mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-07 08:26:10 +00:00
docs: deprecate pre_mcp_call and during_mcp_call guardrail modes
Mark the MCP-specific guardrail modes (pre_mcp_call, during_mcp_call) as deprecated in favor of the standard pre_call and post_call modes. Updated documentation: - mcp_guardrail.md: Added deprecation warning and updated examples - noma_security.md: Updated supported modes list with deprecation notice - panw_prisma_airs.md: Added deprecation warning for MCP modes - pii_masking_v2.md: Updated supported modes and examples This aligns with the standardization on pre/post_call for all guardrail use cases including MCP tool calls. Co-authored-by: Krish Dholakia <krrishdholakia@gmail.com>
This commit is contained in:
Cursor Agent
parent
3dccdde9c8
commit
1a59cfd959
4 changed files with 32 additions and 17 deletions
|
|
@ -4,14 +4,24 @@ import Image from '@theme/IdealImage';
|
|||
|
||||
# MCP Guardrails
|
||||
|
||||
LiteLLM supports applying guardrails to MCP tool calls to ensure security and compliance. You can configure guardrails to run before or during MCP calls to validate inputs and block or mask sensitive information.
|
||||
LiteLLM supports applying guardrails to MCP tool calls to ensure security and compliance. You can configure guardrails to run before or after MCP calls to validate inputs and block or mask sensitive information.
|
||||
|
||||
### Supported MCP Guardrail Modes
|
||||
:::warning Deprecated: `pre_mcp_call` and `during_mcp_call` modes
|
||||
The MCP-specific guardrail modes `pre_mcp_call` and `during_mcp_call` are **deprecated**.
|
||||
|
||||
MCP guardrails support the following modes:
|
||||
We are standardizing on the general-purpose modes:
|
||||
- Use `pre_call` instead of `pre_mcp_call`
|
||||
- Use `post_call` instead of `during_mcp_call`
|
||||
|
||||
- `pre_mcp_call`: Run **before** MCP call, on **input**. Use this mode when you want to apply validation/masking/blocking for MCP requests
|
||||
- `during_mcp_call`: Run **during** MCP call execution. Use this mode for real-time monitoring and intervention
|
||||
The deprecated modes will continue to work for backwards compatibility, but we recommend migrating to `pre_call` and `post_call` for all new configurations.
|
||||
:::
|
||||
|
||||
### Supported Guardrail Modes
|
||||
|
||||
Use the standard guardrail modes for MCP tool calls:
|
||||
|
||||
- `pre_call`: Run **before** the call, on **input**. Use this mode when you want to apply validation/masking/blocking for MCP requests
|
||||
- `post_call`: Run **after** the call, on **output**. Use this mode for scanning responses
|
||||
|
||||
### Configuration Examples
|
||||
|
||||
|
|
@ -22,7 +32,7 @@ guardrails:
|
|||
- guardrail_name: "mcp-input-validation"
|
||||
litellm_params:
|
||||
guardrail: presidio # or other supported guardrails
|
||||
mode: "pre_mcp_call" # or during_mcp_call
|
||||
mode: "pre_call" # Recommended: use pre_call instead of pre_mcp_call
|
||||
pii_entities_config:
|
||||
CREDIT_CARD: "BLOCK" # Will block requests containing credit card numbers
|
||||
EMAIL_ADDRESS: "MASK" # Will mask email addresses
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ guardrails:
|
|||
### Supported Params
|
||||
|
||||
- **`guardrail`**: Use `noma_v2` (recommended), or `noma` with `use_v2: true` for migration
|
||||
- **`mode`**: `pre_call`, `post_call`, `during_call`, `pre_mcp_call`, `during_mcp_call`
|
||||
- **`mode`**: `pre_call`, `post_call`, `during_call` (MCP-specific modes `pre_mcp_call` and `during_mcp_call` are deprecated - use `pre_call`/`post_call` instead)
|
||||
- **`api_key`**: Noma API key (required for Noma SaaS, optional for self-managed deployments)
|
||||
- **`api_base`**: Noma API base URL (defaults to `https://api.noma.security/`)
|
||||
- **`application_id`**: Application identifier. If omitted, v2 checks dynamic `extra_body.application_id`, then configured/env `application_id`; otherwise it is omitted.
