From 15cf779e17f665dc66d2c7778f222b1d90100efc Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 13 Feb 2026 11:05:53 -0800 Subject: [PATCH] feat(mcp): integrate token exchange into resolve_mcp_auth Updates resolve_mcp_auth() to accept a subject_token parameter and route through TokenExchangeHandler when the server is configured for oauth2_token_exchange. Co-Authored-By: Claude Opus 4.6 --- .../_experimental/mcp_server/oauth2_token_cache.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 476e215666e..b1772d2cdb9 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -263,16 +263,24 @@ mcp_per_user_token_cache = MCPPerUserTokenCache() async def resolve_mcp_auth( server: "MCPServer", mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, + subject_token: Optional[str] = None, ) -> Optional[Union[str, Dict[str, str]]]: """Resolve the auth value for an MCP server. Priority: 1. ``mcp_auth_header`` — per-request/per-user override - 2. OAuth2 client_credentials token — auto-fetched and cached - 3. ``server.authentication_token`` — static token from config/DB + 2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token + 3. OAuth2 client_credentials token — auto-fetched and cached + 4. ``server.authentication_token`` — static token from config/DB """ if mcp_auth_header: return mcp_auth_header + if server.has_token_exchange_config and subject_token: + from litellm.proxy._experimental.mcp_server.auth.token_exchange import ( + mcp_token_exchange_handler, + ) + + return await mcp_token_exchange_handler.exchange_token(subject_token, server) if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token