_body = await config.atransform_search_vector_store_request(
+                vector_store_id="test-bucket:test-index",
+                query="test query",
+                vector_store_search_optional_params={},
+                api_base="https://s3vectors.us-west-2.api.aws",
+                litellm_logging_obj=mock_logging_obj,
+                litellm_params={"embedding_model": "azure/text-embedding-3-small"},
+                extra_body=None,
+                router=router,
+            )
+
+        mock_bare.assert_awaited_once_with(model="azure/text-embedding-3-small", input=["test query"])
+        router.aembedding.assert_not_awaited()
+        assert request_body["queryVector"]["float32"] == [0.4, 0.5]
+
+    @pytest.mark.asyncio
+    async def test_atransform_search_without_router_uses_bare_embedding(self):
+        """Backward compat: no router -> bare litellm.aembedding as before"""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+
+        mock_bare = AsyncMock(return_value=Mock(data=[{"embedding": [0.6, 0.7]}]))
+        with patch("litellm.aembedding", new=mock_bare):  # test-quality-ok: stubs the bare-embedding fallback whose request body the test asserts on
+            _, request_body = await config.atransform_search_vector_store_request(
+                vector_store_id="test-bucket:test-index",
+                query="test query",
+                vector_store_search_optional_params={},
+                api_base="https://s3vectors.us-west-2.api.aws",
+                litellm_logging_obj=mock_logging_obj,
+                litellm_params={},
+                extra_body=None,
+            )
+
+        mock_bare.assert_awaited_once_with(model="text-embedding-3-small", input=["test query"])
+        assert request_body["queryVector"]["float32"] == [0.6, 0.7]
+
+    def test_transform_search_uses_router_for_virtual_model_sync(self):
+        """Sync twin: router-served embedding model resolves via router.embedding"""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+        router = _mock_router(["my-embedding-model"], sync=True)
+
+        with patch("litellm.embedding", new=MagicMock()) as mock_bare_embedding:  # test-quality-ok: guards that the bare-embedding path is not taken; dispatch seam is the behavior under test
+            _, request_body = config.transform_search_vector_store_request(
+                vector_store_id="test-bucket:test-index",
+                query="test query",
+                vector_store_search_optional_params={},
+                api_base="https://s3vectors.us-west-2.api.aws",
+                litellm_logging_obj=mock_logging_obj,
+                litellm_params={"embedding_model": "my-embedding-model"},
+                extra_body=None,
+                router=router,
+            )
+
+        router.embedding.assert_called_once_with(model="my-embedding-model", input=["test query"])
+        mock_bare_embedding.assert_not_called()
+        assert request_body["queryVector"]["float32"] == [0.1, 0.2, 0.3]
+
+    def test_transform_search_without_router_uses_bare_embedding_sync(self):
+        """Sync twin: no router -> bare litellm.embedding as before"""
+        config = S3VectorsVectorStoreConfig()
+        mock_logging_obj = Mock()
+        mock_logging_obj.model_call_details = {}
+
+        mock_bare = MagicMock(return_value=Mock(data=[{"embedding": [0.8, 0.9]}]))
+        with patch("litellm.embedding", new=mock_bare):  # test-quality-ok: stubs the bare-embedding fallback whose request body the test asserts on
+            _, request_body = config.transform_search_vector_store_request(
+                vector_store_id="test-bucket:test-index",
+                query="test query",
+                vector_store_search_optional_params={},
+                api_base="https://s3vectors.us-west-2.api.aws",
+                litellm_logging_obj=mock_logging_obj,
+                litellm_params={},
+                extra_body=None,
+            )
+
+        mock_bare.assert_called_once_with(model="text-embedding-3-small", input=["test query"])
+        assert request_body["queryVector"]["float32"] == [0.8, 0.9]
 
     def test_transform_search_request_invalid_vector_store_id(self):
         """Test that invalid vector_store_id format raises error"""
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py b/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py
index 0144fbb17dd..c8ea4867f2c 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py
@@ -6005,6 +6005,44 @@ class TestMCPDcrBridgeDelegateAdmission:
                 await MCPRequestHandler.process_mcp_request(scope)
 
         assert exc_info.value.status_code == 503
+        assert exc_info.value.detail == (
+            "Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly."
+        )
+
+    async def test_user_subject_envelope_permanent_db_fault_is_503_not_worded_as_transient(self):
+        """A query engine fault that never heals (a missing engine binary) still fails admission with 503,
+        but the detail must not call the database "temporarily unreachable" or ask the client to retry: the
+        DCR client would loop on a retry that can never succeed. The fault reaches the handler wrapped in
+        get_user_object's bare ValueError, so the wording has to be picked off the wrapped cause."""
+        from prisma.engine.errors import BinaryNotFoundError
+
+        envelope = self._mint_bridge_envelope(user_id="sso-user-7")
+        scope = {
+            "type": "http",
+            "method": "POST",
+            "path": "/mcp/bridge_delegate_server",
+            "headers": [(b"authorization", f"Bearer {envelope}".encode("latin-1"))],
+        }
+        with (
+            patch(  # test-quality-ok: isolate the MCP registry, same seam as the sibling admission tests
+                "litellm.proxy._experimental.mcp_server.mcp_server_manager.global_mcp_server_manager"
+            ) as mock_mgr,
+            patch(  # test-quality-ok: the envelope opener reads master_key off the proxy module, no injection seam
+                "litellm.proxy.proxy_server.master_key", self._MASTER_KEY
+            ),
+            self._patch_user_reload(
+                side_effect=self._wrapped_user_lookup_error(BinaryNotFoundError("query engine binary not found"))
+            ),
+        ):
+            mock_mgr.get_mcp_server_by_name.return_value = self._bridge_delegate_server()
+            with pytest.raises(HTTPException) as exc_info:
+                await MCPRequestHandler.process_mcp_request(scope)
+
+        assert exc_info.value.status_code == 503
+        assert "temporarily unreachable" not in exc_info.value.detail
+        assert "retry shortly" not in exc_info.value.detail.lower()
+        assert "BinaryNotFoundError" in exc_info.value.detail
+        assert "will not clear by retrying" in exc_info.value.detail
 
     async def test_user_subject_envelope_scim_deactivated_user_fails_closed_401(self):
         """SCIM-deactivating the envelope's user revokes it immediately: the reloaded user carries
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
index 598e9276423..588eba4adb7 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
@@ -6432,6 +6432,23 @@ async def test_bridge_mint_db_outage_is_503_before_upstream():
     response, post = await _prepare_only_bridge_exchange("unavailable")
     assert response.status_code == 503
     assert json.loads(response.body)["error"] == "temporarily_unavailable"
+    assert "retry shortly" in json.loads(response.body)["error_description"]
+    post.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_bridge_mint_permanent_db_fault_is_503_without_retry_advice():
+    """A query engine fault that never heals is still a 503 (the gateway is at fault, not the client), but
+    the description must not tell the client the database is temporarily unreachable and to retry: that
+    sends an operator to wait out an outage that is not one. The code stays temporarily_unavailable, the
+    only RFC 6749 error a client treats as a server-side 503."""
+    response, post = await _prepare_only_bridge_exchange("faulted")
+    assert response.status_code == 503
+    body = json.loads(response.body)
+    assert body["error"] == "temporarily_unavailable"
+    assert "temporarily unreachable" not in body["error_description"]
+    assert "retry shortly" not in body["error_description"]
+    assert "not a transient outage" in body["error_description"]
     post.assert_not_called()
 
 
@@ -7143,6 +7160,56 @@ async def test_resolve_active_litellm_key_db_outage_is_unavailable(proxy_globals
     assert await _resolve_active_litellm_key(request) == "unavailable"
 
 
+@pytest.mark.asyncio
+async def test_resolve_active_litellm_key_permanent_engine_fault_is_faulted(proxy_globals):
+    """A query engine that is missing or version-skewed cannot resolve any key until the deployment is
+    repaired, so the resolver reports "faulted" (still statused 503 by the mint) rather than "unavailable",
+    whose wording promises the outage is transient and asks the client to retry."""
+    from prisma.engine.errors import BinaryNotFoundError
+
+    from litellm.proxy._experimental.mcp_server.bridge_token_flow import (
+        _resolve_active_litellm_key,
+    )
+    from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
+
+    class _FaultedPrisma:
+        async def get_data(self, token, table_name, parent_otel_span=None, proxy_logging_obj=None):
+            raise BinaryNotFoundError("query engine binary not found")
+
+    proxy_globals.user_api_key_cache = UserApiKeyCache()
+    proxy_globals.prisma_client = _FaultedPrisma()
+
+    request = _token_request({"x-litellm-api-key": "sk-during-engine-fault"})
+    assert await _resolve_active_litellm_key(request) == "faulted"
+
+
+@pytest.mark.asyncio
+async def test_resolve_active_litellm_key_transport_error_over_permanent_fault_is_faulted(proxy_globals):
+    """A reconnect that dies on a missing engine binary raises the transport error last, with the
+    BinaryNotFoundError as __context__. The binary is what blocks recovery, so the key read is "faulted",
+    not the "unavailable" that the outer ConnectError alone would suggest."""
+    import httpx
+    from prisma.engine.errors import BinaryNotFoundError
+
+    from litellm.proxy._experimental.mcp_server.bridge_token_flow import (
+        _resolve_active_litellm_key,
+    )
+    from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
+
+    class _ReconnectFailedPrisma:
+        async def get_data(self, token, table_name, parent_otel_span=None, proxy_logging_obj=None):
+            try:
+                raise BinaryNotFoundError("query engine binary not found")
+            except BinaryNotFoundError:
+                raise httpx.ConnectError("All connection attempts failed")
+
+    proxy_globals.user_api_key_cache = UserApiKeyCache()
+    proxy_globals.prisma_client = _ReconnectFailedPrisma()
+
+    request = _token_request({"x-litellm-api-key": "sk-during-failed-reconnect"})
+    assert await _resolve_active_litellm_key(request) == "faulted"
+
+
 @pytest.mark.asyncio
 async def test_resolve_active_litellm_key_no_database_is_unresolvable(proxy_globals):
     """With no database connection configured the gateway cannot verify the presented key at all, so
@@ -7214,6 +7281,26 @@ async def test_reload_active_user_by_id_db_outage_is_unavailable(proxy_globals):
         assert await _reload_active_user_by_id("sso-user-7") == "unavailable"
 
 
+@pytest.mark.asyncio
+async def test_reload_active_user_by_id_permanent_engine_fault_is_faulted(proxy_globals):
+    """A permanent query engine fault while re-validating the user on refresh is "faulted", not
+    "unavailable": both are 503s, but only the transient one may tell the client to retry. get_user_object
+    wraps the fault in a bare ValueError, so the classification has to read the wrapped cause."""
+    from prisma.engine.errors import MismatchedVersionsError
+
+    from litellm.proxy._experimental.mcp_server.bridge_token_flow import _reload_active_user_by_id
+    from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
+
+    proxy_globals.user_api_key_cache = UserApiKeyCache()
+    proxy_globals.prisma_client = object()
+
+    with patch(  # test-quality-ok: get_user_object is the DB seam that wraps the fault; same patch as the outage sibling
+        "litellm.proxy.auth.auth_checks.get_user_object",
+        new=AsyncMock(side_effect=_wrapped_user_lookup_error(MismatchedVersionsError(expected="1", got="2"))),
+    ):
+        assert await _reload_active_user_by_id("sso-user-7") == "faulted"
+
+
 @pytest.mark.asyncio
 async def test_token_endpoint_uses_client_secret_basic_when_configured():
     """LIT-4091: a server with token_endpoint_auth_method=client_secret_basic must send the
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_gateway_dcr_flow.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_gateway_dcr_flow.py
index 32a3f70c357..1670370f082 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_gateway_dcr_flow.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_gateway_dcr_flow.py
@@ -426,6 +426,7 @@ async def test_token_rejects_expired_code_and_missing_configuration():
     [
         ("no_active_key", 400, "invalid_grant"),
         ("unavailable", 503, "temporarily_unavailable"),
+        ("faulted", 503, "temporarily_unavailable"),
         ("unresolvable", 500, "server_error"),
     ],
 )
@@ -460,6 +461,25 @@ async def test_token_gates_on_live_user_revalidation(failure, expected_status, e
     assert json.loads(response.body)["error"] == expected_error
 
 
+def test_permanent_db_fault_503_does_not_promise_a_retry_will_help():
+    """Both DB failures are 503 temporarily_unavailable (the only OAuth error a client reads as a
+    server-side outage), so the description is the one place the two are told apart: a transient outage
+    says retry, a fault that never heals must say retrying will not help and point at the deployment."""
+    from litellm.proxy._experimental.mcp_server.gateway_dcr_flow import (
+        _consent_lookup_failure_response,
+        _mint_failure_response,
+        _reload_failure_response,
+    )
+
+    for render in (_reload_failure_response, _consent_lookup_failure_response, _mint_failure_response):
+        transient = json.loads(render("unavailable").body)["error_description"]
+        faulted = json.loads(render("faulted").body)["error_description"]
+        assert transient == "the gateway database is unavailable; retry"
+        assert "retry" not in faulted.replace("retrying will not help", "")
+        assert "not a transient outage" in faulted
+        assert "retrying will not help" in faulted
+
+
 @pytest.mark.asyncio
 async def test_flow_is_single_use_shared_cache_rejects_second_complete():
     """A double-submit of the finish step mints only ONE code: the second complete over the
@@ -1250,6 +1270,7 @@ async def test_native_authorize_refuses_a_hosted_redirect_for_the_proxy_api():
     "failure, status, error",
     [
         ("unavailable", 503, "temporarily_unavailable"),
+        ("faulted", 503, "temporarily_unavailable"),
         ("unresolvable", 500, "server_error"),
         ("no_active_key", 403, "access_denied"),
     ],
@@ -1424,6 +1445,7 @@ async def test_native_code_without_a_minter_is_refused_server_side():
         ("team_required", 400, "invalid_grant"),
         ("no_active_key", 400, "invalid_grant"),
         ("unavailable", 503, "temporarily_unavailable"),
+        ("faulted", 503, "temporarily_unavailable"),
         ("unresolvable", 500, "server_error"),
     ],
 )
@@ -1805,5 +1827,12 @@ async def test_introspect_fails_closed_on_dead_user_and_503s_on_outage():
     status, body = await _introspect(minted.token.get_secret_value(), reload_user=_reload_user_outage)
     assert (status, body["error"]) == (503, "temporarily_unavailable")
 
+    async def _reload_user_faulted(user_id: str):
+        return "faulted"
+
+    status, body = await _introspect(minted.token.get_secret_value(), reload_user=_reload_user_faulted)
+    assert (status, body["error"]) == (503, "temporarily_unavailable")
+    assert "not a transient outage" in body["error_description"]
+
     status, body = await _introspect(minted.token.get_secret_value(), master_key=None)
     assert (status, body["error"]) == (500, "server_error")
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_tool_search.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_tool_search.py
index 16221f44efe..239f89ebd90 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_tool_search.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_tool_search.py
@@ -10,33 +10,36 @@ Covers:
 """
 
 import json
+from collections.abc import Sequence
 from typing import Any
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
+from mcp.types import Tool
 
+import litellm
 from litellm.models.object_permission import LiteLLM_ObjectPermissionTable
 from litellm.proxy._experimental.mcp_server.faults.list_outcomes import AggregateToolListing
 from litellm.proxy._experimental.mcp_server.tool_search import (
     AGENT_SEARCH_TOOL_NAME,
     MCP_TOOL_CALL_TOOL_NAME,
     MCP_TOOL_SEARCH_TOOL_NAME,
+    SemanticToolRanker,
+    ToolSearchResult,
     coerce_top_k,
     get_virtual_tool_definitions,
+    search_mcp_tools,
     search_tools,
 )
 from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
+from litellm.proxy.common_utils.semantic_text_index import EmbeddingFailed, SemanticTextIndex, Vector
+from litellm.types.mcp import MCPToolSearchSettings
 
 
-def _make_tools(specs: list[tuple[str, str]]) -> list[dict[str, Any]]:
-    return [
-        {
-            "name": name,
-            "description": desc,
-            "inputSchema": {"type": "object", "properties": {}},
-        }
-        for name, desc in specs
-    ]
+def _make_tools(specs: list[tuple[str, str]]) -> tuple[Tool, ...]:
+    return tuple(
+        Tool(name=name, description=desc, inputSchema={"type": "object", "properties": {}}) for name, desc in specs
+    )
 
 
 def _make_perm(**kwargs: Any) -> LiteLLM_ObjectPermissionTable:
@@ -54,6 +57,160 @@ SAMPLE_TOOLS = _make_tools(
 )
 
 
+FX_TOOL = Tool(
+    name="treasury-get_rates",
+    description="Get foreign exchange rates for a currency pair",
+    inputSchema={"type": "object", "properties": {}},
+)
+WEATHER_TOOL = Tool(
+    name="weather-forecast",
+    description="Get the weather forecast for a city",
+    inputSchema={"type": "object", "properties": {}},
+)
+CALENDAR_TOOL = Tool(
+    name="calendar-create_event",
+    description="Create a calendar event",
+    inputSchema={"type": "object", "properties": {}},
+)
+CATALOG = (FX_TOOL, WEATHER_TOOL, CALENDAR_TOOL)
+
+# A stand-in embedding space: "FX" sits next to the foreign-exchange tool and far from the rest.
+FAKE_VECTORS: dict[str, Vector] = {
+    "FX": (1.0, 0.0),
+    f"{FX_TOOL.name}\n{FX_TOOL.description}": (0.9, 0.1),
+    f"{WEATHER_TOOL.name}\n{WEATHER_TOOL.description}": (0.3, 1.0),
+    f"{CALENDAR_TOOL.name}\n{CALENDAR_TOOL.description}": (0.0, 1.0),
+}
+
+
+class RecordingEmbedder:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, ...]] = []
+
+    async def __call__(self, texts: Sequence[str]) -> Sequence[Vector]:
+        self.calls.append(tuple(texts))
+        return tuple(FAKE_VECTORS[text] for text in texts)
+
+
+def _ranker(embedder: RecordingEmbedder | None = None) -> SemanticToolRanker:
+    return SemanticToolRanker(embed=embedder or RecordingEmbedder(), embedding_model="emb", index=SemanticTextIndex())
+
+
+def _names(results: Sequence[ToolSearchResult] | EmbeddingFailed) -> list[str]:
+    assert not isinstance(results, EmbeddingFailed)
+    return [tool["name"] for tool in results]
+
+
+class TestSearchMcpTools:
+    @pytest.mark.asyncio
+    async def test_semantic_mode_finds_foreign_exchange_tool_for_fx(self) -> None:
+        keyword_only = await search_mcp_tools("FX", CATALOG, 5, MCPToolSearchSettings(), ranker=None)
+        assert _names(keyword_only) == []
+
+        results = await search_mcp_tools("FX", CATALOG, 5, MCPToolSearchSettings(embedding_model="emb"), _ranker())
+        assert _names(results) == [FX_TOOL.name, WEATHER_TOOL.name, CALENDAR_TOOL.name]
+        assert not isinstance(results, EmbeddingFailed)
+        assert results[0]["score"] > results[1]["score"] > results[2]["score"]
+        assert results[0]["inputSchema"] == FX_TOOL.inputSchema
+
+    @pytest.mark.asyncio
+    async def test_similarity_threshold_drops_weak_matches(self) -> None:
+        settings = MCPToolSearchSettings(embedding_model="emb", similarity_threshold=0.5)
+        results = await search_mcp_tools("FX", CATALOG, 5, settings, _ranker())
+        assert _names(results) == [FX_TOOL.name]
+
+    @pytest.mark.asyncio
+    async def test_request_top_k_limits_semantic_results(self) -> None:
+        results = await search_mcp_tools("FX", CATALOG, 2, MCPToolSearchSettings(embedding_model="emb"), _ranker())
+        assert _names(results) == [FX_TOOL.name, WEATHER_TOOL.name]
+
+    @pytest.mark.asyncio
+    async def test_configured_top_k_caps_request_top_k(self) -> None:
+        settings = MCPToolSearchSettings(embedding_model="emb", top_k=1)
+        assert _names(await search_mcp_tools("FX", CATALOG, 50, settings, _ranker())) == [FX_TOOL.name]
+        assert _names(await search_mcp_tools("weather", CATALOG, 50, MCPToolSearchSettings(top_k=1), None)) == [
+            WEATHER_TOOL.name
+        ]
+
+    @pytest.mark.asyncio
+    async def test_core_tools_lead_and_do_not_consume_top_k(self) -> None:
+        settings = MCPToolSearchSettings(embedding_model="emb", top_k=1, core_tools=(CALENDAR_TOOL.name,))
+        results = await search_mcp_tools("FX", CATALOG, 1, settings, _ranker())
+        assert _names(results) == [CALENDAR_TOOL.name, FX_TOOL.name]
+        assert not isinstance(results, EmbeddingFailed)
+        assert "score" not in results[0]
+
+    @pytest.mark.asyncio
+    async def test_core_tools_apply_in_keyword_mode_too(self) -> None:
+        settings = MCPToolSearchSettings(core_tools=(CALENDAR_TOOL.name,))
+        assert _names(await search_mcp_tools("weather", CATALOG, 5, settings, None)) == [
+            CALENDAR_TOOL.name,
+            WEATHER_TOOL.name,
+        ]
+
+    @pytest.mark.asyncio
+    async def test_core_tools_outside_the_callers_catalog_are_not_returned(self) -> None:
+        settings = MCPToolSearchSettings(embedding_model="emb", core_tools=("payroll-run", CALENDAR_TOOL.name))
+        results = await search_mcp_tools("FX", (FX_TOOL, WEATHER_TOOL), 5, settings, _ranker())
+        assert _names(results) == [FX_TOOL.name, WEATHER_TOOL.name]
+
+    @pytest.mark.asyncio
+    async def test_core_tools_are_listed_once_and_never_embedded(self) -> None:
+        embedder = RecordingEmbedder()
+        settings = MCPToolSearchSettings(embedding_model="emb", core_tools=(FX_TOOL.name, FX_TOOL.name))
+        results = await search_mcp_tools("FX", CATALOG, 5, settings, _ranker(embedder))
+        assert _names(results) == [FX_TOOL.name, WEATHER_TOOL.name, CALENDAR_TOOL.name]
+        assert all(FX_TOOL.description not in text for call in embedder.calls for text in call)
+
+    @pytest.mark.asyncio
+    async def test_empty_query_returns_only_core_tools_without_embedding(self) -> None:
+        embedder = RecordingEmbedder()
+        settings = MCPToolSearchSettings(embedding_model="emb", core_tools=(CALENDAR_TOOL.name,))
+        assert _names(await search_mcp_tools("", CATALOG, 5, settings, _ranker(embedder))) == [CALENDAR_TOOL.name]
+        assert embedder.calls == []
+
+    @pytest.mark.asyncio
+    async def test_repeat_searches_only_embed_the_query(self) -> None:
+        embedder = RecordingEmbedder()
+        ranker = _ranker(embedder)
+        settings = MCPToolSearchSettings(embedding_model="emb")
+        await search_mcp_tools("FX", CATALOG, 5, settings, ranker)
+        await search_mcp_tools("FX", CATALOG, 5, settings, ranker)
+        assert [len(call) for call in embedder.calls] == [4, 1]
+
+    @pytest.mark.asyncio
+    async def test_embedding_failure_is_reported_not_raised(self) -> None:
+        async def failing(texts: Sequence[str]) -> Sequence[Vector]:
+            raise ValueError("embedding model is down")
+
+        ranker = SemanticToolRanker(embed=failing, embedding_model="emb", index=SemanticTextIndex())
+        result = await search_mcp_tools("FX", CATALOG, 5, MCPToolSearchSettings(embedding_model="emb"), ranker)
+        assert isinstance(result, EmbeddingFailed)
+        assert "embedding model is down" in result.reason
+
+
+class TestMcpToolSearchSettings:
+    def test_rejects_out_of_range_values(self) -> None:
+        from pydantic import ValidationError
+
+        with pytest.raises(ValidationError):
+            MCPToolSearchSettings(top_k=0)
+        with pytest.raises(ValidationError):
+            MCPToolSearchSettings(similarity_threshold=1.5)
+
+    def test_yaml_shape_round_trips(self) -> None:
+        settings = MCPToolSearchSettings.model_validate(
+            {"embedding_model": "emb", "top_k": 3, "similarity_threshold": 0.2, "core_tools": ["a", "b"]}
+        )
+        assert settings.core_tools == ("a", "b")
+        assert settings.model_dump() == {
+            "embedding_model": "emb",
+            "top_k": 3,
+            "similarity_threshold": 0.2,
+            "core_tools": ("a", "b"),
+        }
+
+
 class TestCoerceTopK:
     def test_int_passthrough(self) -> None:
         assert coerce_top_k(3) == 3
@@ -92,10 +249,10 @@ class TestSearchTools:
         assert len(results) <= 2
 
     def test_empty_query_returns_empty(self) -> None:
-        assert search_tools("", SAMPLE_TOOLS) == []
+        assert search_tools("", SAMPLE_TOOLS) == ()
 
     def test_no_match_returns_empty(self) -> None:
-        assert search_tools("xyzzy_nonexistent_zzz", SAMPLE_TOOLS) == []
+        assert search_tools("xyzzy_nonexistent_zzz", SAMPLE_TOOLS) == ()
 
     def test_matches_description_not_just_name(self) -> None:
         results = search_tools("channel", SAMPLE_TOOLS)
@@ -603,6 +760,63 @@ class TestCallToolRestApiVirtualTools:
         assert result.isError is True
         assert result.content[0].text == "set agent_search_embedding_model"
 
+    def _semantic_request(self, query: str = "FX") -> MagicMock:
+        return self._make_request({"name": MCP_TOOL_SEARCH_TOOL_NAME, "arguments": {"query": query}})
+
+    @pytest.mark.asyncio
+    async def test_mcp_tool_search_ranks_the_callers_catalog_with_the_configured_embedding_model(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setattr(litellm, "mcp_tool_search", {"embedding_model": "emb", "similarity_threshold": 0.5})
+        user_api_key_dict = UserAPIKeyAuth(
+            api_key="k", team_id="team-1", object_permission=_make_perm(mcp_tool_search_enabled=True)
+        )
+
+        async def fake_aembedding(model: str, input: list[str], metadata: dict[str, Any]) -> MagicMock:
+            assert model == "emb"
+            assert metadata["user_api_key"] == "k"
+            assert metadata["user_api_key_team_id"] == "team-1"
+            response = MagicMock()
+            response.model_dump.return_value = {"data": [{"embedding": list(FAKE_VECTORS[t])} for t in input]}
+            return response
+
+        router = MagicMock()
+        router.aembedding = AsyncMock(side_effect=fake_aembedding)
+        with (
+            patch(  # test-quality-ok: the proxy's router is a module global; the handler reaches it the way production does
+                "litellm.proxy.proxy_server.llm_router", router
+            ),
+            patch(  # test-quality-ok: the authorized catalog is the seam every virtual tool shares; the ranking under test stays real
+                "litellm.proxy._experimental.mcp_server.server._list_mcp_tools",
+                new_callable=AsyncMock,
+                return_value=AggregateToolListing(tools=list(CATALOG), outcomes={}),
+            ) as mock_list,
+        ):
+            result = await self._get_call_fn()(request=self._semantic_request(), user_api_key_dict=user_api_key_dict)
+
+        assert mock_list.await_args.kwargs["user_api_key_auth"] is user_api_key_dict
+        assert result.isError is False
+        assert [t["name"] for t in json.loads(result.content[0].text)] == [FX_TOOL.name]
+
+    @pytest.mark.asyncio
+    async def test_mcp_tool_search_reports_missing_router_as_tool_error(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setattr(litellm, "mcp_tool_search", {"embedding_model": "emb"})
+        user_api_key_dict = UserAPIKeyAuth(api_key="k", object_permission=_make_perm(mcp_tool_search_enabled=True))
+        with patch(  # test-quality-ok: the proxy's router is a module global; the handler reaches it the way production does
+            "litellm.proxy.proxy_server.llm_router", None
+        ):
+            result = await self._get_call_fn()(request=self._semantic_request(), user_api_key_dict=user_api_key_dict)
+        assert result.isError is True
+        assert "mcp_tool_search.embedding_model" in result.content[0].text
+
+    @pytest.mark.asyncio
+    async def test_mcp_tool_search_reports_invalid_settings_as_tool_error(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setattr(litellm, "mcp_tool_search", {"top_k": 0})
+        user_api_key_dict = UserAPIKeyAuth(api_key="k", object_permission=_make_perm(mcp_tool_search_enabled=True))
+        result = await self._get_call_fn()(request=self._semantic_request(), user_api_key_dict=user_api_key_dict)
+        assert result.isError is True
+        assert "top_k" in result.content[0].text
+
     @pytest.mark.asyncio
     async def test_agent_search_requires_flag_enabled(self) -> None:
         from fastapi import HTTPException
diff --git a/tests/test_litellm/proxy/agent_endpoints/test_a2a_endpoints.py b/tests/test_litellm/proxy/agent_endpoints/test_a2a_endpoints.py
index 2ff38af80b1..43034f889f6 100644
--- a/tests/test_litellm/proxy/agent_endpoints/test_a2a_endpoints.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_a2a_endpoints.py
@@ -918,6 +918,62 @@ async def test_task_method_failure_hook_uses_enriched_request_data():
     assert failure_data.get("agent_id") == "test-agent"
 
 
+@pytest.mark.asyncio
+async def test_agentcore_invalid_context_id_returns_jsonrpc_invalid_params_400():
+    from litellm.proxy._types import UserAPIKeyAuth
+
+    agent = _make_agent_mock()
+    agent.litellm_params = {
+        "custom_llm_provider": "bedrock",
+        "model": "bedrock/agentcore/arn:aws:bedrock-agentcore:us-west-2:123456789012:runtime/demo",
+        "api_key": "test-jwt-token",
+    }
+    mock_request = _make_request_mock(
+        "message/send",
+        {
+            "message": {
+                "role": "user",
+                "parts": [{"kind": "text", "text": "Hello"}],
+                "messageId": "msg-1",
+                "contextId": "too-short",
+            }
+        },
+    )
+    user_api_key_dict = UserAPIKeyAuth(api_key="sk-test", user_id="u1", team_id="t1")
+
+    mock_proxy_logging = MagicMock()
+    mock_proxy_logging.pre_call_hook = AsyncMock(
+        side_effect=lambda user_api_key_dict, data, call_type: data
+    )
+    mock_proxy_logging.post_call_failure_hook = AsyncMock(return_value=None)
+
+    with ExitStack() as stack:
+        for p in _base_patches(agent):
+            stack.enter_context(p)
+        stack.enter_context(
+            patch(  # test-quality-ok: same proxy_logging_obj injection the sibling failure-hook test uses; no HTTP call is made because the request is rejected before signing
+                "litellm.proxy.proxy_server.proxy_logging_obj", mock_proxy_logging
+            )
+        )
+
+        from litellm.proxy.agent_endpoints.a2a_endpoints import invoke_agent_a2a
+
+        response = await invoke_agent_a2a(
+            agent_id="test-agent",
+            request=mock_request,
+            fastapi_response=MagicMock(),
+            user_api_key_dict=user_api_key_dict,
+        )
+
+    body = json.loads(response.body.decode())
+    assert response.status_code == 400
+    assert body["id"] == "req-1"
+    assert body["error"]["code"] == -32602
+    assert "Invalid AgentCore runtime session id" in body["error"]["message"]
+    assert "Internal error" not in body["error"]["message"]
+    mock_proxy_logging.post_call_failure_hook.assert_awaited_once()
+
+
 @pytest.mark.asyncio
 async def test_get_extended_agent_card_rewrites_url():
     from litellm.proxy._types import UserAPIKeyAuth
diff --git a/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py b/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
index 7ce62fdf648..231626c7eb5 100644
--- a/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_agent_registry.py
@@ -8,7 +8,18 @@ from unittest.mock import AsyncMock, MagicMock
 
 import pytest
 
-from litellm.proxy.agent_endpoints.agent_registry import AgentRegistry, GrantMigrationResult
+from litellm.constants import REDACTED_BY_LITELM_STRING
+from litellm.proxy.agent_endpoints.agent_registry import (
+    AgentRegistry,
+    GrantMigrationResult,
+    _restore_redacted_litellm_params,
+    redact_sensitive_agent_litellm_params,
+)
+
+# Obviously-fake stand-ins for a real AWS credential pair (LIT-6736 regression
+# fixtures) -- never a real key shape, and must never appear in any response.
+SENTINEL_AWS_ACCESS_KEY_ID: Final = "AKIATESTSENTINEL0000"
+SENTINEL_AWS_SECRET_ACCESS_KEY: Final = "test-sentinel-do-not-use-secret-value"
 
 
 def _sample_agent_card_params() -> dict:
@@ -49,6 +60,7 @@ async def test_update_agent_in_db_clears_static_headers_and_extra_headers_when_o
 
     mock_update = AsyncMock(return_value=updated_agent)
     mock_prisma.db.litellm_agentstable.update = mock_update
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(return_value=None)
 