|
||||
|
|
@ -141,8 +141,8 @@ guardrails:
|
|||
- `pre_call` Run **before** LLM call, on **input**
|
||||
- `post_call` Run **after** LLM call, on **input & output**
|
||||
- `during_call` Run **during** LLM call, on **input**. Same as `pre_call` but runs in parallel with the LLM call. Response not returned until guardrail check completes
|
||||
- `pre_mcp_call`: Scan MCP tool call inputs before execution
|
||||
- `during_mcp_call`: Monitor MCP tool calls in real-time
|
||||
- ~~`pre_mcp_call`~~: **Deprecated** - Use `pre_call` instead
|
||||
- ~~`during_mcp_call`~~: **Deprecated** - Use `pre_call` or `post_call` instead
|
||||
|
||||
### 2. Start LiteLLM Gateway
|
||||
|
||||
|
|
|
|||
|
|
@ -104,8 +104,10 @@ On success, the guardrail name appears in the `x-litellm-applied-guardrails` res
|
|||
| `pre_call` | Before LLM call | Request input |
|
||||
| `during_call` | Parallel with LLM call | Request input |
|
||||
| `post_call` | After LLM call | Response output |
|
||||
| `pre_mcp_call` | Before MCP tool execution | MCP tool input |
|
||||
| `during_mcp_call` | Parallel with MCP tool execution | MCP tool input |
|
||||
|
||||
:::warning Deprecated MCP Modes
|
||||
The MCP-specific modes `pre_mcp_call` and `during_mcp_call` are **deprecated**. Use `pre_call` and `post_call` instead, which now work for both LLM calls and MCP tool calls.
|
||||
:::
|
||||
|
||||
|
||||
### Configuration Parameters
|
||||
|
|
@ -290,5 +292,5 @@ Tool invocations are sent to AIRS as structured `tool_event` payloads containing
|
|||
### Current Limitations
|
||||
|
||||
- **No post-MCP response scanning.** Actual post-MCP tool-result scanning is not supported because there is no `post_mcp_call` hook in the framework. Response-side MCP events are only scanned when they appear as regular `tool_calls` in the LLM response.
|
||||
- **Guardrail selection not inherited by MCP sub-calls.** With `default_on: false`, MCP request-side child-call scans can be skipped because the parent request's guardrail selection is not propagated to the synthetic MCP payload. Workaround: use a dedicated guardrail with `mode: pre_mcp_call` and `default_on: true`.
|
||||
- **Guardrail selection not inherited by MCP sub-calls.** With `default_on: false`, MCP request-side child-call scans can be skipped because the parent request's guardrail selection is not propagated to the synthetic MCP payload. Workaround: use a dedicated guardrail with `mode: pre_call` and `default_on: true`.
|
||||
- **MCP transaction correlation.** MCP tool scans use the parent `litellm_call_id` when available; otherwise a fallback ID is synthesized and will not be grouped with the parent request in AIRS dashboards.
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ import TabItem from '@theme/TabItem';
|
|||
| Provider | [Microsoft Presidio](https://github.com/microsoft/presidio/) |
|
||||
| Supported Entity Types | All Presidio Entity Types |
|
||||
| Supported Actions | `MASK`, `BLOCK` |
|
||||
| Supported Modes | `pre_call`, `during_call`, `post_call`, `logging_only`, `pre_mcp_call` |
|
||||
| Supported Modes | `pre_call`, `during_call`, `post_call`, `logging_only` |
|
||||
| Language Support | Configurable via `presidio_language` parameter (supports multiple languages including English, Spanish, German, etc.) |
|
||||
|
||||
## Deployment options
|
||||
|
|
@ -256,7 +256,7 @@ guardrails:
|
|||
- guardrail_name: "presidio-mask-guard"
|
||||
litellm_params:
|
||||
guardrail: presidio
|
||||
mode: "pre_mcp_call" # Use this mode for MCP requests
|
||||
mode: "pre_call" # Use pre_call for both LLM and MCP requests
|
||||
presidio_filter_scope: both # input | output | both, optional
|
||||
presidio_score_thresholds: # Optional
|
||||
ALL: 0.7 # Default confidence threshold applied to all entities
|
||||
|
|
@ -373,10 +373,13 @@ The exception includes the entity type that was blocked (`CREDIT_CARD` in this c
|
|||
|
||||
The Presidio guardrail supports the following modes:
|
||||
|
||||
- `pre_call`: Run **before** LLM call, on **input**
|
||||
- `pre_call`: Run **before** LLM call, on **input**. This mode also works for MCP requests.
|
||||
- `post_call`: Run **after** LLM call, on **input & output**
|
||||
- `logging_only`: Run **after** LLM call, only apply PII Masking before logging to Langfuse, etc. Not on the actual llm api request / response
|
||||
- `pre_mcp_call`: Run **before** MCP call, on **input**. Use this mode when you want to apply PII masking/blocking for MCP requests
|
||||
|
||||
:::warning Deprecated: `pre_mcp_call` mode
|
||||
The `pre_mcp_call` mode is **deprecated**. Use `pre_call` instead, which now works for both LLM calls and MCP tool calls.
|
||||
:::
|
||||
|
||||
### MCP Usage Example
|
||||
|
||||
|
|
@ -387,7 +390,7 @@ guardrails:
|
|||
- guardrail_name: "presidio-mcp-guard"
|
||||
litellm_params:
|
||||
guardrail: presidio
|
||||
mode: "pre_mcp_call"
|
||||
mode: "pre_call" # Use pre_call for MCP requests (pre_mcp_call is deprecated)
|
||||
presidio_filter_scope: both # input | output | both
|
||||
presidio_score_thresholds:
|
||||
CREDIT_CARD: 0.8 # Only keep credit card detections scoring 0.8+
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue