scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-04 02:31:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 70

feat(mcp): integrate token exchange into resolve_mcp_auth

Browse source 
Updates resolve_mcp_auth() to accept a subject_token parameter and
route through TokenExchangeHandler when the server is configured for
oauth2_token_exchange.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ishaan Jaffer 2026-02-13 11:05:53 -08:00 • committed by Ishaan Jaffer
parent 08b9f1b8f9
commit 15cf779e17
No known key found for this signature in database
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py
View file

@ -263,16 +263,24 @@ mcp_per_user_token_cache = MCPPerUserTokenCache()
async def resolve_mcp_auth(
server: "MCPServer",
mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None,
subject_token: Optional[str] = None,
) -> Optional[Union[str, Dict[str, str]]]:
"""Resolve the auth value for an MCP server.
Priority:
1. ``mcp_auth_header`` — per-request/per-user override
2. OAuth2 client_credentials token — auto-fetched and cached
3. ``server.authentication_token`` — static token from config/DB
2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token
3. OAuth2 client_credentials token — auto-fetched and cached
4. ``server.authentication_token`` — static token from config/DB
"""
if mcp_auth_header:
return mcp_auth_header
if server.has_token_exchange_config and subject_token:
from litellm.proxy._experimental.mcp_server.auth.token_exchange import (
mcp_token_exchange_handler,
)
return await mcp_token_exchange_handler.exchange_token(subject_token, server)
if server.has_client_credentials:
return await mcp_oauth2_token_cache.async_get_token(server)
return server.authentication_token