     # Agent config WITHOUT static_headers or extra_headers (omitted)
     agent_config = {
@@ -95,6 +107,7 @@ async def test_update_agent_in_db_preserves_explicit_static_headers_and_extra_he
 
     mock_update = AsyncMock(return_value=updated_agent)
     mock_prisma.db.litellm_agentstable.update = mock_update
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(return_value=None)
 
     agent_config = {
         "agent_name": "Updated Agent",
@@ -436,6 +449,9 @@ async def test_update_agent_in_db_raises_when_row_deleted_mid_update():
     guard the code dereferences None and reports an opaque AttributeError instead of the id."""
     registry: Final = AgentRegistry()
     mock_prisma: Final = MagicMock()
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(litellm_params={}, object_permission_id=None)
+    )
     mock_prisma.db.litellm_agentstable.update = AsyncMock(return_value=None)
 
     with pytest.raises(Exception, match="Error updating agent in DB") as exc_info:
@@ -485,3 +501,492 @@ async def test_delete_agent_from_db_raises_when_row_already_gone():
         await registry.delete_agent_from_db(agent_id="agent-123", prisma_client=mock_prisma)
 
     assert str(exc_info.value) == "Error deleting agent from DB: Agent not found, passed agent_id=agent-123"
+
+
+# ---------- LIT-6736: agent litellm_params secret redaction ----------
+
+
+def test_redact_sensitive_agent_litellm_params_masks_secrets_keeps_the_rest():
+    """The sentinel secret must never appear in the redacted output; non-secret
+    keys (model reference, is_public) must survive untouched."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+            "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+            "model": "bedrock/agentcore/my-agent",
+            "is_public": True,
+        }
+    )
+
+    assert SENTINEL_AWS_ACCESS_KEY_ID not in json.dumps(redacted)
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["aws_access_key_id"] == REDACTED_BY_LITELM_STRING
+    assert redacted["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model"] == "bedrock/agentcore/my-agent"
+    assert redacted["is_public"] is True
+
+
+def test_redact_sensitive_agent_litellm_params_recurses_into_nested_dicts():
+    """A secret nested one level down (e.g. a per-provider sub-config) must
+    also be redacted, not just top-level keys."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {"provider_config": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"}}
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["provider_config"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_config"]["region"] == "us-east-1"
+
+
+def test_redact_sensitive_agent_litellm_params_handles_none_and_json_string():
+    assert redact_sensitive_agent_litellm_params(None) is None
+
+    serialized = json.dumps({"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"})
+    redacted = redact_sensitive_agent_litellm_params(serialized)
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in redacted
+    assert json.loads(redacted)["api_key"] == REDACTED_BY_LITELM_STRING
+    assert json.loads(redacted)["model"] == "gpt-4"
+
+
+def test_redact_sensitive_agent_litellm_params_recurses_into_lists_of_dicts():
+    """A secret nested inside a list of provider sub-configs (a shape a
+    non-sensitively-named key can legitimately hold) must also be redacted,
+    not silently returned as-is."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "provider_configs": [
+                {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"},
+                {"aws_secret_access_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-west-2"},
+            ]
+        }
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["provider_configs"][0]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_configs"][0]["region"] == "us-east-1"
+    assert redacted["provider_configs"][1]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["provider_configs"][1]["region"] == "us-west-2"
+
+
+def test_redact_sensitive_agent_litellm_params_redacts_secrets_inside_model_list():
+    """The exact shape flagged in review: litellm_params.model_list, where each
+    entry carries its own nested litellm_params with a provider credential."""
+    redacted = redact_sensitive_agent_litellm_params(
+        {
+            "model_list": [
+                {
+                    "model_name": "gpt-4",
+                    "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"},
+                },
+                {
+                    "model_name": "claude",
+                    "litellm_params": {
+                        "aws_secret_access_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY,
+                        "model": "bedrock/claude",
+                    },
+                },
+            ]
+        }
+    )
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY not in json.dumps(redacted)
+    assert redacted["model_list"][0]["litellm_params"]["api_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model_list"][0]["litellm_params"]["model"] == "gpt-4"
+    assert redacted["model_list"][1]["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+    assert redacted["model_list"][1]["litellm_params"]["model"] == "bedrock/claude"
+
+
+def test_restore_redacted_litellm_params_preserves_secret_inside_model_list():
+    """The write-side counterpart: a caller editing a model_list entry's own
+    non-secret field (renaming it) while leaving that same entry's nested
+    secret masked must not corrupt the stored per-deployment credential.
+    List entries correspond by position (see the module docstring on
+    ``_restore_redacted_nested_value``), so this -- the common "edit this
+    entry, keep its secret" pattern -- must keep working."""
+    existing = {
+        "agent_name": "my-agent",
+        "model_list": [
+            {
+                "model_name": "gpt-4",
+                "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "model": "gpt-4"},
+            },
+        ],
+    }
+    incoming = {
+        "agent_name": "my-agent-renamed",
+        "model_list": [
+            {
+                "model_name": "gpt-4-renamed",
+                "litellm_params": {"api_key": REDACTED_BY_LITELM_STRING, "model": "gpt-4"},
+            },
+        ],
+    }
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert SENTINEL_AWS_SECRET_ACCESS_KEY == restored["model_list"][0]["litellm_params"]["api_key"]
+    assert restored["model_list"][0]["model_name"] == "gpt-4-renamed"
+    assert restored["agent_name"] == "my-agent-renamed"
+
+
+def test_restore_redacted_litellm_params_matches_list_entries_by_position():
+    """Documents the accepted trade-off: a list has no stable per-element
+    identity in a plain ``dict[str, object]`` schema, so restoration matches
+    entries by index, the same correspondence every other part of this merge
+    (and the endpoints' full-replace-on-PUT semantics) already assumes. If a
+    caller both reorders the list AND echoes back a masked marker in the same
+    request, a credential can end up attached to a different logical entry.
+    That is a known, narrow limitation -- not a leak between different
+    agents or tenants, since it only reshuffles one agent's own stored
+    values -- and this test pins the current, deliberate behavior rather
+    than asserting it away."""
+    existing = {
+        "model_list": [
+            {"model_name": "gpt-4", "litellm_params": {"api_key": SENTINEL_AWS_SECRET_ACCESS_KEY}},
+            {"model_name": "claude", "litellm_params": {"api_key": "other-" + SENTINEL_AWS_SECRET_ACCESS_KEY}},
+        ],
+    }
+    incoming = {
+        "model_list": [
+            # Same index (0) now holds what used to be at index 1's entry.
+            {"model_name": "claude", "litellm_params": {"api_key": REDACTED_BY_LITELM_STRING}},
+        ],
+    }
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert restored["model_list"][0]["litellm_params"]["api_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+
+
+def test_restore_redacted_litellm_params_recovers_a_whole_subtree_collapsed_by_the_depth_cap():
+    """Past the read-side recursion depth cap, a whole nested subtree is
+    collapsed to the flat REDACTED_BY_LITELM marker rather than a dict/list.
+    If the caller echoes that flat marker back unchanged, the whole
+    subtree -- not just the literal marker string -- must be restored."""
+    existing_subtree = {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY, "region": "us-east-1"}
+    incoming = {"provider_config": REDACTED_BY_LITELM_STRING}
+    existing = {"provider_config": existing_subtree}
+
+    restored = _restore_redacted_litellm_params(incoming, existing)
+
+    assert restored["provider_config"] == existing_subtree
+
+
+def test_redact_sensitive_agent_litellm_params_does_not_reinterpret_plain_string_values_as_json():
+    """A plain non-JSON string value (most string leaves) must pass through
+    unchanged rather than failing to parse and getting redacted."""
+    redacted = redact_sensitive_agent_litellm_params({"model": "bedrock/agentcore/my-agent", "is_public": True})
+
+    assert redacted["model"] == "bedrock/agentcore/my-agent"
+    assert redacted["is_public"] is True
+
+
+@pytest.mark.asyncio
+async def test_add_agent_to_db_drops_a_sentinel_value_instead_of_storing_the_placeholder():
+    """A create has nothing stored to restore behind a redaction marker, so a
+    sensitive key submitted as the literal marker is dropped rather than
+    persisted as the placeholder string itself."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+    created_agent = MagicMock()
+    created_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    created_agent.object_permission = None
+    mock_create = AsyncMock(return_value=created_agent)
+    mock_prisma.db.litellm_agentstable.create = mock_create
+
+    await registry.add_agent_to_db(
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "model": "bedrock/agentcore/my-agent",
+            },
+        },
+        prisma_client=mock_prisma,
+        created_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_create.call_args.kwargs["data"]["litellm_params"])
+    assert "aws_secret_access_key" not in stored_params
+    assert stored_params["model"] == "bedrock/agentcore/my-agent"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_when_echoed_back_redacted():
+    """PUT round-trips the GET response, which shows the secret redacted. Saving
+    an unrelated field change must not overwrite the real stored credential
+    with the redaction marker."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={
+                "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+                "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                "model": "bedrock/agentcore/my-agent",
+            },
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Renamed Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Renamed Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            # The UI round-tripped the redacted secret and the untouched
+            # access key id verbatim; only agent_name actually changed.
+            "litellm_params": {
+                "aws_access_key_id": SENTINEL_AWS_ACCESS_KEY_ID,
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "model": "bedrock/agentcore/my-agent",
+            },
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["aws_access_key_id"] == SENTINEL_AWS_ACCESS_KEY_ID
+    assert stored_params["model"] == "bedrock/agentcore/my-agent"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_when_key_omitted_entirely():
+    """Omitting the sensitive key altogether must fall back to the stored
+    value too, not just an explicit redaction-marker round-trip."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {"model": "bedrock/agentcore/my-agent"},
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_preserves_secret_nested_under_a_non_sensitive_key():
+    """A secret nested inside a dict held by a non-sensitively-named key
+    (e.g. a per-provider sub-config) must also survive an echoed-back
+    redaction marker, not just top-level secret keys."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={
+                "provider_config": {
+                    "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                    "region": "us-east-1",
+                }
+            },
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {
+                # The GET response redacted the nested secret; the caller
+                # round-trips it verbatim while changing nothing.
+                "provider_config": {
+                    "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                    "region": "us-west-2",
+                }
+            },
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["provider_config"]["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["provider_config"]["region"] == "us-west-2"
+
+
+@pytest.mark.asyncio
+async def test_update_agent_in_db_clears_secret_on_explicit_empty_value():
+    """An explicit empty string is a deliberate clear, distinct from an omitted
+    key or the redaction marker, and must actually clear the stored secret."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=SimpleNamespace(
+            litellm_params={"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            object_permission_id=None,
+        )
+    )
+    updated_agent = MagicMock()
+    updated_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    updated_agent.object_permission = None
+    mock_update = AsyncMock(return_value=updated_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.update_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "agent_name": "Test Agent",
+            "agent_card_params": _sample_agent_card_params(),
+            "litellm_params": {"aws_secret_access_key": ""},
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == ""
+
+
+@pytest.mark.asyncio
+async def test_patch_agent_in_db_preserves_secret_when_litellm_params_omitted():
+    """A PATCH that only renames the agent must not touch (let alone drop) the
+    stored litellm_params secret."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value={
+            "agent_id": "agent-123",
+            "agent_name": "Old Name",
+            "litellm_params": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+            "object_permission_id": None,
+        }
+    )
+    patched_agent = MagicMock()
+    patched_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "New Name",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {"aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY},
+        "object_permission": None,
+    }
+    patched_agent.object_permission = None
+    mock_update = AsyncMock(return_value=patched_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.patch_agent_in_db(
+        agent_id="agent-123",
+        agent={"agent_name": "New Name"},
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    update_data: Final = mock_update.call_args.kwargs["data"]
+    assert "litellm_params" not in update_data
+
+
+@pytest.mark.asyncio
+async def test_patch_agent_in_db_preserves_secret_when_echoed_back_redacted():
+    """A PATCH that includes litellm_params (e.g. to flip an unrelated flag)
+    with the secret round-tripped as the redaction marker must not clobber
+    the stored credential."""
+    registry: Final = AgentRegistry()
+    mock_prisma: Final = MagicMock()
+
+    mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value={
+            "agent_id": "agent-123",
+            "agent_name": "Test Agent",
+            "litellm_params": {
+                "aws_secret_access_key": SENTINEL_AWS_SECRET_ACCESS_KEY,
+                "is_public": False,
+            },
+            "object_permission_id": None,
+        }
+    )
+    patched_agent = MagicMock()
+    patched_agent.model_dump.return_value = {
+        "agent_id": "agent-123",
+        "agent_name": "Test Agent",
+        "agent_card_params": _sample_agent_card_params(),
+        "litellm_params": {},
+        "object_permission": None,
+    }
+    patched_agent.object_permission = None
+    mock_update = AsyncMock(return_value=patched_agent)
+    mock_prisma.db.litellm_agentstable.update = mock_update
+
+    await registry.patch_agent_in_db(
+        agent_id="agent-123",
+        agent={
+            "litellm_params": {
+                "aws_secret_access_key": REDACTED_BY_LITELM_STRING,
+                "is_public": True,
+            }
+        },
+        prisma_client=mock_prisma,
+        updated_by="test-user",
+    )
+
+    stored_params: Final = json.loads(mock_update.call_args.kwargs["data"]["litellm_params"])
+    assert stored_params["aws_secret_access_key"] == SENTINEL_AWS_SECRET_ACCESS_KEY
+    assert stored_params["is_public"] is True
diff --git a/tests/test_litellm/proxy/agent_endpoints/test_agent_search.py b/tests/test_litellm/proxy/agent_endpoints/test_agent_search.py
index 3fb09076e5f..daca244c0a1 100644
--- a/tests/test_litellm/proxy/agent_endpoints/test_agent_search.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_agent_search.py
@@ -16,13 +16,12 @@ from litellm.proxy.agent_endpoints.agent_search import (
     AgentSearchHits,
     AgentSearchIndex,
     AgentSearchNotConfigured,
-    Vector,
     agent_search_text,
-    cosine_similarity,
     search_agents,
 )
 from litellm.proxy.agent_endpoints.auth.agent_permission_handler import RestrictedAgentAccess
 from litellm.proxy.agent_endpoints.endpoints import router, user_api_key_auth
+from litellm.proxy.common_utils.semantic_text_index import Vector, cosine_similarity
 from litellm.types.agents import AgentResponse
 
 CALLER: Final = UserAPIKeyAuth(api_key="hashed-caller-key", team_id="team-1", user_id="user-1")
diff --git a/tests/test_litellm/proxy/agent_endpoints/test_endpoints.py b/tests/test_litellm/proxy/agent_endpoints/test_endpoints.py
index ea196bda529..a78b3238a9a 100644
--- a/tests/test_litellm/proxy/agent_endpoints/test_endpoints.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_endpoints.py
@@ -4,6 +4,7 @@ import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
 
+from litellm.constants import REDACTED_BY_LITELM_STRING
 from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
 from litellm.proxy.agent_endpoints import endpoints as agent_endpoints
 from litellm.proxy.agent_endpoints.auth.agent_permission_handler import (
@@ -484,11 +485,15 @@ class TestAgentRBACInternalUserViewOnly:
         assert resp.status_code == 403
 
 
+SENTINEL_AGENT_API_KEY = "sk-test-sentinel-do-not-use"
+
+
 class TestAgentRBACProxyAdminViewOnly:
     """Read-only proxy admins go through the object-permission scoped branch on
     GET /v1/agents (the admin fast path stays full PROXY_ADMIN only, so viewers
-    cannot fan out health checks beyond their allowlist), and secret unredaction
-    also stays gated on full PROXY_ADMIN."""
+    cannot fan out health checks beyond their allowlist). litellm_params
+    secrets are redacted for every caller, admin included (LIT-6736); only the
+    virtual-key/header visibility stays gated on full PROXY_ADMIN."""
 
     @pytest.fixture(autouse=True)
     def _setup(self, monkeypatch):
@@ -501,7 +506,7 @@ class TestAgentRBACProxyAdminViewOnly:
                 agent_id=f"agent-{index}",
                 agent_name=f"Agent {index}",
                 agent_card_params=_sample_agent_card_params(),
-                litellm_params={"api_key": "sk-super-secret-agent-key"},
+                litellm_params={"api_key": SENTINEL_AGENT_API_KEY},
             )
             for index in (1, 2)
         ]
@@ -544,7 +549,7 @@ class TestAgentRBACProxyAdminViewOnly:
 
     def test_should_still_redact_secrets_for_view_only_admin(self):
         """An unrestricted viewer sees the same agents as an admin but with keys
-        stripped and litellm_params masked."""
+        stripped; litellm_params secrets never appear in either response."""
         self.allowed_agents_spy.return_value = UnrestrictedAgentAccess()
         viewer_resp = self._list_agents(self.viewer_client)
         admin_resp = self._list_agents(self.admin_client)
@@ -553,14 +558,12 @@ class TestAgentRBACProxyAdminViewOnly:
         viewer_by_id = {agent["agent_id"]: agent for agent in viewer_resp.json()}
         assert set(viewer_by_id) == {"agent-1", "agent-2"}
         assert viewer_by_id["agent-1"]["keys"] is None
-        assert "sk-super-secret-agent-key" not in viewer_resp.text
+        assert SENTINEL_AGENT_API_KEY not in viewer_resp.text
 
         admin_by_id = {agent["agent_id"]: agent for agent in admin_resp.json()}
         assert admin_by_id["agent-1"]["keys"][0]["token"] == "hash-aaa"
-        assert (
-            admin_by_id["agent-1"]["litellm_params"]["api_key"]
-            == "sk-super-secret-agent-key"
-        )
+        assert SENTINEL_AGENT_API_KEY not in admin_resp.text
+        assert admin_by_id["agent-1"]["litellm_params"]["api_key"] == REDACTED_BY_LITELM_STRING
 
 
 class TestAgentRBACProxyAdmin:
@@ -616,6 +619,109 @@ class TestAgentRBACProxyAdmin:
             # Security scheme is the LiteLLM scheme.
             assert "LiteLLMKey" in stored_card["securitySchemes"]
 
+    def test_create_agent_response_never_echoes_secret(self):
+        """LIT-6736: POST /v1/agents must not echo the stored secret back, even
+        though it's the caller's own value and even for a proxy admin."""
+        with patch("litellm.proxy.proxy_server.prisma_client"):  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            self.mock_registry.get_agent_by_name = MagicMock(return_value=None)
+            self.mock_registry.add_agent_to_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Test Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={
+                        "aws_secret_access_key": SENTINEL_AGENT_API_KEY,
+                        "model": "bedrock/agentcore/my-agent",
+                    },
+                )
+            )
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.post(
+                "/v1/agents",
+                json={
+                    "agent_name": "Test Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                    "litellm_params": {
+                        "aws_secret_access_key": SENTINEL_AGENT_API_KEY,
+                        "model": "bedrock/agentcore/my-agent",
+                    },
+                },
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            body = resp.json()
+            assert body["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+            assert body["litellm_params"]["model"] == "bedrock/agentcore/my-agent"
+
+    def test_update_agent_response_never_echoes_secret(self):
+        """LIT-6736: PUT /v1/agents/{id} must not echo the stored secret back."""
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+                return_value={
+                    "agent_id": "agent-123",
+                    "agent_name": "Existing Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                }
+            )
+            self.mock_registry.update_agent_in_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Test Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={"aws_secret_access_key": SENTINEL_AGENT_API_KEY},
+                )
+            )
+            self.mock_registry.deregister_agent = MagicMock()
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.put(
+                "/v1/agents/agent-123",
+                json={
+                    "agent_name": "Test Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                    "litellm_params": {"aws_secret_access_key": REDACTED_BY_LITELM_STRING},
+                },
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            assert resp.json()["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+
+    def test_patch_agent_response_never_echoes_secret(self):
+        """LIT-6736: PATCH /v1/agents/{id} must not echo the stored secret back."""
+        with patch("litellm.proxy.proxy_server.prisma_client") as mock_prisma:  # test-quality-ok: proxy_server module global is the endpoint's only injection point
+            mock_prisma.db.litellm_agentstable.find_unique = AsyncMock(
+                return_value={
+                    "agent_id": "agent-123",
+                    "agent_name": "Existing Agent",
+                    "agent_card_params": _sample_agent_card_params(),
+                }
+            )
+            self.mock_registry.patch_agent_in_db = AsyncMock(
+                return_value=AgentResponse(
+                    agent_id="agent-123",
+                    agent_name="Renamed Agent",
+                    agent_card_params=_sample_agent_card_params(),
+                    litellm_params={"aws_secret_access_key": SENTINEL_AGENT_API_KEY},
+                )
+            )
+            self.mock_registry.deregister_agent = MagicMock()
+            self.mock_registry.register_agent = MagicMock()
+
+            resp = self.admin_client.patch(
+                "/v1/agents/agent-123",
+                json={"agent_name": "Renamed Agent"},
+                headers={"Authorization": "Bearer k"},
+            )
+
+            assert resp.status_code == 200
+            assert SENTINEL_AGENT_API_KEY not in resp.text
+            assert resp.json()["litellm_params"]["aws_secret_access_key"] == REDACTED_BY_LITELM_STRING
+
     def test_should_allow_admin_to_delete_agent(self):
         existing = {
             "agent_id": "agent-123",
diff --git a/tests/test_litellm/proxy/auth/test_auth_checks.py b/tests/test_litellm/proxy/auth/test_auth_checks.py
index 3dea89ed67b..ffe3e0fee12 100644
--- a/tests/test_litellm/proxy/auth/test_auth_checks.py
+++ b/tests/test_litellm/proxy/auth/test_auth_checks.py
@@ -7448,3 +7448,64 @@ async def test_delete_cache_key_object_is_best_effort_when_the_cache_backend_fai
     healthy_cache.delete_cache.assert_called_once_with(key=hashed_token)
     healthy_logging_obj.internal_usage_cache.dual_cache.async_delete_cache.assert_awaited_once_with(key=hashed_token)
     assert caplog.records == [], "a healthy eviction must stay silent, and must still reach both caches"
+
+
+# ---------------------------------------------------------------------------
+# Budget-exceeded error text must not carry a raw virtual key (LIT-5909)
+# ---------------------------------------------------------------------------
+
+
+class _BudgetAlertRecorder:
+    async def budget_alerts(self, type, user_info):
+        return None
+
+
+async def _run_key_budget_check(key_name: str) -> str:
+    """Drive the over-budget key path and return the raised message."""
+    valid_token = UserAPIKeyAuth(
+        token="hashed-token",
+        key_name=key_name,
+        key_alias="prod-key",
+        spend=10.0,
+        max_budget=1.0,
+    )
+    with pytest.raises(litellm.BudgetExceededError, match="Budget has been exceeded") as exc_info:
+        await _virtual_key_max_budget_check(
+            valid_token=valid_token,
+            proxy_logging_obj=_BudgetAlertRecorder(),
+        )
+    await asyncio.sleep(0)
+    return exc_info.value.message
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "key_name",
+    [
+        "sk-mx5ous1o9Iezz5fj3pkLuA",
+        "my-company-key-2026",
+        "sk-...5LuA-but-longer",
+        # /key/generate takes a custom key ending in an escape sequence, and this
+        # message reaches a terminal and a log viewer
+        "sk-...\x1b[2J",
+        "sk-...a\x9bm",
+    ],
+)
+async def test_key_budget_error_does_not_carry_a_raw_key_name(key_name):
+    """key_name is written masked, but the column has no enforced shape (a direct DB
+    write bypasses abbreviate_api_key) and this message is returned to the caller."""
+    message = await _run_key_budget_check(key_name)
+    assert key_name not in message
+    assert "Key=prod-key Current cost" in message
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("key_name", ["sk-...5LuA", "sk-...", "sk-...ke.!", "sk-...café"])
+async def test_key_budget_error_keeps_the_masked_key_name(key_name):
+    """The masked form is the whole point of naming the key, so it must survive.
+
+    abbreviate_api_key takes the last four characters of the key verbatim, and a
+    custom key may end in punctuation or a non-ASCII character, so those masked
+    names are just as valid as the alphanumeric ones."""
+    message = await _run_key_budget_check(key_name)
+    assert f"Key=prod-key ({key_name}) Current cost" in message
diff --git a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
index 90be51cfa5b..21e0b83791f 100644
--- a/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
+++ b/tests/test_litellm/proxy/auth/test_auth_exception_handler.py
@@ -9,6 +9,7 @@ from prisma import errors as prisma_errors
 from prisma.engine.errors import (
     BinaryNotFoundError,
     EngineConnectionError,
+    EngineRequestError,
     MismatchedVersionsError,
 )
 from prisma.errors import (
@@ -32,6 +33,12 @@ from litellm.proxy._types import ProxyErrorTypes, ProxyException, UserAPIKeyAuth
 from litellm.proxy.auth.auth_exception_handler import UserAPIKeyAuthExceptionHandler
 
 
+class _EngineHttp500:
+    """The response half of an EngineRequestError: the query engine answered a request with HTTP 500."""
+
+    status = 500
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "db_error",
@@ -113,6 +120,90 @@ async def test_handle_authentication_error_permanent_fault_gets_no_fallback_iden
     assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE)
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "prisma_error",
+    [
+        pytest.param(BinaryNotFoundError("query engine binary not found"), id="BinaryNotFoundError"),
+        pytest.param(MismatchedVersionsError(expected="1", got="2"), id="MismatchedVersionsError"),
+        pytest.param(EngineRequestError(_EngineHttp500(), "query engine crashed"), id="EngineRequestError"),
+        pytest.param(PrismaError(), id="bare_PrismaError"),
+    ],
+)
+async def test_handle_authentication_error_permanent_fault_503_is_not_worded_as_transient(prisma_error):
+    """The 503 for a fault that never heals must not say the database is
+    "temporarily unreachable" and ask the caller to retry. The status is right
+    (the service is at fault) but that wording sends the operator to wait out an
+    outage that is not one, so the message has to say retrying will not help and
+    name the engine fault."""
+    handler = UserAPIKeyAuthExceptionHandler()
+
+    with patch(  # test-quality-ok: the handler reads general_settings off the proxy module, no injection seam
+        "litellm.proxy.proxy_server.general_settings", {"allow_requests_on_db_unavailable": False}
+    ):
+        with pytest.raises(ProxyException) as exc_info:
+            await handler._handle_authentication_error(prisma_error, MagicMock(), {}, "/test", None, "test-key")
+
+    assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE)
+    assert exc_info.value.type == ProxyErrorTypes.no_db_connection
+    assert "temporarily unreachable" not in exc_info.value.message
+    assert "retry shortly" not in exc_info.value.message.lower()
+    assert "will not clear by retrying" in exc_info.value.message
+    assert type(prisma_error).__name__ in exc_info.value.message
+
+
+@pytest.mark.asyncio
+async def test_handle_authentication_error_transport_error_raised_over_a_permanent_fault_names_the_fault():
+    """A reconnect attempt that fails because the engine binary is missing surfaces as a transport
+    error with the BinaryNotFoundError as __context__. The response must describe the binary, which is
+    what keeps the database down, rather than promise the connection will come back."""
+    try:
+        raise BinaryNotFoundError("query engine binary not found")
+    except BinaryNotFoundError:
+        try:
+            raise httpx.ConnectError("All connection attempts failed")
+        except httpx.ConnectError as surfaced:
+            transport_over_fault = surfaced
+    handler = UserAPIKeyAuthExceptionHandler()
+
+    with patch(  # test-quality-ok: the handler reads general_settings off the proxy module, no injection seam
+        "litellm.proxy.proxy_server.general_settings", {"allow_requests_on_db_unavailable": False}
+    ):
+        with pytest.raises(ProxyException) as exc_info:
+            await handler._handle_authentication_error(transport_over_fault, MagicMock(), {}, "/test", None, "k")
+
+    assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE)
+    assert "temporarily unreachable" not in exc_info.value.message
+    assert "BinaryNotFoundError" in exc_info.value.message
+    assert "will not clear by retrying" in exc_info.value.message
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "db_error",
+    [
+        pytest.param(httpx.ConnectError("All connection attempts failed"), id="ConnectError"),
+        pytest.param(EngineConnectionError(), id="EngineConnectionError"),
+        pytest.param(PrismaError("can't reach database server"), id="P1001_text"),
+    ],
+)
+async def test_handle_authentication_error_transient_outage_503_keeps_retry_wording(db_error):
+    """A genuine outage is expected to come back, so its 503 keeps telling the
+    caller the database is temporarily unreachable and to retry."""
+    handler = UserAPIKeyAuthExceptionHandler()
+
+    with patch(  # test-quality-ok: the handler reads general_settings off the proxy module, no injection seam
+        "litellm.proxy.proxy_server.general_settings", {"allow_requests_on_db_unavailable": False}
+    ):
+        with pytest.raises(ProxyException) as exc_info:
+            await handler._handle_authentication_error(db_error, MagicMock(), {}, "/test", None, "test-key")
+
+    assert exc_info.value.code == str(status.HTTP_503_SERVICE_UNAVAILABLE)
+    assert exc_info.value.message == (
+        "Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly."
+    )
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "prisma_error",
diff --git a/tests/test_litellm/proxy/auth/test_auth_utils.py b/tests/test_litellm/proxy/auth/test_auth_utils.py
index 9301176f3ed..f513f397b64 100644
--- a/tests/test_litellm/proxy/auth/test_auth_utils.py
+++ b/tests/test_litellm/proxy/auth/test_auth_utils.py
@@ -3169,7 +3169,7 @@ class TestIsRequestBodySafeChecksBracketNotationMetadata:
 
 
 class TestHasUserSetupSso:
-    """_has_user_setup_sso must treat SAML IdP metadata as SSO configured.
+    """has_user_setup_sso must treat SAML IdP metadata as SSO configured.
 
     Regression: UI discovery used this helper for sso_configured, but it only
     checked OAuth client IDs, so SAML-only setups left the login button gray.
@@ -3187,29 +3187,167 @@ class TestHasUserSetupSso:
             monkeypatch.delenv(key, raising=False)
 
     def test_false_when_no_sso_env(self):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
-        assert _has_user_setup_sso() is False
+        assert has_user_setup_sso() is False
 
     def test_true_for_oauth_client_ids(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
 
     def test_true_for_saml_metadata_url(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv(
             "SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml"
         )
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
 
     def test_true_for_saml_metadata_xml(self, monkeypatch):
-        from litellm.proxy.auth.auth_utils import _has_user_setup_sso
+        from litellm.proxy.auth.auth_utils import has_user_setup_sso
 
         monkeypatch.setenv("SAML_IDP_METADATA_XML", "<EntityDescriptor/>")
-        assert _has_user_setup_sso() is True
+        assert has_user_setup_sso() is True
+
+
+class TestIsSsoProviderFullyConfigured:
+    """A lone client id must not read as ready: `has_user_setup_sso()` only
+    checks the client id (correct for a UI-discovery "show the login button"
+    decision), but a gate that BLOCKS the password fallback needs every
+    companion setting the provider requires, or an incomplete setup locks
+    every admin out with no working login path at all."""
+
+    @pytest.fixture(autouse=True)
+    def _clear_sso_env(self, monkeypatch):
+        for key in (
+            "GOOGLE_CLIENT_ID",
+            "GOOGLE_CLIENT_SECRET",
+            "MICROSOFT_CLIENT_ID",
+            "MICROSOFT_CLIENT_SECRET",
+            "MICROSOFT_TENANT",
+            "GENERIC_CLIENT_ID",
+            "GENERIC_CLIENT_SECRET",
+            "GENERIC_AUTHORIZATION_ENDPOINT",
+            "GENERIC_TOKEN_ENDPOINT",
+            "GENERIC_USERINFO_ENDPOINT",
+            "SAML_IDP_METADATA_URL",
+            "SAML_IDP_METADATA_XML",
+        ):
+            monkeypatch.delenv(key, raising=False)
+
+    def test_false_when_nothing_configured(self):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        assert is_sso_provider_fully_configured() is False
+
+    def test_google_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_google_with_secret_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        monkeypatch.setenv("GOOGLE_CLIENT_SECRET", "google-secret")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_microsoft_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_microsoft_missing_tenant_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_microsoft_with_secret_and_tenant_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        monkeypatch.setenv("MICROSOFT_TENANT", "ms-tenant")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_generic_client_id_alone_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        assert is_sso_provider_fully_configured() is False
+
+    def test_generic_missing_one_endpoint_is_not_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        monkeypatch.setenv("GENERIC_CLIENT_SECRET", "generic-secret")
+        monkeypatch.setenv("GENERIC_AUTHORIZATION_ENDPOINT", "https://idp.example.com/authorize")
+        monkeypatch.setenv("GENERIC_TOKEN_ENDPOINT", "https://idp.example.com/token")
+        # GENERIC_USERINFO_ENDPOINT deliberately left unset.
+        assert is_sso_provider_fully_configured() is False
+
+    def test_generic_with_every_endpoint_is_ready(self, monkeypatch):
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GENERIC_CLIENT_ID", "generic-client")
+        monkeypatch.setenv("GENERIC_CLIENT_SECRET", "generic-secret")
+        monkeypatch.setenv("GENERIC_AUTHORIZATION_ENDPOINT", "https://idp.example.com/authorize")
+        monkeypatch.setenv("GENERIC_TOKEN_ENDPOINT", "https://idp.example.com/token")
+        monkeypatch.setenv("GENERIC_USERINFO_ENDPOINT", "https://idp.example.com/userinfo")
+        assert is_sso_provider_fully_configured() is True
+
+    def test_saml_metadata_url_is_ready_when_runtime_installed(self, monkeypatch):
+        from litellm.proxy.auth import auth_utils
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", lambda name: object())
+        assert auth_utils.is_sso_provider_fully_configured() is True
+
+    def test_saml_metadata_url_is_not_ready_without_runtime(self, monkeypatch):
+        """Regression: python3-saml (``onelogin.saml2``) is an optional
+        dependency; SAMLAuthHandler fails closed on every request when it is
+        not installed, so IdP metadata alone must not read as ready."""
+        from litellm.proxy.auth import auth_utils
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", lambda name: None)
+        assert auth_utils.is_sso_provider_fully_configured() is False
+
+    def test_saml_check_does_not_raise_when_package_entirely_absent(self, monkeypatch):
+        """Regression: `importlib.util.find_spec("onelogin.saml2.auth")`
+        raises ModuleNotFoundError (not merely returns None) when the
+        TOP-LEVEL `onelogin` package is not installed at all, which is
+        exactly the real-world "optional extra not installed" case. If the
+        gate does not catch this, every password login 500s instead of
+        falling back, on a deployment that configured SAML metadata but
+        skipped the extra."""
+        from litellm.proxy.auth import auth_utils
+
+        def _raise(name: str):
+            raise ModuleNotFoundError("No module named 'onelogin'")
+
+        monkeypatch.setenv("SAML_IDP_METADATA_URL", "https://idp.example.com/metadata.xml")
+        monkeypatch.setattr(auth_utils.importlib.util, "find_spec", _raise)
+        assert auth_utils.is_sso_provider_fully_configured() is False
+
+    def test_incomplete_earlier_provider_does_not_mask_a_ready_later_one(self, monkeypatch):
+        """Regression: a stray GOOGLE_CLIENT_ID with no secret (e.g. a
+        leftover from a migration) must not stop the check from reaching a
+        fully configured Microsoft provider set alongside it — every
+        provider is evaluated independently, not in a first-match order."""
+        from litellm.proxy.auth.auth_utils import is_sso_provider_fully_configured
+
+        monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_ID", "ms-client")
+        monkeypatch.setenv("MICROSOFT_CLIENT_SECRET", "ms-secret")
+        monkeypatch.setenv("MICROSOFT_TENANT", "ms-tenant")
+        assert is_sso_provider_fully_configured() is True
 
 
 class TestIsRequestBodySafeBlocksAwsIdentitySelectors:
diff --git a/tests/test_litellm/proxy/auth/test_login_utils.py b/tests/test_litellm/proxy/auth/test_login_utils.py
index 1c66acf8678..8d93d801bfd 100644
--- a/tests/test_litellm/proxy/auth/test_login_utils.py
+++ b/tests/test_litellm/proxy/auth/test_login_utils.py
@@ -6,6 +6,7 @@ to login_utils.py for better reusability.
 """
 
 import os
+from contextlib import ExitStack
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
@@ -598,3 +599,203 @@ class TestEncodeUiSessionJwt:
         request.cookies = {"token": token}
         with patch("litellm.proxy.proxy_server.master_key", "sk-master-for-tests"):
             assert _user_id_from_session_cookie(request) == "cornell-user"
+
+
+def _patch_sso_configured(stack: ExitStack, *, configured: bool) -> None:
+    stack.enter_context(
+        patch(  # test-quality-ok: no HTTP boundary here; same internal the pre-existing tests above already mock
+            "litellm.proxy.auth.login_utils.is_sso_provider_fully_configured", return_value=configured
+        )
+    )
+
+
+def _patch_successful_admin_login_deps(stack: ExitStack) -> None:
+    """The collaborators a real admin login exercises past the SSO gate:
+    generating the UI session key, syncing the admin role, and reading the
+    experimental-login flag. Shared so the two "still allowed" tests below
+    don't each repeat the same three-mock wiring."""
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.generate_key_helper_fn",
+            new_callable=AsyncMock,
+            return_value={"token": "test-token", "user_id": LITELLM_PROXY_ADMIN_NAME},
+        )
+    )
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.user_update",
+            new_callable=AsyncMock,
+            return_value=None,
+        )
+    )
+    stack.enter_context(
+        patch(  # test-quality-ok: internal orchestration, no HTTP boundary; matches pre-existing tests
+            "litellm.proxy.auth.login_utils.get_secret_bool",
+            return_value=False,
+        )
+    )
+
+
+class TestDisablePasswordLoginWhenSSOEnabled:
+    """`disable_password_login_when_sso_enabled` must reject every
+    username/password login attempt (including the UI_USERNAME/UI_PASSWORD
+    admin fallback) once SSO is configured, so SSO becomes the only way to
+    reach the Admin UI. It must not affect logins when SSO is unconfigured,
+    so admins can never lock themselves out with no SSO to fall back to."""
+
+    @pytest.mark.asyncio
+    async def test_rejects_correct_admin_credentials_when_sso_configured(self):
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(os.environ, {"UI_USERNAME": ui_username, "UI_PASSWORD": master_key}):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                with pytest.raises(ProxyException) as exc_info:
+                    await authenticate_user(
+                        username=ui_username,
+                        password=master_key,
+                        master_key=master_key,
+                        prisma_client=mock_prisma_client,
+                        general_settings={"disable_password_login_when_sso_enabled": True},
+                    )
+
+        assert exc_info.value.type == ProxyErrorTypes.auth_error
+        assert exc_info.value.code == "403"
+        # The credential comparison must never even run.
+        mock_prisma_client.db.litellm_usertable.find_first.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_rejects_correct_db_user_credentials_when_sso_configured(self):
+        master_key = "sk-1234"
+        user_email = "test@example.com"
+        password = "correct-password"
+
+        mock_user = LiteLLM_UserTable(
+            user_id="test-user-123",
+            user_email=user_email,
+            password=hash_token(token=password),
+            user_role=LitellmUserRoles.INTERNAL_USER,
+        )
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=mock_user)
+
+        with patch.dict(os.environ, {"UI_USERNAME": "admin", "UI_PASSWORD": "unrelated"}):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                with pytest.raises(ProxyException) as exc_info:
+                    await authenticate_user(
+                        username=user_email,
+                        password=password,
+                        master_key=master_key,
+                        prisma_client=mock_prisma_client,
+                        general_settings={"disable_password_login_when_sso_enabled": True},
+                    )
+
+        assert exc_info.value.code == "403"
+        mock_prisma_client.db.litellm_usertable.find_first.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_setting_enabled_but_sso_not_configured(self):
+        """The setting alone must not lock out an admin who has not actually
+        configured SSO — there would be no fallback left."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=False)
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={"disable_password_login_when_sso_enabled": True},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_sso_env_is_incomplete(self):
+        """Regression: a lone MICROSOFT_CLIENT_ID with no client secret or
+        tenant makes has_user_setup_sso() True, but a real SSO sign-in would
+        fail. The gate must read the real env (no is_sso_provider_fully_configured
+        mock here) and still let password login through, or an admin who set
+        one env var by mistake is locked out with no way in."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+                "MICROSOFT_CLIENT_ID": "ms-client-id-only",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={"disable_password_login_when_sso_enabled": True},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME
+
+    @pytest.mark.asyncio
+    async def test_allows_password_login_when_sso_configured_but_setting_not_enabled(self):
+        """SSO being configured must not, by itself, disable the password
+        fallback: the setting is opt-in."""
+        master_key = "sk-1234"
+        ui_username = "admin"
+
+        mock_prisma_client = MagicMock()
+        mock_prisma_client.db.litellm_usertable.find_first = AsyncMock(return_value=None)
+
+        with patch.dict(
+            os.environ,
+            {
+                "UI_USERNAME": ui_username,
+                "UI_PASSWORD": master_key,
+                "DATABASE_URL": "postgresql://test:test@localhost/test",
+            },
+            clear=True,
+        ):
+            with ExitStack() as stack:
+                _patch_sso_configured(stack, configured=True)
+                _patch_successful_admin_login_deps(stack)
+                result = await authenticate_user(
+                    username=ui_username,
+                    password=master_key,
+                    master_key=master_key,
+                    prisma_client=mock_prisma_client,
+                    general_settings={},
+                )
+
+        assert isinstance(result, LoginResult)
+        assert result.user_id == LITELLM_PROXY_ADMIN_NAME
diff --git a/tests/test_litellm/proxy/auth/test_onboarding.py b/tests/test_litellm/proxy/auth/test_onboarding.py
index d55a5472af1..524b655b465 100644
--- a/tests/test_litellm/proxy/auth/test_onboarding.py
+++ b/tests/test_litellm/proxy/auth/test_onboarding.py
@@ -231,7 +231,7 @@ async def test_claim_token_rejects_already_used_link():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -254,7 +254,7 @@ async def test_claim_token_rejects_expired_link():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -275,7 +275,7 @@ async def test_claim_token_rejects_mismatched_user_id():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="wrong-user",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with patch("litellm.proxy.proxy_server.prisma_client", prisma):
@@ -296,7 +296,7 @@ async def test_claim_token_rejects_missing_onboarding_token():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (
@@ -322,7 +322,7 @@ async def test_claim_token_rejects_wrong_onboarding_session():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
     request = _make_claim_request(
         _make_onboarding_token(invitation_link="other-invite")
@@ -351,7 +351,7 @@ async def test_claim_token_rejects_invalid_bearer_token():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
     request = _make_claim_request("sk-regular-key")
 
@@ -380,7 +380,7 @@ async def test_claim_token_rejects_concurrent_reuse_before_password_write():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (
@@ -418,7 +418,7 @@ async def test_claim_token_sets_accepted_at_after_password_written():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     mock_token_response = {"token": "sk-generated-key", "user_id": "user-123"}
@@ -477,7 +477,7 @@ async def test_claim_token_rolls_back_invite_when_session_key_mint_fails():
     data = InvitationClaim(
         invitation_link="invite-abc",
         user_id="user-123",
-        password="NewP@ssw0rd",
+        password="NewP@ssw0rd123",
     )
 
     with (
diff --git a/tests/test_litellm/proxy/auth/test_password_policy.py b/tests/test_litellm/proxy/auth/test_password_policy.py
new file mode 100644
index 00000000000..f6e7d443907
--- /dev/null
+++ b/tests/test_litellm/proxy/auth/test_password_policy.py
@@ -0,0 +1,136 @@
+"""
+Tests for the configurable password-strength policy in
+`litellm.proxy.auth.password_policy`, enforced on every path that persists a
+new or changed password for a locally-managed user.
+"""
+
+import pytest
+
+from litellm.proxy._types import ProxyErrorTypes, ProxyException
+from litellm.proxy.auth.password_policy import (
+    DEFAULT_MIN_LENGTH,
+    MIN_ALLOWED_LENGTH,
+    PasswordPolicy,
+    get_password_policy,
+    validate_password_policy,
+)
+
+STRONG_PASSWORD = "Str0ng!Passw0rd"
+
+
+def test_get_password_policy_defaults_to_pif_baseline():
+    policy = get_password_policy({})
+    assert policy == PasswordPolicy(
+        min_length=DEFAULT_MIN_LENGTH,
+        require_uppercase=True,
+        require_lowercase=True,
+        require_numbers=True,
+        require_special_characters=True,
+    )
+
+
+def test_get_password_policy_reads_overrides_from_general_settings():
+    policy = get_password_policy(
+        {
+            "password_policy_min_length": 20,
+            "password_policy_require_uppercase": False,
+            "password_policy_require_lowercase": False,
+            "password_policy_require_numbers": False,
+            "password_policy_require_special_characters": False,
+        }
+    )
+    assert policy == PasswordPolicy(
+        min_length=20,
+        require_uppercase=False,
+        require_lowercase=False,
+        require_numbers=False,
+        require_special_characters=False,
+    )
+
+
+def test_validate_password_policy_accepts_strong_password():
+    assert validate_password_policy(STRONG_PASSWORD, {}) is None
+
+
+@pytest.mark.parametrize(
+    "password,expected_fragment",
+    [
+        ("Sh0rt!Pw", "12 characters"),
+        ("weakpassword123!", "uppercase"),
+        ("WEAKPASSWORD123!", "lowercase"),
+        ("WeakPassword!!!!", "number"),
+        ("WeakPassword12345", "special character"),
+    ],
+)
+def test_validate_password_policy_rejects_each_missing_class(password, expected_fragment):
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy(password, {})
+    assert exc_info.value.code == "400"
+    assert exc_info.value.type == ProxyErrorTypes.validation_error
+    assert exc_info.value.param == "password"
+    assert expected_fragment in exc_info.value.message
+
+
+def test_validate_password_policy_reports_every_violation_at_once():
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("weak", {})
+    assert "12 characters" in exc_info.value.message
+    assert "uppercase" in exc_info.value.message
+    assert "number" in exc_info.value.message
+    assert "special character" in exc_info.value.message
+
+
+def test_validate_password_policy_honors_relaxed_config():
+    general_settings = {
+        "password_policy_min_length": MIN_ALLOWED_LENGTH,
+        "password_policy_require_special_characters": False,
+    }
+    # 8 chars, has upper/lower/number, no special char: fails default policy,
+    # passes the relaxed one above.
+    validate_password_policy("Abcd1234", general_settings)
+    with pytest.raises(ProxyException):
+        validate_password_policy("Abcd1234", {})
+
+
+def test_validate_password_policy_honors_stricter_min_length():
+    general_settings = {"password_policy_min_length": 20}
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy(STRONG_PASSWORD, general_settings)
+    assert "20 characters" in exc_info.value.message
+
+
+@pytest.mark.parametrize("configured_min_length", [0, -1, -100, 1, 7])
+def test_get_password_policy_floors_nonpositive_or_too_low_min_length(configured_min_length):
+    """A misconfigured min_length must never disable the length check
+    entirely: it floors at MIN_ALLOWED_LENGTH instead of passing through."""
+    policy = get_password_policy({"password_policy_min_length": configured_min_length})
+    assert policy.min_length == MIN_ALLOWED_LENGTH
+
+
+def test_validate_password_policy_rejects_short_password_even_with_zero_min_length_configured():
+    general_settings = {"password_policy_min_length": 0}
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("a", general_settings)
+    assert f"{MIN_ALLOWED_LENGTH} characters" in exc_info.value.message
+
+
+def test_get_password_policy_ignores_boolean_min_length():
+    """`bool` is a subclass of `int` in Python; a stray `true`/`false` value
+    must not silently coerce into a min_length of 1 or 0."""
+    policy = get_password_policy({"password_policy_min_length": False})
+    assert policy.min_length == DEFAULT_MIN_LENGTH
+
+
+def test_validate_password_policy_rejects_unicode_letter_as_special_character():
+    """Regression: an ASCII-only `[^A-Za-z0-9]` check would miscount an
+    accented letter as the required special character, so a letters-and-
+    digits-only password like this one (no real symbol) must still be
+    rejected."""
+    with pytest.raises(ProxyException) as exc_info:
+        validate_password_policy("Passwörd1234", {})
+    assert "special character" in exc_info.value.message
+
+
+def test_validate_password_policy_accepts_real_special_character_with_unicode_letters():
+    """Same base password as the rejection test above, plus an actual symbol."""
+    assert validate_password_policy("Passwörd1234!", {}) is None
diff --git a/tests/test_litellm/proxy/db/test_exception_handler.py b/tests/test_litellm/proxy/db/test_exception_handler.py
index d80e3acb4b8..c685d778c0e 100644
--- a/tests/test_litellm/proxy/db/test_exception_handler.py
+++ b/tests/test_litellm/proxy/db/test_exception_handler.py
@@ -1,12 +1,14 @@
 import asyncio
 import json
 import sys
+from typing import Final
 from unittest.mock import MagicMock, patch
 
 import httpx
 import pytest
 from fastapi import HTTPException, Request
 from prisma import errors as prisma_errors
+from prisma.engine.errors import BinaryNotFoundError, EngineConnectionError
 from prisma.errors import (
     ClientNotConnectedError,
     DataError,
@@ -317,6 +319,43 @@ def test_is_database_service_unavailable_error_in_chain_sees_through_wrapping():
     assert PrismaDBExceptionHandler.is_database_service_unavailable_error_in_chain(ValueError("nope")) is False
 
 
+def test_find_database_service_unavailable_error_in_chain_returns_the_wrapped_outage_itself():
+    """Wording a 503 by the kind of outage needs the wrapped database error, not the ValueError
+    get_user_object wrapped it in, so the finder must hand back the inner exception."""
+    outage = _wrapped_like_get_user_object(ConnectionError("can't reach database server"))
+    found = PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(outage)
+    assert isinstance(found, ConnectionError)
+    assert found is outage.__context__
+    missing_user = _wrapped_like_get_user_object(Exception())
+    assert PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(missing_user) is None
+
+
+def _raised_while_handling(inner, outer):
+    try:
+        raise inner
+    except BaseException:
+        try:
+            raise outer
+        except BaseException as surfaced:
+            return surfaced
+
+
+def test_permanent_fault_outranks_the_transient_error_that_surfaced_it():
+    """A reconnect that dies on a missing engine binary raises the transport error last, with the
+    BinaryNotFoundError left as __context__. The binary is what keeps the database down, so both the
+    finder and the 503 wording must pick it over the outer transient error, whichever way they nest."""
+    permanent = BinaryNotFoundError("query engine binary not found")
+    transient_over_permanent = _raised_while_handling(permanent, httpx.ConnectError("connection refused"))
+    permanent_over_transient = _raised_while_handling(httpx.ConnectError("connection refused"), permanent)
+
+    for chain in (transient_over_permanent, permanent_over_transient):
+        assert PrismaDBExceptionHandler.find_database_service_unavailable_error_in_chain(chain) is permanent
+        message = PrismaDBExceptionHandler.database_unavailable_message(chain)
+        assert "BinaryNotFoundError" in message
+        assert "will not clear by retrying" in message
+        assert "temporarily unreachable" not in message
+
+
 def test_is_database_service_unavailable_error_in_chain_terminates_on_a_cause_cycle():
     """The walk must terminate on a pathological __cause__ cycle rather than hang. Neither link is an
     outage, so the bounded walk returns False instead of looping forever."""
@@ -508,6 +547,51 @@ def test_permanent_prisma_faults_are_still_reported_as_service_problems(prisma_e
     assert PrismaDBExceptionHandler.is_database_service_unavailable_error(prisma_error) is True
 
 
+RECONNECTABLE_CLIENT_STATE_FAULTS = (prisma_errors.ClientNotConnectedError, prisma_errors.HTTPClientClosedError)
+
+
+@pytest.mark.parametrize("prisma_error", PERMANENT_PRISMA_FAULTS)
+def test_permanent_prisma_faults_are_worded_as_not_retryable(prisma_error):
+    """A 503 for a fault that never heals must not tell the operator to wait.
+
+    The status stays 503 (the service is at fault), but the message has to say
+    the outage is not transient and name the engine fault, or an operator
+    watching a version-skewed engine keeps retrying a request that can never
+    succeed. The two client-state faults a reconnect can repair keep the retry
+    wording."""
+    reconnectable = isinstance(prisma_error, RECONNECTABLE_CLIENT_STATE_FAULTS)
+    message = PrismaDBExceptionHandler.database_unavailable_message(prisma_error)
+
+    assert PrismaDBExceptionHandler.is_permanent_database_fault(prisma_error) is (not reconnectable)
+    assert message.startswith("Service Unavailable")
+    assert ("temporarily unreachable" in message) is reconnectable
+    assert ("Please retry shortly" in message) is reconnectable
+    assert ("will not clear by retrying" in message) is (not reconnectable)
+    assert (type(prisma_error).__name__ in message) is (not reconnectable)
+
+
+@pytest.mark.parametrize(
+    "transient_error",
+    [
+        pytest.param(httpx.ConnectError("All connection attempts failed"), id="ConnectError"),
+        pytest.param(ConnectionError("connection refused"), id="ConnectionError"),
+        pytest.param(EngineConnectionError(), id="EngineConnectionError"),
+        pytest.param(prisma_errors.PrismaError("can't reach database server"), id="P1001_text"),
+        pytest.param(
+            ProxyException(message="no db", type=ProxyErrorTypes.no_db_connection, param=None, code=503),
+            id="ProxyException",
+        ),
+    ],
+)
+def test_transient_outages_keep_the_retry_wording(transient_error):
+    """A genuine outage is expected to come back, so the retry guidance is the
+    right message and must not be replaced by the permanent-fault text."""
+    assert PrismaDBExceptionHandler.is_permanent_database_fault(transient_error) is False
+    assert PrismaDBExceptionHandler.database_unavailable_message(transient_error) == (
+        "Service Unavailable, the authentication database is temporarily unreachable. Please retry shortly."
+    )
+
+
 @pytest.mark.parametrize(
     "transient_error",
     [
@@ -579,3 +663,40 @@ def test_is_deadlock_error_matches_postgres_deadlock(error):
 def test_is_deadlock_error_excludes_non_deadlocks(error):
     """Non-deadlock prisma errors, connectivity failures, and non-prisma exceptions are not treated as deadlocks."""
     assert PrismaDBExceptionHandler.is_deadlock_error(error) is False
+
+
+MOCKED_PRISMA_PREDICATES: Final = (
+    PrismaDBExceptionHandler.is_database_infrastructure_error,
+    PrismaDBExceptionHandler.is_database_transport_error,
+    PrismaDBExceptionHandler.is_deadlock_error,
+    PrismaDBExceptionHandler.is_prisma_engine_internal_error,
+    PrismaDBExceptionHandler.is_database_service_unavailable_error,
+)
+
+
+@pytest.mark.parametrize("predicate", MOCKED_PRISMA_PREDICATES, ids=lambda p: p.__name__)
+def test_predicates_answer_false_for_a_plain_exception_when_prisma_is_mocked(predicate):
+    """Suites that swap ``sys.modules["prisma"]`` for a ``MagicMock`` hand the
+    predicates mocks in place of prisma's error classes. ``isinstance`` against
+    a mock raises ``TypeError``; the predicate must instead answer for the
+    non-prisma checks it still has."""
+    with patch.dict(sys.modules, {"prisma": MagicMock()}):
+        assert predicate(Exception("db connection dropped")) is False
+
+
+def test_infrastructure_error_still_recognizes_transport_errors_when_prisma_is_mocked():
+    """Skipping the prisma classes must not skip the checks that do not need them."""
+    with patch.dict(sys.modules, {"prisma": MagicMock()}):
+        no_db: Final = ProxyException(message="no db", type=ProxyErrorTypes.no_db_connection, param=None, code=503)
+        assert PrismaDBExceptionHandler.is_database_infrastructure_error(httpx.ConnectError("refused")) is True
+        assert PrismaDBExceptionHandler.is_database_infrastructure_error(no_db) is True
+
+
+def test_connection_error_answers_when_prisma_is_mocked_after_import():
+    """``prisma.engine`` is already loaded in a real process, so a mock parent
+    still resolves ``prisma.engine.errors``; its classes are then mocks too."""
+    import prisma.engine.errors  # noqa: F401
+
+    with patch.dict(sys.modules, {"prisma": MagicMock()}):
+        assert PrismaDBExceptionHandler.is_database_connection_error(Exception("x")) is False
+        assert PrismaDBExceptionHandler.is_database_connection_error(httpx.ConnectError("refused")) is True
diff --git a/tests/test_litellm/proxy/discovery_endpoints/test_ui_discovery_endpoints.py b/tests/test_litellm/proxy/discovery_endpoints/test_ui_discovery_endpoints.py
index f4da8c941a4..c3f7b0100d8 100644
--- a/tests/test_litellm/proxy/discovery_endpoints/test_ui_discovery_endpoints.py
+++ b/tests/test_litellm/proxy/discovery_endpoints/test_ui_discovery_endpoints.py
@@ -18,7 +18,7 @@ def test_ui_discovery_endpoints_with_defaults():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -41,7 +41,7 @@ def test_ui_discovery_endpoints_with_custom_server_root_path():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/litellm"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -66,7 +66,7 @@ def test_ui_discovery_endpoints_with_proxy_base_url_when_set():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
 
@@ -91,7 +91,7 @@ def test_ui_discovery_endpoints_with_sso_configured_and_auto_redirect_enabled():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -121,7 +121,7 @@ def test_ui_discovery_endpoints_with_sso_configured_and_auto_redirect_not_set_de
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
         # Ensure AUTO_REDIRECT_UI_LOGIN_TO_SSO is not set (simulate default)
@@ -148,7 +148,7 @@ def test_ui_discovery_endpoints_with_sso_configured_but_auto_redirect_disabled()
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "false", "DISABLE_ADMIN_UI": "false"},
@@ -174,7 +174,7 @@ def test_ui_discovery_endpoints_with_sso_not_configured_but_auto_redirect_enable
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -203,7 +203,7 @@ def test_ui_discovery_endpoints_both_routes_return_same_data():
             "litellm.proxy.utils.get_proxy_base_url",
             return_value="https://proxy.example.com",
         ),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch.dict(
             os.environ,
             {"AUTO_REDIRECT_UI_LOGIN_TO_SSO": "true", "DISABLE_ADMIN_UI": "false"},
@@ -228,7 +228,7 @@ def test_ui_discovery_endpoints_with_auto_redirect_via_general_settings():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"auto_redirect_ui_login_to_sso": True},
@@ -254,7 +254,7 @@ def test_ui_discovery_endpoints_with_auto_redirect_env_var_overrides_general_set
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=True),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=True),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"auto_redirect_ui_login_to_sso": False},
@@ -281,7 +281,7 @@ def test_ui_discovery_endpoints_with_admin_ui_disabled():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "true"}, clear=False),
     ):
 
@@ -311,7 +311,7 @@ def test_ui_discovery_endpoints_is_control_plane_true_when_workers_configured():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch("litellm.proxy.proxy_server.proxy_config", mock_config),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
@@ -336,7 +336,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_default_false():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
         os.environ.pop("LITELLM_HIDE_DEFAULT_CREDENTIALS_HINT", None)
@@ -357,7 +357,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_via_env_var():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch.dict(
             os.environ,
             {
@@ -384,7 +384,7 @@ def test_ui_discovery_endpoints_hide_default_credentials_hint_via_general_settin
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch(
             "litellm.proxy.proxy_server.general_settings",
             {"hide_default_credentials_hint": True},
@@ -411,7 +411,7 @@ def test_ui_discovery_endpoints_is_control_plane_false_when_no_workers():
     with (
         patch("litellm.proxy.utils.get_server_root_path", return_value="/"),
         patch("litellm.proxy.utils.get_proxy_base_url", return_value=None),
-        patch("litellm.proxy.auth.auth_utils._has_user_setup_sso", return_value=False),
+        patch("litellm.proxy.auth.auth_utils.has_user_setup_sso", return_value=False),
         patch("litellm.proxy.proxy_server.proxy_config", mock_config),
         patch.dict(os.environ, {"DISABLE_ADMIN_UI": "false"}, clear=False),
     ):
diff --git a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_headroom.py b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_headroom.py
index 1fbc975e40a..c04fb7b30ec 100644
--- a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_headroom.py
+++ b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_headroom.py
@@ -2199,6 +2199,164 @@ async def test_history_is_still_compressed(guardrail: HeadroomGuardrail):
     assert has_headroom_retrieve_tool(result.get("tools") or [])
 
 
+# ---------------------------------------------------------------------------
+# #38558: a client that runs its own tool loop (e.g. Claude Code via the MCP
+# gateway) executes headroom_retrieve and echoes the recovered original content
+# back as a tool result. Compressing that row re-derives the same content hash
+# it was just retrieved from -- the marker returns and the agent loops. The
+# retrieved row must be held back from the compression service.
+# ---------------------------------------------------------------------------
+
+RETRIEVE_ECHO_MESSAGES = [
+    {"role": "system", "content": "You are Claude Code. " + "S" * 5000},
+    {"role": "user", "content": "H" * 5000},
+    {
+        "role": "assistant",
+        "content": "Expanding the marker.",
+        "tool_calls": [
+            {
+                "id": "hr_1",
+                "type": "function",
+                "function": {
+                    "name": "mcp__headroom__headroom_retrieve",
+                    "arguments": '{"hash": "b573993006976af767214fac"}',
+                },
+            }
+        ],
+    },
+    {"role": "tool", "tool_call_id": "hr_1", "content": "RETRIEVED BODY " + "R" * 5000},
+    {"role": "assistant", "content": "Older answer. " + "O" * 5000},
+    {"role": "user", "content": "now summarize the description"},
+]
+
+
+@pytest.mark.asyncio
+async def test_retrieved_content_is_never_recompressed(guardrail: HeadroomGuardrail):
+    """The tool result carrying headroom_retrieve output is held back, so it can
+    never collapse back to the hash it was just retrieved from."""
+    wire, result = await _wire_and_result(guardrail, RETRIEVE_ECHO_MESSAGES)
+
+    assert not any(row.get("tool_call_id") == "hr_1" for row in wire)
+    assert not any("RETRIEVED BODY" in json.dumps(row) for row in wire)
+    # Reaches the model byte-identical, so no marker stands in for the expansion.
+    assert result["structured_messages"][3] == RETRIEVE_ECHO_MESSAGES[3]
+    # Negative control: unrelated history is still compressed, not a no-op.
+    assert any(row.get("content") == "H" * 5000 for row in wire)
+
+
+@pytest.mark.asyncio
+async def test_retrieved_content_guard_matches_direct_tool_name(guardrail: HeadroomGuardrail):
+    """Server-side the tool is named headroom_retrieve (no MCP prefix); its
+    result must be protected the same way."""
+    messages = [
+        {"role": "system", "content": "sys " + "S" * 5000},
+        {"role": "user", "content": "H" * 5000},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {
+                    "id": "hr_direct",
+                    "type": "function",
+                    "function": {"name": HEADROOM_RETRIEVE_TOOL_NAME, "arguments": "{}"},
+                }
+            ],
+        },
+        {"role": "tool", "tool_call_id": "hr_direct", "content": "RETRIEVED BODY " + "R" * 5000},
+        {"role": "assistant", "content": "Older. " + "O" * 5000},
+        {"role": "user", "content": "summarize"},
+    ]
+    wire, result = await _wire_and_result(guardrail, messages)
+
+    assert not any(row.get("tool_call_id") == "hr_direct" for row in wire)
+    assert result["structured_messages"][3] == messages[3]
+
+
+@pytest.mark.asyncio
+async def test_retrieved_content_protected_when_mcp_tool_name_is_truncated(guardrail: HeadroomGuardrail):
+    """A long mcp__<server>__headroom_retrieve name is truncated past 64 chars in
+    the OpenAI-translated view the guardrail scans, dropping the suffix. The call
+    id read from the request's own Anthropic tool_use (never truncated) still
+    pairs the retrieved row so it is held back."""
+    from litellm.llms.anthropic.experimental_pass_through.adapters.transformation import (
+        truncate_tool_name,
+    )
+
+    long_name = "mcp__" + "s" * 45 + "__" + HEADROOM_RETRIEVE_TOOL_NAME
+    assert len(long_name) > 64
+    truncated = truncate_tool_name(long_name)
+    assert not truncated.endswith(HEADROOM_RETRIEVE_TOOL_NAME)
+
+    # What the guardrail scans: OpenAI-translated messages with the truncated name.
+    structured = [
+        {"role": "system", "content": "sys " + "S" * 5000},
+        {"role": "user", "content": "H" * 5000},
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [{"id": "hr_long", "type": "function", "function": {"name": truncated, "arguments": "{}"}}],
+        },
+        {"role": "tool", "tool_call_id": "hr_long", "content": "RETRIEVED BODY " + "R" * 5000},
+        {"role": "assistant", "content": "Older. " + "O" * 5000},
+        {"role": "user", "content": "summarize"},
+    ]
+    # The request's own messages, untranslated: Anthropic tool_use carries the full name.
+    raw_messages = [
+        {"role": "assistant", "content": [{"type": "tool_use", "id": "hr_long", "name": long_name, "input": {}}]},
+        {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "hr_long", "content": "RETRIEVED BODY"}]},
+    ]
+
+    inputs = GenericGuardrailAPIInputs(texts=["x"], structured_messages=json.loads(json.dumps(structured)))
+    sent: dict = {}
+
+    def _echo(**kwargs):
+        sent["messages"] = kwargs["json"]["messages"]
+        return _make_compress_response(json.loads(json.dumps(kwargs["json"]["messages"])))
+
+    with patch.object(guardrail.async_handler, "post", new_callable=AsyncMock, side_effect=_echo):
+        result = await guardrail.apply_guardrail(
+            inputs=inputs,
+            request_data={"model": "claude-sonnet-4-5-20250929", "messages": raw_messages},
+            input_type="request",
+        )
+
+    assert not any(row.get("tool_call_id") == "hr_long" for row in sent["messages"])
+    assert result["structured_messages"][3] == structured[3]
+    assert any(row.get("content") == "H" * 5000 for row in sent["messages"])
+
+
+def test_raw_retrieve_call_ids_covers_both_shapes_and_ignores_others():
+    """Retrieve ids are read from OpenAI tool_calls and Anthropic tool_use blocks;
+    non-retrieve calls, non-tool_use blocks, string content, and non-list inputs
+    yield nothing."""
+    from litellm.proxy.guardrails.guardrail_hooks.headroom.headroom import _raw_retrieve_call_ids
+
+    messages = [
+        {
+            "role": "assistant",
+            "tool_calls": [
+                {"id": "oa1", "function": {"name": HEADROOM_RETRIEVE_TOOL_NAME}},
+                {"id": "other", "function": {"name": "get_weather"}},
+                {"id": "malformed", "function": {"name": 123}},
+                {"id": "nofunc"},
+            ],
+        },
+        {
+            "role": "assistant",
+            "content": [
+                {"type": "tool_use", "id": "an1", "name": "mcp__hr__headroom_retrieve", "input": {}},
+                {"type": "tool_use", "id": "an2", "name": "jira_get_issue", "input": {}},
+                {"type": "text", "text": "noise"},
+            ],
+        },
+        {"role": "user", "content": "plain string content, not a list"},
+    ]
+
+    assert _raw_retrieve_call_ids(messages) == frozenset({"oa1", "an1"})
+    assert _raw_retrieve_call_ids("not a list") == frozenset()
+    assert _raw_retrieve_call_ids(None) == frozenset()
+
+
 @pytest.mark.asyncio
 async def test_nothing_compressible_returns_inputs_untouched(guardrail: HeadroomGuardrail):
     """A single-turn request is all protected, so there is nothing to send and
diff --git a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_presidio.py b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_presidio.py
index 4ee6741ee02..84f7611c0c0 100644
--- a/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_presidio.py
+++ b/tests/test_litellm/proxy/guardrails/guardrail_hooks/test_presidio.py
@@ -842,24 +842,37 @@ async def test_presidio_filter_scope_initializer(monkeypatch):
 
     params_input = LitellmParams(guardrail="presidio", mode="pre_call", presidio_filter_scope="input")
     guardrail_dict = {"guardrail_name": "g1"}
-    cb = initialize_presidio(params_input, guardrail_dict)
-    assert cb is created[0]
+    callbacks = initialize_presidio(params_input, guardrail_dict)
+    assert callbacks == (created[0],)
     assert created[0].apply_to_output is False
 
     # output-only
     created.clear()
     params_output = LitellmParams(guardrail="presidio", mode="pre_call", presidio_filter_scope="output")
-    cb = initialize_presidio(params_output, guardrail_dict)
+    callbacks = initialize_presidio(params_output, guardrail_dict)
     assert len(created) == 1
+    assert callbacks == (created[0],)
     assert created[0].apply_to_output is True
 
-    # both -> expect two callbacks (input + output)
+    # both -> expect two callbacks (input + output), both returned, input first
     created.clear()
     params_both = LitellmParams(guardrail="presidio", mode="pre_call", presidio_filter_scope="both")
-    cb = initialize_presidio(params_both, guardrail_dict)
+    callbacks = initialize_presidio(params_both, guardrail_dict)
     assert len(created) == 2
-    assert any(not c.apply_to_output for c in created)
-    assert any(c.apply_to_output for c in created)
+    assert callbacks == tuple(created)
+    assert callbacks[0].apply_to_output is False
+    assert callbacks[1].apply_to_output is True
+
+    # both + output_parse_pii -> three callbacks, all returned, input first
+    created.clear()
+    params_all = LitellmParams(
+        guardrail="presidio", mode="pre_call", presidio_filter_scope="both", output_parse_pii=True
+    )
+    callbacks = initialize_presidio(params_all, guardrail_dict)
+    assert len(created) == 3
+    assert callbacks == tuple(created)
+    assert callbacks[0].apply_to_output is False
+    assert mgr.added[-3:] == list(created)
 
 
 @pytest.mark.asyncio
@@ -3116,6 +3129,18 @@ def test_update_in_memory_applies_analyze_chunk_size():
     assert guardrail.presidio_analyze_chunk_size_bytes == 99_000
 
 
+def test_update_in_memory_keeps_output_masker_from_unmasking():
+    masker = _OPTIONAL_PresidioPIIMasking(mock_testing=True, apply_to_output=True, output_parse_pii=False)
+    unmasker = _OPTIONAL_PresidioPIIMasking(mock_testing=True, output_parse_pii=True)
+    params = LitellmParams(guardrail="presidio", mode="pre_call", output_parse_pii=True)
+
+    masker.update_in_memory_litellm_params(params)
+    unmasker.update_in_memory_litellm_params(params)
+
+    assert (masker.apply_to_output, masker.output_parse_pii) == (True, False)
+    assert (unmasker.apply_to_output, unmasker.output_parse_pii) == (False, True)
+
+
 def test_merge_drops_truncated_same_type_fragment_from_overlap():
     """A boundary entity seen truncated by chunk 1 and whole by chunk 2 must
     merge to the single full span; keeping both overlapping spans corrupts the
diff --git a/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py b/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
index 2c0735970d3..24742e1bac2 100644
--- a/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
+++ b/tests/test_litellm/proxy/guardrails/test_guardrail_registry.py
@@ -1,3 +1,4 @@
+from collections.abc import Iterable
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
@@ -491,6 +492,144 @@ def test_repeated_db_sync_does_not_accumulate_runner_instances():
             cb_list[:] = snapshot
 
 
+PRESIDIO_SIBLINGS_GID = "55555555-5555-5555-5555-555555555555"
+PRESIDIO_SIBLINGS_NAME = "presidio-siblings"
+
+
+def _presidio_db_guardrail(pii_entities_config: dict[str, str]) -> Guardrail:
+    return Guardrail(
+        guardrail_id=PRESIDIO_SIBLINGS_GID,
+        guardrail_name=PRESIDIO_SIBLINGS_NAME,
+        litellm_params={
+            "guardrail": "presidio",
+            "mode": "pre_call",
+            "default_on": True,
+            "output_parse_pii": True,
+            "presidio_filter_scope": "both",
+            "presidio_analyzer_api_base": "https://fakelink.com/v1/presidio/analyze",
+            "presidio_anonymizer_api_base": "https://fakelink.com/v1/presidio/anonymize",
+            "pii_entities_config": pii_entities_config,
+        },
+    )
+
+
+def _presidio_callbacks_in(cb_list: Iterable[object]) -> list[CustomGuardrail]:
+    return [
+        callback
+        for callback in cb_list
+        if isinstance(callback, CustomGuardrail) and getattr(callback, "guardrail_name", None) == PRESIDIO_SIBLINGS_NAME
+    ]
+
+
+def test_presidio_siblings_are_tracked_and_deleted_together():
+    """
+    A presidio guardrail scoped to both stages registers the pre_call primary plus
+    the post_call unmask and mask-output siblings. Deleting the guardrail must remove
+    all three from every callback list, not just the primary.
+    """
+    import litellm
+
+    handler = InMemoryGuardrailHandler()
+    lists = _all_callback_lists()
+    snapshots = [list(cb_list) for cb_list in lists]
+    try:
+        handler.initialize_guardrail(_presidio_db_guardrail({"EMAIL_ADDRESS": "MASK"}))
+
+        registered = _presidio_callbacks_in(litellm.callbacks)
+        assert len(registered) == 3
+        primary = handler.guardrail_id_to_custom_guardrail[PRESIDIO_SIBLINGS_GID]
+        siblings = handler.guardrail_id_to_sibling_callbacks[PRESIDIO_SIBLINGS_GID]
+        assert primary is registered[0]
+        assert siblings == tuple(registered[1:])
+        assert [sibling.event_hook for sibling in siblings] == [GuardrailEventHooks.post_call] * 2
+
+        for cb_list in lists[1:]:
+            cb_list.extend(registered)
+
+        handler.delete_in_memory_guardrail(PRESIDIO_SIBLINGS_GID)
+
+        for cb_list in lists:
+            assert _presidio_callbacks_in(cb_list) == []
+        assert PRESIDIO_SIBLINGS_GID not in handler.guardrail_id_to_custom_guardrail
+        assert PRESIDIO_SIBLINGS_GID not in handler.guardrail_id_to_sibling_callbacks
+    finally:
+        for cb_list, snapshot in zip(lists, snapshots):
+            cb_list[:] = snapshot
+
+
+def test_update_in_memory_guardrail_reaches_presidio_siblings_and_keeps_their_stage():
+    import litellm
+
+    handler = InMemoryGuardrailHandler()
+    lists = _all_callback_lists()
+    snapshots = [list(cb_list) for cb_list in lists]
+    try:
+        handler.initialize_guardrail(_presidio_db_guardrail({"EMAIL_ADDRESS": "MASK", "IP_ADDRESS": "MASK"}))
+        tracked = _presidio_callbacks_in(litellm.callbacks)
+        roles_before = [
+            (callback.apply_to_output, callback.output_parse_pii, callback.event_hook) for callback in tracked
+        ]
+        assert roles_before == [
+            (False, True, [GuardrailEventHooks.pre_call, GuardrailEventHooks.post_call]),
+            (False, True, GuardrailEventHooks.post_call),
+            (True, False, GuardrailEventHooks.post_call),
+        ]
+
+        updated = Guardrail(
+            guardrail_id=PRESIDIO_SIBLINGS_GID,
+            guardrail_name=PRESIDIO_SIBLINGS_NAME,
+            litellm_params=LitellmParams(
+                guardrail="presidio",
+                mode="pre_call",
+                default_on=True,
+                output_parse_pii=True,
+                presidio_filter_scope="both",
+                presidio_analyzer_api_base="https://fakelink.com/v1/presidio/analyze",
+                presidio_anonymizer_api_base="https://fakelink.com/v1/presidio/anonymize",
+                pii_entities_config={"EMAIL_ADDRESS": "MASK"},
+            ),
+        )
+        handler.update_in_memory_guardrail(guardrail_id=PRESIDIO_SIBLINGS_GID, guardrail=updated)
+
+        assert [callback.pii_entities_config for callback in tracked] == [{"EMAIL_ADDRESS": "MASK"}] * 3
+        assert [
+            (callback.apply_to_output, callback.output_parse_pii, callback.event_hook) for callback in tracked
+        ] == roles_before
+        assert _presidio_callbacks_in(litellm.callbacks) == tracked
+    finally:
+        for cb_list, snapshot in zip(lists, snapshots):
+            cb_list[:] = snapshot
+
+
+def test_repeated_db_sync_replaces_presidio_siblings_instead_of_leaking_stale_ones():
+    """
+    The callback manager dedupes custom loggers by their scalar attributes, so a
+    leaked post_call sibling blocks the re-initialized sibling from registering and
+    keeps serving the previous entity config. After every DB re-sync, each callback
+    list must hold exactly the three current instances, all on the latest config.
+    """
+    import litellm
+
+    handler = InMemoryGuardrailHandler()
+    lists = _all_callback_lists()
+    snapshots = [list(cb_list) for cb_list in lists]
+    try:
+        entity_configs = [{"EMAIL_ADDRESS": "MASK"}, {"EMAIL_ADDRESS": "MASK", "IP_ADDRESS": "MASK"}]
+        for cycle in range(4):
+            latest = entity_configs[cycle % 2]
+            handler.sync_guardrail_from_db(_presidio_db_guardrail(latest))
+            for cb_list in lists[1:]:
+                cb_list.extend(_presidio_callbacks_in(litellm.callbacks))
+
+            for cb_list in lists:
+                current = _presidio_callbacks_in(cb_list)
+                assert len({id(callback) for callback in current}) == 3
+                assert all(callback.pii_entities_config == latest for callback in current)
+    finally:
+        for cb_list, snapshot in zip(lists, snapshots):
+            cb_list[:] = snapshot
+
+
 def _judge_guardrail(guardrail_id: str) -> Guardrail:
     return Guardrail(
         guardrail_id=guardrail_id,
diff --git a/tests/test_litellm/proxy/management_endpoints/test_internal_user_endpoints.py b/tests/test_litellm/proxy/management_endpoints/test_internal_user_endpoints.py
index 8bce967b316..f231eb66a50 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_internal_user_endpoints.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_internal_user_endpoints.py
@@ -4220,3 +4220,88 @@ async def test_user_new_persists_model_max_budget(
     )
 
     assert captured["user_data"].get("model_max_budget") == expected_written
+
+
+@pytest.fixture
+def _admin_prisma(mocker):
+    """A mocked prisma_client wired in as proxy_server's module globals, for
+    the password-policy tests below (mirrors the pattern every other test in
+    this file repeats per-test; consolidated here since these three share it
+    verbatim)."""
+    mock_prisma_client = mocker.MagicMock()
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.prisma_client", mock_prisma_client
+    )
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.litellm_proxy_admin_name", "admin"
+    )
+    return mock_prisma_client
+
+
+@pytest.mark.asyncio
+async def test_user_update_rejects_weak_password(_admin_prisma):
+    """/user/update must reject a password that fails the configured
+    policy before it ever reaches the DB write."""
+    from litellm.proxy._types import ProxyException
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    user_request = UpdateUserRequest(user_id="target-user", password="short1!")
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    with pytest.raises(ProxyException) as exc_info:
+        await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    assert exc_info.value.code == "400"
+    _admin_prisma.db.litellm_usertable.find_first.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_user_update_rejects_weak_password_against_configured_policy(_admin_prisma, mocker):
+    """A password that meets the default policy but not a stricter
+    admin-configured one must still be rejected."""
+    from litellm.proxy._types import ProxyException
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    mocker.patch(  # test-quality-ok: same module-global mocking every test in this file already uses
+        "litellm.proxy.proxy_server.general_settings",
+        {"password_policy_min_length": 24},
+    )
+
+    user_request = UpdateUserRequest(user_id="target-user", password="Str0ng!Passw0rd")
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    with pytest.raises(ProxyException) as exc_info:
+        await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    assert "24 characters" in exc_info.value.message
+
+
+@pytest.mark.asyncio
+async def test_user_update_hashes_and_persists_strong_password(_admin_prisma, mocker):
+    """A password meeting the policy is hashed (never stored in plaintext)
+    and reaches the DB write."""
+    from litellm.proxy.management_endpoints.internal_user_endpoints import (
+        _update_single_user_helper,
+    )
+
+    mock_prisma_client = _admin_prisma
+    existing_user = mocker.MagicMock()
+    existing_user.model_dump.return_value = {"user_id": "target-user"}
+    existing_user.user_id = "target-user"
+    mock_prisma_client.db.litellm_usertable.find_first = mocker.AsyncMock(return_value=existing_user)
+    mock_prisma_client.update_data = mocker.AsyncMock(return_value={"user_id": "target-user"})
+    mock_prisma_client.jsonify_object = mocker.MagicMock(side_effect=lambda x: x)
+
+    strong_password = "Str0ng!Passw0rd"
+    user_request = UpdateUserRequest(user_id="target-user", password=strong_password)
+    admin_caller = UserAPIKeyAuth(user_id="admin-1", user_role=LitellmUserRoles.PROXY_ADMIN)
+
+    await _update_single_user_helper(user_request=user_request, user_api_key_dict=admin_caller)
+
+    written_data = mock_prisma_client.update_data.call_args.kwargs["data"]
+    assert written_data.get("password") is not None
+    assert written_data["password"] != strong_password
diff --git a/tests/test_litellm/proxy/openai_files_endpoint/test_files_endpoint.py b/tests/test_litellm/proxy/openai_files_endpoint/test_files_endpoint.py
index 87e0319f6a1..bca97915347 100644
--- a/tests/test_litellm/proxy/openai_files_endpoint/test_files_endpoint.py
+++ b/tests/test_litellm/proxy/openai_files_endpoint/test_files_endpoint.py
@@ -4555,3 +4555,114 @@ def test_create_file_async_pre_call_hook_rejection_blocks_upload(monkeypatch, ll
     assert response.status_code == 400, response.text
     assert "file upload not allowed" in response.text
     assert provider_route.call_count == 0
+
+
+def test_create_file_non_batch_over_max_file_size_mb_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    """max_file_size_mb applies to every purpose, unlike the batch-only max_batch_file_size_mb."""
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "max_file_size_mb", 1)
+
+    oversized = b"x" * (2 * 1024 * 1024)
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("labels.jsonl", oversized, "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 413, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert "max_file_size_mb" in error["message"]
+    assert "1 MB" in error["message"]
+    assert forwarded_calls == []
+
+
+def test_create_file_non_batch_under_max_file_size_mb_forwards(monkeypatch, llm_router: Router):
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "max_file_size_mb", 1)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("labels.jsonl", b"small content", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 200, response.text
+    assert len(forwarded_calls) == 1
+
+
+def test_create_file_blocked_extension_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    import litellm.proxy.proxy_server as ps
+
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+    monkeypatch.setitem(ps.general_settings, "blocked_file_extensions", [".exe", ".sh"])
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("payload.exe", b"MZ\x90\x00", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 400, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert ".exe" in error["message"]
+    assert "blocked_file_extensions" in error["message"]
+    assert forwarded_calls == []
+
+
+def test_create_file_blocked_extension_unset_allows_everything(monkeypatch, llm_router: Router):
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("payload.exe", b"MZ\x90\x00", "application/octet-stream")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 200, response.text
+    assert len(forwarded_calls) == 1
+
+
+def test_create_file_path_traversal_filename_rejected_before_forwarding(monkeypatch, llm_router: Router):
+    """A filename carrying a directory-traversal component must never reach storage or the provider."""
+    forwarded_calls = _setup_batch_upload_endpoint(monkeypatch, llm_router)
+
+    try:
+        response = client.post(
+            "/v1/files",
+            files={"file": ("../../etc/passwd", b"malicious content", "text/plain")},
+            data={"purpose": "user_data"},
+            headers={"Authorization": "Bearer test-key"},
+        )
+    finally:
+        _teardown_batch_upload_endpoint()
+
+    assert response.status_code == 400, response.text
+    error = response.json()["error"]
+    assert error["type"] == "invalid_request_error"
+    assert error["param"] == "file"
+    assert "traversal" in error["message"].lower()
+    assert forwarded_calls == []
diff --git a/tests/test_litellm/proxy/openai_files_endpoint/test_general_upload_validation.py b/tests/test_litellm/proxy/openai_files_endpoint/test_general_upload_validation.py
new file mode 100644
index 00000000000..9f7dd914e4a
--- /dev/null
+++ b/tests/test_litellm/proxy/openai_files_endpoint/test_general_upload_validation.py
@@ -0,0 +1,134 @@
+import io
+
+import pytest
+
+from litellm.proxy._types import ProxyException
+from litellm.proxy.openai_files_endpoints.general_upload_validation import (
+    MB,
+    UploadedFileBlockedExtension,
+    UploadedFileTooLarge,
+    UploadedFileUnsafeFilename,
+    check_blocked_extension,
+    check_unsafe_filename,
+    check_upload_file_size,
+    raise_upload_validation_failure,
+)
+
+
+def test_size_under_cap_allowed():
+    assert check_upload_file_size(b"x" * 100, 1) is None
+
+
+def test_size_over_cap_rejected_for_bytes():
+    content = b"x" * (2 * MB)
+    assert check_upload_file_size(content, 1) == UploadedFileTooLarge(size_bytes=len(content), limit_mb=1)
+
+
+def test_size_over_cap_rejected_for_binaryio_and_restores_caller_position():
+    """The handle is caller-owned; inspecting its size must not discard where the caller had it."""
+    content = b"x" * (2 * MB)
+    handle = io.BytesIO(content)
+    handle.seek(17)
+    assert check_upload_file_size(handle, 1) == UploadedFileTooLarge(size_bytes=len(content), limit_mb=1)
+    assert handle.tell() == 17
+
+
+def test_size_under_cap_allowed_for_binaryio_restores_caller_position():
+    handle = io.BytesIO(b"x" * 100)
+    handle.seek(42)
+    assert check_upload_file_size(handle, 1) is None
+    assert handle.tell() == 42
+
+
+def test_size_exactly_at_cap_allowed():
+    content = b"x" * MB
+    assert check_upload_file_size(content, 1) is None
+
+
+def test_no_cap_skips_size_check():
+    assert check_upload_file_size(b"x" * (10 * MB), None) is None
+
+
+@pytest.mark.parametrize("cap", [0, -3])
+def test_nonpositive_cap_disables_size_check(cap):
+    assert check_upload_file_size(b"x" * (10 * MB), cap) is None
+
+
+def test_blocked_extension_rejected():
+    assert check_blocked_extension("payload.exe", (".exe", ".sh")) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_blocked_extension_match_is_case_insensitive():
+    assert check_blocked_extension("payload.EXE", (".exe",)) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_blocked_extension_match_is_case_insensitive_for_configured_value():
+    """A config entry like blocked_file_extensions: ['.EXE'] must still catch a lowercase upload."""
+    assert check_blocked_extension("payload.exe", (".EXE",)) == UploadedFileBlockedExtension(extension=".exe")
+
+
+def test_extension_not_in_blocklist_allowed():
+    assert check_blocked_extension("report.pdf", (".exe", ".sh")) is None
+
+
+def test_empty_blocklist_allows_everything():
+    assert check_blocked_extension("payload.exe", ()) is None
+
+
+def test_no_filename_skips_extension_check():
+    assert check_blocked_extension(None, (".exe",)) is None
+
+
+def test_path_traversal_filename_rejected():
+    assert check_unsafe_filename("../../etc/passwd") == UploadedFileUnsafeFilename(filename="../../etc/passwd")
+
+
+def test_windows_style_path_traversal_filename_rejected():
+    assert check_unsafe_filename("..\\..\\windows\\system32\\config") == UploadedFileUnsafeFilename(
+        filename="..\\..\\windows\\system32\\config"
+    )
+
+
+def test_traversal_embedded_after_extension_rejected():
+    assert check_unsafe_filename("report.jsonl/../../etc/cron.d/evil") == UploadedFileUnsafeFilename(
+        filename="report.jsonl/../../etc/cron.d/evil"
+    )
+
+
+def test_null_byte_filename_rejected():
+    assert check_unsafe_filename("report.pdf\x00.exe") == UploadedFileUnsafeFilename(filename="report.pdf\x00.exe")
+
+
+@pytest.mark.parametrize("filename", ["report.pdf", ".env", "a.b.c.jsonl", "my file (1).csv", None])
+def test_ordinary_filenames_allowed(filename):
+    assert check_unsafe_filename(filename) is None
+
+
+@pytest.mark.parametrize(
+    "failure, expected_code, expected_fragments",
+    [
+        (
+            UploadedFileTooLarge(size_bytes=15728640, limit_mb=10),
+            "413",
+            ("15.0 MB", "max_file_size_mb", "10 MB", "not forwarded"),
+        ),
+        (
+            UploadedFileBlockedExtension(extension=".exe"),
+            "400",
+            (".exe", "blocked_file_extensions", "not forwarded"),
+        ),
+        (
+            UploadedFileUnsafeFilename(filename="../../etc/passwd"),
+            "400",
+            ("../../etc/passwd", "traversal", "not forwarded"),
+        ),
+    ],
+)
+def test_failures_map_to_openai_shaped_proxy_exceptions(failure, expected_code, expected_fragments):
+    with pytest.raises(ProxyException) as exc_info:
+        raise_upload_validation_failure(failure)
+    assert exc_info.value.code == expected_code
+    assert exc_info.value.type == "invalid_request_error"
+    assert exc_info.value.param == "file"
+    for fragment in expected_fragments:
+        assert fragment in exc_info.value.message
diff --git a/tests/test_litellm/proxy/proxy_server/test_routes_config.py b/tests/test_litellm/proxy/proxy_server/test_routes_config.py
index ad3c470acf3..dcb63b8ca82 100644
--- a/tests/test_litellm/proxy/proxy_server/test_routes_config.py
+++ b/tests/test_litellm/proxy/proxy_server/test_routes_config.py
@@ -60,6 +60,141 @@ def test_config_update_happy_admin(client, auth_as, mock_prisma, monkeypatch):
     assert normalize(response.json()) == {"message": "Config updated successfully"}
 
 
+def test_config_update_persists_optional_pre_call_checks(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+    fake_proxy_config = MagicMock()
+    fake_proxy_config.add_deployment = AsyncMock()
+    monkeypatch.setattr(ps, "proxy_config", fake_proxy_config)
+
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"optional_pre_call_checks": ["prompt_caching"]}},
+        )
+
+    assert response.status_code == 200
+    persisted = json.loads(table.upsert.call_args.kwargs["data"]["create"]["param_value"])
+    assert persisted["optional_pre_call_checks"] == ["prompt_caching"]
+
+
+def test_config_update_persists_model_group_affinity_config(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+    fake_proxy_config = MagicMock()
+    fake_proxy_config.add_deployment = AsyncMock()
+    monkeypatch.setattr(ps, "proxy_config", fake_proxy_config)
+
+    model_group_affinity_config = {"gpt-4": ["session_affinity"]}
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"model_group_affinity_config": model_group_affinity_config}},
+        )
+
+    assert response.status_code == 200
+    persisted = json.loads(table.upsert.call_args.kwargs["data"]["create"]["param_value"])
+    assert persisted["model_group_affinity_config"] == model_group_affinity_config
+
+
+def test_config_update_persists_disable_cooldowns(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+    fake_proxy_config = MagicMock()
+    fake_proxy_config.add_deployment = AsyncMock()
+    monkeypatch.setattr(ps, "proxy_config", fake_proxy_config)
+
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"disable_cooldowns": True}},
+        )
+
+    assert response.status_code == 200
+    persisted = json.loads(table.upsert.call_args.kwargs["data"]["create"]["param_value"])
+    assert persisted["disable_cooldowns"] is True
+
+
+def test_config_update_rejects_assistants_config(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"assistants_config": {"enabled": True}}},
+        )
+
+    assert response.status_code == 400
+    assert "assistants_config" in response.json()["error"]["message"]
+    table.upsert.assert_not_called()
+
+
+def test_config_update_rejects_router_general_settings(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"router_general_settings": {"async_only_mode": True}}},
+        )
+
+    assert response.status_code == 400
+    assert "router_general_settings" in response.json()["error"]["message"]
+    table.upsert.assert_not_called()
+
+
+def test_config_update_rejects_unknown_router_setting(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    table = _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+
+    with auth_as(LitellmUserRoles.PROXY_ADMIN):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"optional_precall_checks": ["prompt_caching"]}},
+        )
+
+    assert response.status_code == 400
+    assert "optional_precall_checks" in response.json()["error"]["message"]
+    table.upsert.assert_not_called()
+
+
+def test_config_update_unknown_router_setting_non_admin_forbidden(client, auth_as, mock_prisma, monkeypatch):
+    from litellm.proxy import proxy_server as ps
+    from litellm.proxy._types import LitellmUserRoles
+
+    _install_litellm_config(mock_prisma)
+    monkeypatch.setattr(ps, "prisma_client", mock_prisma)
+
+    with auth_as(LitellmUserRoles.INTERNAL_USER):
+        response = client.post(
+            "/config/update",
+            json={"router_settings": {"optional_precall_checks": ["prompt_caching"]}},
+        )
+
+    assert response.status_code == 403
+    assert "admin" in response.json()["error"]["message"].lower()
+
+
 def test_config_update_non_admin_forbidden(client, auth_as, mock_prisma, monkeypatch):
     """POST /config/update by a non-admin caller is rejected; the error
     surfaces as a ProxyException with the admin-only message."""
diff --git a/tests/test_litellm/proxy/proxy_server/test_routes_login_sso.py b/tests/test_litellm/proxy/proxy_server/test_routes_login_sso.py
index af37dbe85fe..45460dcecf1 100644
--- a/tests/test_litellm/proxy/proxy_server/test_routes_login_sso.py
+++ b/tests/test_litellm/proxy/proxy_server/test_routes_login_sso.py
@@ -29,7 +29,7 @@ def _install_login_mocks(monkeypatch, raise_on_auth: bool = False) -> None:
     """
     from litellm.proxy import proxy_server as ps
 
-    async def _fake_auth(username, password, master_key, prisma_client):
+    async def _fake_auth(username, password, master_key, prisma_client, general_settings=None):
         if raise_on_auth:
             raise Exception("boom-auth-failure")
         fake = MagicMock()
diff --git a/tests/test_litellm/proxy/proxy_server/test_routes_onboarding.py b/tests/test_litellm/proxy/proxy_server/test_routes_onboarding.py
index 5cc22cca7a0..778acc1baab 100644
--- a/tests/test_litellm/proxy/proxy_server/test_routes_onboarding.py
+++ b/tests/test_litellm/proxy/proxy_server/test_routes_onboarding.py
@@ -234,7 +234,7 @@ def test_claim_onboarding_link_happy(client, monkeypatch, mock_prisma):
         json={
             "invitation_link": "inv-123",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": f"Bearer {onboarding_jwt}"},
     )
@@ -260,7 +260,7 @@ def test_claim_onboarding_link_invalid_invite_401(client, monkeypatch, mock_pris
         json={
             "invitation_link": "missing",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": "Bearer irrelevant"},
     )
@@ -287,7 +287,7 @@ def test_claim_onboarding_link_user_id_mismatch_401(
         json={
             "invitation_link": "inv-123",
             "user_id": "user-attacker",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": "Bearer irrelevant"},
     )
@@ -339,7 +339,7 @@ def test_claim_onboarding_link_bad_onboarding_jwt_401(
         json={
             "invitation_link": "inv-123",
             "user_id": "user-abc",
-            "password": "hunter2",
+            "password": "Hunter2Strong!",
         },
         headers={"Authorization": f"Bearer {bogus_jwt}"},
     )
diff --git a/tests/test_litellm/proxy/public_endpoints/test_public_endpoints.py b/tests/test_litellm/proxy/public_endpoints/test_public_endpoints.py
index 31430da71e8..8006f64ba41 100644
--- a/tests/test_litellm/proxy/public_endpoints/test_public_endpoints.py
+++ b/tests/test_litellm/proxy/public_endpoints/test_public_endpoints.py
@@ -1,3 +1,4 @@
+import re
 from datetime import datetime, timezone
 from unittest.mock import AsyncMock, MagicMock, patch
 
@@ -756,6 +757,45 @@ def test_public_agent_hub_returns_empty_when_no_public_groups():
     assert response.json() == []
 
 
+# ---------------------------------------------------------------------------
+# /public/agents/fields
+# ---------------------------------------------------------------------------
+
+
+def test_bedrock_agentcore_runtime_arn_validation_pattern_accepts_full_resource_path():
+    """Regression for LIT-6737: the AgentCore agent_runtime_arn field's
+    validation_pattern must accept a complete runtime ARN whose resource part
+    is itself multi-segment (``runtime/<runtime-id>``), and reject the exact
+    truncated shape a naive split("/")-by-position parse used to produce (the
+    ARN cut off right after the ``runtime`` resource type).
+    """
+    app_instance = FastAPI()
+    app_instance.include_router(router)
+    test_client = TestClient(app_instance)
+
+    response = test_client.get("/public/agents/fields")
+    assert response.status_code == 200
+    agents = response.json()
+
+    bedrock_agentcore = next((a for a in agents if a["agent_type"] == "bedrock_agentcore"), None)
+    assert bedrock_agentcore is not None, "bedrock_agentcore agent type not found"
+    assert bedrock_agentcore["model_template"] == "bedrock/agentcore/{agent_runtime_arn}"
+
+    fields_by_key = {f["key"]: f for f in bedrock_agentcore["credential_fields"]}
+    arn_field = fields_by_key["agent_runtime_arn"]
+    assert arn_field["required"] is True
+    assert arn_field["include_in_litellm_params"] is False
+
+    pattern = arn_field.get("validation_pattern")
+    assert pattern, "agent_runtime_arn must ship a validation_pattern so the UI can reject a truncated ARN"
+
+    full_arn = "arn:aws:bedrock-agentcore:eu-central-1:123456789012:runtime/hosted_agent_4vm3i-BaTdfOELAs"
+    truncated_arn = "arn:aws:bedrock-agentcore:eu-central-1:123456789012:runtime"
+
+    assert re.match(pattern, full_arn), "the validator must accept a complete runtime ARN"
+    assert not re.match(pattern, truncated_arn), "the validator must reject the truncated ARN"
+
+
 # ---------------------------------------------------------------------------
 # /public/endpoints
 # ---------------------------------------------------------------------------
diff --git a/tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py b/tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py
index abbf6892a98..0085b6ebd36 100644
--- a/tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py
+++ b/tests/test_litellm/proxy/rag_endpoints/test_rag_endpoints.py
@@ -324,6 +324,127 @@ def test_rag_query_stream_returns_event_stream(client_internal_user):
     assert "data: [DONE]" in response.text
 
 
+def test_rag_query_merges_managed_store_params(client_internal_user):
+    """
+    Regression: /v1/rag/query must consult the managed vector store registry
+    (like the direct /v1/vector_stores/{id}/search endpoint does) so that
+    provider, region, embedding model, etc. don't have to be repeated in
+    retrieval_config. Pre-fix the registry was never read, so managed S3
+    Vectors stores failed with "aws_region_name is required".
+    """
+    import litellm
+    from litellm.types.utils import ModelResponse
+
+    mock_vector_store = {
+        "vector_store_id": "s3-store",
+        "custom_llm_provider": "s3_vectors",
+        "litellm_params": {
+            "aws_region_name": "eu-west-1",
+            "embedding_model": "my-embed",
+            "vector_bucket_name": "bkt",
+        },
+    }
+    mock_registry = MagicMock()
+    mock_registry.get_litellm_managed_vector_store_from_registry.return_value = mock_vector_store
+
+    mock_response = ModelResponse(
+        id="chatcmpl-test",
+        choices=[{"index": 0, "message": {"role": "assistant", "content": "hi"}, "finish_reason": "stop"}],
+        model="gpt-4o-mini",
+    )
+
+    with patch(  # test-quality-ok: aquery is the endpoint's downstream boundary; the forwarded config is what the test asserts
+        "litellm.proxy.rag_endpoints.endpoints.litellm.aquery",
+        new_callable=AsyncMock,
+        return_value=mock_response,
+    ) as mock_aquery, patch.object(litellm, "vector_store_registry", mock_registry), patch(  # test-quality-ok: seeds the managed-store registry the merge under test reads and grants access so real store resolution runs
+        "litellm.proxy.vector_store_endpoints.utils.can_user_access_vector_store",
+        new=AsyncMock(return_value=True),
+    ):
+        response = client_internal_user.post(
+            "/v1/rag/query",
+            json={
+                "model": "gpt-4o-mini",
+                "messages": [{"role": "user", "content": "hello"}],
+                "retrieval_config": {"vector_store_id": "s3-store"},
+            },
+        )
+
+    assert response.status_code == 200, response.json()
+    mock_aquery.assert_awaited_once()
+    forwarded_config = mock_aquery.await_args.kwargs["retrieval_config"]
+    assert forwarded_config["vector_store_id"] == "s3-store"
+    assert forwarded_config["custom_llm_provider"] == "s3_vectors"
+    assert forwarded_config["aws_region_name"] == "eu-west-1"
+    assert forwarded_config["embedding_model"] == "my-embed"
+    assert forwarded_config["vector_bucket_name"] == "bkt"
+
+
+def test_rag_query_store_params_win_over_user_retrieval_config(client_internal_user):
+    """Registry values must win over user-supplied retrieval_config keys so callers cannot override store credentials."""
+    import litellm
+    from litellm.types.utils import ModelResponse
+
+    mock_vector_store = {
+        "vector_store_id": "s3-store",
+        "custom_llm_provider": "s3_vectors",
+        "litellm_params": {"aws_region_name": "eu-west-1"},
+    }
+    mock_registry = MagicMock()
+    mock_registry.get_litellm_managed_vector_store_from_registry.return_value = mock_vector_store
+
+    mock_response = ModelResponse(
+        id="chatcmpl-test",
+        choices=[{"index": 0, "message": {"role": "assistant", "content": "hi"}, "finish_reason": "stop"}],
+        model="gpt-4o-mini",
+    )
+
+    with patch(  # test-quality-ok: aquery is the endpoint's downstream boundary; the forwarded config is what the test asserts
+        "litellm.proxy.rag_endpoints.endpoints.litellm.aquery",
+        new_callable=AsyncMock,
+        return_value=mock_response,
+    ) as mock_aquery, patch.object(litellm, "vector_store_registry", mock_registry), patch(  # test-quality-ok: seeds the managed-store registry the merge under test reads and grants access so real store resolution runs
+        "litellm.proxy.vector_store_endpoints.utils.can_user_access_vector_store",
+        new=AsyncMock(return_value=True),
+    ):
+        response = client_internal_user.post(
+            "/v1/rag/query",
+            json={
+                "model": "gpt-4o-mini",
+                "messages": [{"role": "user", "content": "hello"}],
+                "retrieval_config": {"vector_store_id": "s3-store", "aws_region_name": "us-east-1"},
+            },
+        )
+
+    assert response.status_code == 200, response.json()
+    forwarded_config = mock_aquery.await_args.kwargs["retrieval_config"]
+    assert forwarded_config["aws_region_name"] == "eu-west-1"
+
+
+@pytest.mark.parametrize(
+    "blocked_key",
+    ["embedding_model", "litellm_embedding_model", "litellm_embedding_config", "litellm_credential_name"],
+)
+def test_rag_query_rejects_caller_embedding_selection_params(client_internal_user, blocked_key):
+    """
+    Regression: a caller must not pick the embedding model or credential used at
+    search time. Those resolve through the Router with the proxy's credentials,
+    bypassing the key's model permissions, so they may only come from the
+    managed store's server-side registration.
+    """
+    response = client_internal_user.post(
+        "/v1/rag/query",
+        json={
+            "model": "gpt-4o-mini",
+            "messages": [{"role": "user", "content": "hello"}],
+            "retrieval_config": {"vector_store_id": "s3-store", blocked_key: "attacker-choice"},
+        },
+    )
+
+    assert response.status_code == 400, response.json()
+    assert blocked_key in str(response.json())
+
+
 EICAR = r"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
 INGEST_REQUEST = '{"ingest_options":{"vector_store":{"custom_llm_provider":"openai"}}}'
 
diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py
index 91fca8f1e27..7322c6e62a5 100644
--- a/tests/test_litellm/proxy/test_proxy_server.py
+++ b/tests/test_litellm/proxy/test_proxy_server.py
@@ -130,6 +130,7 @@ def test_login_v2_returns_redirect_url_and_sets_cookie(monkeypatch):
         password="secret",
         master_key="test-master-key",
         prisma_client=mock_prisma_client,
+        general_settings={},
     )
     mock_create_ui_token_object.assert_called_once_with(
         login_result=mock_login_result,
@@ -10782,11 +10783,54 @@ def test_update_config_redacts_all_environment_variable_values(_update_config_se
 class _EnvBuiltRedisCache(RedisCache):
     """RedisCache stand-in that records its constructor kwargs and never
     opens a network connection, so tests can assert which connection params
-    the proxy used to build its coordination Redis."""
+    the proxy used to build its coordination Redis. `ping()` reports reachable
+    by default, matching a real Redis the env fallback should adopt."""
 
     def __init__(self, **kwargs):
         self.init_kwargs = kwargs
 
+    async def ping(self) -> bool:
+        return True
+
+
+class _UnreachableRedisCache(_EnvBuiltRedisCache):
+    """Same stand-in, but `ping()` fails like a REDIS_* env var naming a Redis
+    that is not actually reachable (wrong host, no service running, ...)."""
+
+    async def ping(self) -> bool:
+        raise ConnectionError("connection refused")
+
+
+@contextlib.contextmanager
+def _patched_coordination_redis_module_state(
+    *,
+    spend_cache: DualCache,
+    config_cache: types.SimpleNamespace,
+    redis_cache_class: type = _EnvBuiltRedisCache,
+):
+    """Stub every `litellm.proxy.proxy_server` global that
+    `_attach_redis_usage_cache` (and its callers) can write to, shared by the
+    whole coordination-Redis test family below.
+
+    Centralizing this is not just DRY: `_attach_redis_usage_cache` always sets
+    `cli_sso_session_cache.redis_cache` unconditionally, and a call site that
+    forgets to patch that one real (persistent) global leaks a throwaway
+    Redis stand-in into it for the rest of the pytest session, breaking
+    unrelated tests that run later. One patched-state helper means a new call
+    site cannot forget a global this family already knows to isolate.
+    """
+    with (
+        patch.object(proxy_server_module, "redis_usage_cache", None),
+        patch.object(proxy_server_module, "spend_counter_cache", spend_cache),
+        patch.object(proxy_server_module, "user_api_key_cache", DualCache()),
+        patch.object(proxy_server_module, "cli_sso_session_cache", DualCache()),
+        patch.object(proxy_server_module, "llm_router", None),
+        patch.object(proxy_server_module, "litellm_config_cache", config_cache),
+        patch.object(proxy_server_module, "RedisCache", redis_cache_class),
+        patch.object(proxy_server_module, "RedisClusterCache", _EnvBuiltClusterCache),
+    ):
+        yield
+
 
 def _run_init_cache_with_backend(cache_backend, redis_env_kwargs):
     """Run ProxyConfig._init_cache with a stubbed response-cache backend and a
@@ -10798,12 +10842,7 @@ def _run_init_cache_with_backend(cache_backend, redis_env_kwargs):
     fresh_config_cache = types.SimpleNamespace(redis_cache=None)
 
     with (
-        patch.object(proxy_server_module, "redis_usage_cache", None),
-        patch.object(proxy_server_module, "spend_counter_cache", fresh_spend_cache),
-        patch.object(proxy_server_module, "user_api_key_cache", DualCache()),
-        patch.object(proxy_server_module, "llm_router", None),
-        patch.object(proxy_server_module, "litellm_config_cache", fresh_config_cache),
-        patch.object(proxy_server_module, "RedisCache", _EnvBuiltRedisCache),
+        _patched_coordination_redis_module_state(spend_cache=fresh_spend_cache, config_cache=fresh_config_cache),
         patch(
             "litellm._redis._redis_kwargs_from_environment",
             return_value=redis_env_kwargs,
@@ -10878,12 +10917,7 @@ def _run_init_coordination_redis(config, env=None):
     fresh_config_cache = types.SimpleNamespace(redis_cache=None)
 
     with (
-        patch.object(proxy_server_module, "redis_usage_cache", None),
-        patch.object(proxy_server_module, "spend_counter_cache", fresh_spend_cache),
-        patch.object(proxy_server_module, "user_api_key_cache", DualCache()),
-        patch.object(proxy_server_module, "litellm_config_cache", fresh_config_cache),
-        patch.object(proxy_server_module, "RedisCache", _EnvBuiltRedisCache),
-        patch.object(proxy_server_module, "RedisClusterCache", _EnvBuiltClusterCache),
+        _patched_coordination_redis_module_state(spend_cache=fresh_spend_cache, config_cache=fresh_config_cache),
         mock.patch.dict(os.environ, env or {}, clear=False),
     ):
         built = proxy_server_module.ProxyConfig()._init_coordination_redis(config=config)
@@ -10971,13 +11005,7 @@ def test_explicit_coordination_redis_takes_precedence_over_cache_backend():
     mock_litellm_cache.cache = cache_backend
 
     with (
-        patch.object(proxy_server_module, "redis_usage_cache", None),
-        patch.object(proxy_server_module, "spend_counter_cache", fresh_spend_cache),
-        patch.object(proxy_server_module, "user_api_key_cache", DualCache()),
-        patch.object(proxy_server_module, "llm_router", None),
-        patch.object(proxy_server_module, "litellm_config_cache", fresh_config_cache),
-        patch.object(proxy_server_module, "RedisCache", _EnvBuiltRedisCache),
-        patch.object(proxy_server_module, "RedisClusterCache", _EnvBuiltClusterCache),
+        _patched_coordination_redis_module_state(spend_cache=fresh_spend_cache, config_cache=fresh_config_cache),
         patch("litellm.Cache", return_value=mock_litellm_cache),
     ):
         litellm.cache = None
@@ -10995,6 +11023,95 @@ def test_explicit_coordination_redis_takes_precedence_over_cache_backend():
         assert fresh_spend_cache.redis_cache is usage_cache
 
 
+async def _run_init_coordination_redis_env_fallback(
+    litellm_settings, redis_env_kwargs, redis_cache_class=_EnvBuiltRedisCache
+):
+    """Run ProxyConfig._init_coordination_redis_env_fallback against a
+    stubbed module state and a controlled REDIS_* environment, returning
+    (built, spend_counter redis)."""
+    fresh_spend_cache = DualCache()
+    fresh_config_cache = types.SimpleNamespace(redis_cache=None)
+
+    with (
+        _patched_coordination_redis_module_state(
+            spend_cache=fresh_spend_cache, config_cache=fresh_config_cache, redis_cache_class=redis_cache_class
+        ),
+        patch(
+            "litellm._redis._redis_kwargs_from_environment",
+            return_value=redis_env_kwargs,
+        ),
+    ):
+        built = await proxy_server_module.ProxyConfig._init_coordination_redis_env_fallback(
+            litellm_settings=litellm_settings
+        )
+        return built, fresh_spend_cache.redis_cache
+
+
+@pytest.mark.asyncio
+async def test_init_coordination_redis_env_fallback_builds_from_environment():
+    """A deployment with no coordination_redis block and no litellm_settings.cache
+    but with bare REDIS_HOST/REDIS_PORT env vars must still get a coordination
+    Redis: otherwise spend counters, budget-window enforcement, and the
+    reset_spend cache-eviction broadcast stay per-pod local and a reset issued
+    on one pod never clears another pod's stale enforcement."""
+    built, spend_redis = await _run_init_coordination_redis_env_fallback(
+        litellm_settings={},
+        redis_env_kwargs={"host": "env-fallback-host", "port": "6390"},
+    )
+
+    assert isinstance(built, _EnvBuiltRedisCache)
+    assert built.init_kwargs["host"] == "env-fallback-host"
+    assert spend_redis is built
+
+
+@pytest.mark.asyncio
+async def test_init_coordination_redis_env_fallback_without_redis_env_returns_none():
+    """With no REDIS_* connection info at all, the fallback must leave the
+    coordination Redis unset rather than building a broken client."""
+    built, spend_redis = await _run_init_coordination_redis_env_fallback(
+        litellm_settings={},
+        redis_env_kwargs={},
+    )
+
+    assert built is None
+    assert spend_redis is None
+
+
+@pytest.mark.asyncio
+async def test_init_coordination_redis_env_fallback_unreachable_stays_in_memory():
+    """REDIS_* env vars can name a Redis that is not actually reachable (wrong
+    host, leftover from an unrelated job/service). Guessing "coordination
+    available" from bare env vars must not turn a previously harmless
+    in-memory-only proxy into one that raises on its next cache write, so an
+    unreachable ping must leave everything exactly as if no REDIS_* vars were
+    set at all."""
+    built, spend_redis = await _run_init_coordination_redis_env_fallback(
+        litellm_settings={},
+        redis_env_kwargs={"host": "unreachable-host", "port": "6390"},
+        redis_cache_class=_UnreachableRedisCache,
+    )
+
+    assert built is None
+    assert spend_redis is None
+
+
+@pytest.mark.asyncio
+async def test_init_coordination_redis_env_fallback_malformed_cluster_nodes_stays_in_memory():
+    """REDIS_CLUSTER_NODES can be set to a malformed value nothing here ever
+    asked to be parsed. Unlike the explicit coordination_redis block (a
+    deliberate opt-in, so a bad value there should fail loudly), this
+    inferred fallback must not abort proxy startup over it -- it has to
+    decline the same way it does for an absent or unreachable Redis."""
+    with mock.patch.dict(os.environ, {"REDIS_CLUSTER_NODES": "not-valid-json"}, clear=False):
+        built, spend_redis = await _run_init_coordination_redis_env_fallback(
+            litellm_settings={},
+            redis_env_kwargs={},
+        )
+
+    assert built is None
+    assert spend_redis is None
+
+
 def test_env_fallback_builds_cluster_client_from_cluster_nodes_env():
     """A deployment whose only Redis env is REDIS_CLUSTER_NODES must still get
     a coordination Redis from the env fallback, and it must be a cluster
@@ -11036,11 +11153,7 @@ async def test_startup_applies_coordination_redis_saved_in_database():
     fresh_config_cache = types.SimpleNamespace(redis_cache=None)
 
     with (
-        patch.object(proxy_server_module, "spend_counter_cache", fresh_spend_cache),
-        patch.object(proxy_server_module, "user_api_key_cache", DualCache()),
-        patch.object(proxy_server_module, "litellm_config_cache", fresh_config_cache),
-        patch.object(proxy_server_module, "RedisCache", _EnvBuiltRedisCache),
-        patch.object(proxy_server_module, "RedisClusterCache", _EnvBuiltClusterCache),
+        _patched_coordination_redis_module_state(spend_cache=fresh_spend_cache, config_cache=fresh_config_cache),
         patch.object(
             proxy_server_module,
             "get_persisted_coordination_redis_settings",
diff --git a/tests/test_litellm/proxy/test_redis_auth_cache_flag.py b/tests/test_litellm/proxy/test_redis_auth_cache_flag.py
index 772b08bc9d0..573bfc40c96 100644
--- a/tests/test_litellm/proxy/test_redis_auth_cache_flag.py
+++ b/tests/test_litellm/proxy/test_redis_auth_cache_flag.py
@@ -5,7 +5,7 @@ Verifies that _init_cache attaches Redis to user_api_key_cache only when
 the flag is explicitly set to True, and leaves it in-memory-only otherwise.
 """
 
-from contextlib import contextmanager
+from contextlib import ExitStack, contextmanager
 import json
 from unittest.mock import MagicMock, patch
 
@@ -167,3 +167,25 @@ class TestRedisAuthCacheFlag:
                     f"cli_sso_session_cache must always get Redis "
                     f"(enable_redis_auth_cache={flag_value!r})"
                 )
+
+    def test_flag_absent_still_shares_the_model_budget_counters_over_redis(self):
+        """
+        Per-model budget counters are spend counters: the limiter must be able to
+        push and read them through Redis without the auth-cache opt-in, or every
+        worker enforces and reports its own share of a key's spend
+        """
+        fake_redis = _FakeRedisCache()
+        limiter_cache = ps.model_max_budget_limiter.dual_cache
+        touched_caches = (
+            limiter_cache,
+            ps.spend_counter_cache,
+            ps.cli_sso_session_cache,
+            ps.user_api_key_cache,
+            ps.litellm_config_cache,
+        )
+        with ExitStack() as detached:
+            for cache in touched_caches:
+                detached.enter_context(patch.object(cache, "redis_cache", None))
+            ps._attach_redis_usage_cache(fake_redis, enable_redis_auth_cache=False)
+            assert limiter_cache.redis_cache is fake_redis
+            assert ps.user_api_key_cache.redis_cache is None
diff --git a/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py b/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
index dc256ccf718..709447d23c0 100644
--- a/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
+++ b/tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
@@ -3006,6 +3006,128 @@ def test_update_mcp_semantic_filter_settings_requires_proxy_admin(monkeypatch):
         app.dependency_overrides.pop(user_api_key_auth, None)
 
 
+class TestMcpToolSearchSettingsEndpoints:
+    """`litellm_settings.mcp_tool_search` drives the native `mcp_tool_search` virtual tool, so the UI must round-trip it."""
+
+    @staticmethod
+    def _override_auth(role: LitellmUserRoles):
+        from litellm.proxy._types import UserAPIKeyAuth
+        from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+        app.dependency_overrides[user_api_key_auth] = lambda: UserAPIKeyAuth(
+            user_id="u", api_key="hashed", user_role=role
+        )
+
+    def test_get_returns_stored_values_and_field_schema(self, mock_proxy_config, mock_auth, monkeypatch):
+        monkeypatch.setattr("litellm.proxy.proxy_server.prisma_client", object())
+        mock_proxy_config["config"]["litellm_settings"]["mcp_tool_search"] = {
+            "embedding_model": "text-embedding-3-small",
+            "core_tools": ["treasury-get_rates"],
+        }
+
+        resp = client.get("/get/mcp_tool_search_settings")
+
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["values"] == {
+            "embedding_model": "text-embedding-3-small",
+            "top_k": 5,
+            "similarity_threshold": 0.0,
+            "core_tools": ["treasury-get_rates"],
+        }
+        assert resp.json()["field_schema"]["properties"]["core_tools"]["type"] == "array"
+
+    def test_update_requires_proxy_admin(self, monkeypatch):
+        monkeypatch.setattr("litellm.proxy.proxy_server.store_model_in_db", True)
+        self._override_auth(LitellmUserRoles.INTERNAL_USER)
+        try:
+            resp = client.patch("/update/mcp_tool_search_settings", json={"top_k": 3})
+        finally:
+            app.dependency_overrides.clear()
+        assert resp.status_code == 403
+
+    def test_update_persists_and_applies_in_memory(self, mock_proxy_config, monkeypatch):
+        import litellm
+
+        monkeypatch.setattr("litellm.proxy.proxy_server.store_model_in_db", True)
+        monkeypatch.setattr(litellm, "mcp_tool_search", None)
+        self._override_auth(LitellmUserRoles.PROXY_ADMIN)
+        payload = {
+            "embedding_model": "text-embedding-3-small",
+            "top_k": 3,
+            "similarity_threshold": 0.25,
+            "core_tools": ["treasury-get_rates"],
+        }
+        try:
+            resp = client.patch("/update/mcp_tool_search_settings", json=payload)
+        finally:
+            app.dependency_overrides.clear()
+
+        assert resp.status_code == 200, resp.text
+        assert mock_proxy_config["save_call_count"]() == 1
+        assert litellm.mcp_tool_search == payload
+        assert mock_proxy_config["config"]["litellm_settings"]["mcp_tool_search"] == payload
+
+    def test_update_rejects_out_of_range_top_k(self, mock_proxy_config, monkeypatch):
+        monkeypatch.setattr("litellm.proxy.proxy_server.store_model_in_db", True)
+        self._override_auth(LitellmUserRoles.PROXY_ADMIN)
+        try:
+            resp = client.patch("/update/mcp_tool_search_settings", json={"top_k": 0})
+        finally:
+            app.dependency_overrides.clear()
+        assert resp.status_code == 422
+        assert mock_proxy_config["save_call_count"]() == 0
+
+
+def test_upload_logo_requires_proxy_admin(monkeypatch):
+    """Any authenticated key could previously write a file to the server's disk here."""
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    async def _internal_user_auth():
+        return UserAPIKeyAuth(
+            user_id="internal-user-1",
+            api_key="hashed-internal-key",
+            user_role=LitellmUserRoles.INTERNAL_USER,
+        )
+
+    app.dependency_overrides[user_api_key_auth] = _internal_user_auth
+    try:
+        resp = client.post(
+            "/upload/logo",
+            files={"file": ("logo.png", b"\x89PNG\r\n\x1a\n" + b"x" * 32, "image/png")},
+        )
+        assert resp.status_code == 403
+        assert "proxy admin" in resp.json()["detail"].lower()
+    finally:
+        app.dependency_overrides.pop(user_api_key_auth, None)
+
+
+def test_upload_logo_allows_proxy_admin(monkeypatch, tmp_path):
+    from litellm.proxy._types import UserAPIKeyAuth
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+
+    async def _admin_auth():
+        return UserAPIKeyAuth(
+            user_id="admin-1",
+            api_key="hashed-admin-key",
+            user_role=LitellmUserRoles.PROXY_ADMIN,
+        )
+
+    app.dependency_overrides[user_api_key_auth] = _admin_auth
+    try:
+        resp = client.post(
+            "/upload/logo",
+            files={"file": ("logo.png", b"\x89PNG\r\n\x1a\n" + b"x" * 32, "image/png")},
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["status"] == "success"
+    finally:
+        app.dependency_overrides.pop(user_api_key_auth, None)
+        uploaded_path = resp.json().get("file_path")
+        if uploaded_path and os.path.exists(uploaded_path):
+            os.remove(uploaded_path)
+
+
 class TestPtuCostAttributionUISetting:
     """``enable_ptu_cost_attribution`` is derived from the environment on every GET.
 
diff --git a/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py b/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py
index eae6f90863a..45a0221c8a6 100644
--- a/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py
+++ b/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py
@@ -3158,3 +3158,35 @@ class TestAzureAIAnalyzeNamedIndexClassification:
             user_api_key_dict=self._team_member("analyze", ["read"]),
         )
         assert result is True
+
+
+@pytest.mark.parametrize(
+    "blocked_key",
+    ["embedding_model", "litellm_embedding_model", "litellm_embedding_config", "litellm_credential_name"],
+)
+def test_vector_store_search_rejects_caller_embedding_selection_params(blocked_key):
+    """
+    Regression: the search request body must not pick the embedding model or
+    credential used to embed the query. Those resolve through the Router with
+    the proxy's credentials, bypassing the key's model permissions, so they may
+    only come from the managed store's server-side registration.
+    """
+    from fastapi.testclient import TestClient
+
+    from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+    from litellm.proxy.proxy_server import app
+
+    mock_auth = UserAPIKeyAuth(user_id="test_internal_user", user_role=LitellmUserRoles.INTERNAL_USER.value)
+    original_overrides = app.dependency_overrides.copy()
+    app.dependency_overrides[user_api_key_auth] = lambda: mock_auth
+    try:
+        client = TestClient(app)
+        response = client.post(
+            "/v1/vector_stores/s3-store/search",
+            json={"query": "hello", blocked_key: "attacker-choice"},
+        )
+    finally:
+        app.dependency_overrides = original_overrides
+
+    assert response.status_code == 400, response.json()
+    assert blocked_key in str(response.json())
diff --git a/tests/test_litellm/rag/test_main.py b/tests/test_litellm/rag/test_main.py
index 2d1b460513f..51d03544910 100644
--- a/tests/test_litellm/rag/test_main.py
+++ b/tests/test_litellm/rag/test_main.py
@@ -259,6 +259,135 @@ async def test_aquery_streaming_bills_sub_call_costs_into_final_event():
     assert standard_logging_object["response_cost"] >= 0.003
 
 
+@pytest.mark.asyncio
+async def test_aquery_forwards_provider_retrieval_config_and_router_to_search():
+    """
+    Regression: provider-specific retrieval_config keys (aws_region_name,
+    embedding_model, vector_bucket_name, ...) and the router must be forwarded
+    to the vector store search call. Pre-fix they were silently dropped, so
+    /v1/rag/query failed with provider config errors (e.g. S3 Vectors
+    "aws_region_name is required") even when the caller supplied them.
+    """
+    from unittest.mock import AsyncMock
+
+    from litellm.types.vector_stores import VectorStoreSearchResponse
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "gpt-4o-mini",
+                "litellm_params": {"model": "openai/gpt-4o-mini", "api_key": "test-key"},
+            }
+        ]
+    )
+
+    fake_search = AsyncMock(
+        return_value=VectorStoreSearchResponse(
+            object="vector_store.search_results.page", search_query="q", data=[]
+        )
+    )
+    with patch("litellm.vector_stores.asearch", new=fake_search):  # test-quality-ok: asearch is the boundary the forwarding contract under test targets
+        response = await litellm.aquery(
+            model="gpt-4o-mini",
+            messages=[{"role": "user", "content": "hello"}],
+            retrieval_config={
+                "vector_store_id": "bkt:idx",
+                "custom_llm_provider": "s3_vectors",
+                "top_k": 5,
+                "aws_region_name": "eu-west-1",
+                "embedding_model": "my-embed",
+                "vector_bucket_name": "bkt",
+            },
+            router=router,
+            mock_response="hi",
+        )
+
+    assert isinstance(response, ModelResponse)
+    fake_search.assert_awaited_once()
+    search_kwargs = fake_search.await_args.kwargs
+    assert search_kwargs["vector_store_id"] == "bkt:idx"
+    assert search_kwargs["custom_llm_provider"] == "s3_vectors"
+    assert search_kwargs["max_num_results"] == 5
+    assert search_kwargs["router"] is router
+    # provider-specific extras forwarded
+    assert search_kwargs["aws_region_name"] == "eu-west-1"
+    assert search_kwargs["embedding_model"] == "my-embed"
+    assert search_kwargs["vector_bucket_name"] == "bkt"
+    # consumed keys are not duplicated into the spread
+    assert "top_k" not in search_kwargs
+
+
+@pytest.mark.asyncio
+async def test_aquery_minimal_retrieval_config_forwards_no_extras():
+    """
+    A minimal retrieval_config must not leak consumed keys (or invent extras)
+    into the vector store search call.
+    """
+    from unittest.mock import AsyncMock
+
+    from litellm.types.vector_stores import VectorStoreSearchResponse
+
+    fake_search = AsyncMock(
+        return_value=VectorStoreSearchResponse(
+            object="vector_store.search_results.page", search_query="q", data=[]
+        )
+    )
+    with patch("litellm.vector_stores.asearch", new=fake_search):  # test-quality-ok: asearch is the boundary the forwarding contract under test targets
+        await litellm.aquery(
+            model="gpt-4o-mini",
+            messages=[{"role": "user", "content": "hello"}],
+            retrieval_config={"vector_store_id": "vs_test_123", "custom_llm_provider": "openai"},
+            mock_response="hi",
+        )
+
+    fake_search.assert_awaited_once()
+    search_kwargs = fake_search.await_args.kwargs
+    assert search_kwargs["vector_store_id"] == "vs_test_123"
+    assert search_kwargs["custom_llm_provider"] == "openai"
+    assert search_kwargs["router"] is None
+    leaked = {"top_k", "filters", "retrieval_filter", "aws_region_name", "embedding_model", "vector_bucket_name"}
+    assert not (leaked & set(search_kwargs.keys()))
+
+
+@pytest.mark.asyncio
+async def test_aquery_does_not_forward_connection_override_keys_to_search():
+    """
+    Only allowlisted retrieval_config keys may reach the vector store search
+    call. Caller-controlled connection overrides (api_base, api_key, arbitrary
+    extras) must be dropped, otherwise a caller could redirect store
+    credentials to an attacker-chosen host.
+    """
+    from unittest.mock import AsyncMock
+
+    from litellm.types.vector_stores import VectorStoreSearchResponse
+
+    fake_search = AsyncMock(
+        return_value=VectorStoreSearchResponse(
+            object="vector_store.search_results.page", search_query="q", data=[]
+        )
+    )
+    with patch("litellm.vector_stores.asearch", new=fake_search):  # test-quality-ok: asearch is the boundary the forwarding contract under test targets
+        await litellm.aquery(
+            model="gpt-4o-mini",
+            messages=[{"role": "user", "content": "hello"}],
+            retrieval_config={
+                "vector_store_id": "bkt:idx",
+                "custom_llm_provider": "s3_vectors",
+                "aws_region_name": "eu-west-1",
+                "api_base": "https://attacker.example.com",
+                "api_key": "attacker-key",
+                "arbitrary_extra": "nope",
+            },
+            mock_response="hi",
+        )
+
+    fake_search.assert_awaited_once()
+    search_kwargs = fake_search.await_args.kwargs
+    assert search_kwargs["aws_region_name"] == "eu-west-1"
+    blocked = {"api_base", "api_key", "arbitrary_extra"}
+    assert not (blocked & set(search_kwargs.keys()))
+
+
 def test_rag_call_types_are_registered():
     """
     query/aquery/ingest/aingest are @client-decorated entry points, so their
diff --git a/tests/test_litellm/rust_bridge/test_verify_linux_native_wheel.py b/tests/test_litellm/rust_bridge/test_verify_linux_native_wheel.py
new file mode 100644
index 00000000000..e449d4392d8
--- /dev/null
+++ b/tests/test_litellm/rust_bridge/test_verify_linux_native_wheel.py
@@ -0,0 +1,197 @@
+from __future__ import annotations
+
+import importlib.util
+import subprocess
+import sys
+import zipfile
+from collections.abc import Callable, Mapping, Sequence
+from pathlib import Path
+from types import MappingProxyType, ModuleType
+from typing import Final, Protocol, cast
+
+import pytest
+
+
+class _CommandRunner(Protocol):
+    def __call__(
+        self,
+        command: tuple[str, ...],
+        *,
+        check: bool,
+        capture_output: bool,
+        text: bool,
+    ) -> subprocess.CompletedProcess[str]: ...
+
+
+class _VerifierModule(Protocol):
+    main: Callable[
+        [
+            Sequence[str] | None,
+            Mapping[str, str] | None,
+            Callable[[Path], ModuleType | None],
+            _CommandRunner,
+        ],
+        int,
+    ]
+
+
+_REPO_ROOT: Final = Path(__file__).resolve().parents[3]
+_MODULE_PATH: Final = _REPO_ROOT / ".github" / "scripts" / "verify_linux_native_wheel.py"
+_SPEC: Final = importlib.util.spec_from_file_location("verify_linux_native_wheel", _MODULE_PATH)
+assert _SPEC is not None and _SPEC.loader is not None
+_LOADED_VERIFIER: Final = importlib.util.module_from_spec(_SPEC)
+sys.modules[_SPEC.name] = _LOADED_VERIFIER
+_SPEC.loader.exec_module(_LOADED_VERIFIER)
+verifier: Final = cast(_VerifierModule, _LOADED_VERIFIER)
+
+_EXPECTED_TAG: Final = "cp310-abi3-linux_x86_64"
+_NATIVE_MEMBER: Final = "litellm/rust_bridge/_native.abi3.so"
+_DIST_INFO: Final = "litellm-1.100.0.dist-info"
+
+
+def _write_wheel(
+    tmp_path: Path,
+    *,
+    filename_tag: str,
+    metadata_tags: tuple[str, ...] | None = (_EXPECTED_TAG,),
+    dist_info: str = _DIST_INFO,
+    duplicate_wheel: bool = False,
+) -> Path:
+    wheel: Final = tmp_path / f"litellm-1.100.0-{filename_tag}.whl"
+    with zipfile.ZipFile(wheel, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+        archive.writestr(_NATIVE_MEMBER, b"synthetic native extension")
+        archive.writestr(
+            f"{dist_info}/METADATA",
+            "Metadata-Version: 2.1\nName: litellm\nVersion: 1.100.0\n",
+        )
+        archive.writestr(
+            f"{dist_info}/RECORD",
+            f"{_NATIVE_MEMBER},,\n{dist_info}/WHEEL,,\n",
+        )
+        if metadata_tags is not None:
+            wheel_metadata: Final = (
+                "Wheel-Version: 1.0\nGenerator: regression-test\nRoot-Is-Purelib: false\n"
+                + "".join(f"Tag: {tag}\n" for tag in metadata_tags)
+            )
+            archive.writestr(f"{dist_info}/WHEEL", wheel_metadata)
+            if duplicate_wheel:
+                archive.writestr(f"{dist_info}/WHEEL", wheel_metadata)
+    return wheel
+
+
+def _fake_subprocess_run(
+    command: tuple[str, ...],
+    *,
+    check: bool,
+    capture_output: bool,
+    text: bool,
+) -> subprocess.CompletedProcess[str]:
+    assert check and capture_output and text
+    if command == ("rustc", "--version"):
+        return subprocess.CompletedProcess(command, 0, stdout="rustc 1.98.0 (regression-test)\n", stderr="")
+    if "--sections" in command:
+        return subprocess.CompletedProcess(command, 0, stdout="[ 1] .text PROGBITS\n", stderr="")
+    if "--dyn-syms" in command:
+        return subprocess.CompletedProcess(command, 0, stdout="PyInit__native\n", stderr="")
+    raise AssertionError(f"unexpected subprocess command: {command}")
+
+
+class _NativeModuleWithPanicHook(ModuleType):
+    def _panic_for_test(self) -> None:
+        return None
+
+
+def _run_verifier(
+    wheel: Path,
+    *,
+    exposes_panic: bool = False,
+) -> int:
+    native_module: Final = (
+        _NativeModuleWithPanicHook("litellm.rust_bridge._native")
+        if exposes_panic
+        else ModuleType("litellm.rust_bridge._native")
+    )
+
+    def _fake_load_native_module(_: Path) -> ModuleType:
+        return native_module
+
+    environment: Final = MappingProxyType({"GITHUB_STEP_SUMMARY": str(wheel.parent / "summary.md")})
+    return verifier.main(
+        (str(_MODULE_PATH), str(wheel)),
+        environment,
+        _fake_load_native_module,
+        _fake_subprocess_run,
+    )
+
+
+def test_accepts_expected_release_wheel_tags(tmp_path: Path) -> None:
+    wheel: Final = _write_wheel(tmp_path, filename_tag=_EXPECTED_TAG)
+
+    assert _run_verifier(wheel) == 0
+
+
+def test_rejects_cp312_version_specific_wheel(tmp_path: Path) -> None:
+    tag: Final = "cp312-cp312-linux_x86_64"
+    wheel: Final = _write_wheel(tmp_path, filename_tag=tag, metadata_tags=(tag,))
+
+    assert _run_verifier(wheel) == 1
+
+
+def test_rejects_non_linux_platform_tag(tmp_path: Path) -> None:
+    tag: Final = "cp310-abi3-win_amd64"
+    wheel: Final = _write_wheel(tmp_path, filename_tag=tag, metadata_tags=(tag,))
+
+    assert _run_verifier(wheel) == 1
+
+
+@pytest.mark.parametrize(
+    "metadata_tags",
+    (None, ("cp312-cp312-linux_x86_64",)),
+    ids=("missing", "mismatched"),
+)
+def test_rejects_missing_or_mismatched_wheel_metadata_tag(
+    tmp_path: Path,
+    metadata_tags: tuple[str, ...] | None,
+) -> None:
+    wheel: Final = _write_wheel(tmp_path, filename_tag=_EXPECTED_TAG, metadata_tags=metadata_tags)
+
+    assert _run_verifier(wheel) == 1
+
+
+def test_rejects_wheel_metadata_from_wrong_dist_info_directory(
+    tmp_path: Path,
+) -> None:
+    wheel: Final = _write_wheel(
+        tmp_path,
+        filename_tag=_EXPECTED_TAG,
+        dist_info="decoy-1.0.0.dist-info",
+    )
+
+    assert _run_verifier(wheel) == 1
+
+
+def test_rejects_duplicate_wheel_metadata_tags(tmp_path: Path) -> None:
+    wheel: Final = _write_wheel(
+        tmp_path,
+        filename_tag=_EXPECTED_TAG,
+        metadata_tags=(_EXPECTED_TAG, _EXPECTED_TAG),
+    )
+
+    assert _run_verifier(wheel) == 1
+
+
+def test_rejects_duplicate_wheel_metadata_file(tmp_path: Path) -> None:
+    with pytest.warns(UserWarning, match="Duplicate name"):
+        wheel: Final = _write_wheel(
+            tmp_path,
+            filename_tag=_EXPECTED_TAG,
+            duplicate_wheel=True,
+        )
+
+    assert _run_verifier(wheel) == 1
+
+
+def test_rejects_production_module_exposing_panic_hook(tmp_path: Path) -> None:
+    wheel: Final = _write_wheel(tmp_path, filename_tag=_EXPECTED_TAG)
+
+    assert _run_verifier(wheel, exposes_panic=True) == 1
diff --git a/tests/test_litellm/test_circleci_rust_toolchain.py b/tests/test_litellm/test_circleci_rust_toolchain.py
index c35ced51e16..800ca21b95d 100644
--- a/tests/test_litellm/test_circleci_rust_toolchain.py
+++ b/tests/test_litellm/test_circleci_rust_toolchain.py
@@ -17,28 +17,27 @@ Two invariants are pinned here:
      Windows job, so the check accepts either. A new job that syncs without one
      falls back to the unpinned path, which is exactly the regression a static
      check catches at PR time and a green CI run does not.
-  2. `install_rust` itself pins what it downloads: an explicit rustup version in
-     the URL, a verified SHA-256, and an exact toolchain version rather than a
-     channel name.
-
-The Windows job predates `install_rust` and provisions its toolchain inline, so
-invariant 2 is scoped to `install_rust`; invariant 1 covers both.
+  2. Both installers pin what they download: an explicit rustup version, a
+     verified SHA-256, and the exact toolchain in `rust-toolchain.toml`.
 """
 
 from __future__ import annotations
 
 import re
 from pathlib import Path
+from typing import Final
 
 import pytest
 import yaml
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
 CONFIG = REPO_ROOT / ".circleci" / "config.yml"
+TOOLCHAIN: Final = REPO_ROOT / "rust-toolchain.toml"
 
 BUILDS_WORKSPACE = re.compile(r"\buv\s+(?:sync|build)\b")
 RUSTUP_ARCHIVE_URL = re.compile(r"https://static\.rust-lang\.org/rustup/archive/\d+\.\d+\.\d+/")
-EXACT_TOOLCHAIN = re.compile(r"--default-toolchain\s+\"?\d+\.\d+\.\d+\"?")
+EXACT_TOOLCHAIN = re.compile(r"--default-toolchain\s+\"?(\d+\.\d+\.\d+)\"?")
+TOOLCHAIN_CHANNEL: Final = re.compile(r'^channel = "(\d+\.\d+\.\d+)"$', re.MULTILINE)
 
 
 def _config() -> dict[str, object]:
@@ -57,6 +56,12 @@ def _step_text(step: object) -> str:
     return ""
 
 
+def _pinned_toolchain() -> str:
+    match: Final = TOOLCHAIN_CHANNEL.search(TOOLCHAIN.read_text())
+    assert match is not None, "rust-toolchain.toml must pin an exact channel"
+    return match.group(1)
+
+
 def _without_comments(text: str) -> str:
     return "\n".join(line for line in text.splitlines() if not line.lstrip().startswith("#"))
 
@@ -142,7 +147,17 @@ def test_install_rust_verifies_the_installer_checksum(install_rust_command: str)
 
 
 def test_install_rust_pins_an_exact_toolchain_version(install_rust_command: str) -> None:
-    assert EXACT_TOOLCHAIN.search(install_rust_command), (
-        "install_rust must pin an exact toolchain version (e.g. 1.97.1); a channel name like "
+    match: Final = EXACT_TOOLCHAIN.search(install_rust_command)
+    assert match is not None, (
+        "install_rust must pin an exact toolchain version (e.g. 1.98.0); a channel name like "
         "stable/beta/nightly makes the compiler drift with whatever upstream published that day"
     )
+    assert match.group(1) == _pinned_toolchain()
+
+
+def test_windows_installer_matches_the_repo_toolchain() -> None:
+    windows_steps: Final = _step_lists()["job using_litellm_on_windows"]
+    windows_command: Final = "\n".join(_step_text(step) for step in windows_steps)
+    match: Final = EXACT_TOOLCHAIN.search(windows_command)
+    assert match is not None
+    assert match.group(1) == _pinned_toolchain()
diff --git a/tests/test_litellm/test_logging.py b/tests/test_litellm/test_logging.py
index 087a1c8b3ad..bf3757e6886 100644
--- a/tests/test_litellm/test_logging.py
+++ b/tests/test_litellm/test_logging.py
@@ -1,26 +1,30 @@
 import ast
 import asyncio
 import json
+import logging
 import re
 import sys
+import time
+from io import StringIO
 from pathlib import Path
 from typing import List
 
 import pytest
 
-import logging
-
 import litellm
 from litellm._logging import (
     _COLOR_LOG_FORMAT,
+    _MAX_SCRUBBED_ACCESS_ARG,
     _PLAIN_LOG_FORMAT,
     ALL_LOGGERS,
+    AccessLogRedactionFilter,
     CorrelationContextFilter,
     CorrelationPlainFormatter,
     JsonFormatter,
     LevelRoutingStreamHandler,
     SecretRedactionFilter,
     StdoutLogTruncationFilter,
+    _get_uvicorn_json_log_config,
     _initialize_loggers_with_handler,
     _parse_json_logs_env,
     _plain_log_format,
@@ -968,3 +972,209 @@ def test_plain_log_format_survives_none_streams():
     """sys.stdout/sys.stderr can be None in embedded interpreters; import must not crash."""
     assert _plain_log_format(None, None) == _PLAIN_LOG_FORMAT
     assert _plain_log_format(_FakeStream(True), None) == _PLAIN_LOG_FORMAT
+
+
+# ---------------------------------------------------------------------------
+# Access-log redaction (LIT-5909)
+# ---------------------------------------------------------------------------
+
+_LEAKED_KEY = "sk-mx5ous1o9Iezz5fj3pkLuA"
+
+
+def _access_record(full_path: str) -> logging.LogRecord:
+    """A record shaped exactly like the one uvicorn.access emits per request."""
+    return logging.LogRecord(
+        name="uvicorn.access",
+        level=logging.INFO,
+        pathname="",
+        lineno=0,
+        msg='%s - "%s %s HTTP/%s" %d',
+        args=("127.0.0.1:1", "GET", full_path, "1.1", 200),
+        exc_info=None,
+    )
+
+
+@pytest.mark.parametrize(
+    "full_path",
+    [
+        f"/key/info?key={_LEAKED_KEY}",
+        f"/global/spend/report?api_key={_LEAKED_KEY}&start_date=2026-08-01",
+        f"/key/spend/report?api_key={_LEAKED_KEY}",
+        f"/spend/logs?api_key={_LEAKED_KEY}",
+        f"/user/daily/activity?api_key={_LEAKED_KEY}",
+        f"/gemini/v1beta/models/gemini-2.0-flash:generateContent?key={_LEAKED_KEY}",
+    ],
+)
+def test_access_log_filter_redacts_a_credential_query_parameter(full_path):
+    record = _access_record(full_path)
+    assert AccessLogRedactionFilter().filter(record) is True
+    assert _LEAKED_KEY not in record.getMessage()
+    assert "REDACTED" in record.getMessage()
+
+
+def test_access_log_filter_keeps_the_record_formattable_by_uvicorn():
+    """uvicorn's AccessFormatter unpacks record.args, so the filter must scrub the
+    args in place rather than collapse them the way SecretRedactionFilter does."""
+    from uvicorn.logging import AccessFormatter
+
+    record = _access_record(f"/key/info?key={_LEAKED_KEY}")
+    AccessLogRedactionFilter().filter(record)
+    assert isinstance(record.args, tuple)
+    assert len(record.args) == 5
+
+    formatted = AccessFormatter('%(client_addr)s - "%(request_line)s" %(status_code)s', use_colors=False).format(record)
+    assert _LEAKED_KEY not in formatted
+    assert "GET" in formatted
+    assert "200 OK" in formatted
+
+
+@pytest.mark.parametrize(
+    "full_path, want",
+    [
+        # The delimiter must survive so the logged request line stays well formed.
+        (f"/key/info?key={_LEAKED_KEY}&page=2", "/key/info?REDACTED&page=2"),
+        ("/download?sig=AbCd1234%2Fxy&page=2", "/download?REDACTED&page=2"),
+        (
+            f"/global/spend/report?api_key={_LEAKED_KEY}&start_date=2026-01-01",
+            "/global/spend/report?REDACTED&start_date=2026-01-01",
+        ),
+        ("/sso/callback?client_secret=abcdefgh12345&state=xyz", "/sso/callback?REDACTED&state=xyz"),
+        (f"/v1/models?token={_LEAKED_KEY}&page=2", "/v1/models?REDACTED&page=2"),
+    ],
+)
+def test_access_log_filter_keeps_the_query_delimiter(full_path, want):
+    record = _access_record(full_path)
+    AccessLogRedactionFilter().filter(record)
+    assert record.args[2] == want
+
+
+@pytest.mark.parametrize(
+    "full_path, want",
+    [
+        # Both the param name and the value are encoded, so neither is literal text
+        # the patterns can see, yet the request parser decodes it into a working key.
+        (f"/key/info?k%65y=sk%2D{_LEAKED_KEY[3:]}", "/key/info?REDACTED"),
+        (f"/key/info?k%65y=sk%2D{_LEAKED_KEY[3:]}&page=2", "/key/info?REDACTED"),
+        (f"/v1/models/sk%2D{_LEAKED_KEY[3:]}", "REDACTED"),
+        # A decoded credential must never be echoed back: it can carry a newline and
+        # forge a following log line.
+        (f"/v1/models?k%65y=sk%2D{_LEAKED_KEY[3:]}%0AINFO:%20forged", "/v1/models?REDACTED"),
+    ],
+)
+def test_access_log_filter_redacts_a_percent_encoded_credential(full_path, want):
+    record = _access_record(full_path)
+    AccessLogRedactionFilter().filter(record)
+    assert record.args[2] == want
+
+
+@pytest.mark.parametrize(
+    "full_path",
+    [
+        "/v1/models?filter=gpt%2D4o&page=2",
+        "/gemini/v1beta/models/gemini-2.0-flash%3AgenerateContent",
+    ],
+)
+def test_access_log_filter_leaves_harmless_percent_encoding_alone(full_path):
+    """Decoding is a detector, not a rewrite, so a request line with no credential
+    in it survives encoded exactly as the client sent it."""
+    record = _access_record(full_path)
+    AccessLogRedactionFilter().filter(record)
+    assert record.args[2] == full_path
+
+
+def test_access_log_filter_caps_how_much_of_a_request_target_it_scans():
+    """The request target is the only input to the secret regex an unauthenticated
+    caller controls end to end, so it is bounded before it is scanned, and the
+    dropped tail must not reach the log either."""
+    record = _access_record("/v1/models?u=" + "a://" * 8192 + f"&key={_LEAKED_KEY}")
+
+    started = time.perf_counter()
+    AccessLogRedactionFilter().filter(record)
+    elapsed = time.perf_counter() - started
+
+    scrubbed = record.args[2]
+    assert _LEAKED_KEY not in scrubbed
+    assert len(scrubbed) < 1024
+    assert elapsed < 1.0, f"scrubbing one access line took {elapsed:.2f}s"
+
+
+@pytest.mark.parametrize("chars_before_the_cut", range(1, 12))
+def test_access_log_filter_never_logs_a_half_scanned_credential(chars_before_the_cut):
+    """Cutting mid-value would leave a prefix too short for the key= pattern to match,
+    and that prefix would then be logged raw, so the cut lands on a param boundary."""
+    prefix = "/v1/models?u="
+    padding = _MAX_SCRUBBED_ACCESS_ARG - len(prefix) - len("&key=") - chars_before_the_cut
+    record = _access_record(f"{prefix}{'a' * padding}&key={_LEAKED_KEY}")
+
+    AccessLogRedactionFilter().filter(record)
+
+    assert f"key={_LEAKED_KEY[:chars_before_the_cut]}" not in record.args[2]
+
+
+def test_access_log_filter_leaves_a_credential_free_request_line_intact():
+    record = _access_record("/v1/chat/completions")
+    AccessLogRedactionFilter().filter(record)
+    assert record.getMessage() == '127.0.0.1:1 - "GET /v1/chat/completions HTTP/1.1" 200'
+
+
+def test_access_log_filter_redacts_a_record_that_carries_no_positional_args():
+    record = logging.LogRecord(
+        name="uvicorn.access",
+        level=logging.INFO,
+        pathname="",
+        lineno=0,
+        msg=f'127.0.0.1:1 - "GET /key/info?key={_LEAKED_KEY} HTTP/1.1" 200',
+        args=None,
+        exc_info=None,
+    )
+    assert AccessLogRedactionFilter().filter(record) is True
+    assert _LEAKED_KEY not in record.getMessage()
+
+
+def _emit_access_line(full_path: str) -> str:
+    """Hand one real record to uvicorn.access and return what a handler wrote out."""
+    from uvicorn.logging import AccessFormatter
+
+    logger = logging.getLogger("uvicorn.access")
+    stream = StringIO()
+    handler = logging.StreamHandler(stream)
+    handler.setFormatter(AccessFormatter('%(client_addr)s - "%(request_line)s" %(status_code)s', use_colors=False))
+    saved_level, saved_propagate = logger.level, logger.propagate
+    logger.addHandler(handler)
+    logger.setLevel(logging.INFO)
+    logger.propagate = False
+    try:
+        logger.handle(_access_record(full_path))
+    finally:
+        logger.removeHandler(handler)
+        logger.setLevel(saved_level)
+        logger.propagate = saved_propagate
+    return stream.getvalue()
+
+
+def test_uvicorn_access_logger_redacts_a_credential_it_is_handed():
+    """Registration happens at litellm import; without it the filter never runs."""
+    emitted = _emit_access_line(f"/key/info?key={_LEAKED_KEY}")
+
+    assert _LEAKED_KEY not in emitted
+    assert "REDACTED" in emitted
+
+
+def test_access_redaction_survives_the_uvicorn_json_log_config():
+    """litellm hands uvicorn a dictConfig when json_logs is on. dictConfig clears a
+    logger's handlers but not its filters, so redaction has to still be attached."""
+    import logging.config
+
+    names = ("uvicorn", "uvicorn.error", "uvicorn.access")
+    saved = tuple((logging.getLogger(n), logging.getLogger(n).handlers[:], logging.getLogger(n).level) for n in names)
+    try:
+        logging.config.dictConfig(_get_uvicorn_json_log_config())
+        emitted = _emit_access_line(f"/key/info?key={_LEAKED_KEY}")
+
+        assert _LEAKED_KEY not in emitted
+        assert "REDACTED" in emitted
+    finally:
+        for lg, handlers, level in saved:
+            lg.handlers[:] = handlers
+            lg.setLevel(level)
+            lg.propagate = True
diff --git a/tests/test_litellm/test_muse_spark_1_3_model_metadata.py b/tests/test_litellm/test_muse_spark_1_3_model_metadata.py
new file mode 100644
index 00000000000..1ecd9490f78
--- /dev/null
+++ b/tests/test_litellm/test_muse_spark_1_3_model_metadata.py
@@ -0,0 +1,107 @@
+import json
+from pathlib import Path
+
+import pytest
+
+import litellm
+from litellm.cost_calculator import cost_per_token
+from litellm.litellm_core_utils.get_llm_provider_logic import get_llm_provider
+from litellm.litellm_core_utils.llm_cost_calc.tool_call_cost_tracking import StandardBuiltInToolCostTracking
+
+MUSE_SPARK_STANDARD = "meta/muse-spark-1.3"
+MUSE_SPARK_CONTRIBUTOR = "meta/muse-spark-1.3-contributor"
+WEB_SEARCH_COST_PER_QUERY = 0.0025
+
+PRICING = (
+    (MUSE_SPARK_STANDARD, 1.25e-06, 1.5e-07, 4.25e-06),
+    (MUSE_SPARK_CONTRIBUTOR, 1e-07, 2e-09, 2e-07),
+)
+
+
+def _load_cost_map(filename: str = "model_prices_and_context_window.json") -> dict:
+    with open(Path(__file__).parents[2] / filename) as f:
+        return json.load(f)
+
+
+
+@pytest.mark.parametrize("model, input_cost, cached_cost, output_cost", PRICING)
+def test_muse_spark_1_3_model_info(model: str, input_cost: float, cached_cost: float, output_cost: float):
+    info = _load_cost_map().get(model)
+    assert info is not None, f"{model} not found in model_prices_and_context_window.json"
+
+    assert info["litellm_provider"] == "meta"
+    assert info["mode"] == "chat"
+
+    assert info["input_cost_per_token"] == input_cost
+    assert info["output_cost_per_token"] == output_cost
+    assert info["cache_read_input_token_cost"] == cached_cost
+
+    assert info["max_input_tokens"] == 1048576
+    assert info["max_output_tokens"] == 131072
+    assert info["max_tokens"] == 131072
+
+    assert info["supports_function_calling"] is True
+    assert info["supports_parallel_function_calling"] is True
+    assert info["supports_prompt_caching"] is True
+    assert info["supports_reasoning"] is True
+    assert info["supports_response_schema"] is True
+    assert info["supports_tool_choice"] is True
+    assert info["supports_vision"] is True
+    assert info["supports_pdf_input"] is True
+    assert info["supports_web_search"] is True
+    assert info["supports_minimal_reasoning_effort"] is True
+    assert info["supports_xhigh_reasoning_effort"] is True
+
+    assert info["supported_endpoints"] == ["/v1/chat/completions", "/v1/responses", "/v1/messages"]
+    assert info["supported_modalities"] == ["text", "image", "video"]
+    assert info["supported_output_modalities"] == ["text"]
+
+    assert info["search_context_cost_per_query"] == {
+        "search_context_size_high": WEB_SEARCH_COST_PER_QUERY,
+        "search_context_size_low": WEB_SEARCH_COST_PER_QUERY,
+        "search_context_size_medium": WEB_SEARCH_COST_PER_QUERY,
+    }
+
+
+@pytest.mark.parametrize("model, input_cost, cached_cost, output_cost", PRICING)
+def test_muse_spark_1_3_cost_per_token(
+    local_model_cost_map, model: str, input_cost: float, cached_cost: float, output_cost: float
+):
+    prompt_cost, completion_cost = cost_per_token(model=model, prompt_tokens=1000, completion_tokens=500)
+
+    assert prompt_cost == pytest.approx(1000 * input_cost)
+    assert completion_cost == pytest.approx(500 * output_cost)
+
+
+@pytest.mark.parametrize("model", (MUSE_SPARK_STANDARD, MUSE_SPARK_CONTRIBUTOR))
+def test_muse_spark_1_3_routes_to_meta_model_api(model: str):
+    routed_model, provider, _, api_base = get_llm_provider(model=model, api_key="sk-test")
+
+    assert routed_model == model.split("/", 1)[1]
+    assert provider == "meta"
+    assert api_base == "https://api.meta.ai/v1"
+
+
+@pytest.mark.parametrize("model", (MUSE_SPARK_STANDARD, MUSE_SPARK_CONTRIBUTOR))
+def test_muse_spark_1_3_web_search_cost_per_query(local_model_cost_map, model: str):
+    info = litellm.get_model_info(model=model)
+
+    assert StandardBuiltInToolCostTracking.get_cost_for_web_search(model_info=info) == WEB_SEARCH_COST_PER_QUERY
+
+
+@pytest.mark.parametrize("model", (MUSE_SPARK_STANDARD, MUSE_SPARK_CONTRIBUTOR))
+def test_muse_spark_1_3_backup_matches_main(model: str):
+    """Ensure the bundled model cost map stays in sync with the canonical file."""
+    main_cost = _load_cost_map()
+    backup_cost = _load_cost_map("litellm/model_prices_and_context_window_backup.json")
+
+    assert backup_cost.get(model) == main_cost.get(model), f"{model} differs between main and backup model cost maps"
+
+
+def test_muse_spark_contributor_tier_is_cheaper_than_standard():
+    cost_map = _load_cost_map()
+    standard = cost_map[MUSE_SPARK_STANDARD]
+    contributor = cost_map[MUSE_SPARK_CONTRIBUTOR]
+
+    for field in ("input_cost_per_token", "output_cost_per_token", "cache_read_input_token_cost"):
+        assert contributor[field] < standard[field], f"contributor {field} should undercut the standard tier"
diff --git a/tests/test_litellm/test_router.py b/tests/test_litellm/test_router.py
index d6328118f57..dcaa6cfd602 100644
--- a/tests/test_litellm/test_router.py
+++ b/tests/test_litellm/test_router.py
@@ -6,6 +6,7 @@ import logging
 import os
 import threading
 from types import SimpleNamespace
+from typing import Final
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import httpx
@@ -1537,6 +1538,91 @@ async def test_ageneric_api_call_deployment_model_overrides_alias():
     ), f"Expected deployment model 'vertex_ai/gemini-2.5-flash', got '{captured['model']}'"
 
 
+@pytest.mark.asyncio
+async def test_ageneric_api_call_resolves_realtime_session_model():
+    """
+    Regression for #36742: realtime client secret requests carry the model inside `session` too, and the proxy
+    fills it with the pre-routing model group name. The underlying litellm function reads session.model first,
+    so it must see the resolved deployment, while a caller's nested transcription model stays untouched.
+    """
+    routed: Final = AsyncMock(return_value={"result": "ok"})
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "my-realtime-group",
+                "litellm_params": {
+                    "model": "openai/gpt-realtime-2.1-mini",
+                    "api_key": "fake-key",
+                },
+                "model_info": {"mode": "realtime"},
+            }
+        ]
+    )
+
+    await router._ageneric_api_call_with_fallbacks(
+        model="my-realtime-group",
+        original_function=routed,
+        session={
+            "type": "realtime",
+            "model": "my-realtime-group",
+            "audio": {"input": {"transcription": {"model": "gpt-4o-transcribe"}}},
+        },
+    )
+
+    sent: Final = routed.call_args.kwargs
+    assert sent["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"]["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"]["audio"]["input"]["transcription"]["model"] == "gpt-4o-transcribe"
+
+
+@pytest.mark.asyncio
+async def test_ageneric_api_call_does_not_add_session_model():
+    """
+    A session that never carried a model must not gain one from routing: the underlying function then falls back
+    to the resolved `model` kwarg itself, and the outgoing session body keeps the caller's shape.
+    """
+    routed: Final = AsyncMock(return_value={"result": "ok"})
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "my-realtime-group",
+                "litellm_params": {
+                    "model": "openai/gpt-realtime-2.1-mini",
+                    "api_key": "fake-key",
+                },
+                "model_info": {"mode": "realtime"},
+            }
+        ]
+    )
+
+    await router._ageneric_api_call_with_fallbacks(
+        model="my-realtime-group",
+        original_function=routed,
+        session={"type": "realtime"},
+    )
+
+    sent: Final = routed.call_args.kwargs
+    assert sent["model"] == "openai/gpt-realtime-2.1-mini"
+    assert sent["session"] == {"type": "realtime"}
+
+
+@pytest.mark.parametrize(
+    "session, expected",
+    [
+        ({"type": "realtime", "model": "my-realtime-group"}, {"session": {"type": "realtime", "model": "resolved"}}),
+        ({"type": "realtime"}, {}),
+        (None, {}),
+        ("not-a-session", {}),
+    ],
+)
+def test_with_router_resolved_session_model(session, expected):
+    from litellm.router import _with_router_resolved_session_model
+
+    assert dict(_with_router_resolved_session_model(session, "resolved")) == expected
+
+
 def test_router_get_model_access_groups_team_only_models():
     """
     Test that Router.get_model_access_groups returns the correct response for team-only models
@@ -7575,6 +7661,118 @@ async def test_acreate_batch_request_bedrock_tags_override_deployment_tags():
         assert mock_sign.call_args.kwargs["data"]["tags"] == request_tags
 
 
+@pytest.mark.asyncio
+async def test_avector_store_search_injects_router():
+    """
+    Regression: router.avector_store_search must pass the router down to the
+    SDK search call so provider transforms can resolve router-managed
+    embedding models (e.g. S3 Vectors query embeddings).
+    """
+    from litellm.types.vector_stores import VectorStoreSearchResponse
+
+    expected_response = VectorStoreSearchResponse(
+        object="vector_store.search_results.page", search_query="q", data=[]
+    )
+    mock_asearch = AsyncMock(return_value=expected_response)
+    # Router.__init__ binds asearch via a local import, so patch the module
+    # attribute before constructing the Router.
+    with patch("litellm.vector_stores.main.asearch", new=mock_asearch):  # test-quality-ok: the SDK call is the only place the injected router kwarg is observable
+        router = litellm.Router(
+            model_list=[
+                {
+                    "model_name": "gpt-3.5-turbo",
+                    "litellm_params": {"model": "openai/gpt-3.5-turbo", "api_key": "test-key"},
+                }
+            ]
+        )
+        search_response = await router.avector_store_search(
+            vector_store_id="v", query="q", custom_llm_provider="s3_vectors"
+        )
+
+    assert search_response is expected_response
+    mock_asearch.assert_awaited_once()
+    assert mock_asearch.await_args.kwargs["router"] is router
+
+
+@pytest.mark.asyncio
+async def test_avector_store_create_does_not_inject_router():
+    """The router injection is gated on the search call type: the create path
+    must keep calling the SDK without a router kwarg."""
+    expected_response = {"id": "vs_1", "object": "vector_store"}
+    mock_acreate = AsyncMock(return_value=expected_response)
+    # avector_store_create(model=None) resolves acreate via a local import at
+    # call time, so patching after Router construction works here.
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "gpt-3.5-turbo",
+                "litellm_params": {"model": "openai/gpt-3.5-turbo", "api_key": "test-key"},
+            }
+        ]
+    )
+    with patch("litellm.vector_stores.main.acreate", new=mock_acreate):  # test-quality-ok: the SDK call is the only place a leaked router kwarg would surface
+        create_response = await router.avector_store_create(model=None, custom_llm_provider="openai")
+
+    assert create_response is expected_response
+    mock_acreate.assert_awaited_once()
+    assert "router" not in mock_acreate.await_args.kwargs
+
+
+def test_vector_store_search_injects_router():
+    """
+    Sync parity for the router injection: router.vector_store_search must pass
+    the router down to the SDK search call so provider transforms can resolve
+    router-managed embedding models, same as avector_store_search.
+    """
+    from litellm.types.vector_stores import VectorStoreSearchResponse
+
+    expected_response = VectorStoreSearchResponse(
+        object="vector_store.search_results.page", search_query="q", data=[]
+    )
+    mock_search = MagicMock(return_value=expected_response)
+    # Router.__init__ binds search via a local import, so patch the module
+    # attribute before constructing the Router.
+    with patch("litellm.vector_stores.main.search", new=mock_search):  # test-quality-ok: the SDK call is the only place the injected router kwarg is observable
+        router = litellm.Router(
+            model_list=[
+                {
+                    "model_name": "gpt-3.5-turbo",
+                    "litellm_params": {"model": "openai/gpt-3.5-turbo", "api_key": "test-key"},
+                }
+            ]
+        )
+        search_response = router.vector_store_search(
+            vector_store_id="v", query="q", custom_llm_provider="s3_vectors"
+        )
+
+    assert search_response is expected_response
+    mock_search.assert_called_once()
+    assert mock_search.call_args.kwargs["router"] is router
+    assert mock_search.call_args.kwargs["custom_llm_provider"] == "s3_vectors"
+
+
+def test_vector_store_create_does_not_inject_router():
+    """The sync create path must keep calling the SDK without a router kwarg."""
+    expected_response = {"id": "vs_1", "object": "vector_store"}
+    mock_create = MagicMock(return_value=expected_response)
+    # Router.__init__ binds create via a local import, so patch the module
+    # attribute before constructing the Router.
+    with patch("litellm.vector_stores.main.create", new=mock_create):  # test-quality-ok: the SDK call is the only place a leaked router kwarg would surface
+        router = litellm.Router(
+            model_list=[
+                {
+                    "model_name": "gpt-3.5-turbo",
+                    "litellm_params": {"model": "openai/gpt-3.5-turbo", "api_key": "test-key"},
+                }
+            ]
+        )
+        create_response = router.vector_store_create(custom_llm_provider="openai")
+
+    assert create_response is expected_response
+    mock_create.assert_called_once()
+    assert "router" not in mock_create.call_args.kwargs
+
+
 class TestPreRoutingStrategyRegistryLifecycle:
     """
     Regression tests: a deployment leaving the model_list must release the
@@ -11795,3 +11993,55 @@ class TestPreRoutingTierDrivesFallbacks:
         response = await router.acompletion(model="smart-router", messages=[{"role": "user", "content": "hi"}])
 
         assert response.choices[0].message.content == "from backup-b"
+
+
+@pytest.mark.asyncio
+async def test_prompt_management_factory_marks_injection_for_every_deployment(monkeypatch):
+    """The factory stamps a provisional deployment's model_info into kwargs before the
+    prompt pass runs, then routes on the returned model, so any deployment can end up
+    billed. An injection recorded there must carry the every-deployment sentinel, never
+    the provisional deployment's id, or a differently-billed deployment loses the credit."""
+    import time
+
+    from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "cached-claude",
+                "litellm_params": {
+                    "model": "anthropic_cache_control_hook/claude-sonnet-5",
+                    "prompt_id": "cache-points",
+                },
+                "model_info": {"id": "provisional-dep"},
+            }
+        ]
+    )
+    captured: dict = {}
+
+    async def _capture_acompletion(**kwargs):
+        captured.update(kwargs)
+        return litellm.ModelResponse()
+
+    monkeypatch.setattr(litellm, "acompletion", _capture_acompletion)
+    logging_obj = LiteLLMLogging(
+        model="cached-claude",
+        messages=[{"role": "user", "content": "hi"}],
+        stream=False,
+        call_type="acompletion",
+        start_time=time.time(),
+        litellm_call_id="lit-6445",
+        function_id="f",
+    )
+    await router.acompletion(
+        model="cached-claude",
+        messages=[
+            {"role": "system", "content": "a static system prompt"},
+            {"role": "user", "content": "hi"},
+        ],
+        cache_control_injection_points=[{"location": "message", "role": "system"}],
+        litellm_logging_obj=logging_obj,
+    )
+    bucket = captured.get("litellm_metadata") or captured["metadata"]
+    assert captured["model_info"]["id"] == "provisional-dep"
+    assert bucket["litellm_gateway_injected_cache"] == ""
diff --git a/tests/test_litellm/test_router_retry_policy_update.py b/tests/test_litellm/test_router_retry_policy_update.py
index 1b98b8c1ae8..be568134763 100644
--- a/tests/test_litellm/test_router_retry_policy_update.py
+++ b/tests/test_litellm/test_router_retry_policy_update.py
@@ -21,6 +21,7 @@ This file pins both halves of the fix.
 
 import json
 from dataclasses import dataclass
+from typing import Final
 from unittest.mock import AsyncMock, MagicMock
 
 import pytest
@@ -28,8 +29,19 @@ from pydantic import ValidationError
 
 
 import litellm
+from litellm.router_strategy.budget_limiter import RouterBudgetLimiting
+from litellm.router_utils.pre_call_checks.model_rate_limit_check import ModelRateLimitingCheck
+from litellm.router_utils.pre_call_checks.prompt_caching_deployment_check import PromptCachingDeploymentCheck
 from litellm.types.router import RetryPolicy, UpdateRouterConfig
 
+
+@pytest.fixture(autouse=True)
+def isolate_litellm_callbacks():
+    callbacks_before: Final = litellm.callbacks.copy()
+    yield
+    litellm.callbacks = callbacks_before  # test-quality-ok: required callback-state restoration fixture
+
+
 # ---------------------------------------------------------------------------
 # UpdateRouterConfig schema membership (LIT-3152 part 1)
 # ---------------------------------------------------------------------------
@@ -100,6 +112,114 @@ def _build_router() -> litellm.Router:
     )
 
 
+def test_update_settings_adds_optional_pre_call_check_once():
+    router = _build_router()
+
+    router.update_settings(num_retries=7, optional_pre_call_checks=["prompt_caching"])
+    router.update_settings(optional_pre_call_checks=["prompt_caching"])
+
+    prompt_caching_callbacks = [
+        callback for callback in router.optional_callbacks if isinstance(callback, PromptCachingDeploymentCheck)
+    ]
+    assert len(prompt_caching_callbacks) == 1
+    assert router.num_retries == 7
+
+
+def test_update_settings_clears_omitted_toggleable_pre_call_checks():
+    router = _build_router()
+
+    router.update_settings(optional_pre_call_checks=["prompt_caching"])
+    router.update_settings(optional_pre_call_checks=[])
+
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in (router.optional_callbacks or []))
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in litellm.callbacks)
+
+
+def test_set_optional_pre_call_checks_reconciles_callback_types():
+    router = _build_router()
+
+    router.set_optional_pre_call_checks(["prompt_caching"])
+    router.set_optional_pre_call_checks([])
+
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in (router.optional_callbacks or []))
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in litellm.callbacks)
+
+
+def test_remove_optional_pre_call_check_removes_local_and_global_callbacks():
+    router = _build_router()
+
+    router.set_optional_pre_call_checks(["prompt_caching"])
+    router._remove_optional_callbacks_of_type(PromptCachingDeploymentCheck)
+
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in (router.optional_callbacks or []))
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in litellm.callbacks)
+
+
+def test_remove_optional_pre_call_check_keeps_global_callback_for_another_router():
+    router_a = _build_router()
+    router_b = _build_router()
+
+    router_a.update_settings(optional_pre_call_checks=["prompt_caching"])
+    router_b.update_settings(optional_pre_call_checks=["prompt_caching"])
+
+    router_a.update_settings(optional_pre_call_checks=[])
+
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in (router_a.optional_callbacks or []))
+    assert any(type(callback) is PromptCachingDeploymentCheck for callback in (router_b.optional_callbacks or []))
+    assert any(type(callback) is PromptCachingDeploymentCheck for callback in litellm.callbacks)
+
+    router_b.update_settings(optional_pre_call_checks=[])
+
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in (router_b.optional_callbacks or []))
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in litellm.callbacks)
+
+
+def test_remove_optional_pre_call_check_keeps_global_callback_when_second_router_clears_first():
+    router_a = _build_router()
+    router_b = _build_router()
+
+    router_a.update_settings(optional_pre_call_checks=["prompt_caching"])
+    router_b.update_settings(optional_pre_call_checks=["prompt_caching"])
+
+    router_b.update_settings(optional_pre_call_checks=[])
+
+    assert any(type(callback) is PromptCachingDeploymentCheck for callback in (router_a.optional_callbacks or []))
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in (router_b.optional_callbacks or []))
+    assert any(type(callback) is PromptCachingDeploymentCheck for callback in litellm.callbacks)
+
+    router_a.update_settings(optional_pre_call_checks=[])
+
+    assert not any(type(callback) is PromptCachingDeploymentCheck for callback in litellm.callbacks)
+
+
+def test_update_settings_replaces_toggleable_pre_call_checks():
+    router = _build_router()
+
+    router.update_settings(optional_pre_call_checks=["prompt_caching"])
+    router.update_settings(optional_pre_call_checks=["enforce_model_rate_limits"])
+
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in (router.optional_callbacks or []))
+    assert not any(isinstance(callback, PromptCachingDeploymentCheck) for callback in litellm.callbacks)
+    assert any(isinstance(callback, ModelRateLimitingCheck) for callback in (router.optional_callbacks or []))
+
+
+@pytest.mark.asyncio
+async def test_update_settings_preserves_router_budget_limiting_when_omitted(monkeypatch):
+    async def _disable_periodic_sync(*args, **kwargs):
+        return None
+
+    monkeypatch.setattr(
+        "litellm.router_strategy.budget_limiter.RouterBudgetLimiting.periodic_sync_in_memory_spend_with_redis",
+        _disable_periodic_sync,
+    )
+    router = _build_router()
+
+    router.add_optional_pre_call_checks(["router_budget_limiting"])
+    router.update_settings(optional_pre_call_checks=[])
+
+    assert any(isinstance(callback, RouterBudgetLimiting) for callback in (router.optional_callbacks or []))
+
+
 def test_update_settings_persists_retry_policy_dict():
     """When the proxy's ``_add_router_settings_from_db_config`` calls
     ``llm_router.update_settings(retry_policy={...})`` after reading the
@@ -255,8 +375,12 @@ async def test_config_update_persists_and_reads_back_retry_policy(monkeypatch):
             RateLimitErrorRetries=7,
         )
     )
+    request = MagicMock()
+    request.json = AsyncMock(return_value={"router_settings": {"retry_policy": posted.model_dump()}})
+
     await proxy_server.update_config(
         config_info=ConfigYAML(router_settings=posted),
+        request=request,
         user_api_key_dict=UserAPIKeyAuth(user_role=LitellmUserRoles.PROXY_ADMIN, api_key="sk-1234"),
     )
 
diff --git a/tests/test_litellm/test_secret_redaction.py b/tests/test_litellm/test_secret_redaction.py
index 7d50694c805..303efcab9c7 100644
--- a/tests/test_litellm/test_secret_redaction.py
+++ b/tests/test_litellm/test_secret_redaction.py
@@ -1,8 +1,10 @@
 import logging
 import logging.config
 import sys
+import time
 from collections.abc import Callable
 from io import StringIO
+from typing import Final
 from unittest.mock import patch
 
 import pytest
@@ -67,6 +69,50 @@ def test_redact_string_catches_secret_patterns():
     assert redact_string(normal) == normal
 
 
+@pytest.mark.parametrize(
+    "connection_string",
+    [
+        "postgres://admin:pass3cret@db.example.com:5432/mydb",
+        "redis://:pass3cret@cache.example.com:6379",
+        "postgres://admin:pass/s3cret@db.example.com:5432/mydb",
+        "amqp://admin:pass:s3cret@rabbit:5672",
+        "https://ad@min:pass3cret@host",
+        # An unencoded "@" inside the password, with a ":" after it
+        "postgresql://admin:p@ss3cret:2026@db.example.com:5432/mydb",
+        "amqp://guest:gu@st3cret:1@rabbit:5672/",
+        # An AWS RDS IAM auth token is a presigned query string used as the
+        # password, so the userinfo runs to several hundred characters.
+        "postgresql://litellm:host%3A5432%2F%3FAction%3Dconnect%26X-Amz-Signature%3D"
+        + "f" * 540
+        + "s3cret@db.host:5432/litellm",
+    ],
+)
+def test_redact_string_still_catches_connection_string_credentials(connection_string):
+    """The bounded userinfo pattern must keep matching real connection strings."""
+    assert "s3cret" not in redact_string(connection_string)
+
+
+def _redaction_cost(url_bytes: int) -> float:
+    url: Final = "/x?u=" + "a://" * (url_bytes // 4)
+
+    def once() -> float:
+        started = time.perf_counter()
+        redact_string(url)
+        return time.perf_counter() - started
+
+    return min(once() for _ in range(3))
+
+
+def test_redact_string_stays_sub_quadratic_on_a_long_adversarial_url():
+    """Access-log redaction runs on attacker-controlled request lines, so quadrupling
+    a URL of scheme separators must not multiply the cost by sixteen. Comparing two
+    sizes rather than asserting a wall-clock ceiling keeps this honest on a slow box:
+    the unbounded pattern this replaced cost 5s at 4 KB and 314s at 16 KB."""
+    growth: Final = _redaction_cost(16 * 1024) / _redaction_cost(4 * 1024)
+
+    assert growth < 11.0, f"cost grew {growth:.1f}x for 4x the URL length"
+
+
 def test_redact_string_catches_minimum_length_virtual_key():
     """Regression test for LIT-4355: keys at the enforced 16-char minimum
     (MINIMUM_CUSTOM_KEY_LENGTH) must be treated as key-shaped by the scrubber."""
diff --git a/tests/test_litellm/test_utils.py b/tests/test_litellm/test_utils.py
index 0790b41c349..200cfd02197 100644
--- a/tests/test_litellm/test_utils.py
+++ b/tests/test_litellm/test_utils.py
@@ -41,7 +41,6 @@ from litellm.utils import (
     _snapshot_exception_for_hook,
     async_post_call_failure_deployment_hook,
     client,
-    get_api_key,
     get_llm_provider,
     get_non_default_completion_params,
     get_optional_params_image_gen,
@@ -4917,17 +4916,6 @@ def test_reapply_runtime_registrations_drops_request_scoped_registrations(monkey
         _invalidate_model_cost_lowercase_map()
 
 
-def test_ai21_api_key_is_resolved_from_the_documented_env_var(monkeypatch: pytest.MonkeyPatch) -> None:
-    """The ai21 branch resolved a misspelled env var, so the name every other ai21 code path
-    reads, and the only name documented, was ignored."""
-    monkeypatch.setattr(litellm, "api_key", None)
-    monkeypatch.setattr(litellm, "ai21_key", None)
-    monkeypatch.delenv("AI211_API_KEY", raising=False)
-    monkeypatch.setenv("AI21_API_KEY", "sk-ai21-resolved-from-env")
-
-    assert get_api_key(llm_provider="ai21", dynamic_api_key=None) == "sk-ai21-resolved-from-env"
-
-
 class _JsonCapture(logging.Handler):
     def __init__(self):
         super().__init__()
diff --git a/tests/test_litellm/vector_stores/__init__.py b/tests/test_litellm/vector_stores/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/tests/test_litellm/vector_stores/test_main.py b/tests/test_litellm/vector_stores/test_main.py
new file mode 100644
index 00000000000..d01e696906a
--- /dev/null
+++ b/tests/test_litellm/vector_stores/test_main.py
@@ -0,0 +1,78 @@
+"""
+Tests for litellm/vector_stores/main.py.
+
+Pins the router threading contract for vector store search: the router is an
+explicit named parameter that reaches the HTTP handler, and it must never leak
+into litellm_params/kwargs where logging would model_dump() it (the #19550
+serialization trap).
+"""
+
+from unittest.mock import MagicMock, patch
+
+import litellm.vector_stores.main as vector_stores_main
+from litellm.vector_stores.main import search
+
+MOCK_SEARCH_RESPONSE = {
+    "object": "vector_store.search_results.page",
+    "search_query": "q",
+    "data": [],
+}
+
+
+def test_search_threads_router_to_handler():
+    """search() must pass its router param through to the HTTP handler"""
+    mock_router = MagicMock()
+    logger = MagicMock()
+
+    with (
+        patch(  # test-quality-ok: stubs provider config resolution; the seam under test is the router kwarg threading
+            "litellm.vector_stores.main.ProviderConfigManager.get_provider_vector_stores_config",
+            return_value=MagicMock(),
+        ),
+        patch.object(  # test-quality-ok: the handler call is the observable boundary for the router kwarg contract
+            vector_stores_main.base_llm_http_handler,
+            "vector_store_search_handler",
+            return_value=MOCK_SEARCH_RESPONSE,
+        ) as mock_handler,
+    ):
+        response = search(
+            vector_store_id="bkt:idx",
+            query="q",
+            custom_llm_provider="s3_vectors",
+            router=mock_router,
+            litellm_logging_obj=logger,
+        )
+
+    assert response == MOCK_SEARCH_RESPONSE
+    mock_handler.assert_called_once()
+    assert mock_handler.call_args.kwargs["router"] is mock_router
+
+
+def test_search_router_not_in_litellm_params():
+    """Regression (#19550 class): the router must stay out of GenericLiteLLMParams,
+    otherwise pre-call logging model_dump()s it and breaks serialization."""
+    mock_router = MagicMock()
+    logger = MagicMock()
+
+    with (
+        patch(  # test-quality-ok: stubs provider config resolution; the seam under test is litellm_params contents
+            "litellm.vector_stores.main.ProviderConfigManager.get_provider_vector_stores_config",
+            return_value=MagicMock(),
+        ),
+        patch.object(  # test-quality-ok: the handler call is where a leaked router in litellm_params would surface
+            vector_stores_main.base_llm_http_handler,
+            "vector_store_search_handler",
+            return_value=MOCK_SEARCH_RESPONSE,
+        ) as mock_handler,
+    ):
+        search(
+            vector_store_id="bkt:idx",
+            query="q",
+            custom_llm_provider="s3_vectors",
+            router=mock_router,
+            litellm_logging_obj=logger,
+        )
+
+    litellm_params = mock_handler.call_args.kwargs["litellm_params"]
+    assert "router" not in litellm_params.model_dump(exclude_none=True)
+    assert getattr(litellm_params, "router", None) is None
diff --git a/type-discipline-budget.json b/type-discipline-budget.json
index 52cb9628252..6273fbce595 100644
--- a/type-discipline-budget.json
+++ b/type-discipline-budget.json
@@ -1,9 +1,9 @@
 {
   "LIT001": {
-    "limit": 22364
+    "limit": 22358
   },
   "LIT002": {
-    "limit": 26777
+    "limit": 26774
   },
   "LIT003": {
     "limit": 269
@@ -27,7 +27,7 @@
     "limit": 0
   },
   "LIT010": {
-    "limit": 16507
+    "limit": 16494
   },
   "LIT011": {
     "limit": 5535
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_info.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_info.integration.test.tsx
index 79bd2f6a21b..de1eb153f6f 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_info.integration.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_info.integration.test.tsx
@@ -75,6 +75,40 @@ const langgraphInfo: AgentCreateInfo = {
   ],
 };
 
+const FULL_RUNTIME_ARN = "arn:aws:bedrock-agentcore:eu-central-1:123456789012:runtime/hosted_agent_4vm3i-BaTdfOELAs";
+
+const BEDROCK_AGENTCORE_AGENT = {
+  agent_id: "agent-3",
+  agent_name: "bedrock-agent",
+  agent_card_params: { name: "bedrock-agent", description: "agentcore agent", url: "", version: "1.0.0", skills: [] },
+  litellm_params: {
+    custom_llm_provider: "bedrock",
+    model: `bedrock/agentcore/${FULL_RUNTIME_ARN}`,
+  },
+};
+
+const bedrockAgentcoreInfo: AgentCreateInfo = {
+  agent_type: "bedrock_agentcore",
+  agent_type_display_name: "Bedrock AgentCore",
+  description: "Bedrock AgentCore runtimes",
+  logo_url: "/b.png",
+  use_a2a_form_fields: false,
+  litellm_params_template: { custom_llm_provider: "bedrock" },
+  model_template: "bedrock/agentcore/{agent_runtime_arn}",
+  credential_fields: [
+    {
+      key: "agent_runtime_arn",
+      label: "Agent Runtime ARN",
+      field_type: "text",
+      required: true,
+      include_in_litellm_params: false,
+      validation_pattern: "^arn:aws[a-zA-Z0-9-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:runtime/.+$",
+      validation_message:
+        'Enter the complete Bedrock AgentCore runtime ARN, including the runtime ID after "runtime/".',
+    },
+  ],
+};
+
 const setup = () => userEvent.setup({ pointerEventsCheck: PointerEventsCheckLevel.Never });
 
 const renderView = () => render(<AgentInfoView agentId="agent-1" onClose={vi.fn()} accessToken="tok" isAdmin={true} />);
@@ -247,6 +281,69 @@ describe("AgentInfoView update payload", () => {
     });
   });
 
+  it("preserves the full AgentCore runtime ARN (including the resource id after runtime/) across an unedited save", async () => {
+    vi.mocked(networking.getAgentCreateMetadata).mockResolvedValue([bedrockAgentcoreInfo]);
+    vi.mocked(networking.getAgentInfo).mockResolvedValue(BEDROCK_AGENTCORE_AGENT as never);
+    const user = setup();
+    renderView();
+    await openEditor(user);
+
+    expect(await screen.findByLabelText("Agent Runtime ARN")).toHaveValue(FULL_RUNTIME_ARN);
+
+    await save(user);
+
+    expect((patchedPayload().litellm_params as Record<string, unknown>).model).toBe(
+      `bedrock/agentcore/${FULL_RUNTIME_ARN}`,
+    );
+  });
+
+  it("blocks the save and shows a validation error when the Agent Runtime ARN is truncated", async () => {
+    vi.mocked(networking.getAgentCreateMetadata).mockResolvedValue([bedrockAgentcoreInfo]);
+    vi.mocked(networking.getAgentInfo).mockResolvedValue(BEDROCK_AGENTCORE_AGENT as never);
+    const user = setup();
+    renderView();
+    await openEditor(user);
+
+    const arnField = await screen.findByLabelText("Agent Runtime ARN");
+    await user.clear(arnField);
+    fireEvent.change(arnField, {
+      target: { value: "arn:aws:bedrock-agentcore:eu-central-1:123456789012:runtime" },
+    });
+    await user.click(screen.getByRole("button", { name: "Save Changes" }));
+
+    expect(
+      await screen.findByText(
+        'Enter the complete Bedrock AgentCore runtime ARN, including the runtime ID after "runtime/".',
+      ),
+    ).toBeInTheDocument();
+    expect(networking.patchAgentCall).not.toHaveBeenCalled();
+  });
+
+  it("renders and saves normally when a field's validation_pattern is not a valid regex", async () => {
+    const infoWithBadPattern: AgentCreateInfo = {
+      ...bedrockAgentcoreInfo,
+      credential_fields: [
+        {
+          ...bedrockAgentcoreInfo.credential_fields[0],
+          validation_pattern: "(unterminated",
+        },
+      ],
+    };
+    vi.mocked(networking.getAgentCreateMetadata).mockResolvedValue([infoWithBadPattern]);
+    vi.mocked(networking.getAgentInfo).mockResolvedValue(BEDROCK_AGENTCORE_AGENT as never);
+    const user = setup();
+    renderView();
+    await openEditor(user);
+
+    expect(await screen.findByLabelText("Agent Runtime ARN")).toHaveValue(FULL_RUNTIME_ARN);
+
+    await save(user);
+
+    expect((patchedPayload().litellm_params as Record<string, unknown>).model).toBe(
+      `bedrock/agentcore/${FULL_RUNTIME_ARN}`,
+    );
+  });
+
   it("reloads the agent and leaves edit mode when the edit is cancelled", async () => {
     const user = setup();
     renderView();
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.test.ts b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.test.ts
new file mode 100644
index 00000000000..0c2d2500776
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.test.ts
@@ -0,0 +1,73 @@
+import { describe, it, expect } from "vitest";
+import { detectAgentType, extractModelTemplateValues, parseDynamicAgentForForm } from "./agent_type_utils";
+import type { AgentCreateInfo } from "@/components/networking";
+import type { Agent } from "@/components/agents/types";
+
+const FULL_RUNTIME_ARN = "arn:aws:bedrock-agentcore:eu-central-1:123456789012:runtime/hosted_agent_4vm3i-BaTdfOELAs";
+
+const bedrockAgentcoreInfo: AgentCreateInfo = {
+  agent_type: "bedrock_agentcore",
+  agent_type_display_name: "Bedrock AgentCore",
+  model_template: "bedrock/agentcore/{agent_runtime_arn}",
+  credential_fields: [
+    {
+      key: "agent_runtime_arn",
+      label: "Agent Runtime ARN",
+      required: true,
+      include_in_litellm_params: false,
+    },
+  ],
+};
+
+describe("extractModelTemplateValues", () => {
+  it("recovers a placeholder value that itself contains '/' (an AWS ARN resource path)", () => {
+    const values = extractModelTemplateValues(
+      "bedrock/agentcore/{agent_runtime_arn}",
+      `bedrock/agentcore/${FULL_RUNTIME_ARN}`,
+    );
+
+    expect(values.agent_runtime_arn).toBe(FULL_RUNTIME_ARN);
+  });
+
+  it("recovers a placeholder value with no '/' (single path segment)", () => {
+    const values = extractModelTemplateValues("langgraph/{assistant_id}", "langgraph/asst_1");
+
+    expect(values.assistant_id).toBe("asst_1");
+  });
+
+  it("returns no match when the model does not fit the template", () => {
+    const values = extractModelTemplateValues("langgraph/{assistant_id}", "azure_ai/agents/asst_1");
+
+    expect(values).toEqual({});
+  });
+});
+
+describe("parseDynamicAgentForForm", () => {
+  it("preserves the full runtime ARN, including the resource id after 'runtime/', when populating the edit form", () => {
+    const agent = {
+      agent_id: "agent-1",
+      agent_name: "bedrock-agent",
+      agent_card_params: { description: "" },
+      litellm_params: {
+        custom_llm_provider: "bedrock",
+        model: `bedrock/agentcore/${FULL_RUNTIME_ARN}`,
+      },
+    } as unknown as Agent;
+
+    const values = parseDynamicAgentForForm(agent, bedrockAgentcoreInfo);
+
+    expect(values.agent_runtime_arn).toBe(FULL_RUNTIME_ARN);
+  });
+});
+
+describe("detectAgentType", () => {
+  it("detects bedrock_agentcore agents from the model prefix", () => {
+    const agent = {
+      agent_id: "agent-1",
+      agent_name: "bedrock-agent",
+      litellm_params: { model: `bedrock/agentcore/${FULL_RUNTIME_ARN}` },
+    } as unknown as Agent;
+
+    expect(detectAgentType(agent)).toBe("bedrock_agentcore");
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.ts b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.ts
index f91590c5732..506f355c519 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.ts
+++ b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/agent_type_utils.ts
@@ -25,6 +25,29 @@ export const detectAgentType = (agent: Agent): string => {
   return "a2a";
 };
 
+const escapeRegExp = (segment: string): string => segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Reverses a `model_template` (e.g. "bedrock/agentcore/{agent_runtime_arn}") against a stored
+ * `model` string to recover the placeholder values that produced it. Builds a regex from the
+ * template's literal segments rather than matching by split("/") position, because a
+ * placeholder's value can itself contain "/" (an AWS ARN's "runtime/<runtime-id>" resource path,
+ * a Vertex AI reasoning engine's "projects/.../reasoningEngines/..." resource id) and would
+ * otherwise be cut off at the first one.
+ */
+export const extractModelTemplateValues = (template: string, model: string): Record<string, string> => {
+  // Splitting on a regex with a capturing group interleaves the captured placeholder
+  // names between the surrounding literal segments, e.g. "a/{x}/b" -> ["a/", "x", "/b"].
+  const parts = template.split(/\{([a-zA-Z0-9_]+)\}/g);
+  const fieldNames = parts.filter((_part, index) => index % 2 === 1);
+  const pattern = parts.map((part, index) => (index % 2 === 1 ? "(.+)" : escapeRegExp(part))).join("");
+
+  const match = model.match(new RegExp(`^${pattern}$`));
+  if (!match) return {};
+
+  return Object.fromEntries(fieldNames.map((name, index) => [name, match[index + 1]]));
+};
+
 /**
  * Parses agent data for dynamic form fields (non-A2A agents).
  * Extracts values from litellm_params based on the agent type metadata.
@@ -35,24 +58,18 @@ export const parseDynamicAgentForForm = (agent: Agent, agentTypeInfo: AgentCreat
     description: agent.agent_card_params?.description || "",
   };
 
+  const templateValues =
+    agentTypeInfo.model_template && agent.litellm_params?.model
+      ? extractModelTemplateValues(agentTypeInfo.model_template, agent.litellm_params.model)
+      : {};
+
   // Extract credential field values from litellm_params
   for (const field of agentTypeInfo.credential_fields) {
     if (field.include_in_litellm_params !== false) {
       values[field.key] = agent.litellm_params?.[field.key] || field.default_value || "";
-    } else {
-      // For fields not in litellm_params (like agent_id), try to extract from model string
-      if (agentTypeInfo.model_template && agent.litellm_params?.model) {
-        const model = agent.litellm_params.model;
-        const templateParts = agentTypeInfo.model_template.split("/");
-        const modelParts = model.split("/");
-
-        // Find the placeholder position and extract the value
-        templateParts.forEach((part, index) => {
-          if (part === `{${field.key}}` && modelParts[index]) {
-            values[field.key] = modelParts[index];
-          }
-        });
-      }
+    } else if (templateValues[field.key] !== undefined) {
+      // For fields not in litellm_params (like agent_runtime_arn), recover from the model string
+      values[field.key] = templateValues[field.key];
     }
   }
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/dynamic_agent_form_fields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/dynamic_agent_form_fields.tsx
index 04a8b0df9d9..0f3355fe073 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/dynamic_agent_form_fields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/agents/_components/dynamic_agent_form_fields.tsx
@@ -24,58 +24,80 @@ interface DynamicAgentFormFieldsProps {
 export const unmountedDynamicFieldNames = (mountedPanels: readonly string[]): readonly string[] =>
   mountedPanels.includes(AGENT_FORM_CONFIG.cost.key) ? [] : COST_FIELD_NAMES;
 
-const CredentialField = ({ field }: { field: AgentCredentialFieldMetadata }) => (
-  <AgentFormField
-    name={field.key}
-    label={field.tooltip ? labelWithHint(field.label, field.tooltip) : field.label}
-    defaultValue={field.default_value ?? undefined}
-    rules={field.required ? { required: `Please enter ${field.label}` } : undefined}
-  >
-    {({ value, onChange, ref, ...control }) => {
-      const text = typeof value === "string" ? value : "";
-      if (field.field_type === "password") {
-        return (
-          <PasswordInput
-            {...control}
-            value={typeof value === "string" ? value : ""}
-            onChange={onChange}
-            ref={ref}
-            placeholder={field.placeholder || ""}
-          />
-        );
-      }
-      if (field.field_type === "textarea") {
-        return (
-          <Textarea
-            {...control}
-            ref={ref}
-            rows={3}
-            placeholder={field.placeholder || ""}
-            value={text}
-            onChange={onChange}
-          />
-        );
-      }
-      if (field.field_type === "select" && field.options) {
-        return (
-          <Select value={text || null} onValueChange={onChange}>
-            <SelectTrigger {...control} className="w-full">
-              <SelectValue placeholder={field.placeholder || ""} />
-            </SelectTrigger>
-            <SelectContent>
-              {field.options.map((option) => (
-                <SelectItem key={option} value={option} title={option}>
-                  {option}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-        );
-      }
-      return <Input {...control} ref={ref} placeholder={field.placeholder || ""} value={text} onChange={onChange} />;
-    }}
-  </AgentFormField>
-);
+// A field's validation_pattern is server-supplied metadata; if it's ever not a valid regex, skip
+// validation rather than throwing during render and taking the whole form down with it.
+const buildValidationPatternRule = (
+  field: AgentCredentialFieldMetadata,
+): { value: RegExp; message: string } | undefined => {
+  if (!field.validation_pattern) return undefined;
+  try {
+    return {
+      value: new RegExp(field.validation_pattern),
+      message: field.validation_message || `${field.label} looks incomplete or malformed`,
+    };
+  } catch {
+    return undefined;
+  }
+};
+
+const CredentialField = ({ field }: { field: AgentCredentialFieldMetadata }) => {
+  const patternRule = buildValidationPatternRule(field);
+  return (
+    <AgentFormField
+      name={field.key}
+      label={field.tooltip ? labelWithHint(field.label, field.tooltip) : field.label}
+      defaultValue={field.default_value ?? undefined}
+      rules={{
+        ...(field.required ? { required: `Please enter ${field.label}` } : {}),
+        ...(patternRule ? { pattern: patternRule } : {}),
+      }}
+    >
+      {({ value, onChange, ref, ...control }) => {
+        const text = typeof value === "string" ? value : "";
+        if (field.field_type === "password") {
+          return (
+            <PasswordInput
+              {...control}
+              value={typeof value === "string" ? value : ""}
+              onChange={onChange}
+              ref={ref}
+              placeholder={field.placeholder || ""}
+            />
+          );
+        }
+        if (field.field_type === "textarea") {
+          return (
+            <Textarea
+              {...control}
+              ref={ref}
+              rows={3}
+              placeholder={field.placeholder || ""}
+              value={text}
+              onChange={onChange}
+            />
+          );
+        }
+        if (field.field_type === "select" && field.options) {
+          return (
+            <Select value={text || null} onValueChange={onChange}>
+              <SelectTrigger {...control} className="w-full">
+                <SelectValue placeholder={field.placeholder || ""} />
+              </SelectTrigger>
+              <SelectContent>
+                {field.options.map((option) => (
+                  <SelectItem key={option} value={option} title={option}>
+                    {option}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          );
+        }
+        return <Input {...control} ref={ref} placeholder={field.placeholder || ""} value={text} onChange={onChange} />;
+      }}
+    </AgentFormField>
+  );
+};
 
 const DynamicAgentFormFields: React.FC<DynamicAgentFormFieldsProps> = ({ agentTypeInfo, panels }) => (
   <>
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings.ts b/ui/litellm-dashboard/src/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings.ts
new file mode 100644
index 00000000000..8645e867c16
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings.ts
@@ -0,0 +1,47 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { apiClient } from "@/components/networking";
+import type { components } from "@/lib/http/schema";
+import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized";
+import { createQueryKeys } from "../common/queryKeysFactory";
+
+export type MCPToolSearchSettings = components["schemas"]["MCPToolSearchSettings"];
+export type MCPToolSearchSettingsResponse = components["schemas"]["MCPToolSearchSettingsResponse"];
+
+const GET_PATH = "/get/mcp_tool_search_settings";
+const UPDATE_PATH = "/update/mcp_tool_search_settings";
+
+const mcpToolSearchSettingsKeys = createQueryKeys("mcpToolSearchSettings");
+
+export const getMCPToolSearchSettings = (accessToken: string): Promise<MCPToolSearchSettingsResponse> =>
+  apiClient.get<MCPToolSearchSettingsResponse>(GET_PATH, { accessToken });
+
+export const updateMCPToolSearchSettings = (
+  accessToken: string,
+  settings: MCPToolSearchSettings,
+): Promise<MCPToolSearchSettings> =>
+  apiClient.patch<MCPToolSearchSettings>(UPDATE_PATH, { accessToken, body: settings });
+
+export const useMCPToolSearchSettings = () => {
+  const { accessToken } = useAuthorized();
+  return useQuery<MCPToolSearchSettingsResponse>({
+    queryKey: mcpToolSearchSettingsKeys.list({}),
+    queryFn: () => getMCPToolSearchSettings(accessToken),
+    enabled: !!accessToken,
+  });
+};
+
+export const useUpdateMCPToolSearchSettings = () => {
+  const { accessToken } = useAuthorized();
+  const queryClient = useQueryClient();
+  return useMutation<MCPToolSearchSettings, Error, MCPToolSearchSettings>({
+    mutationFn: (settings) => {
+      if (!accessToken) {
+        throw new Error("Access token is required");
+      }
+      return updateMCPToolSearchSettings(accessToken, settings);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: mcpToolSearchSettingsKeys.all });
+    },
+  });
+};
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_servers.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_servers.tsx
index 6e70b1ac59a..e6148d5d997 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_servers.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_servers.tsx
@@ -36,6 +36,7 @@ import type {
   Team,
 } from "@/components/mcp_tools/types";
 import MCPSemanticFilterSettings from "@/components/Settings/AdminSettings/MCPSemanticFilterSettings/MCPSemanticFilterSettings";
+import MCPToolSearchSettings from "@/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings";
 import MCPNetworkSettings from "./MCPNetworkSettings";
 import MCPDiscovery from "./mcp_discovery";
 import { ByokCredentialModal } from "@/components/mcp_tools/ByokCredentialModal";
@@ -544,6 +545,11 @@ const MCPServers: React.FC<MCPServerProps> = ({ accessToken, userRole, userID })
                 Semantic Filter
               </TabsTrigger>
             )}
+            {isAdminRole(userRole) && (
+              <TabsTrigger value="tool-search" className="flex-none rounded-none px-4 py-2">
+                Tool Search
+              </TabsTrigger>
+            )}
             {isAdminRole(userRole) && (
               <TabsTrigger value="network-settings" className="flex-none rounded-none px-4 py-2">
                 Network Settings
@@ -726,6 +732,11 @@ const MCPServers: React.FC<MCPServerProps> = ({ accessToken, userRole, userID })
               <MCPSemanticFilterSettings accessToken={accessToken} />
             </TabsContent>
           )}
+          {isAdminRole(userRole) && (
+            <TabsContent value="tool-search" keepMounted>
+              <MCPToolSearchSettings accessToken={accessToken} />
+            </TabsContent>
+          )}
           {isAdminRole(userRole) && (
             <TabsContent value="network-settings" keepMounted>
               <MCPNetworkSettings accessToken={accessToken} />
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.test.tsx
index 34643811e29..4203a3dbf70 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.test.tsx
@@ -116,16 +116,33 @@ describe("VectorStoreTester", () => {
     await waitFor(() => expect(mockSearch).toHaveBeenCalledTimes(1));
   });
 
-  it("reports a failed search and keeps the history empty", async () => {
+  it("shows the backend error in the history when a search fails", async () => {
     const user = userEvent.setup();
-    mockSearch.mockRejectedValue(new Error("boom"));
+    const errorBody = '{"error":{"message":"OpenAIException - api_key is required"}}';
+    mockSearch.mockRejectedValue(new Error(errorBody));
     renderTester();
 
     await user.type(queryInput(), "hello");
     await user.click(searchButton());
 
-    await waitFor(() => expect(mockFromBackend).toHaveBeenCalledWith("Failed to search vector store"));
-    expect(screen.getByText(EMPTY_STATE)).toBeInTheDocument();
+    await waitFor(() => expect(mockFromBackend).toHaveBeenCalledWith(errorBody));
+    expect(screen.getByText(`Search failed: ${errorBody}`)).toBeInTheDocument();
+    expect(screen.queryByText("No results found")).not.toBeInTheDocument();
+    expect(screen.queryByText(EMPTY_STATE)).not.toBeInTheDocument();
+    // the failed query stays in the input for retry
+    expect(queryInput()).toHaveValue("hello");
+  });
+
+  it('renders "No results found" for an empty result set, not an error', async () => {
+    const user = userEvent.setup();
+    mockSearch.mockResolvedValue({ object: "vector_store.search_results.page", search_query: "hello", data: [] });
+    renderTester();
+
+    await user.type(queryInput(), "hello");
+    await user.click(searchButton());
+
+    expect(await screen.findByText("No results found")).toBeInTheDocument();
+    expect(screen.queryByText(/search failed/i)).not.toBeInTheDocument();
   });
 
   it("clears the search history", async () => {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.tsx b/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.tsx
index 6d12880319b..a9c4e0d1061 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/vector-stores/_components/VectorStoreTester.tsx
@@ -40,6 +40,7 @@ export const VectorStoreTester: React.FC<VectorStoreTesterProps> = ({ vectorStor
     {
       query: string;
       response: VectorStoreSearchResponse | null;
+      error: string | null;
       timestamp: number;
     }[]
   >([]);
@@ -59,6 +60,7 @@ export const VectorStoreTester: React.FC<VectorStoreTesterProps> = ({ vectorStor
       const historyEntry = {
         query,
         response,
+        error: null,
         timestamp: Date.now(),
       };
 
@@ -66,7 +68,9 @@ export const VectorStoreTester: React.FC<VectorStoreTesterProps> = ({ vectorStor
       setQuery("");
     } catch (error) {
       console.error("Error searching vector store:", error);
-      toast.fromError("Failed to search vector store");
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      toast.fromError(errorMessage);
+      setSearchHistory((prev) => [{ query, response: null, error: errorMessage, timestamp: Date.now() }, ...prev]);
     } finally {
       setIsLoading(false);
     }
@@ -228,7 +232,13 @@ export const VectorStoreTester: React.FC<VectorStoreTesterProps> = ({ vectorStor
                           })}
                         </div>
                       ) : (
-                        <div className="text-sm text-muted-foreground">No results found</div>
+                        <div
+                          className={
+                            entry.error ? "text-sm break-words text-destructive" : "text-sm text-muted-foreground"
+                          }
+                        >
+                          {entry.error ? `Search failed: ${entry.error}` : "No results found"}
+                        </div>
                       )}
                     </div>
                   </div>
diff --git a/ui/litellm-dashboard/src/autorouter_presets.json b/ui/litellm-dashboard/src/autorouter_presets.json
index b977bd484ac..1e0d40567d7 100644
--- a/ui/litellm-dashboard/src/autorouter_presets.json
+++ b/ui/litellm-dashboard/src/autorouter_presets.json
@@ -68,13 +68,16 @@
   },
   "openai_family": {
     "label": "OpenAI Family",
-    "description": "Routes across the GPT model family: gpt-5.4-nano for simple queries, gpt-5.4-mini for medium, gpt-5.4 for complex, o3 for reasoning-heavy requests.",
+    "description": "Routes across the GPT model family: Luna for simple queries, Terra for medium, Sol for complex, Sol at xhigh thinking for reasoning.",
     "complexity_router_config": {
       "tiers": {
-        "SIMPLE": ["gpt-5.4-nano"],
-        "MEDIUM": ["gpt-5.4-mini"],
-        "COMPLEX": ["gpt-5.4"],
-        "REASONING": ["o3"]
+        "SIMPLE": ["gpt-5.6-luna"],
+        "MEDIUM": ["gpt-5.6-terra"],
+        "COMPLEX": ["gpt-5.6-sol"],
+        "REASONING": ["gpt-5.6-sol"]
+      },
+      "tier_model_configs": {
+        "REASONING": [{ "model_name": "gpt-5.6-sol", "litellm_params": { "reasoning_effort": "xhigh" } }]
       },
       "classifier_type": "heuristic",
       "escalation_keywords": ["LITELLM ESCALATE"],
diff --git a/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.test.tsx b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.test.tsx
new file mode 100644
index 00000000000..6e312bea651
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.test.tsx
@@ -0,0 +1,96 @@
+import React from "react";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, act, fireEvent } from "@testing-library/react";
+import MCPToolSearchSettings from "./MCPToolSearchSettings";
+import {
+  useMCPToolSearchSettings,
+  useUpdateMCPToolSearchSettings,
+} from "@/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings";
+
+vi.mock("@/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings", () => ({
+  useMCPToolSearchSettings: vi.fn(),
+  useUpdateMCPToolSearchSettings: vi.fn(),
+}));
+
+vi.mock("@/components/llm_calls/fetch_models", () => ({
+  fetchAvailableModels: vi.fn().mockResolvedValue([{ model_group: "text-embedding-3-small", mode: "embedding" }]),
+}));
+
+vi.mock("@/lib/toast", () => ({ toast: { success: vi.fn(), fromError: vi.fn() } }));
+
+const mockMutate = vi.fn();
+
+const EDITED_PAYLOAD = {
+  embedding_model: "text-embedding-3-small",
+  top_k: 8,
+  similarity_threshold: 0.25,
+  core_tools: ["treasury-get_rates", "weather-forecast"],
+};
+
+const STORED = {
+  field_schema: {},
+  values: {
+    embedding_model: "text-embedding-3-small",
+    top_k: 3,
+    similarity_threshold: 0.25,
+    core_tools: ["treasury-get_rates"],
+  },
+};
+
+type SettingsQuery = ReturnType<typeof useMCPToolSearchSettings>;
+type SettingsMutation = ReturnType<typeof useUpdateMCPToolSearchSettings>;
+
+const settled = (data: typeof STORED | undefined, overrides: Partial<SettingsQuery> = {}) =>
+  ({ data, isLoading: false, isError: false, error: null, ...overrides }) as SettingsQuery;
+
+async function renderSettings(accessToken: string | null = "token") {
+  const result = render(<MCPToolSearchSettings accessToken={accessToken} />);
+  await act(async () => {});
+  return result;
+}
+
+describe("MCPToolSearchSettings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(useMCPToolSearchSettings).mockReturnValue(settled(STORED));
+    vi.mocked(useUpdateMCPToolSearchSettings).mockReturnValue({
+      mutate: mockMutate,
+      isPending: false,
+    } as unknown as SettingsMutation);
+  });
+
+  it("shows the stored settings and keeps Save disabled until something changes", async () => {
+    await renderSettings();
+
+    expect(screen.getByLabelText(/top k results/i)).toHaveValue(3);
+    expect(screen.getByLabelText(/always returned first/i)).toHaveValue("treasury-get_rates");
+    expect(screen.getByRole("slider", { hidden: true })).toHaveAttribute("aria-valuenow", "0.25");
+    expect(screen.getByRole("button", { name: /save settings/i })).toBeDisabled();
+  });
+
+  it("sends the edited settings as the proxy's PATCH payload", async () => {
+    await renderSettings();
+
+    fireEvent.change(screen.getByLabelText(/top k results/i), { target: { value: "8" } });
+    fireEvent.change(screen.getByLabelText(/always returned first/i), {
+      target: { value: "treasury-get_rates\nweather-forecast" },
+    });
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /save settings/i }));
+    });
+
+    expect(mockMutate).toHaveBeenCalledTimes(1);
+    expect(mockMutate.mock.calls[0][0]).toEqual(EDITED_PAYLOAD);
+  });
+
+  it("asks the user to log in without a token and surfaces load errors", async () => {
+    await renderSettings(null);
+    expect(screen.getByText(/please log in/i)).toBeInTheDocument();
+
+    vi.mocked(useMCPToolSearchSettings).mockReturnValue(
+      settled(undefined, { isError: true, error: new Error("Database not connected") }),
+    );
+    await renderSettings();
+    expect(screen.getByText("Database not connected")).toBeInTheDocument();
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.tsx b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.tsx
new file mode 100644
index 00000000000..2ad9a56d0f3
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/MCPToolSearchSettings.tsx
@@ -0,0 +1,251 @@
+"use client";
+
+import {
+  useMCPToolSearchSettings,
+  useUpdateMCPToolSearchSettings,
+} from "@/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings";
+import { toast } from "@/lib/toast";
+import { Skeleton } from "@/components/ui/skeleton";
+import { CircleHelp, Info, Save } from "lucide-react";
+import { Alert, AlertDescription, AlertTitle } from "@/components/shared/Alert";
+import { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { fetchAvailableModels, ModelGroup } from "@/components/llm_calls/fetch_models";
+import { FieldGroup } from "@/components/ui/field";
+import { FormField } from "@/components/shared/form/FormField";
+import { SearchSelect } from "@/components/shared/SearchSelect";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Slider } from "@/components/ui/slider";
+import { Textarea } from "@/components/ui/textarea";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { UiLoadingSpinner } from "@/components/ui/ui-loading-spinner";
+import {
+  DEFAULT_FORM_VALUES,
+  TOP_K_MAX,
+  TOP_K_MIN,
+  clampTopK,
+  formToPayload,
+  storedValuesToForm,
+  ToolSearchFormValues,
+} from "./toolSearchForm";
+
+interface MCPToolSearchSettingsProps {
+  accessToken: string | null;
+}
+
+const SIMILARITY_THRESHOLD_MARKS = [0, 0.3, 0.5, 0.7, 1];
+
+const labelWithHint = (label: string, hint: string): React.ReactNode => (
+  <>
+    {label}
+    <Tooltip>
+      <TooltipTrigger render={<CircleHelp className="size-3.5 shrink-0 cursor-help text-muted-foreground" />} />
+      <TooltipContent>{hint}</TooltipContent>
+    </Tooltip>
+  </>
+);
+
+export default function MCPToolSearchSettings({ accessToken }: MCPToolSearchSettingsProps) {
+  const { data, isLoading, isError, error } = useMCPToolSearchSettings();
+  const { mutate: updateSettings, isPending: isUpdating } = useUpdateMCPToolSearchSettings();
+  const form = useForm<ToolSearchFormValues>({ defaultValues: DEFAULT_FORM_VALUES });
+  const isDirty = form.formState.isDirty;
+  const [embeddingModels, setEmbeddingModels] = useState<ModelGroup[]>([]);
+  const [loadingModels, setLoadingModels] = useState(true);
+  const storedValues = data?.values;
+
+  useEffect(() => {
+    if (!accessToken) return;
+    fetchAvailableModels(accessToken)
+      .then((models) => setEmbeddingModels(models.filter((model) => model.mode === "embedding")))
+      .catch((fetchError: unknown) => console.error("Error fetching embedding models:", fetchError))
+      .finally(() => setLoadingModels(false));
+  }, [accessToken]);
+
+  useEffect(() => {
+    if (!storedValues) return;
+    form.reset(storedValuesToForm(storedValues));
+  }, [storedValues, form]);
+
+  const handleSave = (formValues: ToolSearchFormValues) => {
+    updateSettings(formToPayload(formValues), {
+      onSuccess: () => {
+        form.reset(formValues);
+        toast.success("Settings updated successfully. Changes will be applied across all pods within 10 seconds.");
+      },
+      onError: (saveError) => toast.fromError(saveError),
+    });
+  };
+
+  if (!accessToken) {
+    return <div className="p-6 text-center text-muted-foreground">Please log in to configure tool search.</div>;
+  }
+
+  if (isLoading) {
+    return (
+      <div className="flex flex-col gap-3">
+        <Skeleton className="h-4 w-2/5" />
+        <Skeleton className="h-4 w-full" />
+        <Skeleton className="h-4 w-3/5" />
+      </div>
+    );
+  }
+
+  if (isError) {
+    return (
+      <Alert variant="error" className="mb-6">
+        <AlertTitle>Could not load MCP tool search settings</AlertTitle>
+        {error instanceof Error && <AlertDescription>{error.message}</AlertDescription>}
+      </Alert>
+    );
+  }
+
+  return (
+    <div className="w-full">
+      <Alert variant="info" className="mb-6">
+        <Info />
+        <AlertTitle>Native MCP Tool Search</AlertTitle>
+        <AlertDescription>
+          Controls the <code>mcp_tool_search</code> virtual tool that native MCP clients call to discover tools. With an
+          embedding model set, tools are ranked by the meaning of their name and description, so a query like
+          &quot;FX&quot; finds a &quot;foreign exchange rates&quot; tool. Without one, keyword matching is used. Callers
+          only ever see tools their key, team and server permissions already allow.
+        </AlertDescription>
+      </Alert>
+
+      <TooltipProvider>
+        <form onSubmit={(event) => event.preventDefault()} noValidate>
+          <Card className="mb-4">
+            <CardHeader className="border-b">
+              <CardTitle>Ranking</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <FieldGroup>
+                <FormField
+                  control={form.control}
+                  name="embedding_model"
+                  label={labelWithHint(
+                    "Embedding Model",
+                    "Embedding model from your model list used to rank tools by meaning. Clear it to fall back to keyword matching.",
+                  )}
+                >
+                  {({ value, onChange, id }) => (
+                    <SearchSelect
+                      inputId={id}
+                      options={embeddingModels.map((model) => ({ label: model.model_group, value: model.model_group }))}
+                      value={value}
+                      onValueChange={onChange}
+                      allowClear
+                      placeholder={loadingModels ? "Loading models..." : "Keyword matching (no embedding model)"}
+                      emptyText={loadingModels ? "Loading..." : "No embedding models available"}
+                      disabled={isUpdating || loadingModels}
+                    />
+                  )}
+                </FormField>
+
+                <FormField
+                  control={form.control}
+                  name="top_k"
+                  label={labelWithHint(
+                    "Top K Results",
+                    "Most ranked tools a search returns. A smaller top_k in the tool call wins. Core tools do not count.",
+                  )}
+                >
+                  {({ ref, value, onChange, onBlur, id }) => (
+                    <Input
+                      id={id}
+                      ref={ref}
+                      type="number"
+                      min={TOP_K_MIN}
+                      max={TOP_K_MAX}
+                      value={value}
+                      onChange={(event) => onChange(event.target.valueAsNumber)}
+                      onBlur={() => {
+                        onChange(Number.isNaN(value) ? DEFAULT_FORM_VALUES.top_k : clampTopK(value));
+                        onBlur();
+                      }}
+                      disabled={isUpdating}
+                    />
+                  )}
+                </FormField>
+
+                <FormField
+                  control={form.control}
+                  name="similarity_threshold"
+                  label={labelWithHint(
+                    "Similarity Threshold",
+                    "Lowest cosine similarity a tool needs to appear in semantic results. 0 means no cutoff.",
+                  )}
+                >
+                  {({ value, onChange, id }) => (
+                    <div className="w-full">
+                      <Slider
+                        id={id}
+                        min={0}
+                        max={1}
+                        step={0.05}
+                        value={[value]}
+                        onValueChange={(next) => onChange(Array.isArray(next) ? next[0] : next)}
+                        disabled={isUpdating}
+                      />
+                      <div className="relative mt-2 h-4 text-xs text-muted-foreground">
+                        {SIMILARITY_THRESHOLD_MARKS.map((mark) => (
+                          <span key={mark} className="absolute -translate-x-1/2" style={{ left: `${mark * 100}%` }}>
+                            {mark.toFixed(1)}
+                          </span>
+                        ))}
+                      </div>
+                    </div>
+                  )}
+                </FormField>
+              </FieldGroup>
+            </CardContent>
+          </Card>
+
+          <Card className="mb-4">
+            <CardHeader className="border-b">
+              <CardTitle>Core Tools</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <FieldGroup>
+                <FormField
+                  control={form.control}
+                  name="core_tools_text"
+                  label={labelWithHint(
+                    "Always Returned First",
+                    "One tool name per line, e.g. my_server-get_rates. Listed before ranked results whenever the caller is allowed to use them.",
+                  )}
+                >
+                  {({ ref, value, onChange, onBlur, id }) => (
+                    <Textarea
+                      id={id}
+                      ref={ref}
+                      value={value}
+                      placeholder={"my_server-get_rates\nmy_server-list_accounts"}
+                      onChange={(event) => onChange(event.target.value)}
+                      onBlur={onBlur}
+                      disabled={isUpdating}
+                    />
+                  )}
+                </FormField>
+              </FieldGroup>
+            </CardContent>
+          </Card>
+
+          <div className="flex justify-end gap-2">
+            <Button
+              type="button"
+              onClick={() => void form.handleSubmit(handleSave)()}
+              disabled={!isDirty || isUpdating}
+            >
+              {isUpdating ? <UiLoadingSpinner className="size-4" /> : <Save />}
+              Save Settings
+            </Button>
+          </div>
+        </form>
+      </TooltipProvider>
+    </div>
+  );
+}
diff --git a/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.test.ts b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.test.ts
new file mode 100644
index 00000000000..2f9032537c1
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { DEFAULT_FORM_VALUES, formToPayload, parseCoreTools, storedValuesToForm } from "./toolSearchForm";
+
+const STORED_SEMANTIC = {
+  embedding_model: "text-embedding-3-small",
+  top_k: 3,
+  similarity_threshold: 0.25,
+  core_tools: ["treasury-get_rates", "treasury-list_accounts"],
+};
+
+const SEMANTIC_FORM = {
+  embedding_model: "text-embedding-3-small",
+  top_k: 3,
+  similarity_threshold: 0.25,
+  core_tools_text: "treasury-get_rates\ntreasury-list_accounts",
+};
+
+const KEYWORD_PAYLOAD = { embedding_model: null, top_k: 5, similarity_threshold: 0, core_tools: [] };
+
+const OVERSIZED_FORM = {
+  embedding_model: "emb",
+  top_k: 400,
+  similarity_threshold: 0.5,
+  core_tools_text: "treasury-get_rates",
+};
+
+const CLAMPED_PAYLOAD = {
+  embedding_model: "emb",
+  top_k: 100,
+  similarity_threshold: 0.5,
+  core_tools: ["treasury-get_rates"],
+};
+
+describe("storedValuesToForm", () => {
+  it("maps stored settings onto the form, joining core tools one per line", () => {
+    expect(storedValuesToForm(STORED_SEMANTIC)).toEqual(SEMANTIC_FORM);
+  });
+
+  it("falls back to keyword defaults when nothing usable is stored", () => {
+    expect(storedValuesToForm({})).toEqual(DEFAULT_FORM_VALUES);
+    expect(storedValuesToForm({ embedding_model: null, top_k: "7" })).toEqual(DEFAULT_FORM_VALUES);
+  });
+});
+
+describe("parseCoreTools", () => {
+  it("splits on newlines and commas, trims, drops blanks and duplicates in order", () => {
+    expect(parseCoreTools(" a-x \n\nb-y, a-x ,c-z\n")).toEqual(["a-x", "b-y", "c-z"]);
+  });
+});
+
+describe("formToPayload", () => {
+  it("sends null for a cleared embedding model so the proxy returns to keyword matching", () => {
+    expect(formToPayload({ ...DEFAULT_FORM_VALUES, embedding_model: "  " })).toEqual(KEYWORD_PAYLOAD);
+  });
+
+  it("clamps top_k into the range the proxy accepts and lists core tools", () => {
+    expect(formToPayload(OVERSIZED_FORM)).toEqual(CLAMPED_PAYLOAD);
+    expect(formToPayload({ ...DEFAULT_FORM_VALUES, top_k: 0 }).top_k).toBe(1);
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.ts b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.ts
new file mode 100644
index 00000000000..f10bfd249d7
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/Settings/AdminSettings/MCPToolSearchSettings/toolSearchForm.ts
@@ -0,0 +1,49 @@
+import type { MCPToolSearchSettings } from "@/app/(dashboard)/hooks/mcpToolSearchSettings/useMCPToolSearchSettings";
+
+export interface ToolSearchFormValues {
+  embedding_model: string;
+  top_k: number;
+  similarity_threshold: number;
+  core_tools_text: string;
+}
+
+export const TOP_K_MIN = 1;
+export const TOP_K_MAX = 100;
+
+export const DEFAULT_FORM_VALUES: ToolSearchFormValues = {
+  embedding_model: "",
+  top_k: 5,
+  similarity_threshold: 0,
+  core_tools_text: "",
+};
+
+const isString = (value: unknown): value is string => typeof value === "string";
+const isNumber = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
+
+export const parseCoreTools = (text: string): string[] =>
+  Array.from(
+    new Set(
+      text
+        .split(/[\n,]/)
+        .map((name) => name.trim())
+        .filter((name) => name.length > 0),
+    ),
+  );
+
+export const clampTopK = (value: number): number => Math.min(TOP_K_MAX, Math.max(TOP_K_MIN, Math.round(value)));
+
+export const storedValuesToForm = (values: Record<string, unknown>): ToolSearchFormValues => ({
+  embedding_model: isString(values.embedding_model) ? values.embedding_model : DEFAULT_FORM_VALUES.embedding_model,
+  top_k: isNumber(values.top_k) ? values.top_k : DEFAULT_FORM_VALUES.top_k,
+  similarity_threshold: isNumber(values.similarity_threshold)
+    ? values.similarity_threshold
+    : DEFAULT_FORM_VALUES.similarity_threshold,
+  core_tools_text: Array.isArray(values.core_tools) ? values.core_tools.filter(isString).join("\n") : "",
+});
+
+export const formToPayload = (form: ToolSearchFormValues): MCPToolSearchSettings => ({
+  embedding_model: form.embedding_model.trim() === "" ? null : form.embedding_model.trim(),
+  top_k: clampTopK(form.top_k),
+  similarity_threshold: form.similarity_threshold,
+  core_tools: parseCoreTools(form.core_tools_text),
+});
diff --git a/ui/litellm-dashboard/src/components/networking.tsx b/ui/litellm-dashboard/src/components/networking.tsx
index b53a67f9bcc..db7baf5e171 100644
--- a/ui/litellm-dashboard/src/components/networking.tsx
+++ b/ui/litellm-dashboard/src/components/networking.tsx
@@ -310,6 +310,8 @@ export interface AgentCredentialFieldMetadata {
   options?: string[] | null;
   default_value?: string | null;
   include_in_litellm_params?: boolean;
+  validation_pattern?: string | null;
+  validation_message?: string | null;
 }
 
 export interface AgentCreateInfo {
@@ -6970,7 +6972,7 @@ export const vectorStoreSearchCall = async (
     if (!response.ok) {
       const errorData = await response.text();
       await handleError(errorData);
-      return null;
+      throw new Error(errorData);
     }
 
     const data = await response.json();
diff --git a/ui/litellm-dashboard/src/lib/autorouter_presets.test.ts b/ui/litellm-dashboard/src/lib/autorouter_presets.test.ts
index 2a8306473b8..b5802ffa2dc 100644
--- a/ui/litellm-dashboard/src/lib/autorouter_presets.test.ts
+++ b/ui/litellm-dashboard/src/lib/autorouter_presets.test.ts
@@ -158,6 +158,24 @@ describe("autorouter_presets", () => {
     });
   });
 
+  it("pins the OpenAI preset to the Luna, Terra, and Sol progression", () => {
+    const preset = getPresetByKey("openai_family")!;
+    const expectedTiers = {
+      SIMPLE: ["gpt-5.6-luna"],
+      MEDIUM: ["gpt-5.6-terra"],
+      COMPLEX: ["gpt-5.6-sol"],
+      REASONING: ["gpt-5.6-sol"],
+    };
+    expect(preset.complexity_router_config.tiers).toEqual(expectedTiers);
+    expect(preset.complexity_router_config.tier_model_configs).toEqual({
+      REASONING: [{ model_name: "gpt-5.6-sol", litellm_params: { reasoning_effort: "xhigh" } }],
+    });
+    const prefill = buildPresetPrefill(preset.complexity_router_config, groupsOnly(getRequiredModelsInPreset(preset)));
+    expect(prefill.complexityRouterConfig.tier_model_params).toEqual({
+      REASONING: { "gpt-5.6-sol": { reasoning_effort: "xhigh" } },
+    });
+  });
+
   it("pins the gemini preset to concrete model ids, never Google's hot-swapping -latest aliases", () => {
     const gemini = getPresetByKey("gemini_family")!;
     const config = gemini.complexity_router_config;
diff --git a/ui/litellm-dashboard/src/lib/http/schema.d.ts b/ui/litellm-dashboard/src/lib/http/schema.d.ts
index 6f044fec3f3..522a2de574b 100644
--- a/ui/litellm-dashboard/src/lib/http/schema.d.ts
+++ b/ui/litellm-dashboard/src/lib/http/schema.d.ts
@@ -5110,6 +5110,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/get/mcp_tool_search_settings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Mcp Tool Search Settings
+         * @description Get the `litellm_settings.mcp_tool_search` configuration used by the native `mcp_tool_search` virtual tool.
+         */
+        get: operations["get_mcp_tool_search_settings_get_mcp_tool_search_settings_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/get/sso_settings": {
         parameters: {
             query?: never;
@@ -7692,8 +7712,9 @@ export interface paths {
          * @description Retrieve information about a key.
          *
          *     Parameters:
-         *     - key: str | None (query parameter) - The key to look up. Accepts the plaintext key or its hash.
-         *       Defaults to the key in the Authorization header.
+         *     - key: str | None (query parameter) - The key to look up. Accepts the plaintext key or its hash;
+         *       prefer the hash, since a query parameter is recorded verbatim by any HTTP access log in front
+         *       of the proxy. Defaults to the key in the Authorization header.
          *
          *     Returns:
          *     - key: str - The key that was looked up, echoed back as it was passed in
@@ -7725,7 +7746,7 @@ export interface paths {
          *
          *     Example Curl:
          *     ```
-         *     curl -X GET "http://0.0.0.0:4000/key/info?key=sk-test-example-key-123" -H "Authorization: Bearer sk-1234"
+         *     curl -X GET "http://0.0.0.0:4000/key/info?key=d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa" -H "Authorization: Bearer sk-1234"
          *     ```
          *
          *     Example Curl - if no key is passed, it will use the Key Passed in Authorization Header
@@ -14021,7 +14042,7 @@ export interface paths {
          *
          *     Example Request for specific api_key
          *     ```
-         *     curl -X GET "http://0.0.0.0:8000/spend/logs?api_key=sk-test-example-key-123" -H "Authorization: Bearer sk-1234"
+         *     curl -X GET "http://0.0.0.0:8000/spend/logs?api_key=d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa" -H "Authorization: Bearer sk-1234"
          *     ```
          *
          *     Example Request for specific user_id
@@ -16126,6 +16147,27 @@ export interface paths {
         patch: operations["update_mcp_semantic_filter_settings_update_mcp_semantic_filter_settings_patch"];
         trace?: never;
     };
+    "/update/mcp_tool_search_settings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update Mcp Tool Search Settings
+         * @description Update `litellm_settings.mcp_tool_search` in the database.
+         *     Settings will be picked up by all pods within approximately 10 seconds via background polling.
+         */
+        patch: operations["update_mcp_tool_search_settings_update_mcp_tool_search_settings_patch"];
+        trace?: never;
+    };
     "/update/sso_settings": {
         parameters: {
             query?: never;
@@ -22868,6 +22910,10 @@ export interface components {
             required: boolean;
             /** Tooltip */
             tooltip?: string | null;
+            /** Validation Message */
+            validation_message?: string | null;
+            /** Validation Pattern */
+            validation_pattern?: string | null;
         };
         /**
          * AgentExtension
@@ -25434,6 +25480,11 @@ export interface components {
              * @description run health checks in background
              */
             background_health_checks?: boolean | null;
+            /**
+             * Blocked File Extensions
+             * @description file extensions (e.g. ['.exe', '.sh']) rejected on /v1/files uploads, for any purpose, matched case-insensitively against the uploaded filename
+             */
+            blocked_file_extensions?: string[] | null;
             /**
              * Cancel On Disconnect
              * @description cancel the in-flight upstream LLM request (non-streaming) when the client disconnects, freeing backend capacity (e.g. a vLLM GPU slot); the request is logged as a 499 failure
@@ -25518,6 +25569,11 @@ export interface components {
              * @description If True, disables the optimistic per-request budget reservation introduced in v1.84.0. WARNING: This weakens hard budget enforcement. Without the reservation, a burst of concurrent requests from a single key can each pass the read-time spend check before any of them is charged, allowing a configured budget to be exceeded under high concurrency. Budgets are still evaluated on every request at read time, so an already-exhausted budget is still rejected. Enable only if your deployment is experiencing phantom BudgetExceededError responses caused by leaked reservations (see GitHub issue #27639). A proxy-level WARNING is logged on every request while this flag is active as a reminder that hard enforcement is relaxed.
              */
             disable_budget_reservation?: boolean | null;
+            /**
+             * Disable Password Login When Sso Enabled
+             * @description If True and SSO is configured (MICROSOFT_CLIENT_ID, GOOGLE_CLIENT_ID, GENERIC_CLIENT_ID, or SAML_IDP_METADATA_URL/XML), disables username/password login on /login, /v2/login, and /v3/login so SSO is the only way to reach the Admin UI. An admin locked out of the UI can still administer the proxy over the API with the master key; unset this setting and restart the proxy to restore UI username/password login. Default is False.
+             */
+            disable_password_login_when_sso_enabled?: boolean | null;
             /**
              * Enable Public Model Hub
              * @description Public model hub for users to see what models they have access to, supported openai params, etc.
@@ -25573,6 +25629,11 @@ export interface components {
              * @description max batch input file size in MB for /v1/files uploads with purpose=batch, if a file is larger than this size it will be rejected before being forwarded to the provider
              */
             max_batch_file_size_mb?: number | null;
+            /**
+             * Max File Size Mb
+             * @description max file size in MB for /v1/files uploads, for any purpose, if a file is larger than this size it will be rejected before being forwarded to the provider
+             */
+            max_file_size_mb?: number | null;
             /**
              * Max Parallel Requests
              * @description maximum parallel requests for each api key
@@ -25663,6 +25724,31 @@ export interface components {
              * @description Default upstream request timeout in seconds for native and custom pass-through endpoints that use pass_through_request. Defaults to 600 when unset.
              */
             pass_through_request_timeout?: number | null;
+            /**
+             * Password Policy Min Length
+             * @description Minimum length required for a locally-managed user's password. Default is 12; a value below 8 is floored to 8 rather than weakening the requirement further.
+             */
+            password_policy_min_length?: number | null;
+            /**
+             * Password Policy Require Lowercase
+             * @description If True (default), a locally-managed user's password must contain a lowercase letter.
+             */
+            password_policy_require_lowercase?: boolean | null;
+            /**
+             * Password Policy Require Numbers
+             * @description If True (default), a locally-managed user's password must contain a number.
+             */
+            password_policy_require_numbers?: boolean | null;
+            /**
+             * Password Policy Require Special Characters
+             * @description If True (default), a locally-managed user's password must contain a special (non-alphanumeric) character.
+             */
+            password_policy_require_special_characters?: boolean | null;
+            /**
+             * Password Policy Require Uppercase
+             * @description If True (default), a locally-managed user's password must contain an uppercase letter.
+             */
+            password_policy_require_uppercase?: boolean | null;
             /**
              * Plugins
              * @description external services registered as embeddable UI plugins
@@ -31069,6 +31155,49 @@ export interface components {
             /** Total */
             total: number;
         };
+        /**
+         * MCPToolSearchSettings
+         * @description `litellm_settings.mcp_tool_search`: how the native `mcp_tool_search` virtual tool ranks the caller's tools.
+         */
+        MCPToolSearchSettings: {
+            /**
+             * Core Tools
+             * @description Tool names always returned first when the caller can access them, e.g. `my_server-get_rates`.
+             * @default []
+             */
+            core_tools: string[];
+            /**
+             * Embedding Model
+             * @description Embedding model from model_list used to rank tools by meaning. Unset keeps keyword matching.
+             */
+            embedding_model?: string | null;
+            /**
+             * Similarity Threshold
+             * @description Lowest cosine similarity a tool needs to appear in semantic results (0.0 = no cutoff).
+             * @default 0
+             */
+            similarity_threshold: number;
+            /**
+             * Top K
+             * @description Most ranked tools a search returns. A smaller top_k in the tool call wins. Core tools do not count.
+             * @default 5
+             */
+            top_k: number;
+        };
+        /**
+         * MCPToolSearchSettingsResponse
+         * @description Response model for native MCP tool search settings
+         */
+        MCPToolSearchSettingsResponse: {
+            /** Field Schema */
+            field_schema: {
+                [key: string]: unknown;
+            };
+            /** Values */
+            values: {
+                [key: string]: unknown;
+            };
+        };
         /** MCPToolsetTool */
         MCPToolsetTool: {
             /** Server Id */
@@ -37473,6 +37602,8 @@ export interface components {
             } | null;
             /** Num Retries */
             num_retries?: number | null;
+            /** Optional Pre Call Checks */
+            optional_pre_call_checks?: ("prompt_caching" | "router_budget_limiting" | "responses_api_deployment_check" | "deployment_affinity" | "session_affinity" | "forward_client_headers_by_model_group" | "enforce_model_rate_limits" | "encrypted_content_affinity")[] | null;
             /** Retry After */
             retry_after?: number | null;
             retry_policy?: components["schemas"]["RetryPolicy"] | null;
@@ -46599,6 +46730,26 @@ export interface operations {
             };
         };
     };
+    get_mcp_tool_search_settings_get_mcp_tool_search_settings_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MCPToolSearchSettingsResponse"];
+                };
+            };
+        };
+    };
     get_sso_settings_get_sso_settings_get: {
         parameters: {
             query?: never;
@@ -47335,7 +47486,7 @@ export interface operations {
                 end_date?: string | null;
                 /** @description Group spend by internal team or customer or api_key */
                 group_by?: ("team" | "customer" | "api_key") | null;
-                /** @description View spend for a specific api_key. Example api_key='sk-1234 */
+                /** @description View spend for a specific api_key. Pass the key's sha256 hash so the raw key stays out of URLs and access logs. Example api_key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa' */
                 api_key?: string | null;
                 /** @description View spend for a specific internal_user_id. Example internal_user_id='1234 */
                 internal_user_id?: string | null;
@@ -49208,7 +49359,7 @@ export interface operations {
     info_key_fn_key_info_get: {
         parameters: {
             query?: {
-                /** @description Key in the request parameters */
+                /** @description Key to look up. Pass the key's sha256 hash so the raw key stays out of URLs and access logs. Example key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa' */
                 key?: string | null;
             };
             header?: never;
@@ -49386,7 +49537,7 @@ export interface operations {
                 start_date?: string | null;
                 /** @description Time till which to view spend (YYYY-MM-DD) */
                 end_date?: string | null;
-                /** @description View spend for a specific api_key. Proxy admin only; other callers are scoped to their own key. */
+                /** @description View spend for a specific api_key. Proxy admin only; other callers are scoped to their own key. Pass the key's sha256 hash so the raw key stays out of URLs and access logs. Example api_key='d5345c0ecc68ae6295c69f91926b2bd379e25481a40c34b5884d157a9f65d8fa' */
                 api_key?: string | null;
             };
             header?: never;
@@ -58930,6 +59081,41 @@ export interface operations {
             };
         };
     };
+    update_mcp_tool_search_settings_update_mcp_tool_search_settings_patch: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MCPToolSearchSettings"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     update_sso_settings_update_sso_settings_patch: {
         parameters: {
             query?: never;
diff --git a/uv.lock b/uv.lock
index 27be919eea1..aa59ff7b229 100644
--- a/uv.lock
+++ b/uv.lock
@@ -10,7 +10,7 @@ resolution-markers = [
 ]
 
 [options]
-exclude-newer = "2026-08-29T17:58:57.633306Z"
+exclude-newer = "2026-08-30T17:51:25.171404Z"
 exclude-newer-span = "P3D"
 
 [manifest]
@@ -25,7 +25,7 @@ constraints = [
     { name = "packaging", specifier = ">=24.0" },
     { name = "setuptools", specifier = ">=83.0.0" },
     { name = "soupsieve", specifier = ">=2.8.4" },
-    { name = "tornado", specifier = ">=6.5.6" },
+    { name = "tornado", specifier = ">=6.5.8" },
 ]
 overrides = [
     { name = "cryptography", specifier = ">=50.0.0,<51.0" },
@@ -4552,7 +4552,7 @@ requires-dist = [
     { name = "pydantic-settings", specifier = ">=2.14.1,<3.0" },
     { name = "pyjwt", marker = "extra == 'proxy'", specifier = ">=2.13.0,<3.0" },
     { name = "pynacl", marker = "extra == 'proxy'", specifier = ">=1.6.2,<2.0" },
-    { name = "pypdf", marker = "extra == 'proxy-runtime'", specifier = ">=6.12.0,<7.0" },
+    { name = "pypdf", marker = "extra == 'proxy-runtime'", specifier = ">=6.16.1,<7.0" },
     { name = "pyroscope-io", marker = "sys_platform != 'win32' and extra == 'proxy'", specifier = ">=0.8.16,<1.0" },
     { name = "python-dotenv", specifier = ">=1.0.0,<2.0" },
     { name = "python-multipart", marker = "extra == 'proxy'", specifier = ">=0.0.27,<1.0" },
@@ -7564,14 +7564,14 @@ wheels = [
 
 [[package]]
 name = "pypdf"
-version = "6.15.0"
+version = "6.16.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/17/17/ee75a92718ec7212de831e71454d702225aa5e474a805cce169806044453/pypdf-6.15.0.tar.gz", hash = "sha256:d39c4d955a76409284a905e2d65b40076d77ab76129e0faaeeb6612403ecfc79", size = 6993794, upload-time = "2026-08-06T13:06:49.929Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/44/66/54212e75406afd9f3e933d0dda23072f6aecc55c5a273077dc2e0b028b23/pypdf-6.16.2.tar.gz", hash = "sha256:595647f6191de6f402cfde1d0c455d6cbccbd509aac32b34783009c032de5d6e", size = 7008996, upload-time = "2026-08-23T13:50:07.135Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/af/72/ce3067ac31e214a66388159f8462ddb8c13dd00170f24d555a1f1ae8ee91/pypdf-6.15.0-py3-none-any.whl", hash = "sha256:14e001d6504822cb1ca9c7ed9a69bccb320f59b320730f55af804361abe4d5ee", size = 378123, upload-time = "2026-08-06T13:06:47.709Z" },
+    { url = "https://files.pythonhosted.org/packages/13/f1/a2da3b55acd4ab737bf728c97edaaed5ec1d3c1236acb639dcdfa97e42c7/pypdf-6.16.2-py3-none-any.whl", hash = "sha256:c8b09a59399062fb45a1b8156c18a787a10a3dae03ac9674397a226712c94604", size = 385060, upload-time = "2026-08-23T13:50:05.349Z" },
 ]
 
 [[package]]
@@ -9441,19 +9441,19 @@ wheels = [
 
 [[package]]
 name = "tornado"
-version = "6.5.7"
+version = "6.5.8"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/64/24/95ec527ad67b76d59299e5465b3935d05e4294b7e0290a3924b7487df30b/tornado-6.5.7.tar.gz", hash = "sha256:66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c3ddfc2", size = 519252, upload-time = "2026-06-08T17:34:51.232Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/10/d3/343e5bb989d6515b1646cf3d40135d73f3d5e45339bded401b56cdac24dd/tornado-6.5.8.tar.gz", hash = "sha256:9452e1b208a8bd771e2cb1f2ff564985b9b214bdebbe622793e1799e0a6bd23f", size = 520493, upload-time = "2026-08-07T02:12:42.971Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/02/dc/c7043cab6fed8ae159fc1923ce829ada35c4dbd797d408a43858ffaf9639/tornado-6.5.7-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:148b2eb15c2c765a50796172c1e499649b35f30d2e3c3d3e15913cfa56bfb163", size = 448543, upload-time = "2026-06-08T17:34:38.052Z" },
-    { url = "https://files.pythonhosted.org/packages/92/4f/090b1431e5a43df696feceffc268c5383cc079ecb5f08ce58f917109aafe/tornado-6.5.7-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:9da38de27f1da3b78a966f0dae12b5a1ea9afe72ca805d84ff06508272ddf100", size = 446707, upload-time = "2026-06-08T17:34:39.594Z" },
-    { url = "https://files.pythonhosted.org/packages/37/d8/ef374952fd5da67d4463122c2b8e5a96536ec10b4b339254c6dcde81d01c/tornado-6.5.7-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8d759e71906ee783f8867b93bf26a265743da4c1e2f4a018464c1ba019862972", size = 449774, upload-time = "2026-06-08T17:34:41.204Z" },
-    { url = "https://files.pythonhosted.org/packages/35/37/d434c73f4c6e014b745b9b37085f34f40c022f007efff3d7fe65991899f3/tornado-6.5.7-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8a46347a18f23fb92b396beebe0fb78f61dda0cc302445202c16203d8a18848b", size = 450745, upload-time = "2026-06-08T17:34:42.531Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/2b/56b9aff361d7f1ab728a805ec7d7ea835f8807afa9f5cc690ea0e630efb9/tornado-6.5.7-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7778b30bef919231265e91c69963ce0f49a1e9c07ac900bbe75b19ce2575ba92", size = 450578, upload-time = "2026-06-08T17:34:43.787Z" },
-    { url = "https://files.pythonhosted.org/packages/02/30/a7444fb23aa76860a14198fab96ac79f1866b0a6e19e26c4381b0938e50f/tornado-6.5.7-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:e726f0c75da7726eec023aa62751ff8878bd2737e34fbdd33b1ae5897d2200f5", size = 449985, upload-time = "2026-06-08T17:34:45.326Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/42/5f0e56c01e8d9d36f4e23f367b85ae6cae0c1ecddd5e6977d8388ad27488/tornado-6.5.7-cp39-abi3-win32.whl", hash = "sha256:f8de3bf12d3efdd0cbe7c8887868198f8a91415e3f29fcf258d9b8eb7b1d9ae4", size = 451047, upload-time = "2026-06-08T17:34:46.784Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/a4/b393076ffb21b469eec5b328a0534cf03a3b90bfc6b1f09507cdd075d938/tornado-6.5.7-cp39-abi3-win_amd64.whl", hash = "sha256:de942f843533a039ef9fa3d9c88c7cd8a7c94553fb5ad0154270989b3d99a2c4", size = 451485, upload-time = "2026-06-08T17:34:48.248Z" },
-    { url = "https://files.pythonhosted.org/packages/71/2e/7b1c769803121b809112cf9a00681c472eae1d80e32d7ec0e0bd61d0d0e1/tornado-6.5.7-cp39-abi3-win_arm64.whl", hash = "sha256:ff934fce95643af5f11efdae618eaa73d469dc588641e5c8d19295a0c65c4796", size = 450506, upload-time = "2026-06-08T17:34:49.702Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/d5/007086fd8df5489338e204f65adce33fd4f21a4999dbb2b9cff2f897b5f4/tornado-6.5.8-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:cc6aa787d7cfab7c3d35189dc7a56fbd2399a569624c730c6b55b3d6531d0403", size = 449487, upload-time = "2026-08-07T02:12:28.682Z" },
+    { url = "https://files.pythonhosted.org/packages/70/c8/5a24a99495903f594f6a199dd7beead1cbc0a13e2cb9102727bcaaf2a997/tornado-6.5.8-cp39-abi3-macosx_10_9_x86_64.whl", hash = "sha256:9715b5eb79735b2bcd454ce216a9275b7c0470e64ea1bf5742f78b2f72b26eeb", size = 447649, upload-time = "2026-08-07T02:12:30.306Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/de/f2e733f386b85962d1b1dc82cd63d169b5b4580062b35397eac9244a41fe/tornado-6.5.8-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:547d63f450d570c14fe0e8db2cfb14c9bbd1c2503b4a6612586267955aa47b58", size = 450707, upload-time = "2026-08-07T02:12:31.95Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/94/20efeee9a01c141e9ac47c397f81679dfda24b32768fc4fff24e76d36c2c/tornado-6.5.8-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7e2360a0ffbe145eca8af0b19cb7203d79b1a98dd4cccdd6b368f6f49c2e3808", size = 451677, upload-time = "2026-08-07T02:12:33.512Z" },
+    { url = "https://files.pythonhosted.org/packages/42/ec/a96ccb8ccf0de2b7bc2c5fa1608a4803735018242e90c4882365a9fd418f/tornado-6.5.8-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:5d242290bdf7ab3151bc1065fdd75c0dcc21cbc7b49f22a4c56329c2d6566d22", size = 451510, upload-time = "2026-08-07T02:12:35.346Z" },
+    { url = "https://files.pythonhosted.org/packages/29/b5/93185859245ad3f00e62175f29607346788b696369347f0146e0421286bb/tornado-6.5.8-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7b94ff0e128fe0542f3bd331fb44d06260fc4ac16881545159f34ef08aad4195", size = 450917, upload-time = "2026-08-07T02:12:36.963Z" },
+    { url = "https://files.pythonhosted.org/packages/97/cf/fe33cf062834487d34d1559746a4a12521033c22645b6d74d4bca702e018/tornado-6.5.8-cp39-abi3-win32.whl", hash = "sha256:67832909c4779c64942380cb5f044a5c6163d00831472d80e25e115de9917836", size = 451952, upload-time = "2026-08-07T02:12:38.512Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/e1/468ad54333e92ccb62627e62cb88e5fc14a2171daa67ed47b1b8542d5b86/tornado-6.5.8-cp39-abi3-win_amd64.whl", hash = "sha256:11881db6b7c168494be2c2d12e65931451bdf7ee718535418ae1d8855dd5a0ee", size = 452391, upload-time = "2026-08-07T02:12:39.971Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/3e/cd5e4f06e34cde33b8ef66cf36aa2b5ad46354cc1af7d2136bbe365fee1d/tornado-6.5.8-cp39-abi3-win_arm64.whl", hash = "sha256:68a7468c7e289f8514d7d664101753903217eff1bb6822c6b5994a0b5f5bcb26", size = 451411, upload-time = "2026-08-07T02:12:41.469Z" },
 ]
 
 [[package]]