Merge upstream/litellm_oss_staging_03_11_2026 and resolve conflicts

Update type aliases to include anthropic provider added in base branch.

.circleci/config.yml

@@ -69,9 +69,11 @@ jobs:
       - run:
           name: Install Python
           command: |
-            choco install python --version=3.11.0 -y
+            choco install python --version=3.11.0 -y --no-progress --force
             refreshenv
             python --version
+          environment:
+            CHOCOLATEY_CONFIRM_ALL: "true"
       - run:
           name: Install Dependencies
           command: |

.github/workflows/codeql.yml

@@ -34,8 +34,6 @@ jobs:
             build-mode: none
           - language: python
             build-mode: none
-          - language: ruby
-            build-mode: none
 
     steps:
       - name: Checkout repository

.github/workflows/publish_enterprise.yml

@@ -19,6 +19,7 @@ jobs:
     if: github.repository == 'BerriAI/litellm'
     permissions:
       contents: write
+      pull-requests: write
     defaults:
       run:
         working-directory: enterprise
@@ -56,14 +57,33 @@ jobs:
       - name: Build
         run: poetry build
 
-      - name: Commit version bump
+      - name: Commit version bump and create PR
+        id: create-pr
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           cd ..
+          BRANCH="bump/enterprise-${{ steps.bump.outputs.new }}"
+          git checkout -b "$BRANCH"
           git add enterprise/pyproject.toml pyproject.toml requirements.txt poetry.lock
           git commit -m "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push
+          git push origin "$BRANCH" --force
+          gh pr create \
+            --title "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}" \
+            --body "Version bump for litellm-enterprise. Merge to update main." \
+            --head "$BRANCH" \
+            --base main \
+          || true
+          PR_URL=$(gh pr list --head "$BRANCH" --json url -q '.[0].url')
+          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Enable auto-merge
+        run: |
+          gh pr merge "${{ steps.create-pr.outputs.pr_url }}" --auto --squash
+        env:
+          GH_TOKEN: ${{ github.token }}
 
       - name: Publish to PyPI
         env:

AGENTS.md

@@ -212,6 +212,8 @@ When opening issues or pull requests, follow these templates:
 
    Using helpers like `supports_reasoning` (which read from `model_prices_and_context_window.json` / `get_model_info`) allows future model updates to "just work" without code changes.
 
+9. **Never close HTTP/SDK clients on cache eviction**: Do not add `close()`, `aclose()`, or `create_task(close_fn())` inside `LLMClientCache._remove_key()` or any cache eviction path. Evicted clients may still be held by in-flight requests; closing them causes `RuntimeError: Cannot send a request, as the client has been closed.` in production after the cache TTL (1 hour) expires. Connection cleanup is handled at shutdown by `close_litellm_async_clients()`. See PR #22247 for the full incident history.
+
 ## HELPFUL RESOURCES
 
 - Main documentation: https://docs.litellm.ai/
@@ -249,9 +251,11 @@ The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot
 See `CLAUDE.md` and the `Makefile` for standard commands. Key notes:
 
 - `psycopg-binary` must be installed (`poetry run pip install psycopg-binary`) because the pytest-postgresql plugin requires it and the lock file only includes `psycopg` (no binary).
+- `openapi-core` must be installed (`poetry run pip install openapi-core`) for the OpenAPI compliance tests in `tests/test_litellm/interactions/`.
 - The `--timeout` pytest flag is NOT available; don't pass it.
 - Unit tests: `poetry run pytest tests/test_litellm/ -x -vv -n 4`
 - Black `--check` may report pre-existing formatting issues; this does not block test runs.
+- If `poetry install` fails with "pyproject.toml changed significantly since poetry.lock was last generated", run `poetry lock` first to regenerate the lock file.
 
 ### Lint
 

CLAUDE.md

@@ -114,4 +114,17 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### Enterprise Features
 - Enterprise-specific code in `enterprise/` directory
 - Optional features enabled via environment variables
-- Separate licensing and authentication for enterprise features
+- Separate licensing and authentication for enterprise features
+
+### HTTP Client Cache Safety
+- **Never close HTTP/SDK clients on cache eviction.** `LLMClientCache._remove_key()` must not call `close()`/`aclose()` on evicted clients — they may still be used by in-flight requests. Doing so causes `RuntimeError: Cannot send a request, as the client has been closed.` after the 1-hour TTL expires. Cleanup happens at shutdown via `close_litellm_async_clients()`.
+
+### Troubleshooting: DB schema out of sync after proxy restart
+`litellm-proxy-extras` runs `prisma migrate deploy` on startup using **its own** bundled migration files, which may lag behind schema changes in the current worktree. Symptoms: `Unknown column`, `Invalid prisma invocation`, or missing data on new fields.
+
+**Diagnose:** Run `\d "TableName"` in psql and compare against `schema.prisma` — missing columns confirm the issue.
+
+**Fix options:**
+1. **Create a Prisma migration** (permanent) — run `prisma migrate dev --name <description>` in the worktree. The generated file will be picked up by `prisma migrate deploy` on next startup.
+2. **Apply manually for local dev** — `psql -d litellm -c "ALTER TABLE ... ADD COLUMN IF NOT EXISTS ..."` after each proxy start. Fine for dev, not for production.
+3. **Update litellm-proxy-extras** — if the package is installed from PyPI, its migration directory must include the new file. Either update the package or run the migration manually until the next release ships it.

Dockerfile

@@ -49,7 +49,7 @@ USER root
 
 # Install runtime dependencies (libsndfile needed for audio processing on ARM64)
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.10 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
     # levels inside its dependency tree. `npm install -g <pkg>` only creates a
     # SEPARATE global package, it does NOT replace npm's internal copies.
@@ -70,7 +70,15 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    # SECURITY FIX: patch npm's own package.json metadata so scanners see the
+    # actual installed versions instead of the stale declared dependencies.
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    # Remove the apk-tracked npm so its stale SBOM metadata (tar 7.5.9) is
+    # no longer visible to image scanners.  The globally installed npm@latest
+    # at /usr/local/lib/node_modules/npm/ remains fully functional.
+    { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -96,6 +104,7 @@ RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

ci_cd/security_scans.sh

@@ -161,6 +161,8 @@ run_grype_scans() {
         "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code
         "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
         "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
+        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image
+        "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code
     )
 
     # Build JSON array of allowlisted CVE IDs for jq

deploy/charts/litellm-helm/templates/deployment.yaml

@@ -13,9 +13,16 @@ spec:
   {{- if and (not .Values.keda.enabled) (not .Values.autoscaling.enabled) }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "litellm.selectorLabels" . | nindent 6 }}
+  {{- if .Values.deploymentMinReadySeconds }}
+  minReadySeconds: {{ .Values.deploymentMinReadySeconds }}
+  {{- end }}
   template:
     metadata:
       annotations:

deploy/charts/litellm-helm/tests/deployment_tests.yaml

@@ -306,3 +306,16 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].resources
           value: {}
+  - it: should be able to set minReadySeconds
+    template: deployment.yaml
+    set:
+      deploymentMinReadySeconds: 5
+    asserts:
+      - equal:
+          path: spec.minReadySeconds
+          value: 5
+  - it: should have minReadySeconds absent when deploymentMinReadySeconds is not set
+    template: deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.minReadySeconds

deploy/charts/litellm-helm/values.yaml

@@ -31,10 +31,20 @@ serviceAccount:
 # annotations for litellm deployment
 deploymentAnnotations: {}
 deploymentLabels: {}
+deploymentMinReadySeconds: 0
+
 # annotations for litellm pods
 podAnnotations: {}
 podLabels: {}
 
+# -- Deployment strategy configuration
+# Example:
+#   type: RollingUpdate
+#   rollingUpdate:
+#     maxUnavailable: 0
+#     maxSurge: 1
+strategy: {}
+
 terminationGracePeriodSeconds: 90
 topologySpreadConstraints:
   []

docker/Dockerfile.custom_ui

@@ -19,7 +19,7 @@ RUN apt-get update && apt-get upgrade -y \
         libgnutls30 \
         libc6 && \
     apt-get install -y nodejs npm && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.10 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -36,7 +36,10 @@ RUN apt-get update && apt-get upgrade -y \
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    apt-get purge -y npm
 
 # Copy the UI source into the container
 COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard

docker/Dockerfile.database

@@ -50,7 +50,7 @@ USER root
 
 # Install runtime dependencies
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.10 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -67,7 +67,10 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -85,6 +88,7 @@ RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

docker/Dockerfile.dev

@@ -75,7 +75,7 @@ RUN apt-get update && apt-get upgrade -y \
     nodejs \
     npm \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 \
+    && npm install -g npm@latest tar@7.5.10 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
     && GLOBAL="$(npm root -g)" \
     && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -92,7 +92,10 @@ RUN apt-get update && apt-get upgrade -y \
     && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
        done \
-    && npm cache clean --force
+    && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
+    && npm cache clean --force \
+    && apt-get purge -y npm
 
 WORKDIR /app
 
@@ -114,6 +117,7 @@ RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

docker/Dockerfile.non_root

@@ -106,7 +106,7 @@ RUN for i in 1 2 3; do \
     apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
     done \
   && apk upgrade --no-cache nodejs \
-  && npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 \
+  && npm install -g npm@latest tar@7.5.10 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
   && GLOBAL="$(npm root -g)" \
   && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -123,7 +123,10 @@ RUN for i in 1 2 3; do \
   && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
      done \
-  && npm cache clean --force
+  && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
+  && npm cache clean --force \
+  && { apk del --no-cache npm 2>/dev/null || true; }
 
 # Copy artifacts from builder
 COPY --from=builder /app/requirements.txt /app/requirements.txt
@@ -169,6 +172,7 @@ RUN pip install --no-index --find-links=/wheels/ -r requirements.txt && \
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

docs/my-website/blog/gpt_5_4/index.md

@@ -0,0 +1,97 @@
+---
+slug: gpt_5_4
+title: "Day 0 Support: GPT-5.4"
+date: 2026-03-05T10:00:00
+authors:
+  - name: Sameer Kankute
+    title: SWE @ LiteLLM (LLM Translation)
+    url: https://www.linkedin.com/in/sameer-kankute/
+    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
+  - name: Krrish Dholakia
+    title: "CEO, LiteLLM"
+    url: https://www.linkedin.com/in/krish-d/
+    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - name: Ishaan Jaff
+    title: "CTO, LiteLLM"
+    url: https://www.linkedin.com/in/reffajnaahsi/
+    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+description: "GPT-5.4 model support in LiteLLM"
+tags: [openai, gpt-5.4, completion]
+hide_table_of_contents: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+LiteLLM now supports fully GPT-5.4!
+
+## Docker Image
+
+```bash
+docker pull ghcr.io/berriai/litellm:v1.81.14-stable.gpt-5.4_patch
+```
+
+## Usage
+
+<Tabs>
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+**1. Setup config.yaml**
+
+```yaml
+model_list:
+  - model_name: gpt-5.4
+    litellm_params:
+      model: openai/gpt-5.4
+      api_key: os.environ/OPENAI_API_KEY
+```
+
+**2. Start the proxy**
+
+```bash
+docker run -d \
+  -p 4000:4000 \
+  -e OPENAI_API_KEY=$OPENAI_API_KEY \
+  -v $(pwd)/config.yaml:/app/config.yaml \
+  ghcr.io/berriai/litellm:v1.81.14-stable.gpt-5.4_patch \
+  --config /app/config.yaml
+```
+
+**3. Test it**
+
+```bash
+curl -X POST "http://0.0.0.0:4000/chat/completions" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $LITELLM_KEY" \
+  -d '{
+    "model": "gpt-5.4",
+    "messages": [
+      {"role": "user", "content": "Write a Python function to check if a number is prime."}
+    ]
+  }'
+```
+
+</TabItem>
+<TabItem value="sdk" label="LiteLLM SDK">
+
+```python
+from litellm import completion
+
+response = completion(
+    model="openai/gpt-5.4",
+    messages=[
+        {"role": "user", "content": "Write a Python function to check if a number is prime."}
+    ],
+)
+
+print(response.choices[0].message.content)
+```
+
+</TabItem>
+</Tabs>
+
+## Notes
+
+- Restart your container to get the cost tracking for this model.
+- Use `/responses` for better model performance.
+- GPT-5.4 supports reasoning, function calling, vision, and tool-use — see the [OpenAI provider docs](../../docs/providers/openai) for advanced usage.

docs/my-website/docs/a2a.md

@@ -20,6 +20,7 @@ Add A2A Agents on LiteLLM AI Gateway, Invoke agents in A2A Protocol, track reque
 | Logging | ✅ |
 | Load Balancing | ✅ |
 | Streaming | ✅ |
+| [Iteration Budgets](a2a_iteration_budgets) | ✅ |
 
 
 :::tip

docs/my-website/docs/a2a_agent_headers.md

@@ -0,0 +1,252 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# A2A Agent Authentication Headers
+
+Forward authentication credentials (Bearer tokens, API keys, etc.) from clients to backend A2A agents.
+
+## Overview
+
+When LiteLLM proxies a request to a backend A2A agent, the agent may require its own authentication headers. There are three ways to supply them:
+
+| Method | Who configures | How it works |
+|---|---|---|
+| **Static headers** | Admin (UI / API) | Always sent, regardless of client request |
+| **Forward client headers** | Admin (UI / API) | Header names to extract from client request and forward |
+| **Convention-based** | Client (no admin config) | Client sends `x-a2a-{agent_name}-{header}` — automatically routed |
+
+All three methods can be combined. **Static headers always win** on key conflicts.
+
+---
+
+## Method 1 — Static Headers
+
+Admin-configured headers that are always sent to the backend agent. Use this for server-to-server tokens or internal credentials that clients should never see or override.
+
+<Tabs>
+<TabItem value="ui" label="UI">
+
+1. Go to **Agents** in the LiteLLM dashboard.
+2. Create or edit an agent.
+3. Open the **Authentication Headers** panel.
+4. Under **Static Headers**, click **Add Static Header** and fill in the header name and value.
+
+</TabItem>
+<TabItem value="api" label="REST API">
+
+```bash
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "static_headers": {
+      "Authorization": "Bearer internal-server-token",
+      "X-Internal-Service": "litellm-proxy"
+    }
+  }'
+```
+
+To update an existing agent:
+
+```bash
+curl -X PATCH http://localhost:4000/v1/agents/{agent_id} \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "static_headers": {
+      "Authorization": "Bearer new-token"
+    }
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+**Client call — no special headers needed:**
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "jsonrpc": "2.0", "id": "1", "method": "message/send",
+    "params": { "message": { "role": "user", "parts": [{"kind": "text", "text": "Hello"}], "messageId": "msg-1" } }
+  }'
+```
+
+The backend agent receives `Authorization: Bearer internal-server-token` without the client ever knowing the value.
+
+---
+
+## Method 2 — Forward Client Headers
+
+Admin specifies a list of header **names**. When the client sends a request that includes those headers, LiteLLM extracts their values and forwards them to the backend agent. The client controls the values; the admin controls which headers are eligible to be forwarded.
+
+<Tabs>
+<TabItem value="ui" label="UI">
+
+1. Go to **Agents** in the LiteLLM dashboard.
+2. Create or edit an agent.
+3. Open the **Authentication Headers** panel.
+4. Under **Forward Client Headers**, type header names and press **Enter** (e.g. `x-api-key`, `Authorization`).
+
+</TabItem>
+<TabItem value="api" label="REST API">
+
+```bash
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "extra_headers": ["x-api-key", "x-user-token"]
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+**Client call — include the forwarded headers:**
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-api-key: user-secret-value" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The backend agent receives `x-api-key: user-secret-value`.
+
+:::note
+Header name matching is **case-insensitive**. If the client sends `X-API-Key` and `extra_headers` lists `x-api-key`, they match.
+:::
+
+---
+
+## Method 3 — Convention-Based Forwarding
+
+Clients can forward headers to a specific agent without any admin pre-configuration by using the naming convention:
+
+```
+x-a2a-{agent_name_or_id}-{header_name}: value
+```
+
+LiteLLM parses these headers automatically and routes them to the matching agent only.
+
+**Examples:**
+
+| Client header sent | Agent name/ID | Forwarded as |
+|---|---|---|
+| `x-a2a-my-agent-authorization: Bearer tok` | `my-agent` | `authorization: Bearer tok` |
+| `x-a2a-my-agent-x-api-key: secret` | `my-agent` | `x-api-key: secret` |
+| `x-a2a-abc123-authorization: Bearer tok` | agent ID `abc123` | `authorization: Bearer tok` |
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-a2a-my-agent-authorization: Bearer agent-specific-token" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The `x-a2a-other-agent-authorization` header sent in the same request is **not** forwarded to `my-agent` — it is silently ignored.
+
+:::tip Matches both agent name and agent ID
+Both the human-readable name (e.g. `my-agent`) and the UUID (e.g. `abc123-...`) are valid. Use whichever is convenient for the client.
+:::
+
+---
+
+## Merge Precedence
+
+When multiple methods supply the same header name, **static headers win**:
+
+```
+dynamic (forwarded/convention)  →  merged  ←  static (overlays, wins)
+```
+
+Example:
+
+| Source | `Authorization` value |
+|---|---|
+| Client sends (via `extra_headers` or convention) | `Bearer client-token` |
+| Admin-configured `static_headers` | `Bearer server-token` |
+| **What the backend agent receives** | **`Bearer server-token`** |
+
+This ensures admin-controlled credentials cannot be overridden by client requests.
+
+---
+
+## Combining All Three Methods
+
+```bash
+# Register agent with static + forwarded headers
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "static_headers": {
+      "X-Internal-Token": "secret123"
+    },
+    "extra_headers": ["x-user-id"]
+  }'
+
+# Client call using all three mechanisms
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-user-id: user-42" \
+  -H "x-a2a-my-agent-x-request-id: req-abc" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The backend agent receives:
+
+```
+X-Internal-Token: secret123          ← static header (always)
+x-user-id: user-42                   ← forwarded (in extra_headers)
+x-request-id: req-abc                ← convention-based (x-a2a-my-agent-*)
+X-LiteLLM-Trace-Id: <uuid>           ← LiteLLM internal
+X-LiteLLM-Agent-Id: <agent-id>       ← LiteLLM internal
+```
+
+---
+
+## Header Isolation
+
+Each agent invocation uses an isolated HTTP connection. Headers configured for agent A are **never** sent to agent B, even if both agents are running and receiving requests simultaneously.
+
+---
+
+## API Reference
+
+### `POST /v1/agents` / `PATCH /v1/agents/{agent_id}`
+
+| Field | Type | Description |
+|---|---|---|
+| `static_headers` | `object` | `{"Header-Name": "value"}` — always forwarded |
+| `extra_headers` | `string[]` | Header names to extract from client request and forward |
+
+### Agent Response
+
+Both fields are returned in `GET /v1/agents` and `GET /v1/agents/{agent_id}`:
+
+```json
+{
+  "agent_id": "...",
+  "agent_name": "my-agent",
+  "static_headers": { "X-Internal-Token": "secret123" },
+  "extra_headers": ["x-user-id"],
+  ...
+}
+```
+
+:::caution
+`static_headers` values are stored in the database and returned by the API. Treat them as you would any credential — do not store sensitive long-lived tokens here if your API is publicly accessible. Consider using short-lived tokens or environment-injected secrets instead.
+:::

docs/my-website/docs/a2a_iteration_budgets.md

@@ -0,0 +1,188 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Agent Iteration Budgets
+
+Control runaway costs from agentic loops with per-session iteration and budget caps.
+
+## Overview
+
+When agents run agentic loops, they can make unbounded LLM calls, causing unexpected costs. LiteLLM provides two controls:
+
+| Control | Description |
+|---------|-------------|
+| **Max Iterations** | Hard cap on the number of LLM calls per session |
+| **Max Budget Per Session** | Dollar cap per session (identified by `x-litellm-trace-id`) |
+
+Both controls require a `session_id` (sent via `x-litellm-trace-id` header or `metadata.session_id`) to track calls within a session.
+
+## Trace-ID Enforcement
+
+LiteLLM supports two independent trace-id flags, configured in `litellm_params` on the agent:
+
+| Flag | Description |
+|------|-------------|
+| `require_trace_id_on_calls_to_agent` | Requires callers invoking this agent to include `x-litellm-trace-id`. Use when the agent should only be called as a sub-agent with a trace context. Returns **400** if missing. |
+| `require_trace_id_on_calls_by_agent` | Requires all LLM/MCP calls made **by** this agent (via its virtual key) to include `x-litellm-trace-id`. This is what enables `max_iterations` and `max_budget_per_session` tracking. Returns **400** if missing. |
+
+## Configuring via UI
+
+When creating an agent in the LiteLLM Admin UI:
+
+1. Navigate to the **Agents** tab and click **Add Agent**
+2. In the **Agent Settings** step, expand the **Tracing** section
+3. Toggle **Require x-litellm-trace-id on calls BY this agent** to enable session tracking
+4. Set **Max Iterations** to cap the number of LLM calls per session
+5. Set **Max Budget Per Session ($)** to cap spend per session
+
+The trace-id flags are stored on the agent's `litellm_params`. Budget controls (`max_iterations`, `max_budget_per_session`) are stored in the virtual key's metadata.
+
+## Configuring via API
+
+Set trace-id enforcement on the agent itself:
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_to_agent": true,
+      "require_trace_id_on_calls_by_agent": true
+    }
+  }'
+```
+
+Budget controls are set on the agent's `litellm_params` (not on individual keys), so they apply across all keys for the agent:
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_by_agent": true,
+      "max_iterations": 25,
+      "max_budget_per_session": 5.00
+    }
+  }'
+```
+
+## How It Works
+
+### Session Tracking
+
+Callers identify their session by including a `session_id` in one of these ways:
+- **Header**: `x-litellm-trace-id: my-session-123`
+- **Metadata**: `{"metadata": {"session_id": "my-session-123"}}`
+
+### Max Iterations
+
+When `max_iterations` is set in agent `litellm_params`:
+- Each LLM call for a session increments a counter
+- When the counter exceeds `max_iterations`, the request receives a **429 Too Many Requests**
+- Counters expire after 1 hour by default (configurable via `LITELLM_MAX_ITERATIONS_TTL` env var)
+
+### Max Budget Per Session
+
+When `max_budget_per_session` is set in agent `litellm_params`:
+- After each successful LLM call, the response cost is accumulated for the session
+- Before each call, the accumulated spend is checked against the budget
+- When spend exceeds the budget, the request receives a **429 Too Many Requests**
+- Session spend counters expire after 1 hour by default (configurable via `LITELLM_MAX_BUDGET_PER_SESSION_TTL` env var)
+
+## Example
+
+Create an agent with max 25 iterations and a $5 budget cap:
+
+<Tabs>
+<TabItem value="ui" label="Via UI">
+
+1. Go to **Agents** → **Add Agent**
+2. Configure your agent (name, model, etc.)
+3. In **Agent Settings**, expand the **Tracing** section
+4. Toggle on **Require x-litellm-trace-id on calls BY this agent**
+5. Set **Max Iterations** to `25`
+6. Set **Max Budget Per Session** to `5.00`
+7. Proceed to create a new key for the agent
+8. Click **Create Agent**
+
+</TabItem>
+<TabItem value="api" label="Via API">
+
+```bash
+# 1. Create the agent with trace-id enforcement
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_by_agent": true
+    }
+  }'
+
+# 2. Create a key for the agent
+curl -X POST 'http://localhost:4000/key/generate' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_id": "<agent_id_from_step_1>",
+    "key_alias": "my-research-agent-key"
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+### Making Calls with Session Tracking
+
+```bash
+curl -X POST 'http://localhost:4000/chat/completions' \
+  -H 'Authorization: Bearer sk-agent-key-xxx' \
+  -H 'x-litellm-trace-id: session-abc-123' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "model": "gpt-4o",
+    "messages": [{"role": "user", "content": "Hello"}]
+  }'
+```
+
+After 25 calls or $5 spent within this session, subsequent requests will receive:
+
+```json
+{
+  "error": {
+    "message": "Session budget exceeded for session session-abc-123. Current spend: $5.0032, max_budget_per_session: $5.00.",
+    "type": "budget_exceeded",
+    "code": 429
+  }
+}
+```
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `LITELLM_MAX_ITERATIONS_TTL` | `3600` (1 hour) | TTL in seconds for session iteration counters |
+| `LITELLM_MAX_BUDGET_PER_SESSION_TTL` | `3600` (1 hour) | TTL in seconds for session budget counters |

docs/my-website/docs/anthropic_unified/messages_to_responses_mapping.md

@@ -0,0 +1,120 @@
+# v1/messages → /responses Parameter Mapping
+
+When you send a request to `/v1/messages` targeting an OpenAI or Azure model, LiteLLM internally routes it through the OpenAI Responses API. This page documents exactly how every parameter gets translated in both directions.
+
+The transformation lives in `litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py`.
+
+
+## Request: Anthropic → Responses API
+
+### Top-level parameters
+
+| Anthropic (`/v1/messages`) | Responses API | Notes |
+|---|---|---|
+| `model` | `model` | Passed through as-is |
+| `messages` | `input` | Structurally transformed — see the messages section below |
+| `system` (string) | `instructions` | Passed as a plain string |
+| `system` (list of content blocks) | `instructions` | Text blocks are joined with `\n`; non-text blocks are ignored |
+| `max_tokens` | `max_output_tokens` | Renamed |
+| `temperature` | `temperature` | Passed through as-is |
+| `top_p` | `top_p` | Passed through as-is |
+| `tools` | `tools` | Format-translated — see the tools section below |
+| `tool_choice` | `tool_choice` | Type-remapped — see the tool_choice section below |
+| `thinking` | `reasoning` | Budget tokens mapped to effort level — see the thinking section below |
+| `output_format` or `output_config.format` | `text` | Wrapped as `{"format": {"type": "json_schema", "name": "structured_output", "schema": ..., "strict": true}}` |
+| `context_management` | `context_management` | Converted from Anthropic dict to OpenAI array format — see the context_management section below |
+| `metadata.user_id` | `user` | Extracted from the metadata object and truncated to 64 characters |
+| `stop_sequences` | ❌ Not mapped | Dropped silently |
+| `top_k` | ❌ Not mapped | Dropped silently |
+| `speed` | ❌ Not mapped | Only used to set Anthropic beta headers on the native path |
+
+
+### How messages get converted
+
+Each Anthropic message is expanded into one or more Responses API input items. The key difference is that `tool_result` and `tool_use` blocks become **top-level items** in the input array rather than being nested inside a message.
+
+| Anthropic message | Responses API input item |
+|---|---|
+| `user` role, string content | `{"type": "message", "role": "user", "content": [{"type": "input_text", "text": "..."}]}` |
+| `user` role, `{"type": "text"}` block | `{"type": "input_text", "text": "..."}` inside a user message |
+| `user` role, `{"type": "image", "source": {"type": "base64"}}` | `{"type": "input_image", "image_url": "data:<media_type>;base64,<data>"}` inside a user message |
+| `user` role, `{"type": "image", "source": {"type": "url"}}` | `{"type": "input_image", "image_url": "<url>"}` inside a user message |
+| `user` role, `{"type": "tool_result"}` block | Top-level `{"type": "function_call_output", "call_id": "...", "output": "..."}` — pulled out of the message entirely |
+| `assistant` role, string content | `{"type": "message", "role": "assistant", "content": [{"type": "output_text", "text": "..."}]}` |
+| `assistant` role, `{"type": "text"}` block | `{"type": "output_text", "text": "..."}` inside an assistant message |
+| `assistant` role, `{"type": "tool_use"}` block | Top-level `{"type": "function_call", "call_id": "<id>", "name": "...", "arguments": "<JSON string>"}` — pulled out of the message entirely |
+| `assistant` role, `{"type": "thinking"}` block | `{"type": "output_text", "text": "<thinking text>"}` inside an assistant message |
+
+
+### tools
+
+| Anthropic tool | Responses API tool |
+|---|---|
+| Any tool where `type` starts with `"web_search"` or `name == "web_search"` | `{"type": "web_search_preview"}` |
+| All other tools | `{"type": "function", "name": "...", "description": "...", "parameters": <input_schema>}` |
+
+
+### tool_choice
+
+| Anthropic `tool_choice.type` | Responses API `tool_choice` |
+|---|---|
+| `"auto"` | `{"type": "auto"}` |
+| `"any"` | `{"type": "required"}` |
+| `"tool"` | `{"type": "function", "name": "<tool name>"}` |
+
+
+### thinking → reasoning
+
+The `budget_tokens` value is mapped to a string effort level. `summary` is always set to `"detailed"`.
+
+| `thinking.budget_tokens` | `reasoning.effort` |
+|---|---|
+| >= 10000 | `"high"` |
+| >= 5000 | `"medium"` |
+| >= 2000 | `"low"` |
+| < 2000 | `"minimal"` |
+
+If `thinking.type` is anything other than `"enabled"`, the `reasoning` field is not sent at all.
+
+
+### context_management
+
+Anthropic uses a nested dict with an `edits` array. OpenAI uses a flat array of compaction objects.
+
+```
+Anthropic input:
+{
+  "edits": [
+    {
+      "type": "compact_20260112",
+      "trigger": {"type": "input_tokens", "value": 150000}
+    }
+  ]
+}
+
+Responses API output:
+[
+  {"type": "compaction", "compact_threshold": 150000}
+]
+```
+
+
+## Response: Responses API → Anthropic
+
+When the Responses API reply comes back, LiteLLM converts it into an Anthropic `AnthropicMessagesResponse`.
+
+| Responses API field | Anthropic response field | Notes |
+|---|---|---|
+| `response.id` | `id` | |
+| `response.model` | `model` | Falls back to `"unknown-model"` if missing |
+| `ResponseReasoningItem` — `summary[*].text` | `content` block `{"type": "thinking", "thinking": "..."}` | Each non-empty summary text becomes a thinking block |
+| `ResponseOutputMessage` — `content[*]` where `type == "output_text"` | `content` block `{"type": "text", "text": "..."}` | |
+| `ResponseFunctionToolCall` — `{call_id, name, arguments}` | `content` block `{"type": "tool_use", "id": "...", "name": "...", "input": {...}}` | `arguments` is JSON-parsed back into a dict |
+| Any `function_call` present in output | `stop_reason: "tool_use"` | |
+| `response.status == "incomplete"` | `stop_reason: "max_tokens"` | Takes precedence over the default |
+| Everything else | `stop_reason: "end_turn"` | Default |
+| `response.usage.input_tokens` | `usage.input_tokens` | |
+| `response.usage.output_tokens` | `usage.output_tokens` | |
+| *(hardcoded)* | `type: "message"` | Always set |
+| *(hardcoded)* | `role: "assistant"` | Always set |
+| *(hardcoded)* | `stop_sequence: null` | Always null on this path |

docs/my-website/docs/files_endpoints.md

@@ -326,4 +326,10 @@ print("file content=", content.text)
 
 ### [Bedrock](./providers/bedrock_batches#4-retrieve-batch-results)
 
+### [Anthropic](./providers/anthropic#files-api)
+
+:::note
+Anthropic Files API has a different purpose than OpenAI's. It's **not** for Batches or Fine-tuning—it's for uploading files once and referencing them by `file_id` in multiple messages, avoiding re-uploads. File API operations are free — file content used in Messages requests is priced as input tokens.
+:::
+
 ## [Swagger API Reference](https://litellm-api.up.railway.app/#/files)

docs/my-website/docs/mcp.md

@@ -217,6 +217,7 @@ mcp_servers:
   | `bearer_token` | `Authorization: Bearer <auth_value>` |
   | `basic` | `Authorization: Basic <auth_value>` |
   | `authorization` | `Authorization: <auth_value>` |
+  | `aws_sigv4` | Per-request AWS SigV4 signature ([details](./mcp_aws_sigv4.md)) |
 
 - **Extra Headers**: Optional list of additional header names that should be forwarded from client to the MCP server
 - **Static Headers**: Optional map of header key/value pairs to include every request to the MCP server.
@@ -257,6 +258,16 @@ mcp_servers:
     auth_type: "authorization"
     auth_value: "Token example123"  # headers={"Authorization": "Token example123"}
 
+  # AWS SigV4 for Bedrock AgentCore MCP servers
+  agentcore_mcp:
+    url: "https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/<url-encoded-ARN>/invocations"
+    transport: "http"
+    auth_type: "aws_sigv4"
+    aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
+    aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
+    aws_region_name: us-east-1
+    aws_service_name: bedrock-agentcore
+
   # Example with extra headers forwarding
   github_mcp:
     url: "https://api.githubcopilot.com/mcp"
@@ -336,175 +347,9 @@ litellm_settings:
 
 ## Converting OpenAPI Specs to MCP Servers
 
-LiteLLM can automatically convert OpenAPI specifications into MCP servers, allowing you to expose any REST API as MCP tools. This is useful when you have existing APIs with OpenAPI/Swagger documentation and want to make them available as MCP tools.
+LiteLLM can convert OpenAPI specifications into MCP servers, exposing any REST API as MCP tools without writing custom server code.
 
-**Benefits:**
-
-- **Rapid Integration**: Convert existing APIs to MCP tools without writing custom MCP server code
-- **Automatic Tool Generation**: LiteLLM automatically generates MCP tools from your OpenAPI spec
-- **Unified Interface**: Use the same MCP interface for both native MCP servers and OpenAPI-based APIs
-- **Easy Testing**: Test and iterate on API integrations quickly
-
-**Configuration:**
-
-Add your OpenAPI-based MCP server to your `config.yaml`:
-
-```yaml title="config.yaml - OpenAPI to MCP" showLineNumbers
-model_list:
-  - model_name: gpt-4o
-    litellm_params:
-      model: openai/gpt-4o
-      api_key: sk-xxxxxxx
-
-mcp_servers:
-  # OpenAPI Spec Example - Petstore API
-  petstore_mcp:
-    url: "https://petstore.swagger.io/v2"
-    spec_path: "/path/to/openapi.json"
-    auth_type: "none"
-  
-  # OpenAPI Spec with API Key Authentication
-  my_api_mcp:
-    url: "http://0.0.0.0:8090"
-    spec_path: "/path/to/openapi.json"
-    auth_type: "api_key"
-    auth_value: "your-api-key-here"
-  
-  # OpenAPI Spec with Bearer Token
-  secured_api_mcp:
-    url: "https://api.example.com"
-    spec_path: "/path/to/openapi.json" 
-    auth_type: "bearer_token"
-    auth_value: "your-bearer-token"
-```
-
-**Configuration Parameters:**
-
-| Parameter | Required | Description |
-|-----------|----------|-------------|
-| `url` | Yes | The base URL of your API endpoint |
-| `spec_path` | Yes | Path or URL to your OpenAPI specification file (JSON or YAML) |
-| `auth_type` | No | Authentication type: `none`, `api_key`, `bearer_token`, `basic`, `authorization` |
-| `auth_value` | No | Authentication value (required if `auth_type` is set) |
-| `authorization_url` | No | For `auth_type: oauth2`. Optional override; if omitted LiteLLM auto-discovers it. |
-| `token_url` | No | For `auth_type: oauth2`. Optional override; if omitted LiteLLM auto-discovers it. |
-| `registration_url` | No | For `auth_type: oauth2`. Optional override; if omitted LiteLLM auto-discovers it. |
-| `scopes` | No | For `auth_type: oauth2`. Optional override; if omitted LiteLLM uses the scopes advertised by the server. |
-| `description` | No | Optional description for the MCP server |
-| `allowed_tools` | No | List of specific tools to allow (see [MCP Tool Filtering](#mcp-tool-filtering)) |
-| `disallowed_tools` | No | List of specific tools to block (see [MCP Tool Filtering](#mcp-tool-filtering)) |
-
-### Usage Example
-
-Once configured, you can use the OpenAPI-based MCP server just like any other MCP server:
-
-<Tabs>
-<TabItem value="fastmcp" label="Python FastMCP">
-
-```python title="Using OpenAPI-based MCP Server" showLineNumbers
-from fastmcp import Client
-import asyncio
-
-# Standard MCP configuration
-config = {
-    "mcpServers": {
-        "petstore": {
-            "url": "http://localhost:4000/petstore_mcp/mcp",
-            "headers": {
-                "x-litellm-api-key": "Bearer sk-1234"
-            }
-        }
-    }
-}
-
-# Create a client that connects to the server
-client = Client(config)
-
-async def main():
-    async with client:
-        # List available tools generated from OpenAPI spec
-        tools = await client.list_tools()
-        print(f"Available tools: {[tool.name for tool in tools]}")
-
-        # Example: Get a pet by ID (from Petstore API)
-        response = await client.call_tool(
-            name="getpetbyid", 
-            arguments={"petId": "1"}
-        )
-        print(f"Response:\n{response}\n")
-
-        # Example: Find pets by status
-        response = await client.call_tool(
-            name="findpetsbystatus", 
-            arguments={"status": "available"}
-        )
-        print(f"Response:\n{response}\n")
-
-if __name__ == "__main__":
-    asyncio.run(main())
-```
-
-</TabItem>
-
-<TabItem value="cursor" label="Cursor IDE">
-
-```json title="Cursor MCP Configuration for OpenAPI Server" showLineNumbers
-{
-  "mcpServers": {
-    "Petstore": {
-      "url": "http://localhost:4000/petstore_mcp/mcp",
-      "headers": {
-        "x-litellm-api-key": "Bearer $LITELLM_API_KEY"
-      }
-    }
-  }
-}
-```
-
-</TabItem>
-
-<TabItem value="openai" label="OpenAI Responses API">
-
-```bash title="Using OpenAPI MCP Server with OpenAI" showLineNumbers
-curl --location 'https://api.openai.com/v1/responses' \
---header 'Content-Type: application/json' \
---header "Authorization: Bearer $OPENAI_API_KEY" \
---data '{
-    "model": "gpt-4o",
-    "tools": [
-        {
-            "type": "mcp",
-            "server_label": "petstore",
-            "server_url": "http://localhost:4000/petstore_mcp/mcp",
-            "require_approval": "never",
-            "headers": {
-                "x-litellm-api-key": "Bearer YOUR_LITELLM_API_KEY"
-            }
-        }
-    ],
-    "input": "Find all available pets in the petstore",
-    "tool_choice": "required"
-}'
-```
-
-</TabItem>
-</Tabs>
-
-**How It Works**
-
-1. **Spec Loading**: LiteLLM loads your OpenAPI specification from the provided `spec_path`
-2. **Tool Generation**: Each API endpoint in the spec becomes an MCP tool
-3. **Parameter Mapping**: OpenAPI parameters are automatically mapped to MCP tool parameters
-4. **Request Handling**: When a tool is called, LiteLLM converts the MCP request to the appropriate HTTP request
-5. **Response Translation**: API responses are converted back to MCP format
-
-**OpenAPI Spec Requirements**
-
-Your OpenAPI specification should follow standard OpenAPI/Swagger conventions:
-- **Supported versions**: OpenAPI 3.0.x, OpenAPI 3.1.x, Swagger 2.0
-- **Required fields**: `paths`, `info` sections should be properly defined
-- **Operation IDs**: Each operation should have a unique `operationId` (this becomes the tool name)
-- **Parameters**: Request parameters should be properly documented with types and descriptions
+See the **[MCP from OpenAPI Specs guide](./mcp_openapi.md)** for full setup, usage examples, and how to override tool names and descriptions.
 
 ## MCP OAuth
 
@@ -870,6 +715,63 @@ asyncio.run(main())
 
 [Learn more about customer management →](./proxy/customers)
 
+## Calling the Proxy's /v1/responses Endpoint
+
+When calling your LiteLLM Proxy's `/v1/responses` endpoint to use MCP tools, **always use `server_url: "litellm_proxy"`** in the tools array. This tells the proxy to use its configured MCP servers.
+
+:::important Do not use the full proxy URL
+Using `server_url: "https://your-proxy.com/mcp"` is incorrect when the request is already going to the proxy. The proxy needs the literal value `litellm_proxy` to route to its configured MCP servers.
+:::
+
+```bash title="Correct: Using litellm_proxy" showLineNumbers
+curl --location 'https://your-proxy.com/v1/responses' \
+--header 'Content-Type: application/json' \
+--header "Authorization: Bearer $LITELLM_API_KEY" \
+--data '{
+    "model": "gpt-4",
+    "tools": [
+        {
+            "type": "mcp",
+            "server_label": "litellm",
+            "server_url": "litellm_proxy",
+            "require_approval": "never"
+        }
+    ],
+    "input": "Run available tools",
+    "tool_choice": "required"
+}'
+```
+
+### Sending Custom Headers to MCP Servers
+
+To pass custom headers (e.g., API keys, auth tokens) to specific MCP servers, use either:
+
+**Option 1: Request headers** – Add `x-mcp-{server_alias}-{header_name}` to your request headers. The proxy forwards these to the matching MCP server.
+
+```bash
+# Send Authorization header to the "weather2" MCP server
+--header 'x-mcp-weather2-authorization: Bearer your-token'
+
+# Send custom header to the "github" MCP server  
+--header 'x-mcp-github-x-api-key: your-api-key'
+```
+
+**Option 2: Headers in tool config** – Include a `headers` object in the tool definition. These are merged with request headers.
+
+```json
+{
+    "type": "mcp",
+    "server_label": "litellm",
+    "server_url": "litellm_proxy",
+    "require_approval": "never",
+    "headers": {
+        "x-litellm-api-key": "Bearer YOUR_LITELLM_API_KEY",
+        "x-mcp-servers": "Zapier_MCP,dev-group",
+        "x-mcp-weather2-authorization": "Bearer your-weather-api-token"
+    }
+}
+```
+
 ## Using your MCP with client side credentials
 
 Use this if you want to pass a client side authentication token to LiteLLM to then pass to your MCP to auth to your MCP.

docs/my-website/docs/mcp_aws_sigv4.md

@@ -0,0 +1,144 @@
+# MCP - AWS SigV4 Auth
+
+Use AWS SigV4 authentication to connect LiteLLM to MCP servers hosted on [AWS Bedrock AgentCore](https://docs.aws.amazon.com/bedrock/latest/userguide/agentcore.html).
+
+## Why SigV4?
+
+AWS services authenticate requests using [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) — a per-request signing protocol that includes the request body in the cryptographic signature. This is fundamentally different from static-header auth types (`api_key`, `bearer_token`, etc.) which send the same header on every request.
+
+LiteLLM's `aws_sigv4` auth type handles this automatically: every outgoing MCP request is signed with your AWS credentials before it's sent.
+
+## Quick Start
+
+### 1. Set AWS credentials
+
+```bash
+export AWS_ACCESS_KEY_ID="AKIA..."
+export AWS_SECRET_ACCESS_KEY="..."
+export AWS_REGION_NAME="us-east-1"
+```
+
+### 2. Add your AgentCore MCP server to config.yaml
+
+```yaml title="config.yaml" showLineNumbers
+model_list:
+  - model_name: gpt-4o
+    litellm_params:
+      model: openai/gpt-4o
+      api_key: os.environ/OPENAI_API_KEY
+
+mcp_servers:
+  my_agentcore_mcp:
+    url: "https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/<url-encoded-ARN>/invocations"
+    transport: "http"
+    auth_type: "aws_sigv4"
+    aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
+    aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
+    aws_region_name: "us-east-1"
+    aws_service_name: "bedrock-agentcore"
+```
+
+:::info URL encoding
+
+The AgentCore runtime ARN must be URL-encoded in the `url` field. For example:
+
+```
+arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/my-mcp-server
+```
+
+becomes:
+
+```
+arn%3Aaws%3Abedrock-agentcore%3Aus-east-1%3A123456789012%3Aruntime%2Fmy-mcp-server
+```
+
+:::
+
+### 3. Start the proxy
+
+```bash
+litellm --config config.yaml
+```
+
+### 4. Use the MCP tools
+
+Once started, your AgentCore MCP tools are available through LiteLLM like any other MCP server:
+
+```bash title="List available tools"
+curl http://localhost:4000/mcp-rest/tools/list \
+  -H "Authorization: Bearer sk-1234"
+```
+
+```bash title="Call a tool"
+curl http://localhost:4000/mcp-rest/tools/call \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer sk-1234" \
+  -d '{
+    "name": "my_agentcore_mcp_your_tool_name",
+    "arguments": {"key": "value"}
+  }'
+```
+
+## Config Reference
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `url` | Yes | AgentCore MCP server URL (with URL-encoded ARN) |
+| `transport` | Yes | Must be `"http"` |
+| `auth_type` | Yes | Must be `"aws_sigv4"` |
+| `aws_access_key_id` | No | AWS access key. Supports `os.environ/VAR_NAME`. Falls back to boto3 credential chain if omitted |
+| `aws_secret_access_key` | No | AWS secret key. Supports `os.environ/VAR_NAME`. Falls back to boto3 credential chain if omitted |
+| `aws_region_name` | Yes | AWS region (e.g., `us-east-1`) |
+| `aws_service_name` | No | AWS service name for signing. Defaults to `bedrock-agentcore` |
+| `aws_session_token` | No | AWS session token for temporary credentials. Supports `os.environ/VAR_NAME` |
+
+## How It Works
+
+LiteLLM uses an `httpx.Auth` subclass (`MCPSigV4Auth`) that hooks into the HTTP request lifecycle:
+
+1. For every outgoing MCP request, the auth handler computes a SHA-256 hash of the request body
+2. It creates a SigV4 signature using your AWS credentials, the request URL, headers, and body hash
+3. The signed `Authorization` and `x-amz-date` headers are added to the request
+4. AWS validates the signature and processes the MCP request
+
+This happens transparently — no manual token management required.
+
+## Using Temporary Credentials (STS)
+
+If you use AWS STS temporary credentials (e.g., from IAM roles or SSO), include the session token:
+
+```yaml title="config.yaml with STS credentials" showLineNumbers
+mcp_servers:
+  my_agentcore_mcp:
+    url: "https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes/<url-encoded-ARN>/invocations"
+    transport: "http"
+    auth_type: "aws_sigv4"
+    aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
+    aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
+    aws_session_token: os.environ/AWS_SESSION_TOKEN
+    aws_region_name: "us-east-1"
+    aws_service_name: "bedrock-agentcore"
+```
+
+## Troubleshooting
+
+### 403 Forbidden from AWS
+
+- Verify your AWS credentials are valid and not expired
+- Check that `aws_region_name` matches the region in your AgentCore URL
+- Ensure `aws_service_name` is set to `bedrock-agentcore`
+- If using STS credentials, confirm `aws_session_token` is set and not expired
+
+### Health check errors on startup
+
+SigV4-authenticated MCP servers skip the standard health check on proxy startup. This is expected — the proxy will still sign requests correctly when tools are invoked.
+
+### "botocore not found" error
+
+Install the `botocore` package:
+
+```bash
+pip install botocore
+```
+
+`botocore` is used for SigV4 credential handling and is required when using `aws_sigv4` auth.

docs/my-website/docs/mcp_control.md

@@ -323,7 +323,7 @@ curl --location '<your-litellm-proxy-base-url>/v1/responses' \
         {
             "type": "mcp",
             "server_label": "litellm",
-            "server_url": "<your-litellm-proxy-base-url>/dev_group/mcp",
+            "server_url": "litellm_proxy",
             "require_approval": "never",
             "headers": {
                 "x-litellm-api-key": "Bearer YOUR_LITELLM_API_KEY"
@@ -335,7 +335,7 @@ curl --location '<your-litellm-proxy-base-url>/v1/responses' \
 }'
 ```
 
-This example uses URL namespacing to access all servers in the "dev_group" access group.
+This example uses the `x-mcp-servers` header to access all servers in the "dev_group" access group. Use `server_url: "litellm_proxy"` when calling the proxy's `/v1/responses` endpoint—do not use the full proxy URL.
 
 </TabItem>
 
@@ -423,7 +423,7 @@ curl --location '<your-litellm-proxy-base-url>/v1/responses' \
         {
             "type": "mcp",
             "server_label": "litellm",
-            "server_url": "<your-litellm-proxy-base-url>/mcp/",
+            "server_url": "litellm_proxy",
             "require_approval": "never",
             "headers": {
                 "x-litellm-api-key": "Bearer YOUR_LITELLM_API_KEY",
@@ -436,7 +436,7 @@ curl --location '<your-litellm-proxy-base-url>/v1/responses' \
 }'
 ```
 
-This configuration restricts the request to only use tools from the specified MCP servers.
+This configuration restricts the request to only use tools from the specified MCP servers. Use `server_url: "litellm_proxy"` when calling the proxy's `/v1/responses` endpoint.
 
 </TabItem>
 

docs/my-website/docs/mcp_openapi.md

@@ -0,0 +1,226 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import Image from '@theme/IdealImage';
+
+# MCP from OpenAPI Specs
+
+LiteLLM can convert any OpenAPI/Swagger spec into an MCP server — no custom MCP server code required.
+
+## Step 1 — Add the MCP Server
+
+Add your OpenAPI-based server in `config.yaml`:
+
+```yaml title="config.yaml" showLineNumbers
+mcp_servers:
+  petstore_mcp:
+    url: "https://petstore.swagger.io/v2"
+    spec_path: "/path/to/openapi.json"
+    auth_type: "none"
+
+  my_api_mcp:
+    url: "http://0.0.0.0:8090"
+    spec_path: "/path/to/openapi.json"
+    auth_type: "api_key"
+    auth_value: "your-api-key-here"
+
+  secured_api_mcp:
+    url: "https://api.example.com"
+    spec_path: "/path/to/openapi.json"
+    auth_type: "bearer_token"
+    auth_value: "your-bearer-token"
+```
+
+Or from the UI: go to **MCP Servers → Add New MCP Server**, fill in the URL and spec path, and LiteLLM will fetch the spec and load all endpoints as tools.
+
+**Configuration parameters:**
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `url` | Yes | Base URL of your API |
+| `spec_path` | Yes | Path or URL to your OpenAPI spec (JSON or YAML) |
+| `auth_type` | No | `none`, `api_key`, `bearer_token`, `basic`, `authorization`, `oauth2` |
+| `auth_value` | No | Auth value (required if `auth_type` is set) |
+| `description` | No | Optional description |
+| `allowed_tools` | No | Allowlist of specific tools |
+| `disallowed_tools` | No | Blocklist of specific tools |
+
+**Supported spec versions:** OpenAPI 3.0.x, 3.1.x, Swagger 2.0. Each operation's `operationId` becomes the tool name — make sure they're unique.
+
+Once tools are loaded, you'll see them in the Tool Configuration section:
+
+<Image
+  img={require('../img/mcp_openapi_tools_loaded.png')}
+  style={{width: '80%', display: 'block', margin: '0'}}
+/>
+
+<br/>
+
+## Step 2 — Optionally Override Tool Names and Descriptions
+
+By default, tool names and descriptions come from the `operationId` and description fields in your spec. You can rename or rewrite them so MCP clients see something cleaner — without touching the upstream spec.
+
+### From the UI
+
+Each tool card has a pencil icon. Click it to open the inline editor:
+
+<Image
+  img={require('../img/mcp_openapi_tool_edit_panel.png')}
+  style={{width: '80%', display: 'block', margin: '0'}}
+/>
+
+<br/>
+
+- **Display Name** — overrides the name MCP clients see
+- **Description** — overrides the description MCP clients see
+- Leave a field blank to keep the original from the spec
+
+After setting overrides, a purple **Custom name** badge appears on the tool card:
+
+<Image
+  img={require('../img/mcp_openapi_custom_name_badge.png')}
+  style={{width: '80%', display: 'block', margin: '0'}}
+/>
+
+<br/>
+
+### From the API
+
+Pass `tool_name_to_display_name` and `tool_name_to_description` in the create or update request:
+
+```bash title="Create server with tool name overrides" showLineNumbers
+curl -X POST http://localhost:4000/v1/mcp/server \
+  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "petstore_mcp",
+    "url": "https://petstore.swagger.io/v2",
+    "spec_path": "/path/to/openapi.json",
+    "tool_name_to_display_name": {
+      "getPetById": "Get Pet",
+      "findPetsByStatus": "List Available Pets"
+    },
+    "tool_name_to_description": {
+      "getPetById": "Look up a pet by its ID",
+      "findPetsByStatus": "Returns all pets matching a given status (available, pending, sold)"
+    }
+  }'
+```
+
+```bash title="Update overrides on an existing server" showLineNumbers
+curl -X PUT http://localhost:4000/v1/mcp/server/{server_id} \
+  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "tool_name_to_display_name": {
+      "getPetById": "Get Pet"
+    },
+    "tool_name_to_description": {
+      "getPetById": "Look up a pet by its ID"
+    }
+  }'
+```
+
+The map key is the **original `operationId`** from the spec — not the prefixed tool name. LiteLLM strips the server prefix before doing the lookup.
+
+For example, if your server is `petstore_mcp`, the tool is exposed as `petstore_mcp-getPetById`. The map key is still `getPetById`.
+
+**Before and after:**
+
+```
+# Without overrides
+Tool: "petstore_mcp-getPetById"
+Description: "Returns a single pet"
+
+Tool: "petstore_mcp-findPetsByStatus"
+Description: "Finds Pets by status"
+
+# After overrides
+Tool: "Get Pet"
+Description: "Look up a pet by its ID"
+
+Tool: "List Available Pets"
+Description: "Returns all pets matching a given status (available, pending, sold)"
+```
+
+## Using the Server
+
+<Tabs>
+<TabItem value="fastmcp" label="Python FastMCP">
+
+```python title="Using OpenAPI-based MCP Server" showLineNumbers
+from fastmcp import Client
+import asyncio
+
+config = {
+    "mcpServers": {
+        "petstore": {
+            "url": "http://localhost:4000/petstore_mcp/mcp",
+            "headers": {
+                "x-litellm-api-key": "Bearer sk-1234"
+            }
+        }
+    }
+}
+
+client = Client(config)
+
+async def main():
+    async with client:
+        tools = await client.list_tools()
+        print(f"Available tools: {[tool.name for tool in tools]}")
+
+        response = await client.call_tool(
+            name="Get Pet",        # overridden name
+            arguments={"petId": "1"}
+        )
+        print(f"Response: {response}")
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+</TabItem>
+
+<TabItem value="cursor" label="Cursor IDE">
+
+```json title="Cursor MCP Configuration" showLineNumbers
+{
+  "mcpServers": {
+    "Petstore": {
+      "url": "http://localhost:4000/petstore_mcp/mcp",
+      "headers": {
+        "x-litellm-api-key": "Bearer $LITELLM_API_KEY"
+      }
+    }
+  }
+}
+```
+
+</TabItem>
+
+<TabItem value="openai" label="OpenAI Responses API">
+
+```bash title="Using OpenAPI MCP Server with OpenAI" showLineNumbers
+curl --location 'https://api.openai.com/v1/responses' \
+--header 'Content-Type: application/json' \
+--header "Authorization: Bearer $OPENAI_API_KEY" \
+--data '{
+    "model": "gpt-4o",
+    "tools": [
+        {
+            "type": "mcp",
+            "server_label": "petstore",
+            "server_url": "http://localhost:4000/petstore_mcp/mcp",
+            "require_approval": "never",
+            "headers": {
+                "x-litellm-api-key": "Bearer YOUR_LITELLM_API_KEY"
+            }
+        }
+    ],
+    "input": "Find all available pets",
+    "tool_choice": "required"
+}'
+```
+
+</TabItem>
+</Tabs>

docs/my-website/docs/providers/anthropic.md

@@ -1965,6 +1965,98 @@ curl -L -X POST 'http://0.0.0.0:4000/v1/chat/completions' \
 </TabItem>
 </Tabs>
 
+## Files API
+
+Upload files once and reference them by `file_id` in multiple requests—no need to re-upload content each time.
+
+:::info
+The `file_id` obtained from Anthropic only works with Anthropic Claude models. You cannot use it with other providers (OpenAI, Bedrock, etc.).
+:::
+
+- **Max file size:** 500 MB | **Total storage:** 100 GB per org
+- **Pricing:** File API operations are free. File content used in Messages requests is priced as input tokens.
+
+**Supported models by file type:**
+- **Images:** All Claude 3+ models
+- **PDFs:** All Claude 3.5+ models
+- **Other file types** (for code execution): Claude 3.5 Haiku + all Claude 3.7+ models
+
+### Quick Start
+
+```python
+import litellm
+import os
+
+os.environ["ANTHROPIC_API_KEY"] = "sk-ant-..."
+
+# 1. Upload a file once
+file = litellm.create_file(
+    file=open("document.pdf", "rb"),
+    purpose="messages",
+    custom_llm_provider="anthropic",
+)
+
+# 2. Use file_id in messages (no re-upload needed)
+response = litellm.completion(
+    model="anthropic/claude-sonnet-4-5-20250929",
+    messages=[{
+        "role": "user",
+        "content": [
+            {"type": "text", "text": "Summarize this document"},
+            {"type": "file", "file": {"file_id": file.id, "format": "application/pdf"}}
+        ]
+    }]
+)
+```
+
+### File Operations
+
+| Operation | Function |
+|-----------|----------|
+| Upload | `litellm.create_file(file, purpose="messages", custom_llm_provider="anthropic")` |
+| List | `litellm.file_list(custom_llm_provider="anthropic")` |
+| Retrieve | `litellm.file_retrieve(file_id, custom_llm_provider="anthropic")` |
+| Delete | `litellm.file_delete(file_id, custom_llm_provider="anthropic")` |
+| Download | `litellm.file_content(file_id, custom_llm_provider="anthropic")` |
+
+:::note
+Download only works for files created by the [code execution tool](https://docs.anthropic.com/en/docs/agents-and-tools/tool-use/code-execution-tool), not uploaded files.
+:::
+
+### Supported Formats
+
+| File Type | Format Value |
+|-----------|-------------|
+| PDF | `application/pdf` |
+| Plain text | `text/plain` |
+| JPEG | `image/jpeg` |
+| PNG | `image/png` |
+| GIF | `image/gif` |
+| WebP | `image/webp` |
+
+### Using Images
+
+```python
+# Upload image
+image = litellm.create_file(
+    file=open("photo.jpg", "rb"),
+    purpose="messages",
+    custom_llm_provider="anthropic",
+)
+
+# Use in message
+response = litellm.completion(
+    model="anthropic/claude-sonnet-4-5-20250929",
+    messages=[{
+        "role": "user",
+        "content": [
+            {"type": "text", "text": "What's in this image?"},
+            {"type": "file", "file": {"file_id": image.id, "format": "image/jpeg"}}
+        ]
+    }]
+)
+```
+
 ## Usage - passing 'user_id' to Anthropic
 
 LiteLLM translates the OpenAI `user` param to Anthropic's `metadata[user_id]` param.

docs/my-website/docs/providers/azure_ai/azure_model_router.md

@@ -2,6 +2,32 @@
 
 Azure Model Router is a feature in Azure AI Foundry that automatically routes your requests to the best available model based on your requirements. This allows you to use a single endpoint that intelligently selects the optimal model for each request.
 
+## Quick Start
+
+**Model pattern**: `azure_ai/model_router/<deployment-name>`
+
+```python
+import litellm
+
+response = litellm.completion(
+    model="azure_ai/model_router/model-router",  # Replace with your deployment name
+    messages=[{"role": "user", "content": "Hello!"}],
+    api_base="https://your-endpoint.cognitiveservices.azure.com/openai/v1/",
+    api_key="your-api-key",
+)
+```
+
+**Proxy config** (`config.yaml`):
+
+```yaml
+model_list:
+  - model_name: model-router
+    litellm_params:
+      model: azure_ai/model_router/model-router
+      api_base: https://your-endpoint.cognitiveservices.azure.com/openai/deployments/model-router/chat/completions?api-version=2025-01-01-preview
+      api_key: your-api-key
+```
+
 ## Key Features
 
 - **Automatic Model Selection**: Azure Model Router dynamically selects the best model for your request
@@ -229,19 +255,51 @@ Cost is tracked based on the actual model used (e.g., `gpt-4.1-nano`), plus a fl
 
 ## Cost Tracking
 
-LiteLLM automatically handles cost tracking for Azure Model Router by:
+LiteLLM automatically handles cost tracking for Azure Model Router. Understanding how this works helps you interpret spend and debug billing.
 
-1. **Detecting the actual model**: When Azure Model Router routes your request to a specific model (e.g., `gpt-4.1-nano-2025-04-14`), LiteLLM extracts this from the response
-2. **Calculating accurate costs**: Costs are calculated based on:
-   - The actual model used (e.g., `gpt-4.1-nano` token costs)
-   - Plus a flat infrastructure cost of **$0.14 per million input tokens** for using the Model Router
-3. **Streaming support**: Cost tracking works correctly for both streaming and non-streaming requests
+### How LiteLLM Calculates Cost
+
+When you use Azure Model Router, LiteLLM computes **two cost components**:
+
+| Component | Description | When Applied |
+|-----------|-------------|--------------|
+| **Model Cost** | Token-based cost for the actual model that handled the request (e.g., `gpt-5-nano`, `gpt-4.1-nano`) | Always, when Azure returns the model in the response |
+| **Router Flat Cost** | $0.14 per million input tokens (Azure AI Foundry infrastructure fee) | When the **request** was made via a model router endpoint |
+
+### Cost Calculation Flow
+
+1. **Request model detection**: LiteLLM records the model you requested (e.g., `azure_ai/model_router/model-router`). If it contains `model_router` or `model-router`, the request is treated as a router request.
+
+2. **Response model extraction**: Azure returns the actual model used in the response (e.g., `gpt-5-nano-2025-08-07`). LiteLLM uses this for the model cost lookup.
+
+3. **Model cost**: LiteLLM looks up the response model in its pricing table and computes cost from prompt tokens and completion tokens.
+
+4. **Router flat cost**: Because the original request was to a model router, LiteLLM adds the flat cost ($0.14 per M input tokens) on top of the model cost.
+
+5. **Total cost**: `Total = Model Cost + Router Flat Cost`
+
+### Configuration Requirements
+
+For cost tracking to work correctly:
+
+- **Use the full pattern**: `azure_ai/model_router/<deployment-name>` (e.g., `azure_ai/model_router/model-router`)
+- **Proxy config**: When using the LiteLLM proxy, set `model` in `litellm_params` to the full pattern so the request model is correctly identified as a router
+
+```yaml
+# proxy_server_config.yaml
+model_list:
+  - model_name: model-router
+    litellm_params:
+      model: azure_ai/model_router/model-router  # Required for router cost detection
+      api_base: https://your-endpoint.cognitiveservices.azure.com/openai/deployments/model-router/chat/completions?api-version=2025-01-01-preview
+      api_key: your-api-key
+```
 
 ### Cost Breakdown
 
 When you use Azure Model Router, the total cost includes:
 
-- **Model Cost**: Based on the actual model that handled your request (e.g., `gpt-4.1-nano`)
+- **Model Cost**: Based on the actual model that handled your request (e.g., `gpt-5-nano`, `gpt-4.1-nano`)
 - **Router Flat Cost**: $0.14 per million input tokens (Azure AI Foundry infrastructure fee)
 
 ### Example Response with Cost

docs/my-website/docs/providers/bedrock_agentcore.md

@@ -13,7 +13,7 @@ Call Bedrock AgentCore in the OpenAI Request/Response format.
 
 :::info
 
-This documentation is for **AgentCore Agents** (agent runtimes). If you want to use AgentCore MCP servers, add them as you would any other MCP server. See the [MCP documentation](https://docs.litellm.ai/docs/mcp) for details.
+This documentation is for **AgentCore Agents** (agent runtimes). If you want to use AgentCore MCP servers with LiteLLM, see the [MCP AWS SigV4 Auth](https://docs.litellm.ai/docs/mcp_aws_sigv4) guide for setup instructions.
 
 :::
 

docs/my-website/docs/providers/bedrock_mantle.md

@@ -0,0 +1,157 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Amazon Bedrock Mantle
+
+[Amazon Bedrock Mantle](https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-mantle.html) is Amazon Bedrock's distributed inference engine (Project Mantle) that exposes an **OpenAI-compatible API** for Bedrock-hosted models.
+
+Use this provider to call Bedrock Mantle models with accurate **AWS Bedrock pricing** instead of OpenAI pricing.
+
+:::tip
+
+**We support ALL Bedrock Mantle models, just set `model=bedrock_mantle/<model-id>` as a prefix when sending litellm requests**
+
+:::
+
+## API Key
+
+```python
+# env variable
+os.environ['BEDROCK_MANTLE_API_KEY'] = "your-aws-bedrock-api-key"
+
+# optional: override region (defaults to us-east-1)
+os.environ['BEDROCK_MANTLE_REGION'] = "us-east-1"  # or use AWS_REGION
+```
+
+## Supported Models
+
+| Model | Context Window | Input (per 1M tokens) | Output (per 1M tokens) |
+|-------|---------------|----------------------|------------------------|
+| `openai.gpt-oss-120b` | 131K | $0.15 | $0.60 |
+| `openai.gpt-oss-20b` | 131K | $0.075 | $0.30 |
+| `openai.gpt-oss-safeguard-120b` | 131K | $0.15 | $0.60 |
+| `openai.gpt-oss-safeguard-20b` | 131K | $0.075 | $0.30 |
+
+## Sample Usage
+
+<Tabs>
+<TabItem value="sdk" label="SDK">
+
+```python
+from litellm import completion
+import os
+
+os.environ['BEDROCK_MANTLE_API_KEY'] = "your-bedrock-api-key"
+
+response = completion(
+    model="bedrock_mantle/openai.gpt-oss-120b",
+    messages=[{"role": "user", "content": "hello from litellm"}],
+)
+print(response)
+```
+
+</TabItem>
+<TabItem value="streaming" label="Streaming">
+
+```python
+from litellm import completion
+import os
+
+os.environ['BEDROCK_MANTLE_API_KEY'] = "your-bedrock-api-key"
+
+response = completion(
+    model="bedrock_mantle/openai.gpt-oss-120b",
+    messages=[{"role": "user", "content": "hello from litellm"}],
+    stream=True,
+)
+
+for chunk in response:
+    print(chunk)
+```
+
+</TabItem>
+<TabItem value="async" label="Async">
+
+```python
+import asyncio
+from litellm import acompletion
+import os
+
+os.environ['BEDROCK_MANTLE_API_KEY'] = "your-bedrock-api-key"
+
+async def main():
+    response = await acompletion(
+        model="bedrock_mantle/openai.gpt-oss-120b",
+        messages=[{"role": "user", "content": "hello from litellm"}],
+    )
+    print(response)
+
+asyncio.run(main())
+```
+
+</TabItem>
+</Tabs>
+
+## Region Configuration
+
+The API base URL is `https://bedrock-mantle.{region}.api.aws/v1`. Region is resolved in this order:
+
+1. `BEDROCK_MANTLE_REGION` env var
+2. `AWS_REGION` env var
+3. Default: `us-east-1`
+
+**Supported regions:** `us-east-1`, `us-east-2`, `us-west-2`, `eu-west-1`, `eu-west-2`, `eu-central-1`, `eu-south-1`, `eu-north-1`, `ap-northeast-1`, `ap-south-1`, `ap-southeast-3`, `sa-east-1`
+
+```python
+import os
+os.environ['BEDROCK_MANTLE_REGION'] = "eu-west-1"
+
+# or pass api_base directly
+response = completion(
+    model="bedrock_mantle/openai.gpt-oss-120b",
+    messages=[{"role": "user", "content": "hello"}],
+    api_base="https://bedrock-mantle.eu-west-1.api.aws/v1",
+)
+```
+
+## Usage with LiteLLM Proxy
+
+### 1. Set Bedrock Mantle models on config.yaml
+
+```yaml
+model_list:
+  - model_name: gpt-oss-120b
+    litellm_params:
+      model: bedrock_mantle/openai.gpt-oss-120b
+      api_key: os.environ/BEDROCK_MANTLE_API_KEY
+      # optional region override:
+      api_base: "https://bedrock-mantle.us-east-1.api.aws/v1"
+
+  - model_name: gpt-oss-20b
+    litellm_params:
+      model: bedrock_mantle/openai.gpt-oss-20b
+      api_key: os.environ/BEDROCK_MANTLE_API_KEY
+```
+
+### 2. Start the proxy
+
+```shell
+litellm --config /path/to/config.yaml
+```
+
+### 3. Send a request
+
+```python
+import openai
+
+client = openai.OpenAI(
+    api_key="anything",
+    base_url="http://0.0.0.0:4000",
+)
+
+response = client.chat.completions.create(
+    model="gpt-oss-120b",
+    messages=[{"role": "user", "content": "hello from litellm"}],
+)
+print(response)
+```

docs/my-website/docs/providers/chatgpt.md

@@ -4,12 +4,12 @@ Use ChatGPT Pro/Max subscription models through LiteLLM with OAuth device flow a
 
 | Property | Details |
 |-------|-------|
-| Description | ChatGPT subscription access (Codex + GPT-5.2 family) via ChatGPT backend API |
+| Description | ChatGPT subscription access (Codex + GPT-5.3/5.4 family) via ChatGPT backend API |
 | Provider Route on LiteLLM | `chatgpt/` |
 | Supported Endpoints | `/responses`, `/chat/completions` (bridged to Responses for supported models) |
 | API Reference | https://chatgpt.com |
 
-ChatGPT subscription access is native to the Responses API. Chat Completions requests are bridged to Responses for supported models (for example `chatgpt/gpt-5.2`).
+ChatGPT subscription access is native to the Responses API. Chat Completions requests are bridged to Responses for supported models (for example `chatgpt/gpt-5.4`).
 
 Notes:
 - The ChatGPT subscription backend rejects token limit fields (`max_tokens`, `max_output_tokens`, `max_completion_tokens`) and `metadata`. LiteLLM strips these fields for this provider.
@@ -31,7 +31,7 @@ ChatGPT subscription access uses an OAuth device code flow:
 import litellm
 
 response = litellm.responses(
-    model="chatgpt/gpt-5.2-codex",
+    model="chatgpt/gpt-5.3-codex",
     input="Write a Python hello world"
 )
 
@@ -44,7 +44,7 @@ print(response)
 import litellm
 
 response = litellm.completion(
-    model="chatgpt/gpt-5.2",
+    model="chatgpt/gpt-5.4",
     messages=[{"role": "user", "content": "Write a Python hello world"}]
 )
 
@@ -55,16 +55,36 @@ print(response)
 
 ```yaml showLineNumbers title="config.yaml"
 model_list:
-  - model_name: chatgpt/gpt-5.2
+  - model_name: chatgpt/gpt-5.4
     model_info:
       mode: responses
     litellm_params:
-      model: chatgpt/gpt-5.2
-  - model_name: chatgpt/gpt-5.2-codex
+      model: chatgpt/gpt-5.4
+  - model_name: chatgpt/gpt-5.4-pro
     model_info:
       mode: responses
     litellm_params:
-      model: chatgpt/gpt-5.2-codex
+      model: chatgpt/gpt-5.4-pro
+  - model_name: chatgpt/gpt-5.3-codex
+    model_info:
+      mode: responses
+    litellm_params:
+      model: chatgpt/gpt-5.3-codex
+  - model_name: chatgpt/gpt-5.3-codex-spark
+    model_info:
+      mode: responses
+    litellm_params:
+      model: chatgpt/gpt-5.3-codex-spark
+  - model_name: chatgpt/gpt-5.3-instant
+    model_info:
+      mode: responses
+    litellm_params:
+      model: chatgpt/gpt-5.3-instant
+  - model_name: chatgpt/gpt-5.3-chat-latest
+    model_info:
+      mode: responses
+    litellm_params:
+      model: chatgpt/gpt-5.3-chat-latest
 ```
 
 ```bash showLineNumbers title="Start LiteLLM Proxy"

docs/my-website/docs/providers/openai.md

@@ -192,8 +192,12 @@ os.environ["OPENAI_BASE_URL"] = "https://your_host/v1"     # OPTIONAL
 | gpt-5.2-2025-12-11 | `response = completion(model="gpt-5.2-2025-12-11", messages=messages)` |
 | gpt-5.2-chat-latest | `response = completion(model="gpt-5.2-chat-latest", messages=messages)` |
 | gpt-5.3-chat-latest | `response = completion(model="gpt-5.3-chat-latest", messages=messages)` |
+| gpt-5.4 | `response = completion(model="gpt-5.4", messages=messages)` |
+| gpt-5.4-2026-03-05 | `response = completion(model="gpt-5.4-2026-03-05", messages=messages)` |
 | gpt-5.2-pro | `response = completion(model="gpt-5.2-pro", messages=messages)` |
 | gpt-5.2-pro-2025-12-11 | `response = completion(model="gpt-5.2-pro-2025-12-11", messages=messages)` |
+| gpt-5.4-pro | `response = completion(model="gpt-5.4-pro", messages=messages)` |
+| gpt-5.4-pro-2026-03-05 | `response = completion(model="gpt-5.4-pro-2026-03-05", messages=messages)` |
 | gpt-5.1 | `response = completion(model="gpt-5.1", messages=messages)` |
 | gpt-5.1-codex | `response = completion(model="gpt-5.1-codex", messages=messages)` |
 | gpt-5.1-codex-mini | `response = completion(model="gpt-5.1-codex-mini", messages=messages)` |
@@ -628,7 +632,22 @@ curl -X POST 'http://0.0.0.0:4000/chat/completions' \
 
 ## OpenAI Chat Completion to Responses API Bridge
 
-Call any Responses API model from OpenAI's `/chat/completions` endpoint. 
+Call any Responses API model from OpenAI's `/chat/completions` endpoint.
+
+:::tip gpt-5.4 + reasoning_effort + function tools
+
+OpenAI does not support `reasoning_effort` with function tools for `gpt-5.4` in `/v1/chat/completions`. Use the responses bridge instead:
+
+```python
+response = litellm.completion(
+    model="openai/responses/gpt-5.4",  # routes to /v1/responses
+    messages=[{"role": "user", "content": "What's the weather?"}],
+    tools=[...],
+    reasoning_effort="low",
+)
+```
+
+:::
 
 <Tabs>
 <TabItem value="sdk" label="SDK">

docs/my-website/docs/providers/openai/responses_api.md

@@ -693,6 +693,236 @@ print(final_response.output)
 
 Set `parallel_tool_calls=False` to ensure zero or one tool is called per turn. [More details](https://platform.openai.com/docs/guides/function-calling#parallel-function-calling).
 
+## Tool Search & Namespaces
+
+Tool search lets models dynamically load tools at runtime instead of sending every tool definition in the prompt. Group functions into **namespaces** and mark them with `defer_loading: true` — the model only loads the schemas it actually needs, saving tokens.
+
+Requires `gpt-5.4` or later. See [OpenAI Tool Search docs](https://developers.openai.com/api/docs/guides/tools-tool-search) for full details.
+
+<Tabs>
+<TabItem value="sdk" label="LiteLLM Python SDK">
+
+```python showLineNumbers title="Tool Search with Namespaces"
+import litellm
+
+# Define namespaces with deferred tools
+tools = [
+    {"type": "tool_search"},  # Enable tool search
+    {
+        "type": "namespace",
+        "name": "crm",
+        "description": "CRM tools for customer management",
+        "tools": [
+            {
+                "type": "function",
+                "name": "get_customer",
+                "description": "Get customer details by ID",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "customer_id": {"type": "string"}
+                    },
+                    "required": ["customer_id"],
+                },
+                "defer_loading": True,
+            },
+            {
+                "type": "function",
+                "name": "list_customers",
+                "description": "List customers with optional filters",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "status": {"type": "string", "enum": ["active", "inactive"]},
+                    },
+                },
+                "defer_loading": True,
+            },
+        ],
+    },
+    {
+        "type": "namespace",
+        "name": "billing",
+        "description": "Billing and invoicing tools",
+        "tools": [
+            {
+                "type": "function",
+                "name": "get_invoice",
+                "description": "Get an invoice by ID",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "invoice_id": {"type": "string"}
+                    },
+                    "required": ["invoice_id"],
+                },
+                "defer_loading": True,
+            },
+        ],
+    },
+]
+
+response = litellm.responses(
+    model="openai/gpt-5.4",
+    input="Look up invoice INV-2024-001 from the billing system",
+    tools=tools,
+)
+
+# The response contains tool_search_call, tool_search_output, and function_call items
+for item in response.output:
+    if isinstance(item, dict):
+        if item["type"] == "tool_search_call":
+            print(f"Searched namespaces: {item['arguments']['paths']}")
+        elif item["type"] == "tool_search_output":
+            print(f"Loaded {len(item['tools'])} tool(s)")
+        elif item["type"] == "function_call":
+            print(f"Called: {item.get('namespace', '')}.{item['name']}({item['arguments']})")
+    else:
+        if item.type == "function_call":
+            print(f"Called: {item.namespace}.{item.name}({item.arguments})")
+```
+
+</TabItem>
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+1. Set up config.yaml
+
+```yaml showLineNumbers title="OpenAI Proxy Configuration"
+model_list:
+  - model_name: openai/gpt-5.4
+    litellm_params:
+      model: openai/gpt-5.4
+      api_key: os.environ/OPENAI_API_KEY
+```
+
+2. Start LiteLLM Proxy Server
+
+```bash title="Start LiteLLM Proxy Server"
+litellm --config /path/to/config.yaml
+
+# RUNNING on http://0.0.0.0:4000
+```
+
+3. Test it!
+
+```python showLineNumbers title="Tool Search via OpenAI SDK with LiteLLM Proxy"
+from openai import OpenAI
+
+client = OpenAI(
+    base_url="http://localhost:4000",
+    api_key="your-api-key"
+)
+
+response = client.responses.create(
+    model="openai/gpt-5.4",
+    input="Look up invoice INV-2024-001 from the billing system",
+    tools=[
+        {"type": "tool_search"},
+        {
+            "type": "namespace",
+            "name": "billing",
+            "description": "Billing and invoicing tools",
+            "tools": [
+                {
+                    "type": "function",
+                    "name": "get_invoice",
+                    "description": "Get an invoice by ID",
+                    "parameters": {
+                        "type": "object",
+                        "properties": {"invoice_id": {"type": "string"}},
+                        "required": ["invoice_id"],
+                    },
+                    "defer_loading": True,
+                },
+            ],
+        },
+    ],
+)
+
+print(response.output)
+```
+
+</TabItem>
+</Tabs>
+
+### Tool Search via Chat Completions Bridge
+
+You can also use tool search through the `/v1/chat/completions` endpoint by prefixing the model with `openai/responses/`. The request is routed through the Responses API but returns a standard chat completions response.
+
+<Tabs>
+<TabItem value="sdk" label="LiteLLM Python SDK">
+
+```python showLineNumbers title="Tool Search via Chat Completions Bridge"
+import litellm
+
+response = litellm.completion(
+    model="openai/responses/gpt-5.4",
+    messages=[{"role": "user", "content": "Look up invoice INV-2024-001"}],
+    tools=[
+        {"type": "tool_search"},
+        {
+            "type": "namespace",
+            "name": "billing",
+            "description": "Billing and invoicing tools",
+            "tools": [
+                {
+                    "type": "function",
+                    "name": "get_invoice",
+                    "description": "Get an invoice by ID",
+                    "parameters": {
+                        "type": "object",
+                        "properties": {"invoice_id": {"type": "string"}},
+                        "required": ["invoice_id"],
+                    },
+                    "defer_loading": True,
+                },
+            ],
+        },
+    ],
+)
+
+# Standard chat completions response
+for tool_call in response.choices[0].message.tool_calls:
+    print(f"Called: {tool_call.function.name}({tool_call.function.arguments})")
+```
+
+</TabItem>
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+```bash showLineNumbers title="Tool Search via /v1/chat/completions"
+curl http://localhost:4000/v1/chat/completions \
+  -H "Authorization: Bearer $LITELLM_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "model": "openai/responses/gpt-5.4",
+    "messages": [{"role": "user", "content": "Look up invoice INV-2024-001"}],
+    "tools": [
+      {"type": "tool_search"},
+      {
+        "type": "namespace",
+        "name": "billing",
+        "description": "Billing and invoicing tools",
+        "tools": [
+          {
+            "type": "function",
+            "name": "get_invoice",
+            "description": "Get an invoice by ID",
+            "parameters": {
+              "type": "object",
+              "properties": {"invoice_id": {"type": "string"}},
+              "required": ["invoice_id"]
+            },
+            "defer_loading": true
+          }
+        ]
+      }
+    ]
+  }'
+```
+
+</TabItem>
+</Tabs>
+
 ## Free-form Function Calling
 
 <Tabs>

docs/my-website/docs/providers/vertex.md

@@ -1472,6 +1472,82 @@ Your WIF credentials JSON file typically looks like this (for AWS federation):
 
 For more details on setting up Workload Identity Federation, see [Google Cloud WIF documentation](https://cloud.google.com/iam/docs/workload-identity-federation).
 
+#### Explicit AWS Credentials for WIF
+
+By default, AWS-based WIF relies on the EC2 instance metadata service to obtain AWS credentials. This works when LiteLLM runs on an EC2 instance or ECS task with an IAM role attached.
+
+If your environment **does not have access to the EC2 metadata service** (e.g., running on-premises, in a container without host networking, or in a different cloud with security restrictions), you can provide explicit AWS credentials directly in the WIF credential JSON file. LiteLLM will use these to authenticate to AWS before performing the GCP token exchange.
+
+Add the `aws_*` keys at the **top level** of your WIF credential JSON (alongside `type`, `audience`, etc.):
+
+```json
+{
+  "type": "external_account",
+  "audience": "//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID",
+  "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
+  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_EMAIL:generateAccessToken",
+  "token_url": "https://sts.googleapis.com/v1/token",
+  "credential_source": {
+    "environment_id": "aws1",
+    "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
+    "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
+    "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"
+  },
+  "aws_role_name": "arn:aws:iam::123456789012:role/MyWifRole",
+  "aws_region_name": "us-east-1"
+}
+```
+
+**Supported `aws_*` parameters:**
+
+| Parameter | Required | Description |
+|---|---|---|
+| `aws_region_name` | Yes | AWS region for credential verification (e.g. `us-east-1`) |
+| `aws_role_name` | No | IAM role ARN for STS AssumeRole |
+| `aws_access_key_id` | No | Static AWS access key ID |
+| `aws_secret_access_key` | No | Static AWS secret access key |
+| `aws_session_token` | No | Temporary session token |
+| `aws_profile_name` | No | AWS CLI profile name |
+| `aws_session_name` | No | Session name for AssumeRole |
+| `aws_web_identity_token` | No | Web identity token for STS |
+| `aws_sts_endpoint` | No | Custom STS endpoint URL |
+| `aws_external_id` | No | External ID for cross-account AssumeRole |
+
+`aws_region_name` is always required when using explicit AWS credentials. The other parameters follow the same authentication flows as [Bedrock AWS auth](/docs/providers/bedrock#authentication) -- you can use role assumption, static keys, profiles, or web identity tokens.
+
+<Tabs>
+<TabItem value="sdk" label="SDK">
+
+```python
+from litellm import completion
+
+response = completion(
+    model="vertex_ai/gemini-1.5-pro",
+    messages=[{"role": "user", "content": "Hello!"}],
+    vertex_credentials="/path/to/wif-credentials-with-aws.json",  # WIF JSON with aws_* keys
+    vertex_project="your-gcp-project-id",
+    vertex_location="us-central1"
+)
+```
+
+</TabItem>
+<TabItem value="proxy" label="PROXY">
+
+```yaml
+model_list:
+  - model_name: gemini-model
+    litellm_params:
+      model: vertex_ai/gemini-1.5-pro
+      vertex_project: your-gcp-project-id
+      vertex_location: us-central1
+      vertex_credentials: /path/to/wif-credentials-with-aws.json  # WIF JSON with aws_* keys
+```
+
+</TabItem>
+</Tabs>
+
+When `aws_*` keys are present in the JSON, LiteLLM automatically uses explicit AWS authentication instead of the EC2 metadata service. When they are absent, the standard metadata-based flow is used unchanged.
+
 ### **Environment Variables**
 
 You can set:
@@ -1687,6 +1763,20 @@ litellm.vertex_location = "us-central1 # Your Location
 | gemini-2.5-flash-lite-preview-09-2025   | `completion('gemini-2.5-flash-lite-preview-09-2025', messages)`, `completion('vertex_ai/gemini-2.5-flash-lite-preview-09-2025', messages)` |
 | gemini-3.1-flash-lite-preview   | `completion('gemini-3.1-flash-lite-preview', messages)`, `completion('vertex_ai/gemini-3.1-flash-lite-preview', messages)` |
 
+## PayGo / Priority Cost Tracking
+
+LiteLLM automatically tracks spend for Vertex AI Gemini models using the correct pricing tier based on the response's `usageMetadata.trafficType`:
+
+| Vertex AI `trafficType` | LiteLLM `service_tier` | Pricing applied |
+|-------------------------|-------------------------|-----------------|
+| `ON_DEMAND_PRIORITY` | `priority` | PayGo / priority pricing (`input_cost_per_token_priority`, `output_cost_per_token_priority`) |
+| `ON_DEMAND` | standard | Default on-demand pricing |
+| `FLEX` / `BATCH` | `flex` | Batch/flex pricing |
+
+When you use [Vertex AI PayGo](https://cloud.google.com/vertex-ai/generative-ai/pricing) (on-demand priority) or batch workloads, LiteLLM reads `trafficType` from the response and applies the matching cost per token from the [model cost map](https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json). No configuration is required — spend tracking works out of the box for both standard and PayGo requests.
+
+See [Spend Tracking](../proxy/cost_tracking.md) for general cost tracking setup.
+
 ## Private Service Connect (PSC) Endpoints
 
 LiteLLM supports Vertex AI models deployed to Private Service Connect (PSC) endpoints, allowing you to use custom `api_base` URLs for private deployments.

docs/my-website/docs/providers/vertex_partner.md

@@ -11,6 +11,7 @@ import TabItem from '@theme/TabItem';
 |----------|---------------|---------------|
 | Anthropic (Claude) | `vertex_ai/claude-*` | [Vertex AI - Anthropic Models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-claude) |
 | DeepSeek | `vertex_ai/deepseek-ai/{MODEL}` | [Vertex AI - DeepSeek Models](https://cloud.google.com/vertex-ai/generative-ai/docs/maas/deepseek) |
+| ZAI (GLM) | `vertex_ai/zai-org/{MODEL}` | [Vertex AI - GLM Models](https://cloud.google.com/vertex-ai/generative-ai/docs/maas/zaiorg/glm-47) |
 | Meta/Llama | `vertex_ai/meta/{MODEL}` | [Vertex AI - Meta Models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/llama) |
 | Mistral | `vertex_ai/mistral-*` | [Vertex AI - Mistral Models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/mistral) |
 | AI21 (Jamba) | `vertex_ai/jamba-*` | [Vertex AI - AI21 Models](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/ai21) |
@@ -226,6 +227,79 @@ ModelResponse(
 |------------------|------------------------------|
 | vertex_ai/deepseek-ai/deepseek-r1-0528-maas | `completion('vertex_ai/deepseek-ai/deepseek-r1-0528-maas', messages)` |
 
+## VertexAI ZAI (GLM)
+
+| Property | Details |
+|----------|---------|
+| Provider Route | `vertex_ai/zai-org/{MODEL}` |
+| Vertex Documentation | [Vertex AI - GLM Models](https://cloud.google.com/vertex-ai/generative-ai/docs/maas/zaiorg/glm-47) |
+
+**LiteLLM Supports all Vertex AI GLM Models.** Ensure you use the `vertex_ai/zai-org/` prefix for all Vertex AI GLM models.
+
+| Model Name | Usage |
+|------------|-------|
+| vertex_ai/zai-org/glm-4.7-maas | `completion('vertex_ai/zai-org/glm-4.7-maas', messages)` |
+
+#### Usage
+
+<Tabs>
+<TabItem value="sdk" label="SDK">
+
+```python
+from litellm import completion
+import os
+
+os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = ""
+
+response = completion(
+    model="vertex_ai/zai-org/glm-4.7-maas",
+    messages=[{"role": "user", "content": "hi"}],
+    vertex_project="your-vertex-project",
+    # vertex_location routes to "global"
+)
+print("\nModel Response", response)
+```
+</TabItem>
+<TabItem value="proxy" label="Proxy">
+
+**1. Add to config**
+
+```yaml
+model_list:
+  - model_name: glm-4.7
+    litellm_params:
+      model: vertex_ai/zai-org/glm-4.7-maas
+      vertex_project: "my-project"
+      # vertex_location routes to "global"
+```
+
+**2. Start proxy**
+
+```bash
+litellm --config /path/to/config.yaml
+
+# RUNNING at http://0.0.0.0:4000
+```
+
+**3. Test it!**
+
+```bash
+curl --location 'http://0.0.0.0:4000/chat/completions' \
+      --header 'Authorization: Bearer sk-1234' \
+      --header 'Content-Type: application/json' \
+      --data '{
+            "model": "glm-4.7",
+            "messages": [
+                {
+                "role": "user",
+                "content": "what llm are you"
+                }
+            ],
+        }'
+```
+
+</TabItem>
+</Tabs>
 
 ## VertexAI Meta/Llama API
  

docs/my-website/docs/proxy/admin_ui_sso.md

@@ -41,12 +41,38 @@ After creating the app, copy your **Client ID** and **Client Secret** from the a
 
 Ensure users are assigned to the app in the **Assignments** tab. If Federation Broker Mode is enabled, you may need to disable it to assign users manually.
 
-#### Step 3: Configure Authorization Server Access Policy
+#### Step 3: Set Environment Variables
 
-:::warning Important
-This step is required. Without an Access Policy for your app, users will get a `no_matching_policy` error when attempting to log in.
+Set the following environment variables. The only difference between the two Okta authorization servers is the endpoint URLs:
+
+**Org Authorization Server** (available on all Okta plans, no additional SKU required):
+```bash
+GENERIC_CLIENT_ID="<your-client-id>"
+GENERIC_CLIENT_SECRET="<your-client-secret>"
+GENERIC_AUTHORIZATION_ENDPOINT="https://<your-okta-domain>/oauth2/v1/authorize"
+GENERIC_TOKEN_ENDPOINT="https://<your-okta-domain>/oauth2/v1/token"
+GENERIC_USERINFO_ENDPOINT="https://<your-okta-domain>/oauth2/v1/userinfo"
+PROXY_BASE_URL="https://<your-proxy-base-url>"
+```
+
+**Custom Authorization Server** (requires the Okta API Access Management SKU):
+```bash
+GENERIC_CLIENT_ID="<your-client-id>"
+GENERIC_CLIENT_SECRET="<your-client-secret>"
+GENERIC_AUTHORIZATION_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/authorize"
+GENERIC_TOKEN_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/token"
+GENERIC_USERINFO_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/userinfo"
+PROXY_BASE_URL="https://<your-proxy-base-url>"
+```
+
+:::tip
+You can find all OAuth endpoints at `https://<your-okta-domain>/.well-known/openid-configuration`
 :::
 
+#### Step 3a: Configure Access Policy (Custom Authorization Server only)
+
+If you are using the Custom Authorization Server, you must configure an Access Policy. Without it, users will get a `no_matching_policy` error. Skip this step if you are using the Org Authorization Server.
+
 1. Go to **Security** → **API**
 
 <Image img={require('../../img/okta_security_api.png')} />
@@ -62,21 +88,21 @@ This step is required. Without an Access Policy for your app, users will get a `
 
 See [Okta's Access Policy documentation](https://help.okta.com/en-us/content/topics/security/api-access-management/access-policies.htm) for more details.
 
-#### Step 4: Configure LiteLLM Environment Variables
+#### Step 4: Configure Okta Security Settings
+
+**GENERIC_CLIENT_STATE** is recommended for Okta to prevent CSRF attacks:
 
 ```bash
-GENERIC_CLIENT_ID="<your-client-id>"
-GENERIC_CLIENT_SECRET="<your-client-secret>"
-GENERIC_AUTHORIZATION_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/authorize"
-GENERIC_TOKEN_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/token"
-GENERIC_USERINFO_ENDPOINT="https://<your-okta-domain>/oauth2/default/v1/userinfo"
 GENERIC_CLIENT_STATE="random-string"
-PROXY_BASE_URL="https://<your-proxy-base-url>"
 ```
 
-:::tip
-You can find all OAuth endpoints at `https://<your-okta-domain>/.well-known/openid-configuration`
-:::
+**PKCE (Proof Key for Code Exchange)** — If your Okta application is configured to require PKCE, enable it by setting:
+
+```bash
+GENERIC_CLIENT_USE_PKCE="true"
+```
+
+LiteLLM will automatically handle PKCE parameter generation and verification during the OAuth flow.
 
 #### Step 5: Test the SSO Flow
 
@@ -91,7 +117,7 @@ You can find all OAuth endpoints at `https://<your-okta-domain>/.well-known/open
 |-------|-------|----------|
 | `redirect_uri` error | Redirect URI not configured | Add `<proxy_base_url>/sso/callback` to Sign-in redirect URIs in Okta |
 | `access_denied` | User not assigned to app | Assign the user in the Assignments tab |
-| `no_matching_policy` | Missing Access Policy | Create an Access Policy in the Authorization Server (see Step 3) |
+| `no_matching_policy` | Missing Access Policy (Custom Authorization Server only) | Create an Access Policy in the Authorization Server (see Step 3a) |
 
 </TabItem>
 <TabItem value="google" label="Google SSO">
@@ -456,23 +482,9 @@ PROXY_BASE_URL=http://litellm.platform.com
 PROXY_BASE_URL=litellm.platform.com
 ```
 
-**2. For Okta specifically, ensure GENERIC_CLIENT_STATE is set**
+**2. For Okta specifically, ensure `GENERIC_CLIENT_STATE` is set and PKCE is configured if required**
 
-Okta requires the `GENERIC_CLIENT_STATE` parameter:
-
-```bash
-GENERIC_CLIENT_STATE="random-string" # Required for Okta
-```
-
-### Okta PKCE
-
-If your Okta application is configured to require PKCE (Proof Key for Code Exchange), enable it by setting:
-
-```bash
-GENERIC_CLIENT_USE_PKCE="true"
-```
-
-This is required when your Okta app settings enforce PKCE for enhanced security. LiteLLM will automatically handle PKCE parameter generation and verification during the OAuth flow.
+See [Okta SSO — Step 4: Configure Okta Security Settings](#step-4-configure-okta-security-settings) for details on `GENERIC_CLIENT_STATE` and PKCE configuration.
 
 ### Common Configuration Issues
 

docs/my-website/docs/proxy/config_settings.md

@@ -199,6 +199,7 @@ router_settings:
 | use_chat_completions_url_for_anthropic_messages | boolean | If true, routes OpenAI `/v1/messages` requests through chat/completions instead of the Responses API. Can also be set via env var `LITELLM_USE_CHAT_COMPLETIONS_URL_FOR_ANTHROPIC_MESSAGES=true`. |
 | disable_hf_tokenizer_download | boolean | If true, it defaults to using the openai tokenizer for all models (including huggingface models). |
 | enable_json_schema_validation | boolean | If true, enables json schema validation for all requests. |
+| enable_key_alias_format_validation | boolean | If true, validates `key_alias` format on `/key/generate` and `/key/update`. Must be 2-255 chars, start/end with alphanumeric, only allow `a-zA-Z0-9_-/.@`. Default `false`. |
 | disable_copilot_system_to_assistant | boolean | **DEPRECATED** - GitHub Copilot API supports system prompts. |
 
 ### general_settings - Reference
@@ -354,7 +355,7 @@ router_settings:
 | set_verbose | boolean | [DEPRECATED PARAM - see debug docs](./debugging) If true, sets the logging level to verbose. |
 | retry_after | int | Time to wait before retrying a request in seconds. Defaults to 0. If `x-retry-after` is received from LLM API, this value is overridden. |
 | provider_budget_config | ProviderBudgetConfig | Provider budget configuration. Use this to set llm_provider budget limits. example $100/day to OpenAI, $100/day to Azure, etc. Defaults to None. [Further Docs](./provider_budget_routing.md) |
-| enable_pre_call_checks | boolean | If true, checks if a call is within the model's context window before making the call. [More information here](reliability) |
+| enable_pre_call_checks | boolean | If true, checks if a call is within the model's context window before making the call. **Required** for `model_info.max_input_tokens` enforcement. Default: false. [More information here](reliability) |
 | model_group_retry_policy | Dict[str, RetryPolicy] | [SDK-only arg] Set retry policy for model groups. |
 | context_window_fallbacks | List[Dict[str, List[str]]] | Fallback models for context window violations. |
 | redis_url | str | URL for Redis server. **Known performance issue with Redis URL.** |
@@ -803,6 +804,7 @@ router_settings:
 | PYROSCOPE_SERVER_ADDRESS | Pyroscope server URL to send profiles to. Required when LITELLM_ENABLE_PYROSCOPE is true. No default.
 | PYROSCOPE_SAMPLE_RATE | Optional. Sample rate for Pyroscope profiling (integer). No default; when unset, the pyroscope-io library default is used.
 | LITELLM_MASTER_KEY | Master key for proxy authentication
+| LITELLM_MAX_BUDGET_PER_SESSION_TTL | TTL in seconds for session budget counters used by the max-budget-per-session limiter. Default is 3600 (1 hour)
 | LITELLM_MAX_ITERATIONS_TTL | TTL in seconds for session iteration counters used by the max-iterations limiter. Default is 3600 (1 hour)
 | LITELLM_MAX_STREAMING_DURATION_SECONDS | Maximum duration in seconds allowed for a streaming response. Streams exceeding this duration are terminated with a Timeout error. Default is None (no limit)
 | LITELLM_MODE | Operating mode for LiteLLM (e.g., production, development)
@@ -815,6 +817,7 @@ router_settings:
 | LITELLM_TOKEN | Access token for LiteLLM integration
 | LITELLM_USE_CHAT_COMPLETIONS_URL_FOR_ANTHROPIC_MESSAGES | When set to "true", routes OpenAI /v1/messages requests through chat/completions instead of the Responses API for Anthropic models. Can also be set via `litellm_settings.use_chat_completions_url_for_anthropic_messages`
 | LITELLM_USER_AGENT | Custom user agent string for LiteLLM API requests. Used for partner telemetry attribution
+| LITELLM_WORKER_STARTUP_HOOKS | Comma-separated list of `module.path:function_name` callables to run in each worker process during startup. Runs early in the worker lifecycle (before config/DB loading). Useful for re-initializing per-process state like [gflags](https://github.com/google/python-gflags). See [Worker Startup Hooks](/proxy/worker_startup_hooks) for details
 | LITELLM_PRINT_STANDARD_LOGGING_PAYLOAD | If true, prints the standard logging payload to the console - useful for debugging
 | LITELM_ENVIRONMENT | Environment for LiteLLM Instance. This is currently only logged to DeepEval to determine the environment for DeepEval integration.
 | LITELLM_ASYNCIO_QUEUE_MAXSIZE | Maximum size for asyncio queues (e.g. log queues, spend update queues, and cookbook examples such as realtime audio in `nova_sonic_realtime.py`). Bounds in-memory growth to prevent OOM. Default is 1000.
@@ -918,6 +921,7 @@ router_settings:
 | PRISMA_HEALTH_WATCHDOG_INTERVAL_SECONDS | Interval in seconds for Prisma health watchdog probes. Default is 30
 | PRISMA_HEALTH_WATCHDOG_PROBE_TIMEOUT_SECONDS | Timeout in seconds for each Prisma health probe. Default is 5.0
 | PRISMA_RECONNECT_COOLDOWN_SECONDS | Cooldown in seconds between Prisma reconnection attempts. Default is 15
+| PRISMA_RECONNECT_ESCALATION_THRESHOLD | Number of consecutive reconnect failures before escalating the reconnection strategy. Default is 3
 | PRISMA_WATCHDOG_RECONNECT_TIMEOUT_SECONDS | Timeout in seconds for Prisma watchdog-initiated reconnection. Default is 30.0
 | PREDIBASE_API_BASE | Base URL for Predibase API
 | PRESIDIO_ANALYZER_API_BASE | Base URL for Presidio Analyzer service
@@ -940,6 +944,7 @@ router_settings:
 | QDRANT_URL | Connection URL for Qdrant database
 | QDRANT_VECTOR_SIZE | Vector size for Qdrant operations. Default is 1536
 | REDIS_CONNECTION_POOL_TIMEOUT | Timeout in seconds for Redis connection pool. Default is 5
+| REDIS_CLUSTER_NODES | JSON-formatted list of Redis cluster startup nodes for Redis Cluster mode. Example: '[{"host": "node1", "port": 6379}]'
 | REDIS_HOST | Hostname for Redis server
 | REDIS_PASSWORD | Password for Redis service
 | REDIS_PORT | Port number for Redis server

docs/my-website/docs/proxy/cost_tracking.md

@@ -8,6 +8,8 @@ Track spend for keys, users, and teams across 100+ LLMs.
 
 LiteLLM automatically tracks spend for all known models. See our [model cost map](https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json)
 
+Provider-specific cost tracking (e.g., [Vertex AI PayGo / priority pricing](../providers/vertex.md#paygo--priority-cost-tracking), [Bedrock service tiers](../providers/bedrock.md#usage---service-tier), [Azure base model mapping](./custom_pricing.md#set-base_model-for-cost-tracking-eg-azure-deployments)) is applied automatically when the response includes tier metadata.
+
 :::tip Keep Pricing Data Updated
 [Sync model pricing data from GitHub](./sync_models_github.md) to ensure accurate cost tracking.
 :::

docs/my-website/docs/proxy/custom_pricing.md

@@ -104,9 +104,18 @@ There are other keys you can use to specify costs for different scenarios and mo
 - `input_cost_per_video_per_second` - Cost per second of video input
 - `input_cost_per_video_per_second_above_128k_tokens` - Video cost for large contexts
 - `input_cost_per_character` - Character-based pricing for some providers
+- `input_cost_per_token_priority` / `output_cost_per_token_priority` - Priority/PayGo pricing (Vertex AI Gemini, Bedrock)
+- `input_cost_per_token_flex` / `output_cost_per_token_flex` - Batch/flex pricing
 
 These keys evolve based on how new models handle multimodality. The latest version can be found at [https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json](https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json).
 
+### Service Tier / PayGo Pricing (Vertex AI, Bedrock)
+
+For providers that support multiple pricing tiers (e.g., Vertex AI PayGo, Bedrock service tiers), LiteLLM automatically applies the correct cost based on the response:
+
+- **Vertex AI Gemini**: Uses `usageMetadata.trafficType` (`ON_DEMAND_PRIORITY` → priority, `FLEX`/`BATCH` → flex). See [Vertex AI - PayGo / Priority Cost Tracking](../providers/vertex.md#paygo--priority-cost-tracking).
+- **Bedrock**: Uses `serviceTier` from the response. See [Bedrock - Usage - Service Tier](../providers/bedrock.md#usage---service-tier).
+
 ## Zero-Cost Models (Bypass Budget Checks)
 
 **Use Case**: You have on-premises or free models that should be accessible even when users exceed their budget limits.

docs/my-website/docs/proxy/custom_sso.md

@@ -121,15 +121,14 @@ Use this if you want to run your own code **after** a user signs on to the LiteL
 Make sure the response type follows the `SSOUserDefinedValues` pydantic object. This is used for logging the user into the Admin UI:
 
 ```python
-from fastapi import Request
 from fastapi_sso.sso.base import OpenID
 
 from litellm.proxy._types import LitellmUserRoles, SSOUserDefinedValues
-from litellm.proxy.management_endpoints.internal_user_endpoints import (
-    new_user,
-    user_info,
-)
-from litellm.proxy.management_endpoints.team_endpoints import add_new_member
+from litellm.proxy import proxy_server
+
+# These imports are available if you need to create users or manage team membership:
+# from litellm.proxy.management_endpoints.internal_user_endpoints import new_user
+# from litellm.proxy.management_endpoints.team_endpoints import add_new_member
 
 
 async def custom_sso_handler(userIDPInfo: OpenID) -> SSOUserDefinedValues:
@@ -158,8 +157,9 @@ async def custom_sso_handler(userIDPInfo: OpenID) -> SSOUserDefinedValues:
         #################################################
         # Run your custom code / logic here
         # check if user exists in litellm proxy DB
-        _user_info = await user_info(user_id=userIDPInfo.id)
-        print("_user_info from litellm DB ", _user_info)  # noqa
+        if proxy_server.prisma_client is not None:
+            _user_info = await proxy_server.prisma_client.get_data(user_id=userIDPInfo.id)
+            print("_user_info from litellm DB ", _user_info)  # noqa
         #################################################
 
         return SSOUserDefinedValues(

docs/my-website/docs/proxy/dynamic_rate_limit.md

@@ -3,6 +3,8 @@
 
 Prevent projects from gobbling too much tpm/rpm.
 
+**See Also:** [Request Prioritization](../scheduler.md) - Prioritize LLM API requests in high-traffic by adding them to a priority queue.
+
 Dynamically allocate TPM/RPM quota to api keys, based on active keys in that minute. [**See Code**](https://github.com/BerriAI/litellm/blob/9bffa9a48e610cc6886fc2dce5c1815aeae2ad46/litellm/proxy/hooks/dynamic_rate_limiter.py#L125)
 
 ## Quick Start Usage

docs/my-website/docs/proxy/forward_client_headers.md

@@ -112,6 +112,8 @@ general_settings:
   forward_llm_provider_auth_headers: true  # Enable BYOK
 ```
 
+For **Claude Code** with `/login` and your own Anthropic key, see [Claude Code BYOK](../tutorials/claude_code_byok.md). Use `ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: sk-12345"` to pass your LiteLLM key while your Anthropic key (from `/login`) is forwarded as `x-api-key`.
+
 Client request:
 ```bash
 curl -X POST "http://localhost:4000/v1/messages" \

docs/my-website/docs/proxy/guardrails/quick_start.md

@@ -497,7 +497,7 @@ curl --location 'http://0.0.0.0:4000/chat/completions' \
 
 Run guardrails based on the user-agent header. This is useful for running pre-call checks on OpenWebUI but only masking in logs for Claude CLI.
 
-`default` can be a single mode string or a list of modes.
+Both `default` and tag values can be a single mode string or a list of modes.
 
 <Tabs>
 <TabItem value="single" label="Single Default Mode">
@@ -545,6 +545,29 @@ guardrails:
       default_on: true
 ```
 
+</TabItem>
+<TabItem value="tag-list" label="Multiple Tag Modes">
+
+```yaml
+model_list:
+  - model_name: gpt-3.5-turbo
+    litellm_params:
+      model: gpt-3.5-turbo
+      api_key: os.environ/OPENAI_API_KEY
+
+guardrails:
+  - guardrail_name: "guardrails_ai-guard"
+    litellm_params:
+      guardrail: guardrails_ai
+      guard_name: "pii_detect"
+      mode:
+        tags:
+            "User-Agent: claude-cli": ["pre_call", "post_call"]  # Run both pre and post call for claude-cli
+        default: "logging_only"  # Default to logging only when no tags match
+      api_base: os.environ/GUARDRAILS_AI_API_BASE
+      default_on: true
+```
+
 </TabItem>
 </Tabs>
 
@@ -669,7 +692,7 @@ guardrails:
 
 Mode Specification
 
-`default` accepts either a single string or a list of strings.
+Both `default` and tag values accept either a single string or a list of strings.
 
 ```python
 from litellm.types.guardrails import Mode
@@ -685,6 +708,12 @@ mode = Mode(
     tags={"User-Agent: claude-cli": "logging_only"},
     default=["pre_call", "post_call"]
 )
+
+# Multiple modes on a tag value
+mode = Mode(
+    tags={"User-Agent: claude-cli": ["pre_call", "post_call"]},
+    default="logging_only"
+)
 ```
 
 ### `guardrails` Request Parameter

docs/my-website/docs/proxy/guardrails/team_based_guardrails.md

@@ -1,6 +1,6 @@
 import Image from '@theme/IdealImage';
 
-# Team-Based Guardrails
+# Team Bring-Your-Own Guardrails
 
 Team-based guardrails let **developers** register a guardrail for their team via the API; an **admin** then reviews and approves or rejects it in the LiteLLM UI. Only [Generic Guardrail API](/docs/adding_provider/generic_guardrail_api) guardrails can be registered this way.
 

docs/my-website/docs/proxy/reliability.md

@@ -713,6 +713,34 @@ curl -X POST 'http://0.0.0.0:4000/chat/completions' \
 
 [**See Code**](https://github.com/BerriAI/litellm/blob/c9e6b05cfb20dfb17272218e2555d6b496c47f6f/litellm/router.py#L2163)
 
+:::important
+**`enable_pre_call_checks` is required** for context-window enforcement. Without it, requests are sent to the provider regardless of input token count. Set `enable_pre_call_checks: true` in `router_settings` in your config.
+:::
+
+#### Custom max_input_tokens per deployment
+
+You can override the default context limit for a deployment by setting `max_input_tokens` in `model_info`. This is useful for testing, rate-limiting long prompts, or enforcing stricter limits than the provider's default.
+
+**Both** of the following are required:
+
+1. **`router_settings.enable_pre_call_checks: true`** — enables pre-call checks
+2. **`model_info.max_input_tokens`** on the deployment — overrides the limit for that model
+
+```yaml
+router_settings:
+  enable_pre_call_checks: true  # Required for enforcement
+
+model_list:
+  - model_name: gpt-4o
+    litellm_params:
+      model: openai/gpt-4o
+      api_key: os.environ/OPENAI_API_KEY
+    model_info:
+      max_input_tokens: 10  # Override: reject prompts > 10 tokens
+```
+
+If a request exceeds the limit, LiteLLM raises `ContextWindowExceededError` with details like `Model=gpt-4o, Max Input Tokens=10, Got=306`.
+
 **1. Setup config**
 
 For azure deployments, set the base model. Pick the base model from [this list](https://github.com/BerriAI/litellm/blob/main/model_prices_and_context_window.json), all the azure models start with azure/.

docs/my-website/docs/proxy/token_auth.md

@@ -1054,6 +1054,95 @@ curl -X GET 'http://0.0.0.0:4000/user/info?user_id=user-123' \
 -H 'Authorization: Bearer <PROXY_MASTER_KEY>'
 ```
 
+## [BETA] JWT-to-Virtual-Key Mapping
+
+Map JWT identities to LiteLLM virtual keys so that JWT-authenticated users get per-user budgets, rate limits, model access controls, and spend tracking.
+
+When a JWT comes in, LiteLLM looks up a configured claim (e.g. `email`, `sub`) in a mapping table. If a mapping exists, the request is treated as if it arrived with the corresponding virtual key — all virtual key features apply.
+
+### Setup
+
+Add `virtual_key_claim_field` to your JWT auth config:
+
+```yaml
+general_settings:
+  enable_jwt_auth: True
+  litellm_jwtauth:
+    virtual_key_claim_field: "email"         # JWT claim to look up (supports dot notation)
+    virtual_key_mapping_cache_ttl: 300       # Cache TTL in seconds (default: 300)
+```
+
+### Managing Mappings
+
+All endpoints require admin auth (`Authorization: Bearer <master_key>`).
+
+**Create a mapping** — link a JWT claim value to an existing virtual key:
+
+```bash
+curl -X POST http://localhost:4000/jwt/key/mapping/new \
+  -H "Authorization: Bearer sk-1234" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "jwt_claim_name": "email",
+    "jwt_claim_value": "user@example.com",
+    "key": "sk-virtual-key-from-key-generate"
+  }'
+```
+
+**List mappings** (paginated):
+
+```bash
+curl http://localhost:4000/jwt/key/mapping/list?page=1&size=50 \
+  -H "Authorization: Bearer sk-1234"
+```
+
+**Get a specific mapping:**
+
+```bash
+curl "http://localhost:4000/jwt/key/mapping/info?id=<mapping-id>" \
+  -H "Authorization: Bearer sk-1234"
+```
+
+**Update a mapping:**
+
+```bash
+curl -X POST http://localhost:4000/jwt/key/mapping/update \
+  -H "Authorization: Bearer sk-1234" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "id": "<mapping-id>",
+    "description": "Updated description",
+    "is_active": true
+  }'
+```
+
+**Delete a mapping:**
+
+```bash
+curl -X POST http://localhost:4000/jwt/key/mapping/delete \
+  -H "Authorization: Bearer sk-1234" \
+  -H "Content-Type: application/json" \
+  -d '{"id": "<mapping-id>"}'
+```
+
+### How It Works
+
+1. A request arrives with a JWT bearer token
+2. LiteLLM validates the JWT signature
+3. Extracts the configured claim (e.g. `email` → `user@example.com`)
+4. Looks up the claim value in the `LiteLLM_JWTKeyMapping` table
+5. If a mapping exists, the request proceeds as if the mapped virtual key was used — budgets, rate limits, model access, and spend tracking all apply
+6. If no mapping exists, falls back to standard JWT auth (team-level controls)
+
+### Error Codes
+
+| Code | Meaning |
+|------|---------|
+| 409 | Duplicate mapping — a mapping for that claim name + value already exists |
+| 400 | The provided key does not match an existing virtual key |
+| 404 | Mapping not found (for update/delete/info) |
+| 403 | Non-admin user attempted a mapping operation |
+
 ## All JWT Params
 
 [**See Code**](https://github.com/BerriAI/litellm/blob/b204f0c01c703317d812a1553363ab0cb989d5b6/litellm/proxy/_types.py#L95)

docs/my-website/docs/proxy/users.md

@@ -10,6 +10,8 @@ import TabItem from '@theme/TabItem';
 
 **Team member budgets**: Set individual spending limits within the team's shared budget
 
+**Agent budgets**: Set rate limits (tpm/rpm) and session-level caps (iterations, dollar budget) on agents [**Jump**](#agents)
+
 ***If a key belongs to a team, the team budget is applied, not the user's personal budget.***
 :::
 
@@ -420,6 +422,109 @@ Expected response on failure
 </Tabs>
 
 
+### Agents
+
+Set budgets and rate limits on agents registered with LiteLLM's [Agent Gateway](../a2a.md). You can control:
+- **Per-agent rate limits**: `tpm_limit` and `rpm_limit` on the agent itself
+- **Per-session rate limits**: `session_tpm_limit` and `session_rpm_limit` applied per session
+- **Per-session iteration cap**: `max_iterations` in agent `litellm_params`
+- **Per-session budget cap**: `max_budget_per_session` in agent `litellm_params`
+
+<Tabs>
+<TabItem value="agent-rate-limits" label="Agent Rate Limits">
+
+Set `tpm_limit` and `rpm_limit` on the agent to cap total throughput across all sessions.
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "tpm_limit": 100000,
+    "rpm_limit": 100
+  }'
+```
+
+</TabItem>
+<TabItem value="session-rate-limits" label="Session Rate Limits">
+
+Set `session_tpm_limit` and `session_rpm_limit` to cap throughput per individual session.
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "session_tpm_limit": 50000,
+    "session_rpm_limit": 50
+  }'
+```
+
+</TabItem>
+<TabItem value="session-budgets" label="Session Budgets">
+
+Set `max_iterations` and `max_budget_per_session` in agent `litellm_params` to cap individual sessions. Requires `require_trace_id_on_calls_by_agent` so LiteLLM can track calls per session.
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_by_agent": true,
+      "max_iterations": 25,
+      "max_budget_per_session": 5.00
+    }
+  }'
+```
+
+When a session exceeds the limit, requests receive a **429 Too Many Requests** response.
+
+See the [Agent Iteration Budgets](../a2a_iteration_budgets) guide for full details.
+
+</TabItem>
+</Tabs>
+
+:::info
+
+You can also update rate limits on existing agents using `PATCH /v1/agents/{agent_id}`:
+
+```bash
+curl -X PATCH 'http://localhost:4000/v1/agents/<agent_id>' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "tpm_limit": 200000,
+    "rpm_limit": 200,
+    "session_tpm_limit": 50000,
+    "session_rpm_limit": 50
+  }'
+```
+
+:::
+
+
 ### Customers
 
 Use this to budget `user` passed to `/chat/completions`, **without needing to create a key for every user**
@@ -685,6 +790,31 @@ These headers indicate:
 - 1 request remaining for the GPT-4 model for key=`sk-ulGNRXWtv7M0lFnnsQk0wQ`
 - 179 tokens remaining for the GPT-4 model for key=`sk-ulGNRXWtv7M0lFnnsQk0wQ`
 
+</TabItem>
+<TabItem value="per-agent" label="Per Agent">
+
+Set rate limits on agents registered with the [Agent Gateway](../a2a.md).
+
+**Agent-level limits** cap total throughput across all sessions:
+
+```shell
+curl -X POST 'http://0.0.0.0:4000/v1/agents' \
+--header 'Authorization: Bearer sk-1234' \
+--header 'Content-Type: application/json' \
+--data '{"agent_name": "my-agent", "agent_card_params": {"name": "my-agent", "description": "My agent", "url": "http://my-agent:8080", "version": "1.0.0"}, "tpm_limit": 100000, "rpm_limit": 100}'
+```
+
+**Session-level limits** cap throughput per individual session:
+
+```shell
+curl -X POST 'http://0.0.0.0:4000/v1/agents' \
+--header 'Authorization: Bearer sk-1234' \
+--header 'Content-Type: application/json' \
+--data '{"agent_name": "my-agent", "agent_card_params": {"name": "my-agent", "description": "My agent", "url": "http://my-agent:8080", "version": "1.0.0"}, "session_tpm_limit": 50000, "session_rpm_limit": 50}'
+```
+
+You can also set **max_iterations** (call count cap) and **max_budget_per_session** (dollar cap) per session via `litellm_params`. See [Agent Iteration Budgets](../a2a_iteration_budgets) for details.
+
 </TabItem>
 <TabItem value="per-end-user" label="For customers">
 

docs/my-website/docs/proxy/worker_startup_hooks.md

@@ -0,0 +1,155 @@
+# Worker Startup Hooks
+
+Use `LITELLM_WORKER_STARTUP_HOOKS` to run custom initialization functions in **each worker process** during proxy startup. This is essential when using multi-worker deployments (`--num_workers > 1`) with libraries that require per-process initialization, such as [gflags](https://github.com/google/python-gflags).
+
+## The Problem
+
+When running the LiteLLM proxy with multiple workers:
+
+```bash
+litellm --config config.yaml --num_workers 4
+```
+
+Each worker is a **separate process** spawned by uvicorn or gunicorn. Any in-process state initialized in the master process (before `run_server()`) is **not available** in worker processes. This includes:
+
+- [python-gflags](https://github.com/google/python-gflags) (`gflags.FLAGS`)
+- [absl-py flags](https://abseil.io/docs/python/guides/flags) (`absl.flags.FLAGS`)
+- Custom singleton registries or connection pools
+- Any module-level state that requires explicit initialization
+
+## Usage
+
+Set the `LITELLM_WORKER_STARTUP_HOOKS` environment variable to a comma-separated list of `module.path:function_name` callables:
+
+```bash
+export LITELLM_WORKER_STARTUP_HOOKS="my_module:my_init_function"
+```
+
+Each hook is called **early** in the worker startup lifecycle — before config loading, database setup, or any request handling. Both sync and async functions are supported.
+
+## Example: gflags Initialization
+
+### 1. Define your wrapper module
+
+```python title="my_litellm_wrapper.py"
+import gflags
+import json
+import os
+import sys
+from typing import Optional, List, Any
+
+
+def init_gflags(
+    usage: Optional[Any] = None,
+    raw_args: Optional[List[str]] = None,
+    known_only: bool = False,
+) -> List[str]:
+    """Initialize gflags from command-line arguments."""
+    try:
+        gflags.FLAGS.set_gnu_getopt(True)
+        if raw_args is None:
+            raw_args = sys.argv
+        argv = gflags.FLAGS(raw_args, known_only=known_only)
+    except gflags.Error as e:
+        if usage is None:
+            print("%s\nUsage: %s ARGS\n%s" % (e, sys.argv[0], gflags.FLAGS))
+        else:
+            print(usage % dict(cmd=sys.argv[0], flags=gflags.FLAGS))
+        sys.exit(1)
+    return argv
+
+
+def init_gflags_for_worker():
+    """Re-initialize gflags in each worker process.
+
+    Reads the original sys.argv from the GFLAGS_ARGV env var
+    (set by the master process before starting the proxy).
+    """
+    raw_args = json.loads(os.environ.get("GFLAGS_ARGV", "[]")) or sys.argv
+    init_gflags(raw_args=raw_args, known_only=True)
+```
+
+### 2. Start the proxy
+
+```python title="start_proxy.py"
+import json
+import os
+import sys
+
+from my_litellm_wrapper import init_gflags
+
+# Store sys.argv so workers can re-parse the same flags
+os.environ["GFLAGS_ARGV"] = json.dumps(sys.argv)
+
+# Tell LiteLLM to call our hook in each worker
+os.environ["LITELLM_WORKER_STARTUP_HOOKS"] = "my_litellm_wrapper:init_gflags_for_worker"
+
+# Initialize gflags in the master process
+init_gflags()
+
+# Start the proxy (programmatic invocation)
+from litellm.proxy.proxy_cli import run_server
+
+run_server(
+    ["--config", "config.yaml", "--num_workers", "4"],
+    standalone_mode=False,
+)
+```
+
+Or via shell:
+
+```bash
+export GFLAGS_ARGV='["my_app", "--my_flag=value", "--batch_size=32"]'
+export LITELLM_WORKER_STARTUP_HOOKS="my_litellm_wrapper:init_gflags_for_worker"
+
+litellm --config config.yaml --num_workers 4
+```
+
+## How It Works
+
+```
+Master Process                          Worker Process (×N)
+─────────────────                       ──────────────────────
+1. init_gflags()                        3. proxy_startup_event():
+2. run_server()                            → Read LITELLM_WORKER_STARTUP_HOOKS
+   → sets env vars                         → Import & call each hook
+   → uvicorn.run(workers=N)                  (gflags.FLAGS re-initialized ✓)
+   → spawns workers ──────────────────►    → Continue with config/DB setup
+                                           → Ready to serve requests
+```
+
+- Hooks run at the **very beginning** of `proxy_startup_event` (the FastAPI lifespan), before config loading, database connections, or any other initialization.
+- Environment variables set in the master process are **inherited** by worker processes (standard Unix fork/spawn behavior).
+- If a hook **raises an exception**, the worker fails to start — this is intentional, since missing initialization (e.g., uninitialized gflags) would cause downstream errors.
+
+## Multiple Hooks
+
+Separate multiple hooks with commas:
+
+```bash
+export LITELLM_WORKER_STARTUP_HOOKS="my_module:init_gflags,my_module:init_metrics,my_module:init_connections"
+```
+
+Hooks are executed **in order**, left to right.
+
+## Async Hooks
+
+Async functions are also supported — they are automatically awaited:
+
+```python
+async def init_async_connections():
+    """Example async hook for initializing async resources."""
+    await setup_async_connection_pool()
+```
+
+```bash
+export LITELLM_WORKER_STARTUP_HOOKS="my_module:init_async_connections"
+```
+
+## Reference
+
+| Environment Variable | Description |
+|---|---|
+| `LITELLM_WORKER_STARTUP_HOOKS` | Comma-separated `module.path:function_name` callables to run in each worker on startup |
+
+The hook format follows the standard Python entry point syntax: `module.path:function_name`, where `module.path` is a dotted Python import path and `function_name` is the name of the callable within that module.

docs/my-website/docs/reasoning_content.md

@@ -592,6 +592,12 @@ Expected Response
 </TabItem>
 </Tabs>
 
+:::tip gpt-5.4: reasoning_effort + function tools
+
+OpenAI does not support `reasoning_effort` with function tools for `gpt-5.4` in `/v1/chat/completions`. Use `openai/responses/gpt-5.4` to route through the Responses API instead. See [Responses API Bridge](/docs/providers/openai#openai-chat-completion-to-responses-api-bridge) for details.
+
+:::
+
 ## OpenAI Responses API - Auto-Summary Control
 
 When using OpenAI Responses API models (like `gpt-5`) via `/chat/completions` with `reasoning_effort`, you can control whether `summary="detailed"` is automatically added to the reasoning parameter.

docs/my-website/docs/search/index.md

@@ -2,7 +2,7 @@
 
 | Feature | Supported | 
 |---------|-----------|
-| Supported Providers | `perplexity`, `tavily`, `parallel_ai`, `exa_ai`, `brave`, `google_pse`, `dataforseo`, `firecrawl`, `searxng`, `linkup`, `duckduckgo`, `searchapi` |
+| Supported Providers | `perplexity`, `tavily`, `parallel_ai`, `exa_ai`, `brave`, `google_pse`, `dataforseo`, `firecrawl`, `searxng`, `linkup`, `duckduckgo`, `searchapi`, `serper` |
 | Cost Tracking | ✅ |
 | Logging | ✅ |
 | Load Balancing | ❌ |
@@ -210,7 +210,7 @@ See the [official Perplexity Search documentation](https://docs.perplexity.ai/ap
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
 | `query` | string or array | Yes | Search query. Can be a single string or array of strings |
-| `search_provider` | string | Yes (SDK) | The search provider to use: `"perplexity"`, `"tavily"`, `"parallel_ai"`, `"exa_ai"`, `"brave"`, `"google_pse"`, `"dataforseo"`, `"firecrawl"`, `"searxng"`, `"linkup"`, `"duckduckgo"`, or `"searchapi"` |
+| `search_provider` | string | Yes (SDK) | The search provider to use: `"perplexity"`, `"tavily"`, `"parallel_ai"`, `"exa_ai"`, `"brave"`, `"google_pse"`, `"dataforseo"`, `"firecrawl"`, `"searxng"`, `"linkup"`, `"duckduckgo"`, `"searchapi"`, or `"serper"` |
 | `search_tool_name` | string | Yes (Proxy) | Name of the search tool configured in `config.yaml` |
 | `max_results` | integer | No | Maximum number of results to return (1-20). Default: 10 |
 | `search_domain_filter` | array | No | List of domains to filter results (max 20 domains) |
@@ -276,6 +276,7 @@ The response follows Perplexity's search format with the following structure:
 | Firecrawl | `FIRECRAWL_API_KEY` | `firecrawl` |
 | SearXNG | `SEARXNG_API_BASE` (required) | `searxng` |
 | Linkup | `LINKUP_API_KEY` | `linkup` |
+| Serper | `SERPER_API_KEY` | `serper` |
 | DuckDuckGo | `DUCKDUCKGO_API_BASE` | `duckduckgo` |
 | SearchAPI.io | `SEARCHAPI_API_KEY` | `searchapi` |
 

docs/my-website/docs/search/serper.md

@@ -0,0 +1,77 @@
+# Serper Search
+
+**Get API Key:** [https://serper.dev](https://serper.dev)
+
+## LiteLLM Python SDK
+
+```python showLineNumbers title="Serper Search"
+import os
+from litellm import search
+
+os.environ["SERPER_API_KEY"] = "your-api-key"
+
+response = search(
+    query="latest AI developments",
+    search_provider="serper",
+    max_results=5
+)
+```
+
+## LiteLLM AI Gateway
+
+### 1. Setup config.yaml
+
+```yaml showLineNumbers title="config.yaml"
+model_list:
+  - model_name: gpt-5
+    litellm_params:
+      model: gpt-5
+      api_key: os.environ/OPENAI_API_KEY
+
+search_tools:
+  - search_tool_name: serper-search
+    litellm_params:
+      search_provider: serper
+      api_key: os.environ/SERPER_API_KEY
+```
+
+### 2. Start the proxy
+
+```bash
+litellm --config /path/to/config.yaml
+
+# RUNNING on http://0.0.0.0:4000
+```
+
+### 3. Test the search endpoint
+
+```bash showLineNumbers title="Test Request"
+curl http://0.0.0.0:4000/v1/search/serper-search \
+  -H "Authorization: Bearer sk-1234" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "query": "latest AI developments",
+    "max_results": 5
+  }'
+```
+
+## Provider-specific Parameters
+
+```python showLineNumbers title="Serper Search with Provider-specific Parameters"
+import os
+from litellm import search
+
+os.environ["SERPER_API_KEY"] = "your-api-key"
+
+response = search(
+    query="latest tech news",
+    search_provider="serper",
+    max_results=10,
+    # Serper-specific parameters
+    gl="us",                    # Country/geolocation code
+    hl="en",                    # Language code
+    autocorrect=False,          # Disable autocorrect
+    tbs="qdr:d",               # Time filter: past day ('qdr:h' hour, 'qdr:w' week, 'qdr:m' month)
+    page=2                      # Page number
+)
+```

docs/my-website/docs/troubleshoot/pip_venv_upgrade.md

@@ -0,0 +1,121 @@
+# Upgrading LiteLLM Proxy (pip/venv)
+
+Guide for upgrading LiteLLM Proxy when installed via pip in a virtual environment.
+
+:::info Important
+Always activate your virtual environment before running any `litellm` or `prisma` commands. All commands in this guide assume you're working inside an activated venv.
+:::
+
+## How pip/venv Upgrades Work
+
+There are two pieces that need to stay in sync:
+
+1. **Prisma client** - Generated Python code that talks to the DB
+2. **DB schema** - Tables/columns in PostgreSQL
+
+When you upgrade via pip, the `litellm-proxy-extras` package ships with a new `schema.prisma` and a `migrations/` directory. But unlike the Docker image, pip install does NOT automatically regenerate the Prisma client or run migrations. You have to do both manually.
+
+## Upgrade Workflow (pip/venv)
+
+### 1. Stop the proxy
+
+Stop your running LiteLLM proxy instance.
+
+### 2. (Optional) Back up your DB
+
+```bash
+pg_dump -h <host> -U <user> -d <db> -F c -f backup_$(date +%Y%m%d).dump
+```
+
+### 3. Upgrade the package
+
+```bash
+pip install 'litellm[proxy]==<version>'
+```
+
+### 4. Regenerate the Prisma client
+
+```bash
+prisma generate --schema <venv>/lib/python<version>/site-packages/litellm_proxy_extras/schema.prisma
+```
+
+Replace `<venv>` with your virtual environment path and `<version>` with your Python version (e.g., `python3.11`, `python3.12`, `python3.13`).
+
+### 5. Apply DB migrations
+
+You have two options:
+
+**Option A: Just start the proxy** (simplest)
+
+The proxy automatically runs `prisma migrate deploy` on startup, which applies any new migrations.
+
+First, activate your virtual environment:
+
+```bash
+source <venv>/bin/activate
+```
+
+Then start the proxy:
+
+```bash
+litellm --config your_config.yaml --port 4000
+```
+
+**Option B: Run manually before starting**
+
+Activate your virtual environment first:
+
+```bash
+source <venv>/bin/activate
+```
+
+Then run the migration with the explicit schema path:
+
+```bash
+prisma migrate deploy --schema <venv>/lib/python<version>/site-packages/litellm_proxy_extras/schema.prisma
+```
+
+Replace `<venv>` with your virtual environment path and `<version>` with your Python version (e.g., `python3.11`, `python3.12`, `python3.13`).
+
+### 6. Start the proxy
+
+If you used Option B above, now start the proxy (with venv still activated):
+
+```bash
+litellm --config your_config.yaml --port 4000
+```
+
+## How to Verify Migrations
+
+> **Note:** `<schema-path>` = `<venv>/lib/python<version>/site-packages/litellm_proxy_extras/schema.prisma`
+
+### Before applying migrations: Preview what will change
+
+Run `pip install 'litellm[proxy]==<version>'` first (Step 3) so the new `schema.prisma` is available.
+
+```bash
+prisma migrate diff \
+  --from-url $DATABASE_URL \
+  --to-schema-datamodel <schema-path> \
+  --script
+```
+
+### After applying migrations: Check status
+
+```bash
+prisma migrate status --schema <schema-path>
+```
+
+All migrations should have a `finished_at` timestamp and no `rolled_back_at`.
+
+## Key Things to Know
+
+- **`DISABLE_SCHEMA_UPDATE=true`** env var prevents auto-migration on startup - useful if you want full manual control
+
+- **`prisma db push`** is the nuclear option: force-syncs the DB to match the schema, bypassing migration history. Safe when all changes are additive (new columns/tables), but always have a backup.
+
+- **The `schema.prisma` inside `litellm_proxy_extras` is the source of truth** - always use that one, not one from a different version or from the git repo
+
+## Troubleshooting
+
+If you encounter migration errors, see the [Prisma Migration Troubleshooting Guide](./prisma_migrations).

docs/my-website/docs/tutorials/claude_code_byok.md

@@ -0,0 +1,123 @@
+# Claude Code with Bring Your Own Key (BYOK)
+
+Use Claude Code with your own Anthropic API key through the LiteLLM proxy. When you use Claude's `/login` with your Anthropic account, your API key is sent as `x-api-key`. With BYOK enabled, LiteLLM forwards your key to Anthropic instead of using proxy-configured keys — so you pay Anthropic directly while still benefiting from LiteLLM's routing, logging, and guardrails.
+
+## How It Works
+
+1. **Claude Code `/login`** — You sign in with your Anthropic account; Claude Code sends your Anthropic API key as `x-api-key`.
+2. **LiteLLM authentication** — You pass your LiteLLM proxy key via `ANTHROPIC_CUSTOM_HEADERS` so the proxy can authenticate and track your usage.
+3. **Key forwarding** — With `forward_llm_provider_auth_headers: true`, LiteLLM forwards your `x-api-key` to Anthropic, giving it precedence over any proxy-configured keys.
+
+## Prerequisites
+
+- [Claude Code](https://docs.anthropic.com/en/docs/claude-code/overview) installed
+- Anthropic API key (from [console.anthropic.com](https://console.anthropic.com))
+- LiteLLM proxy with a virtual key for authentication
+
+## Step 1: Configure LiteLLM Proxy
+
+Enable forwarding of LLM provider auth headers so your Anthropic key takes precedence:
+
+```yaml title="config.yaml"
+model_list:
+  - model_name: claude-sonnet-4-5
+    litellm_params:
+      model: anthropic/claude-sonnet-4-5
+      # No api_key needed — client's key will be used
+
+litellm_settings:
+  forward_llm_provider_auth_headers: true  # Required for BYOK
+```
+
+:::info Why `forward_llm_provider_auth_headers`?
+
+By default, LiteLLM strips `x-api-key` from client requests for security. Setting this to `true` allows client-provided provider keys (like your Anthropic key from `/login`) to be forwarded to Anthropic, overriding any proxy-configured keys.
+
+:::
+
+## Step 2: Create a LiteLLM Virtual Key
+
+Create a virtual key in the LiteLLM UI or via API. 
+```bash
+# Example: Create key via API
+curl -X POST "http://localhost:4000/key/generate" \
+  -H "Authorization: Bearer sk-your-master-key" \
+  -H "Content-Type: application/json" \
+  -d '{"key_alias": "claude-code-byok", "models": ["claude-sonnet-4-5"]}'
+```
+
+## Step 3: Configure Claude Code
+
+Set environment variables so Claude Code uses LiteLLM and sends your LiteLLM key for proxy auth:
+
+```bash
+# Point Claude Code to your LiteLLM proxy
+export ANTHROPIC_BASE_URL="http://localhost:4000"
+
+# Model name from your config
+export ANTHROPIC_MODEL="claude-sonnet-4-5"
+
+# LiteLLM proxy auth — this is added to every request
+# Use x-litellm-api-key so the proxy authenticates you; your Anthropic key goes via x-api-key from /login
+export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: sk-12345"
+```
+
+Replace `sk-12345` with your actual LiteLLM virtual key.
+
+:::tip Multiple headers
+
+For multiple headers, use newline-separated values:
+
+```bash
+export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: sk-12345
+x-litellm-user-id: my-user-id"
+```
+
+:::
+
+## Step 4: Sign In with Claude Code
+
+1. Launch Claude Code:
+
+   ```bash
+   claude
+   ```
+
+2. Use **`/login`** and sign in with your Anthropic account (or use your API key directly).
+
+3. Claude Code will send:
+   - `x-api-key`: Your Anthropic API key (from `/login`)
+   - `x-litellm-api-key`: Your LiteLLM key (from `ANTHROPIC_CUSTOM_HEADERS`)
+
+4. LiteLLM authenticates you via `x-litellm-api-key`, then forwards `x-api-key` to Anthropic. Your Anthropic key takes precedence over any proxy-configured key.
+
+## Summary
+
+| Header | Source | Purpose |
+|--------|--------|---------|
+| `x-api-key` | Claude Code `/login` (Anthropic key) | Sent to Anthropic for API calls |
+| `x-litellm-api-key` | `ANTHROPIC_CUSTOM_HEADERS` | Proxy authentication, tracking, rate limits |
+
+## Troubleshooting
+
+### Requests fail with "invalid x-api-key"
+
+- Ensure `forward_llm_provider_auth_headers: true` is set in `litellm_settings` (or `general_settings`).
+- Restart the LiteLLM proxy after changing the config.
+- Verify you completed `/login` in Claude Code so your Anthropic key is being sent.
+
+### Proxy returns 401
+
+- Check that `ANTHROPIC_CUSTOM_HEADERS` includes `x-litellm-api-key: <your-key>`.
+- Ensure the LiteLLM key is valid and has access to the model.
+
+### Proxy key is used instead of my Anthropic key
+
+- Confirm `forward_llm_provider_auth_headers: true` is in your config.
+- The setting can be in `litellm_settings` or `general_settings` depending on your config structure.
+- Enable debug logging: `LITELLM_LOG=DEBUG` to see which key is being forwarded.
+
+## Related
+
+- [Forward Client Headers](./../proxy/forward_client_headers.md) — Full BYOK and header forwarding docs
+- [Claude Code Max Subscription](./claude_code_max_subscription.md) — Using Claude Code with OAuth/Max subscription through LiteLLM

docs/my-website/package.json

@@ -15,10 +15,10 @@
   },
   "dependencies": {
     "@docusaurus/core": "3.8.1",
-    "@docusaurus/plugin-google-gtag": "^3.5.2",
+    "@docusaurus/plugin-google-gtag": "3.8.1",
     "@docusaurus/plugin-ideal-image": "3.8.1",
-    "@docusaurus/preset-classic": "^3.5.2",
-    "@docusaurus/theme-mermaid": "^3.5.2",
+    "@docusaurus/preset-classic": "3.8.1",
+    "@docusaurus/theme-mermaid": "3.8.1",
     "@inkeep/cxkit-docusaurus": "^0.5.89",
     "@mdx-js/react": "^3.0.0",
     "clsx": "^1.2.1",
@@ -61,7 +61,7 @@
     "mermaid": ">=11.10.0",
     "gray-matter": "4.0.3",
     "glob": ">=11.1.0",
-    "tar": ">=7.5.8",
+    "tar": ">=7.5.10",
     "minimatch": ">=10.2.4",
     "diff": ">=8.0.3",
     "@isaacs/brace-expansion": ">=5.0.1",
@@ -93,6 +93,8 @@
     "axios": ">=0.30.2",
     "webpack": ">=5.94.0",
     "serve-static": ">=1.16.0",
-    "path-to-regexp": ">=0.1.12"
+    "path-to-regexp": ">=0.1.12",
+    "dompurify": ">=3.3.2",
+    "svgo": ">=3.3.3"
   }
 }

docs/my-website/release_notes/v1.81.14.md

@@ -1,5 +1,5 @@
 ---
-title: "[Preview] v1.81.14 - New Gateway Level Guardrails & Compliance Playground"
+title: "v1.81.14 - New Gateway Level Guardrails & Compliance Playground"
 slug: "v1-81-14"
 date: 2026-02-21T00:00:00
 authors:
@@ -27,7 +27,7 @@ import Image from '@theme/IdealImage';
 docker run \
 -e STORE_MODEL_IN_DB=True \
 -p 4000:4000 \
-ghcr.io/berriai/litellm:main-v1.81.14.rc.1
+ghcr.io/berriai/litellm:main-v1.81.14-stable
 ```
 
 </TabItem>

docs/my-website/release_notes/v1.81.9.md

@@ -279,7 +279,7 @@ Let's dive in.
     - Add HTTP support to custom code guardrails + Unified guardrails for MCP + Agent guardrail support - [PR #20619](https://github.com/BerriAI/litellm/pull/20619)
     - Custom Code Guardrails UI Playground - [PR #20377](https://github.com/BerriAI/litellm/pull/20377)
 
-- **Team-Based Guardrails**
+- **Team Bring-Your-Own Guardrails**
     - Implement team-based isolation guardrails management - [PR #20318](https://github.com/BerriAI/litellm/pull/20318)
 
 - **[OpenAI Moderations](../../docs/apply_guardrail)**

docs/my-website/release_notes/v1.82.0.md

@@ -1,5 +1,5 @@
 ---
-title: "v1.82.0 - Realtime Guardrails, Projects Management, and 10+ Performance Optimizations"
+title: "[Preview] v1.82.0 - Realtime Guardrails, Projects Management, and 10+ Performance Optimizations"
 slug: "v1-82-0"
 date: 2026-02-28T00:00:00
 authors:
@@ -46,6 +46,11 @@ pip install litellm==1.82.0
 - **Guardrail ecosystem expansion** — [Noma v2, Lakera v2 post-call, Singapore regulatory policies (PDPA + MAS), employment discrimination blockers, code execution blocker, guardrail policy versioning, and production monitoring](../../docs/proxy/guardrails) - [PR #21400](https://github.com/BerriAI/litellm/pull/21400), [PR #21783](https://github.com/BerriAI/litellm/pull/21783), [PR #21948](https://github.com/BerriAI/litellm/pull/21948)
 - **OpenAI Codex 5.3 — day 0** — [Full support for `gpt-5.3-codex` on OpenAI and Azure, plus `gpt-audio-1.5` and `gpt-realtime-1.5` model coverage](../../docs/providers/openai) - [PR #22035](https://github.com/BerriAI/litellm/pull/22035)
 - **10+ performance optimizations** — Streaming hot-path fixes, Redis pipeline batching, database task batching, ModelResponse init skip, and router cache improvements — lower latency and CPU on every request
+- **`/v1/messages` → `/responses` routing** — `/v1/messages` requests are now routed to the [Responses API](../../docs/response_api) by default for OpenAI/Azure models
+
+:::danger v1/messages routing change
+This version starts routing `/v1/messages` requests to the `/responses` API by default. To opt out and continue using chat/completions, set `LITELLM_USE_CHAT_COMPLETIONS_URL_FOR_ANTHROPIC_MESSAGES=true` or `litellm_settings.use_chat_completions_url_for_anthropic_messages: true` in your config.
+:::
 
 ---
 

docs/my-website/sidebars.js

@@ -154,6 +154,7 @@ const sidebars = {
           items: [
             "tutorials/claude_responses_api",
             "tutorials/claude_code_max_subscription",
+            "tutorials/claude_code_byok",
             "tutorials/claude_code_customer_tracking",
             "tutorials/claude_code_prompt_cache_routing",
             "tutorials/claude_code_websearch",
@@ -310,6 +311,7 @@ const sidebars = {
             "proxy/master_key_rotations",
             "proxy/model_management",
             "proxy/prod",
+            "proxy/worker_startup_hooks",
             "proxy/release_cycle",
           ],
         },
@@ -538,8 +540,10 @@ const sidebars = {
           items: [
             "a2a",
             "a2a_invoking_agents",
+            "a2a_agent_headers",
             "a2a_cost_tracking",
-            "a2a_agent_permissions"
+            "a2a_agent_permissions",
+            "a2a_iteration_budgets"
           ],
         },
         "assistants",
@@ -608,7 +612,9 @@ const sidebars = {
           items: [
             "mcp",
             "mcp_usage",
+            "mcp_openapi",
             "mcp_oauth",
+            "mcp_aws_sigv4",
             "mcp_public_internet",
             "mcp_semantic_filter",
             "mcp_control",
@@ -623,6 +629,7 @@ const sidebars = {
           items: [
             "anthropic_unified/index",
             "anthropic_unified/structured_output",
+            "anthropic_unified/messages_to_responses_mapping",
           ]
         },
         "anthropic_count_tokens",
@@ -678,6 +685,7 @@ const sidebars = {
             "search/firecrawl",
             "search/searxng",
             "search/linkup",
+            "search/serper",
           ]
         },
         "skills",
@@ -794,6 +802,7 @@ const sidebars = {
             "providers/bedrock_realtime_with_audio",
             "providers/aws_polly",
             "providers/bedrock_vector_store",
+            "providers/bedrock_mantle",
           ]
         },
         "providers/litellm_proxy",
@@ -1148,6 +1157,7 @@ const sidebars = {
             "troubleshoot/prisma_migrations",
           ],
         },
+        "troubleshoot/pip_venv_upgrade",
         "troubleshoot/rollback",
         "troubleshoot",
       ],

enterprise/litellm_enterprise/integrations/custom_guardrail.py

@@ -50,8 +50,10 @@ class EnterpriseCustomGuardrailHelper:
                     break
 
         if matched_mode is not None:
-            # Tag matched: only run if event_type matches the tag's mode value
+            # Tag matched: only run if event_type matches the tag's mode value(s)
             if event_type is not None:
+                if isinstance(matched_mode, list):
+                    return event_type.value in matched_mode
                 return event_type.value == matched_mode
             return True
 

enterprise/litellm_enterprise/proxy/common_utils/check_batch_cost.py

@@ -78,8 +78,6 @@ class CheckBatchCost:
                 "status": {"not_in": ["failed", "expired", "cancelled"]}
             }
         )
-        completed_jobs = []
-
         for job in jobs:
             # get the model from the job
             unified_object_id = job.unified_object_id
@@ -237,10 +235,16 @@ class CheckBatchCost:
                 )
 
                 # mark the job as complete
-                completed_jobs.append(job)
-
-            if len(completed_jobs) > 0:
-                await self.prisma_client.db.litellm_managedobjecttable.update_many(
-                    where={"id": {"in": [job.id for job in completed_jobs]}},
-                    data={"batch_processed": True, "status": "complete"},
-                )
+                try:
+                    await self.prisma_client.db.litellm_managedobjecttable.update(
+                        where={"id": job.id},
+                        data={
+                            "batch_processed": True,
+                            "status": "complete",
+                            "file_object": response.model_dump_json(),
+                        },
+                    )
+                except Exception as db_err:
+                    verbose_proxy_logger.error(
+                        f"CheckBatchCost: failed to mark job {job.id} complete in DB: {db_err}"
+                    )

enterprise/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "litellm-enterprise"
-version = "0.1.33"
+version = "0.1.34"
 description = "Package for LiteLLM Enterprise features"
 authors = ["BerriAI"]
 readme = "README.md"

litellm-js/spend-logs/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "dependencies": {
         "@hono/node-server": "^1.10.1",
-        "hono": "^4.10.3"
+        "hono": "^4.12.7"
       },
       "devDependencies": {
         "@types/node": "^20.11.17",
@@ -548,9 +548,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.10.6",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.10.6.tgz",
-      "integrity": "sha512-BIdolzGpDO9MQ4nu3AUuDwHZZ+KViNm+EZ75Ae55eMXMqLVhDFqEMXxtUe9Qh8hjL+pIna/frs2j6Y2yD5Ua/g==",
+      "version": "4.12.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.7.tgz",
+      "integrity": "sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

litellm-js/spend-logs/package.json

@@ -4,7 +4,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.10.1",
-    "hono": "^4.10.3"
+    "hono": "^4.12.7"
   },
   "devDependencies": {
     "@types/node": "^20.11.17",
@@ -12,8 +12,8 @@
   },
   "overrides": {
     "glob": ">=11.1.0",
-    "tar": ">=7.5.8",
-    "minimatch": ">=10.2.1",
+    "tar": ">=7.5.10",
+    "minimatch": ">=10.2.4",
     "diff": ">=8.0.3",
     "@isaacs/brace-expansion": ">=5.0.1",
     "@babel/traverse": ">=7.23.2",

litellm-proxy-extras/litellm_proxy_extras/migrations/20260304175016_add_spend_to_agent_table/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN     "spend" DOUBLE PRECISION NOT NULL DEFAULT 0.0;
+

litellm-proxy-extras/litellm_proxy_extras/migrations/20260305000000_add_agent_headers/migration.sql

@@ -0,0 +1,5 @@
+-- Add static_headers and extra_headers to LiteLLM_AgentsTable
+
+ALTER TABLE "LiteLLM_AgentsTable"
+  ADD COLUMN IF NOT EXISTS "static_headers" JSONB DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS "extra_headers"  TEXT[] DEFAULT ARRAY[]::TEXT[];

litellm-proxy-extras/litellm_proxy_extras/migrations/20260305000000_add_rate_limits_to_agents/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN "tpm_limit" INTEGER;
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN "rpm_limit" INTEGER;
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN "session_tpm_limit" INTEGER;
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN "session_rpm_limit" INTEGER;

litellm-proxy-extras/litellm_proxy_extras/migrations/20260306175056_add_configs_override_table/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN     "spec_path" TEXT;
+

litellm-proxy-extras/litellm_proxy_extras/migrations/20260306233848_schema_sync/migration.sql

@@ -0,0 +1,57 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_MCPServerTable" ADD COLUMN     "byok_api_key_help_url" TEXT,
+ADD COLUMN     "byok_description" TEXT[] DEFAULT ARRAY[]::TEXT[],
+ADD COLUMN     "is_byok" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "tool_name_to_description" JSONB DEFAULT '{}',
+ADD COLUMN     "tool_name_to_display_name" JSONB DEFAULT '{}';
+
+-- CreateTable
+CREATE TABLE "LiteLLM_MCPUserCredentials" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "server_id" TEXT NOT NULL,
+    "credential_b64" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_MCPUserCredentials_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "LiteLLM_JWTKeyMapping" (
+    "id" TEXT NOT NULL,
+    "jwt_claim_name" TEXT NOT NULL,
+    "jwt_claim_value" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "description" TEXT,
+    "is_active" BOOLEAN NOT NULL DEFAULT true,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "created_by" TEXT,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_by" TEXT,
+
+    CONSTRAINT "LiteLLM_JWTKeyMapping_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "LiteLLM_ConfigOverrides" (
+    "config_type" TEXT NOT NULL,
+    "config_value" JSONB NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LiteLLM_ConfigOverrides_pkey" PRIMARY KEY ("config_type")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "LiteLLM_MCPUserCredentials_user_id_server_id_key" ON "LiteLLM_MCPUserCredentials"("user_id", "server_id");
+
+-- CreateIndex
+CREATE INDEX "LiteLLM_JWTKeyMapping_jwt_claim_name_jwt_claim_value_is_act_idx" ON "LiteLLM_JWTKeyMapping"("jwt_claim_name", "jwt_claim_value", "is_active");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "LiteLLM_JWTKeyMapping_jwt_claim_name_jwt_claim_value_key" ON "LiteLLM_JWTKeyMapping"("jwt_claim_name", "jwt_claim_value");
+
+-- AddForeignKey
+ALTER TABLE "LiteLLM_JWTKeyMapping" ADD CONSTRAINT "LiteLLM_JWTKeyMapping_token_fkey" FOREIGN KEY ("token") REFERENCES "LiteLLM_VerificationToken"("token") ON DELETE RESTRICT ON UPDATE CASCADE;
+

litellm-proxy-extras/litellm_proxy_extras/migrations/20260309000000_add_mcp_approval_status/migration.sql

@@ -0,0 +1,11 @@
+-- AlterTable: Add BYOM approval workflow fields to LiteLLM_MCPServerTable
+ALTER TABLE "LiteLLM_MCPServerTable"
+  ADD COLUMN IF NOT EXISTS "approval_status" TEXT DEFAULT 'active',
+  ADD COLUMN IF NOT EXISTS "submitted_by"    TEXT,
+  ADD COLUMN IF NOT EXISTS "submitted_at"    TIMESTAMP(3),
+  ADD COLUMN IF NOT EXISTS "reviewed_at"     TIMESTAMP(3),
+  ADD COLUMN IF NOT EXISTS "review_notes"    TEXT;
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_MCPServerTable_approval_status_idx"
+  ON "LiteLLM_MCPServerTable"("approval_status");

litellm-proxy-extras/litellm_proxy_extras/migrations/20260309000001_add_mcp_source_url/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable: Add source_url field to LiteLLM_MCPServerTable for GitHub/docs link
+ALTER TABLE "LiteLLM_MCPServerTable"
+  ADD COLUMN IF NOT EXISTS "source_url" TEXT;

litellm-proxy-extras/litellm_proxy_extras/schema.prisma

@@ -63,9 +63,16 @@ model LiteLLM_AgentsTable {
   agent_name String @unique
   litellm_params Json?
   agent_card_params Json
+  static_headers       Json?          @default("{}")
+  extra_headers        String[]       @default([])
   agent_access_groups String[]       @default([])
   object_permission_id String?
   object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
+  spend      Float    @default(0.0)
+  tpm_limit  Int?
+  rpm_limit  Int?
+  session_tpm_limit Int?
+  session_rpm_limit Int?
   created_at    DateTime               @default(now()) @map("created_at")
   created_by String
   updated_at    DateTime               @default(now()) @updatedAt @map("updated_at")
@@ -277,6 +284,7 @@ model LiteLLM_MCPServerTable {
   alias        String?
   description  String?
   url          String?
+  spec_path    String?
   transport    String         @default("sse")
   auth_type    String?        
   credentials  Json?          @default("{}")
@@ -287,6 +295,8 @@ model LiteLLM_MCPServerTable {
   mcp_info     Json?          @default("{}")
   mcp_access_groups String[]
   allowed_tools String[]      @default([])
+  tool_name_to_display_name Json? @default("{}")
+  tool_name_to_description   Json? @default("{}")
   extra_headers String[]    @default([])
   static_headers Json?        @default("{}")
   // Health check status
@@ -302,6 +312,21 @@ model LiteLLM_MCPServerTable {
   registration_url   String?
   allow_all_keys Boolean @default(false)
   available_on_public_internet Boolean @default(true)
+  is_byok               Boolean  @default(false)
+  byok_description      String[] @default([])
+  byok_api_key_help_url String?
+}
+
+// Per-user BYOK credentials for MCP servers
+model LiteLLM_MCPUserCredentials {
+  id             String   @id @default(uuid())
+  user_id        String
+  server_id      String
+  credential_b64 String
+  created_at     DateTime @default(now()) @map("created_at")
+  updated_at     DateTime @default(now()) @updatedAt @map("updated_at")
+
+  @@unique([user_id, server_id])
 }
 
 // Generate Tokens for Proxy
@@ -352,6 +377,7 @@ model LiteLLM_VerificationToken {
     litellm_organization_table LiteLLM_OrganizationTable?   @relation(fields: [organization_id], references: [organization_id])
     litellm_project_table LiteLLM_ProjectTable?   @relation(fields: [project_id], references: [project_id])
     object_permission LiteLLM_ObjectPermissionTable?   @relation(fields: [object_permission_id], references: [object_permission_id])
+    jwt_key_mappings LiteLLM_JWTKeyMapping[]
 
     // SELECT COUNT(*) FROM (SELECT "public"."LiteLLM_VerificationToken"."token" FROM "public"."LiteLLM_VerificationToken" WHERE ("public"."LiteLLM_VerificationToken"."user_id" = $1 AND ("public"."LiteLLM_VerificationToken"."team_id" IS NULL OR "public"."LiteLLM_VerificationToken"."team_id" <> $2)) OFFSET $3 ) AS "sub"
     // SELECT ... FROM "public"."LiteLLM_VerificationToken" WHERE "public"."LiteLLM_VerificationToken"."user_id" = $1 OFFSET $2
@@ -364,6 +390,24 @@ model LiteLLM_VerificationToken {
     @@index([budget_reset_at, expires])
 }
 
+model LiteLLM_JWTKeyMapping {
+    id                String   @id @default(uuid())
+    jwt_claim_name    String   // e.g. "sub", "email"
+    jwt_claim_value   String   // The claim value to match
+    token             String   // Hashed virtual key (FK)
+    description       String?
+    is_active         Boolean  @default(true)
+    created_at        DateTime @default(now())
+    created_by        String?
+    updated_at        DateTime @default(now()) @updatedAt
+    updated_by        String?
+
+    litellm_verification_token LiteLLM_VerificationToken @relation(fields: [token], references: [token])
+
+    @@unique([jwt_claim_name, jwt_claim_value])
+    @@index([jwt_claim_name, jwt_claim_value, is_active])
+}
+
 // Deprecated keys during grace period - allows old key to work until revoke_at
 model LiteLLM_DeprecatedVerificationToken {
     id               String   @id @default(uuid())
@@ -1018,6 +1062,14 @@ model LiteLLM_UISettings {
   updated_at DateTime @updatedAt
 }
 
+// Generic config overrides table - one row per config_type
+model LiteLLM_ConfigOverrides {
+  config_type  String   @id
+  config_value Json
+  created_at   DateTime @default(now())
+  updated_at   DateTime @updatedAt
+}
+
 // Skills table for storing LiteLLM-managed skills
 model LiteLLM_SkillsTable {
   skill_id       String   @id @default(uuid())
@@ -1076,24 +1128,24 @@ model LiteLLM_PolicyAttachmentTable {
   updated_by       String?
 }
 
-// Global tool registry - auto-discovered from LLM responses; admins set input_policy/output_policy here
+// Global tool registry - auto-discovered from LLM responses; admins set input/output policies here
 model LiteLLM_ToolTable {
-  tool_id       String    @id @default(uuid())
-  tool_name     String    @unique   // e.g. "huggingface_remote-mcp__dynamic_space"
-  origin        String?             // MCP server name or "user_defined"
-  input_policy  String    @default("untrusted")  // "trusted" | "untrusted" | "blocked"
-  output_policy String    @default("untrusted")  // "trusted" | "untrusted"
-  call_count    Int       @default(0)             // cumulative number of times this tool was seen
-  assignments   Json?     @default("{}")
-  key_hash      String?             // hash of the virtual key that first called this tool
-  team_id       String?             // team that first called this tool
-  key_alias     String?             // human-readable alias of the virtual key
-  user_agent    String?             // user-agent of the first request that discovered this tool
-  last_used_at  DateTime?           // timestamp of the most recent call
-  created_at    DateTime  @default(now())
-  created_by    String?
-  updated_at    DateTime  @default(now()) @updatedAt
-  updated_by    String?
+  tool_id        String   @id @default(uuid())
+  tool_name      String   @unique   // e.g. "huggingface_remote-mcp__dynamic_space"
+  origin         String?            // MCP server name or "user_defined"
+  input_policy   String   @default("untrusted")  // "trusted" | "untrusted" | "blocked"
+  output_policy  String   @default("untrusted")  // "trusted" | "untrusted"
+  call_count     Int      @default(0)            // cumulative number of times this tool was seen
+  assignments    Json?    @default("{}")
+  key_hash       String?            // hash of the virtual key that first called this tool
+  team_id        String?            // team that first called this tool
+  key_alias      String?            // human-readable alias of the virtual key
+  user_agent     String?            // user-agent of the first request that discovered this tool
+  last_used_at   DateTime?          // timestamp of the most recent call
+  created_at     DateTime @default(now())
+  created_by     String?
+  updated_at     DateTime @default(now()) @updatedAt
+  updated_by     String?
 
   @@index([input_policy])
   @@index([output_policy])

litellm-proxy-extras/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "litellm-proxy-extras"
-version = "0.4.50"
+version = "0.4.53"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 authors = ["BerriAI"]
 readme = "README.md"
@@ -22,7 +22,7 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.commitizen]
-version = "0.4.50"
+version = "0.4.53"
 version_files = [
     "pyproject.toml:version",
     "../requirements.txt:litellm-proxy-extras==",

litellm/_lazy_imports.py

@@ -55,7 +55,7 @@ from ._lazy_imports_registry import (
 def _get_litellm_globals() -> dict:
     """
     Get the globals dictionary of the litellm module.
-    
+
     This is where we cache imported attributes so we don't import them twice.
     When you do `litellm.some_function`, it gets stored in this dictionary.
     """
@@ -65,12 +65,13 @@ def _get_litellm_globals() -> dict:
 def _get_utils_globals() -> dict:
     """
     Get the globals dictionary of the utils module.
-    
+
     This is where we cache imported attributes so we don't import them twice.
     When you do `litellm.utils.some_function`, it gets stored in this dictionary.
     """
     return sys.modules["litellm.utils"].__dict__
 
+
 # These are special lazy loaders for things that are used internally
 # They're separate from the main lazy import system because they have specific use cases
 
@@ -81,10 +82,10 @@ _default_encoding: Optional[Any] = None
 def _get_default_encoding() -> Any:
     """
     Lazily load and cache the default OpenAI encoding.
-    
+
     This avoids importing `litellm.litellm_core_utils.default_encoding` (and thus tiktoken)
     at `litellm` import time. The encoding is cached after the first import.
-    
+
     This is used internally by utils.py functions that need the encoding but shouldn't
     trigger its import during module load.
     """
@@ -103,10 +104,10 @@ _get_modified_max_tokens_func: Optional[Any] = None
 def _get_modified_max_tokens() -> Any:
     """
     Lazily load and cache the get_modified_max_tokens function.
-    
+
     This avoids importing `litellm.litellm_core_utils.token_counter` at `litellm` import time.
     The function is cached after the first import.
-    
+
     This is used internally by utils.py functions that need the token counter but shouldn't
     trigger its import during module load.
     """
@@ -127,10 +128,10 @@ _token_counter_new_func: Optional[Any] = None
 def _get_token_counter_new() -> Any:
     """
     Lazily load and cache the token_counter function (aliased as token_counter_new).
-    
+
     This avoids importing `litellm.litellm_core_utils.token_counter` at `litellm` import time.
     The function is cached after the first import.
-    
+
     This is used internally by utils.py functions that need the token counter but shouldn't
     trigger its import during module load.
     """
@@ -157,10 +158,10 @@ _LAZY_IMPORT_REGISTRY: Optional[dict[str, Callable[[str], Any]]] = None
 def _get_lazy_import_registry() -> dict[str, Callable[[str], Any]]:
     """
     Build the registry that maps attribute names to their handler functions.
-    
+
     This is called once, the first time someone accesses a lazy-loaded attribute.
     After that, we just look up the handler function in this dictionary.
-    
+
     Returns:
         Dictionary like {"ModelResponse": _lazy_import_utils, ...}
     """
@@ -199,17 +200,19 @@ def _get_lazy_import_registry() -> dict[str, Callable[[str], Any]]:
             _LAZY_IMPORT_REGISTRY[name] = _lazy_import_llm_provider_logic
         for name in UTILS_MODULE_NAMES:
             _LAZY_IMPORT_REGISTRY[name] = _lazy_import_utils_module
-    
+
     return _LAZY_IMPORT_REGISTRY
 
 
-def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], category: str) -> Any:
+def _generic_lazy_import(
+    name: str, import_map: dict[str, tuple[str, str]], category: str
+) -> Any:
     """
     Generic function that handles lazy importing for most attributes.
-    
+
     This is the workhorse function - it does the actual importing and caching.
     Most handler functions just call this with their specific import map.
-    
+
     Steps:
     1. Check if the name exists in the import map (if not, raise error)
     2. Check if we've already imported it (if yes, return cached value)
@@ -218,7 +221,7 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate
     5. Get the attribute from the module
     6. Cache it in _globals so we don't import again
     7. Return it
-    
+
     Args:
         name: The attribute name someone is trying to access (e.g., "ModelResponse")
         import_map: Dictionary telling us where to find each attribute
@@ -228,19 +231,19 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate
     # Step 1: Make sure this attribute exists in our map
     if name not in import_map:
         raise AttributeError(f"{category} lazy import: unknown attribute {name!r}")
-    
+
     # Step 2: Get the cache (where we store imported things)
     _globals = _get_litellm_globals()
-    
+
     # Step 3: If we've already imported it, just return the cached version
     if name in _globals:
         return _globals[name]
-    
+
     # Step 4: Look up where to find this attribute
     # The map tells us: (module_path, attribute_name)
     # Example: (".utils", "ModelResponse") means "look in .utils module, get ModelResponse"
     module_path, attr_name = import_map[name]
-    
+
     # Step 5: Import the module
     # Python automatically caches modules in sys.modules, so calling this twice is fast
     # If module_path starts with ".", it's a relative import (needs package="litellm")
@@ -249,14 +252,14 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate
         module = importlib.import_module(module_path, package="litellm")
     else:
         module = importlib.import_module(module_path)
-    
+
     # Step 6: Get the actual attribute from the module
     # Example: getattr(utils_module, "ModelResponse") returns the ModelResponse class
     value = getattr(module, attr_name)
-    
+
     # Step 7: Cache it so we don't have to import again next time
     _globals[name] = value
-    
+
     # Step 8: Return it
     return value
 
@@ -268,6 +271,7 @@ def _generic_lazy_import(name: str, import_map: dict[str, tuple[str, str]], cate
 # Most of them just call _generic_lazy_import with their specific import map.
 # The registry (above) maps attribute names to these handler functions.
 
+
 def _lazy_import_utils(name: str) -> Any:
     """Handler for utils module attributes (ModelResponse, token_counter, etc.)"""
     return _generic_lazy_import(name, _UTILS_IMPORT_MAP, "Utils")
@@ -297,6 +301,7 @@ def _lazy_import_caching(name: str) -> Any:
     """Handler for caching classes (Cache, DualCache, RedisCache, etc.)"""
     return _generic_lazy_import(name, _CACHING_IMPORT_MAP, "Caching")
 
+
 def _lazy_import_dotprompt(name: str) -> Any:
     """Handler for dotprompt integration globals"""
     return _generic_lazy_import(name, _DOTPROMPT_IMPORT_MAP, "Dotprompt")
@@ -311,6 +316,7 @@ def _lazy_import_llm_configs(name: str) -> Any:
     """Handler for LLM config classes (AnthropicConfig, OpenAILikeChatConfig, etc.)"""
     return _generic_lazy_import(name, _LLM_CONFIGS_IMPORT_MAP, "LLM config")
 
+
 def _lazy_import_litellm_logging(name: str) -> Any:
     """Handler for litellm_logging module (Logging, modify_integration)"""
     return _generic_lazy_import(name, _LITELLM_LOGGING_IMPORT_MAP, "Litellm logging")
@@ -318,87 +324,91 @@ def _lazy_import_litellm_logging(name: str) -> Any:
 
 def _lazy_import_llm_provider_logic(name: str) -> Any:
     """Handler for LLM provider logic functions (get_llm_provider, etc.)"""
-    return _generic_lazy_import(name, _LLM_PROVIDER_LOGIC_IMPORT_MAP, "LLM provider logic")
+    return _generic_lazy_import(
+        name, _LLM_PROVIDER_LOGIC_IMPORT_MAP, "LLM provider logic"
+    )
 
 
 def _lazy_import_utils_module(name: str) -> Any:
     """
     Handler for utils module lazy imports.
-    
+
     This uses a custom implementation because utils module needs to use
     _get_utils_globals() instead of _get_litellm_globals() for caching.
     """
     # Check if this attribute exists in our map
     if name not in _UTILS_MODULE_IMPORT_MAP:
         raise AttributeError(f"Utils module lazy import: unknown attribute {name!r}")
-    
+
     # Get the cache (where we store imported things) - use utils globals
     _globals = _get_utils_globals()
-    
+
     # If we've already imported it, just return the cached version
     if name in _globals:
         return _globals[name]
-    
+
     # Look up where to find this attribute
     module_path, attr_name = _UTILS_MODULE_IMPORT_MAP[name]
-    
+
     # Import the module
     if module_path.startswith("."):
         module = importlib.import_module(module_path, package="litellm")
     else:
         module = importlib.import_module(module_path)
-    
+
     # Get the actual attribute from the module
     value = getattr(module, attr_name)
-    
+
     # Cache it so we don't have to import again next time
     _globals[name] = value
-    
+
     # Return it
     return value
 
+
 # ============================================================================
 # SPECIAL HANDLERS
 # ============================================================================
 # These handlers have custom logic that doesn't fit the generic pattern
 
+
 def _lazy_import_llm_client_cache(name: str) -> Any:
     """
     Handler for LLM client cache - has special logic for singleton instance.
-    
+
     This one is different because:
     - "LLMClientCache" is the class itself
     - "in_memory_llm_clients_cache" is a singleton instance of that class
     So we need custom logic to handle both cases.
     """
     _globals = _get_litellm_globals()
-    
+
     # If already cached, return it
     if name in _globals:
         return _globals[name]
-    
+
     # Import the class
     module = importlib.import_module("litellm.caching.llm_caching_handler")
     LLMClientCache = getattr(module, "LLMClientCache")
-    
+
     # If they want the class itself, return it
     if name == "LLMClientCache":
         _globals["LLMClientCache"] = LLMClientCache
         return LLMClientCache
-    
+
     # If they want the singleton instance, create it (only once)
     if name == "in_memory_llm_clients_cache":
         instance = LLMClientCache()
         _globals["in_memory_llm_clients_cache"] = instance
         return instance
-    
+
     raise AttributeError(f"LLM client cache lazy import: unknown attribute {name!r}")
 
 
 def _lazy_import_http_handlers(name: str) -> Any:
     """
     Handler for HTTP clients - has special logic for creating client instances.
-    
+
     This one is different because:
     - These aren't just imports, they're actual client instances that need to be created
     - They need configuration (timeout, etc.) from the module globals
@@ -413,14 +423,14 @@ def _lazy_import_http_handlers(name: str) -> Any:
         # Get timeout from module config (if set)
         timeout = _globals.get("request_timeout")
         params = {"timeout": timeout, "client_alias": "module level aclient"}
-        
+
         # Create the client instance
         provider_id = cast(Any, "litellm_module_level_client")
         async_client = get_async_httpx_client(
             llm_provider=provider_id,
             params=params,
         )
-        
+
         # Cache it so we don't create it again
         _globals["module_level_aclient"] = async_client
         return async_client
@@ -431,7 +441,7 @@ def _lazy_import_http_handlers(name: str) -> Any:
 
         timeout = _globals.get("request_timeout")
         sync_client = HTTPHandler(timeout=timeout)
-        
+
         # Cache it
         _globals["module_level_client"] = sync_client
         return sync_client

litellm/_lazy_imports_registry.py

@@ -214,6 +214,7 @@ LLM_CONFIG_NAMES = (
     "TopazImageVariationConfig",
     "OpenAITextCompletionConfig",
     "GroqChatConfig",
+    "BedrockMantleChatConfig",
     "A2AConfig",
     "GenAIHubOrchestrationConfig",
     "VoyageEmbeddingConfig",
@@ -676,7 +677,10 @@ _LLM_CONFIGS_IMPORT_MAP = {
         "FireworksAIRerankConfig",
     ),
     "VoyageRerankConfig": (".llms.voyage.rerank.transformation", "VoyageRerankConfig"),
-    "IBMWatsonXRerankConfig": (".llms.watsonx.rerank.transformation", "IBMWatsonXRerankConfig"),
+    "IBMWatsonXRerankConfig": (
+        ".llms.watsonx.rerank.transformation",
+        "IBMWatsonXRerankConfig",
+    ),
     "ClarifaiConfig": (".llms.clarifai.chat.transformation", "ClarifaiConfig"),
     "AI21ChatConfig": (".llms.ai21.chat.transformation", "AI21ChatConfig"),
     "LlamaAPIConfig": (".llms.meta_llama.chat.transformation", "LlamaAPIConfig"),
@@ -858,6 +862,10 @@ _LLM_CONFIGS_IMPORT_MAP = {
         "OpenAITextCompletionConfig",
     ),
     "GroqChatConfig": (".llms.groq.chat.transformation", "GroqChatConfig"),
+    "BedrockMantleChatConfig": (
+        ".llms.bedrock_mantle.chat.transformation",
+        "BedrockMantleChatConfig",
+    ),
     "A2AConfig": (".llms.a2a.chat.transformation", "A2AConfig"),
     "GenAIHubOrchestrationConfig": (
         ".llms.sap.chat.transformation",

litellm/_redis.py

@@ -34,7 +34,12 @@ def _get_redis_kwargs():
         "retry",
     }
 
-    include_args = ["url", "redis_connect_func", "gcp_service_account", "gcp_ssl_ca_certs"]
+    include_args = [
+        "url",
+        "redis_connect_func",
+        "gcp_service_account",
+        "gcp_ssl_ca_certs",
+    ]
 
     available_args = [x for x in arg_spec.args if x not in exclude_args] + include_args
 
@@ -75,7 +80,9 @@ def _get_redis_cluster_kwargs(client=None):
     available_args.append("ssl_cert_reqs")
     available_args.append("ssl_check_hostname")
     available_args.append("ssl_ca_certs")
-    available_args.append("redis_connect_func")  # Needed for sync clusters and IAM detection
+    available_args.append(
+        "redis_connect_func"
+    )  # Needed for sync clusters and IAM detection
     available_args.append("gcp_service_account")
     available_args.append("gcp_ssl_ca_certs")
     available_args.append("max_connections")
@@ -103,10 +110,10 @@ def _redis_kwargs_from_environment():
 def _generate_gcp_iam_access_token(service_account: str) -> str:
     """
     Generate GCP IAM access token for Redis authentication.
-    
+
     Args:
         service_account: GCP service account in format 'projects/-/serviceAccounts/name@project.iam.gserviceaccount.com'
-    
+
     Returns:
         Access token string for GCP IAM authentication
     """
@@ -117,11 +124,11 @@ def _generate_gcp_iam_access_token(service_account: str) -> str:
             "google-cloud-iam is required for GCP IAM Redis authentication. "
             "Install it with: pip install google-cloud-iam"
         )
-    
+
     client = iam_credentials_v1.IAMCredentialsClient()
     request = iam_credentials_v1.GenerateAccessTokenRequest(
         name=service_account,
-        scope=['https://www.googleapis.com/auth/cloud-platform'],
+        scope=["https://www.googleapis.com/auth/cloud-platform"],
     )
     response = client.generate_access_token(request=request)
     return str(response.access_token)
@@ -133,14 +140,15 @@ def create_gcp_iam_redis_connect_func(
 ) -> Callable:
     """
     Creates a custom Redis connection function for GCP IAM authentication.
-    
+
     Args:
         service_account: GCP service account in format 'projects/-/serviceAccounts/name@project.iam.gserviceaccount.com'
         ssl_ca_certs: Path to SSL CA certificate file for secure connections
-    
+
     Returns:
         A connection function that can be used with Redis clients
     """
+
     def iam_connect(self):
         """Initialize the connection and authenticate using GCP IAM"""
         from redis.exceptions import (
@@ -148,25 +156,25 @@ def create_gcp_iam_redis_connect_func(
             AuthenticationWrongNumberOfArgsError,
         )
         from redis.utils import str_if_bytes
-        
+
         self._parser.on_connect(self)
-        
+
         auth_args = (_generate_gcp_iam_access_token(service_account),)
         self.send_command("AUTH", *auth_args, check_health=False)
-        
+
         try:
             auth_response = self.read_response()
         except AuthenticationWrongNumberOfArgsError:
             # Fallback to password auth if IAM fails
-            if hasattr(self, 'password') and self.password:
+            if hasattr(self, "password") and self.password:
                 self.send_command("AUTH", self.password, check_health=False)
                 auth_response = self.read_response()
             else:
                 raise
-        
+
         if str_if_bytes(auth_response) != "OK":
             raise AuthenticationError("GCP IAM authentication failed")
-    
+
     return iam_connect
 
 
@@ -178,22 +186,20 @@ def get_redis_url_from_environment():
         raise ValueError(
             "Either 'REDIS_URL' or both 'REDIS_HOST' and 'REDIS_PORT' must be specified for Redis."
         )
-    
+
     if "REDIS_SSL" in os.environ and os.environ["REDIS_SSL"].lower() == "true":
         redis_protocol = "rediss"
     else:
         redis_protocol = "redis"
-    
+
     # Build authentication part of URL
     auth_part = ""
     if "REDIS_USERNAME" in os.environ and "REDIS_PASSWORD" in os.environ:
         auth_part = f"{os.environ['REDIS_USERNAME']}:{os.environ['REDIS_PASSWORD']}@"
     elif "REDIS_PASSWORD" in os.environ:
         auth_part = f"{os.environ['REDIS_PASSWORD']}@"
-    
-    return (
-        f"{redis_protocol}://{auth_part}{os.environ['REDIS_HOST']}:{os.environ['REDIS_PORT']}"
-    )
+
+    return f"{redis_protocol}://{auth_part}{os.environ['REDIS_HOST']}:{os.environ['REDIS_PORT']}"
 
 
 def _get_redis_client_logic(**env_overrides):
@@ -241,22 +247,27 @@ def _get_redis_client_logic(**env_overrides):
         redis_kwargs["service_name"] = _service_name
 
     # Handle GCP IAM authentication
-    _gcp_service_account = redis_kwargs.get("gcp_service_account") or get_secret_str("REDIS_GCP_SERVICE_ACCOUNT")
-    _gcp_ssl_ca_certs = redis_kwargs.get("gcp_ssl_ca_certs") or get_secret_str("REDIS_GCP_SSL_CA_CERTS")
-    
+    _gcp_service_account = redis_kwargs.get("gcp_service_account") or get_secret_str(
+        "REDIS_GCP_SERVICE_ACCOUNT"
+    )
+    _gcp_ssl_ca_certs = redis_kwargs.get("gcp_ssl_ca_certs") or get_secret_str(
+        "REDIS_GCP_SSL_CA_CERTS"
+    )
+
     if _gcp_service_account is not None:
-        verbose_logger.debug("Setting up GCP IAM authentication for Redis with service account.")
+        verbose_logger.debug(
+            "Setting up GCP IAM authentication for Redis with service account."
+        )
         redis_kwargs["redis_connect_func"] = create_gcp_iam_redis_connect_func(
-            service_account=_gcp_service_account,
-            ssl_ca_certs=_gcp_ssl_ca_certs
+            service_account=_gcp_service_account, ssl_ca_certs=_gcp_ssl_ca_certs
         )
         # Store GCP service account in redis_connect_func for async cluster access
         redis_kwargs["redis_connect_func"]._gcp_service_account = _gcp_service_account
-        
+
         # Remove GCP-specific kwargs that shouldn't be passed to Redis client
         redis_kwargs.pop("gcp_service_account", None)
         redis_kwargs.pop("gcp_ssl_ca_certs", None)
-        
+
         # Only enable SSL if explicitly requested AND SSL CA certs are provided
         if _gcp_ssl_ca_certs and redis_kwargs.get("ssl", False):
             redis_kwargs["ssl_ca_certs"] = _gcp_ssl_ca_certs
@@ -377,7 +388,8 @@ def get_redis_client(**env_overrides):
 
 
 def get_redis_async_client(
-    connection_pool: Optional[async_redis.BlockingConnectionPool] = None, **env_overrides,
+    connection_pool: Optional[async_redis.BlockingConnectionPool] = None,
+    **env_overrides,
 ) -> Union[async_redis.Redis, async_redis.RedisCluster]:
     redis_kwargs = _get_redis_client_logic(**env_overrides)
     if "url" in redis_kwargs and redis_kwargs["url"] is not None:
@@ -411,39 +423,50 @@ def get_redis_async_client(
 
         # Get GCP service account - first try from redis_connect_func, then from environment
         gcp_service_account = None
-        if redis_connect_func and hasattr(redis_connect_func, '_gcp_service_account'):
+        if redis_connect_func and hasattr(redis_connect_func, "_gcp_service_account"):
             gcp_service_account = redis_connect_func._gcp_service_account
         else:
-            gcp_service_account = redis_kwargs.get("gcp_service_account") or get_secret_str("REDIS_GCP_SERVICE_ACCOUNT")
-        
-        verbose_logger.debug(f"DEBUG: Redis cluster kwargs: redis_connect_func={redis_connect_func is not None}, gcp_service_account_provided={gcp_service_account is not None}")
-        
+            gcp_service_account = redis_kwargs.get(
+                "gcp_service_account"
+            ) or get_secret_str("REDIS_GCP_SERVICE_ACCOUNT")
+
+        verbose_logger.debug(
+            f"DEBUG: Redis cluster kwargs: redis_connect_func={redis_connect_func is not None}, gcp_service_account_provided={gcp_service_account is not None}"
+        )
+
         # If GCP IAM is configured (indicated by redis_connect_func), generate access token and use as password
         if redis_connect_func and gcp_service_account:
-            verbose_logger.debug("DEBUG: Generating IAM token for service account (value not logged for security reasons)")
+            verbose_logger.debug(
+                "DEBUG: Generating IAM token for service account (value not logged for security reasons)"
+            )
             try:
                 # Generate IAM access token using the helper function
                 access_token = _generate_gcp_iam_access_token(gcp_service_account)
                 cluster_kwargs["password"] = access_token
-                verbose_logger.debug("DEBUG: Successfully generated GCP IAM access token for async Redis cluster")
+                verbose_logger.debug(
+                    "DEBUG: Successfully generated GCP IAM access token for async Redis cluster"
+                )
             except Exception as e:
                 verbose_logger.error(f"Failed to generate GCP IAM access token: {e}")
                 from redis.exceptions import AuthenticationError
+
                 raise AuthenticationError("Failed to generate GCP IAM access token")
         else:
-            verbose_logger.debug(f"DEBUG: Not using GCP IAM auth - redis_connect_func={redis_connect_func is not None}, gcp_service_account_provided={gcp_service_account is not None}")
-        
+            verbose_logger.debug(
+                f"DEBUG: Not using GCP IAM auth - redis_connect_func={redis_connect_func is not None}, gcp_service_account_provided={gcp_service_account is not None}"
+            )
+
         new_startup_nodes: List[ClusterNode] = []
 
         for item in redis_kwargs["startup_nodes"]:
             new_startup_nodes.append(ClusterNode(**item))
         cluster_kwargs.pop("startup_nodes", None)
-        
+
         # Create async RedisCluster with IAM token as password if available
         cluster_client = async_redis.RedisCluster(
             startup_nodes=new_startup_nodes, **cluster_kwargs  # type: ignore
         )
-            
+
         return cluster_client
 
     # Check for Redis Sentinel
@@ -463,7 +486,10 @@ def get_redis_connection_pool(**env_overrides):
     redis_kwargs = _get_redis_client_logic(**env_overrides)
     verbose_logger.debug("get_redis_connection_pool: redis_kwargs", redis_kwargs)
     if "url" in redis_kwargs and redis_kwargs["url"] is not None:
-        pool_kwargs = {"timeout": REDIS_CONNECTION_POOL_TIMEOUT, "url": redis_kwargs["url"]}
+        pool_kwargs = {
+            "timeout": REDIS_CONNECTION_POOL_TIMEOUT,
+            "url": redis_kwargs["url"],
+        }
         if "max_connections" in redis_kwargs:
             try:
                 pool_kwargs["max_connections"] = int(redis_kwargs["max_connections"])
@@ -483,6 +509,7 @@ def get_redis_connection_pool(**env_overrides):
         timeout=REDIS_CONNECTION_POOL_TIMEOUT, **redis_kwargs
     )
 
+
 def _pretty_print_redis_config(redis_kwargs: dict) -> None:
     """Pretty print the Redis configuration using rich with sensitive data masking"""
     try:
@@ -492,6 +519,7 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
         from rich.panel import Panel
         from rich.table import Table
         from rich.text import Text
+
         if not verbose_logger.isEnabledFor(logging.DEBUG):
             return
 
@@ -499,7 +527,7 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
 
         # Initialize the sensitive data masker
         masker = SensitiveDataMasker()
-        
+
         # Mask sensitive data in redis_kwargs
         masked_redis_kwargs = masker.mask_dict(redis_kwargs)
 
@@ -531,7 +559,7 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
                         value_str = str(value)
                 else:
                     value_str = str(value)
-                
+
                 config_table.add_row(key, value_str)
 
         # Determine connection type
@@ -568,4 +596,3 @@ def _pretty_print_redis_config(redis_kwargs: dict) -> None:
         verbose_logger.info(f"Redis configuration: {masked_redis_kwargs}")
     except Exception as e:
         verbose_logger.error(f"Error pretty printing Redis configuration: {e}")
-

litellm/_service_logger.py

@@ -317,7 +317,7 @@ class ServiceLogging(CustomLogger):
             await self.async_service_success_hook(
                 service=ServiceTypes.LITELLM,
                 duration=_duration,
-                call_type=kwargs.get("call_type", "unknown")
+                call_type=kwargs.get("call_type", "unknown"),
             )
         except Exception as e:
             raise e

litellm/a2a_protocol/client.py

@@ -103,5 +103,7 @@ class A2AClient:
         from litellm.a2a_protocol.main import asend_message_streaming
 
         a2a_client = await self._get_client()
-        async for chunk in asend_message_streaming(a2a_client=a2a_client, request=request):
+        async for chunk in asend_message_streaming(
+            a2a_client=a2a_client, request=request
+        ):
             yield chunk

litellm/a2a_protocol/cost_calculator.py

@@ -97,7 +97,11 @@ class A2ACostCalculator:
         completion_tokens = getattr(usage, "completion_tokens", 0) or 0
 
         # Calculate costs
-        input_cost = prompt_tokens * (float(input_cost_per_token) if input_cost_per_token else 0.0)
-        output_cost = completion_tokens * (float(output_cost_per_token) if output_cost_per_token else 0.0)
+        input_cost = prompt_tokens * (
+            float(input_cost_per_token) if input_cost_per_token else 0.0
+        )
+        output_cost = completion_tokens * (
+            float(output_cost_per_token) if output_cost_per_token else 0.0
+        )
 
         return input_cost + output_cost

litellm/a2a_protocol/litellm_completion_bridge/handler.py

@@ -50,30 +50,28 @@ class A2ACompletionBridgeHandler:
         a2a_provider_config = A2AProviderConfigManager.get_provider_config(
             custom_llm_provider=custom_llm_provider
         )
-        
+
         # If provider config exists, use it
         if a2a_provider_config is not None:
             if api_base is None:
                 raise ValueError(f"api_base is required for {custom_llm_provider}")
-            
-            verbose_logger.info(
-                f"A2A: Using provider config for {custom_llm_provider}"
-            )
-            
+
+            verbose_logger.info(f"A2A: Using provider config for {custom_llm_provider}")
+
             response_data = await a2a_provider_config.handle_non_streaming(
                 request_id=request_id,
                 params=params,
                 api_base=api_base,
             )
-            
+
             return response_data
-        
+
         # Extract message from params
         message = params.get("message", {})
 
         # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(
-            message
+        openai_messages = (
+            A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
         )
 
         # Get completion params
@@ -100,7 +98,8 @@ class A2ACompletionBridgeHandler:
         }
         # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
         litellm_params_to_add = {
-            k: v for k, v in litellm_params.items()
+            k: v
+            for k, v in litellm_params.items()
             if k not in ("model", "custom_llm_provider")
         }
         completion_params.update(litellm_params_to_add)
@@ -109,9 +108,11 @@ class A2ACompletionBridgeHandler:
         response = await litellm.acompletion(**completion_params)
 
         # Transform response to A2A format
-        a2a_response = A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
-            response=response,
-            request_id=request_id,
+        a2a_response = (
+            A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
+                response=response,
+                request_id=request_id,
+            )
         )
 
         verbose_logger.info(f"A2A completion bridge completed: request_id={request_id}")
@@ -148,25 +149,25 @@ class A2ACompletionBridgeHandler:
         a2a_provider_config = A2AProviderConfigManager.get_provider_config(
             custom_llm_provider=custom_llm_provider
         )
-        
+
         # If provider config exists, use it
         if a2a_provider_config is not None:
             if api_base is None:
                 raise ValueError(f"api_base is required for {custom_llm_provider}")
-            
+
             verbose_logger.info(
                 f"A2A: Using provider config for {custom_llm_provider} (streaming)"
             )
-            
+
             async for chunk in a2a_provider_config.handle_streaming(
                 request_id=request_id,
                 params=params,
                 api_base=api_base,
             ):
                 yield chunk
-            
+
             return
-        
+
         # Extract message from params
         message = params.get("message", {})
 
@@ -177,8 +178,8 @@ class A2ACompletionBridgeHandler:
         )
 
         # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(
-            message
+        openai_messages = (
+            A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
         )
 
         # Get completion params
@@ -205,7 +206,8 @@ class A2ACompletionBridgeHandler:
         }
         # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
         litellm_params_to_add = {
-            k: v for k, v in litellm_params.items()
+            k: v
+            for k, v in litellm_params.items()
             if k not in ("model", "custom_llm_provider")
         }
         completion_params.update(litellm_params_to_add)
@@ -244,9 +246,11 @@ class A2ACompletionBridgeHandler:
 
         # Emit artifact update with accumulated content
         if accumulated_text:
-            artifact_event = A2ACompletionBridgeTransformation.create_artifact_update_event(
-                ctx=ctx,
-                text=accumulated_text,
+            artifact_event = (
+                A2ACompletionBridgeTransformation.create_artifact_update_event(
+                    ctx=ctx,
+                    text=accumulated_text,
+                )
             )
             yield artifact_event
 

litellm/a2a_protocol/litellm_completion_bridge/transformation.py

@@ -124,9 +124,7 @@ class A2ACompletionBridgeTransformation:
             },
         }
 
-        verbose_logger.debug(
-            f"OpenAI -> A2A transform: content_length={len(content)}"
-        )
+        verbose_logger.debug(f"OpenAI -> A2A transform: content_length={len(content)}")
 
         return a2a_response
 

litellm/a2a_protocol/main.py

@@ -120,9 +120,9 @@ def _get_a2a_model_info(a2a_client: Any, kwargs: Dict[str, Any]) -> str:
         litellm_logging_obj.model = model
         litellm_logging_obj.custom_llm_provider = custom_llm_provider
         litellm_logging_obj.model_call_details["model"] = model
-        litellm_logging_obj.model_call_details["custom_llm_provider"] = (
-            custom_llm_provider
-        )
+        litellm_logging_obj.model_call_details[
+            "custom_llm_provider"
+        ] = custom_llm_provider
 
     return agent_name
 
@@ -162,6 +162,49 @@ async def _send_message_via_completion_bridge(
     return LiteLLMSendMessageResponse.from_dict(response_dict)
 
 
+async def _execute_a2a_send_with_retry(
+    a2a_client: Any,
+    request: Any,
+    agent_card: Any,
+    card_url: Optional[str],
+    api_base: Optional[str],
+    agent_name: Optional[str],
+) -> Any:
+    """Send an A2A message with retry logic for localhost URL errors."""
+    a2a_response = None
+    for _ in range(2):  # max 2 attempts: original + 1 retry
+        try:
+            a2a_response = await a2a_client.send_message(request)
+            break  # success, exit retry loop
+        except A2ALocalhostURLError as e:
+            a2a_client = handle_a2a_localhost_retry(
+                error=e,
+                agent_card=agent_card,
+                a2a_client=a2a_client,
+                is_streaming=False,
+            )
+            card_url = agent_card.url if agent_card else None
+        except Exception as e:
+            try:
+                map_a2a_exception(e, card_url, api_base, model=agent_name)
+            except A2ALocalhostURLError as localhost_err:
+                a2a_client = handle_a2a_localhost_retry(
+                    error=localhost_err,
+                    agent_card=agent_card,
+                    a2a_client=a2a_client,
+                    is_streaming=False,
+                )
+                card_url = agent_card.url if agent_card else None
+                continue
+            except Exception:
+                raise
+    if a2a_response is None:
+        raise RuntimeError(
+            "A2A send_message failed: no response received after retry attempts."
+        )
+    return a2a_response
+
+
 @client
 async def asend_message(
     a2a_client: Optional["A2AClientType"] = None,
@@ -169,6 +212,7 @@ async def asend_message(
     api_base: Optional[str] = None,
     litellm_params: Optional[Dict[str, Any]] = None,
     agent_id: Optional[str] = None,
+    agent_extra_headers: Optional[Dict[str, str]] = None,
     **kwargs: Any,
 ) -> LiteLLMSendMessageResponse:
     """
@@ -250,9 +294,12 @@ async def asend_message(
                 "Either a2a_client or api_base is required for standard A2A flow"
             )
         trace_id = trace_id or str(uuid.uuid4())
-        extra_headers = {"X-LiteLLM-Trace-Id": trace_id}
+        extra_headers: Dict[str, str] = {"X-LiteLLM-Trace-Id": trace_id}
         if agent_id:
             extra_headers["X-LiteLLM-Agent-Id"] = agent_id
+        # Overlay agent-level headers (agent headers take precedence over LiteLLM internal ones)
+        if agent_extra_headers:
+            extra_headers.update(agent_extra_headers)
         a2a_client = await create_a2a_client(
             base_url=api_base, extra_headers=extra_headers
         )
@@ -279,44 +326,17 @@ async def asend_message(
         if getattr(message, "context_id", None) is None:
             message.context_id = context_id
 
-    # Retry loop: if connection fails due to localhost URL in agent card, retry with fixed URL
-    a2a_response = None
-    for _ in range(2):  # max 2 attempts: original + 1 retry
-        try:
-            a2a_response = await a2a_client.send_message(request)
-            break  # success, exit retry loop
-        except A2ALocalhostURLError as e:
-            # Localhost URL error - fix and retry
-            a2a_client = handle_a2a_localhost_retry(
-                error=e,
-                agent_card=agent_card,
-                a2a_client=a2a_client,
-                is_streaming=False,
-            )
-            card_url = agent_card.url if agent_card else None
-        except Exception as e:
-            # Map exception - will raise A2ALocalhostURLError if applicable
-            try:
-                map_a2a_exception(e, card_url, api_base, model=agent_name)
-            except A2ALocalhostURLError as localhost_err:
-                # Localhost URL error - fix and retry
-                a2a_client = handle_a2a_localhost_retry(
-                    error=localhost_err,
-                    agent_card=agent_card,
-                    a2a_client=a2a_client,
-                    is_streaming=False,
-                )
-                card_url = agent_card.url if agent_card else None
-                continue
-            except Exception:
-                # Re-raise the mapped exception
-                raise
+    a2a_response = await _execute_a2a_send_with_retry(
+        a2a_client=a2a_client,
+        request=request,
+        agent_card=agent_card,
+        card_url=card_url,
+        api_base=api_base,
+        agent_name=agent_name,
+    )
 
     verbose_logger.info(f"A2A send_message completed, request_id={request.id}")
 
-    # a2a_response is guaranteed to be set if we reach here (loop breaks on success or raises)
-    assert a2a_response is not None
-
     # Wrap in LiteLLM response type for _hidden_params support
     response = LiteLLMSendMessageResponse.from_a2a_response(a2a_response)
 
@@ -418,7 +438,7 @@ def _build_streaming_logging_obj(
     return logging_obj
 
 
-async def asend_message_streaming(
+async def asend_message_streaming(  # noqa: PLR0915
     a2a_client: Optional["A2AClientType"] = None,
     request: Optional["SendStreamingMessageRequest"] = None,
     api_base: Optional[str] = None,
@@ -426,6 +446,7 @@ async def asend_message_streaming(
     agent_id: Optional[str] = None,
     metadata: Optional[Dict[str, Any]] = None,
     proxy_server_request: Optional[Dict[str, Any]] = None,
+    agent_extra_headers: Optional[Dict[str, str]] = None,
 ) -> AsyncIterator[Any]:
     """
     Async: Send a streaming message to an A2A agent.
@@ -507,7 +528,17 @@ async def asend_message_streaming(
             raise ValueError(
                 "Either a2a_client or api_base is required for standard A2A flow"
             )
-        a2a_client = await create_a2a_client(base_url=api_base)
+        # Mirror the non-streaming path: always include trace and agent-id headers
+        streaming_extra_headers: Dict[str, str] = {
+            "X-LiteLLM-Trace-Id": str(request.id),
+        }
+        if agent_id:
+            streaming_extra_headers["X-LiteLLM-Agent-Id"] = agent_id
+        if agent_extra_headers:
+            streaming_extra_headers.update(agent_extra_headers)
+        a2a_client = await create_a2a_client(
+            base_url=api_base, extra_headers=streaming_extra_headers
+        )
 
     # Type assertion: a2a_client is guaranteed to be non-None here
     assert a2a_client is not None
@@ -621,17 +652,28 @@ async def create_a2a_client(
 
     verbose_logger.info(f"Creating A2A client for {base_url}")
 
-    # Use LiteLLM's cached httpx client
-    http_handler = get_async_httpx_client(
-        llm_provider=httpxSpecialProvider.A2A,
-        params={"timeout": timeout},
+    # Use get_async_httpx_client with per-agent params so that different agents
+    # (with different extra_headers) get separate cached clients.  The params
+    # dict is hashed into the cache key, keeping agent auth isolated while
+    # still reusing connections within the same agent.
+    #
+    # Only pass params that AsyncHTTPHandler.__init__ accepts (e.g. timeout).
+    # Use "disable_aiohttp_transport" key for cache-key-only data (it's
+    # filtered out before reaching the constructor).
+    _client_params: dict = {"timeout": timeout}
+    if extra_headers:
+        # Encode headers into a cache-key-only param so each unique header
+        # set produces a distinct cache key.
+        _client_params["disable_aiohttp_transport"] = str(sorted(extra_headers.items()))
+    _async_handler = get_async_httpx_client(
+        llm_provider=httpxSpecialProvider.A2AProvider,
+        params=_client_params,
     )
-    httpx_client = http_handler.client
-
+    httpx_client = _async_handler.client
     if extra_headers:
         httpx_client.headers.update(extra_headers)
         verbose_proxy_logger.debug(
-            f"A2A client created with extra_headers={extra_headers}"
+            f"A2A client created with extra_headers={list(extra_headers.keys())}"
         )
 
     # Resolve agent card

litellm/a2a_protocol/providers/__init__.py

@@ -8,4 +8,3 @@ from litellm.a2a_protocol.providers.base import BaseA2AProviderConfig
 from litellm.a2a_protocol.providers.config_manager import A2AProviderConfigManager
 
 __all__ = ["BaseA2AProviderConfig", "A2AProviderConfigManager"]
-

litellm/a2a_protocol/providers/base.py

@@ -9,7 +9,7 @@ from typing import Any, AsyncIterator, Dict
 class BaseA2AProviderConfig(ABC):
     """
     Base configuration class for A2A protocol providers.
-    
+
     Each provider should implement this interface to define how to handle
     A2A requests for their specific agent type.
     """
@@ -60,4 +60,3 @@ class BaseA2AProviderConfig(ABC):
         # The yield is here to make this a generator function
         if False:  # pragma: no cover
             yield {}
-

litellm/a2a_protocol/providers/config_manager.py

@@ -12,7 +12,7 @@ from litellm.a2a_protocol.providers.base import BaseA2AProviderConfig
 class A2AProviderConfigManager:
     """
     Manager for A2A provider configurations.
-    
+
     Similar to ProviderConfigManager in litellm.utils but specifically for A2A providers.
     """
 
@@ -31,7 +31,7 @@ class A2AProviderConfigManager:
         """
         if custom_llm_provider is None:
             return None
-            
+
         if custom_llm_provider == "pydantic_ai_agents":
             from litellm.a2a_protocol.providers.pydantic_ai_agents.config import (
                 PydanticAIProviderConfig,
@@ -45,4 +45,3 @@ class A2AProviderConfigManager:
         #     return AnotherProviderConfig()
 
         return None
-

litellm/a2a_protocol/providers/litellm_completion/__init__.py

@@ -3,4 +3,3 @@ LiteLLM Completion bridge provider for A2A protocol.
 
 Routes A2A requests through litellm.acompletion based on custom_llm_provider.
 """
-

litellm/a2a_protocol/providers/litellm_completion/handler.py

@@ -52,26 +52,26 @@ class A2ACompletionBridgeHandler:
         if custom_llm_provider == "pydantic_ai_agents":
             if api_base is None:
                 raise ValueError("api_base is required for Pydantic AI agents")
-            
+
             verbose_logger.info(
                 f"Pydantic AI: Routing to Pydantic AI agent at {api_base}"
             )
-            
+
             # Send request directly to Pydantic AI agent
             response_data = await PydanticAITransformation.send_non_streaming_request(
                 api_base=api_base,
                 request_id=request_id,
                 params=params,
             )
-            
+
             return response_data
-        
+
         # Extract message from params
         message = params.get("message", {})
 
         # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(
-            message
+        openai_messages = (
+            A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
         )
 
         # Get completion params
@@ -98,7 +98,8 @@ class A2ACompletionBridgeHandler:
         }
         # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
         litellm_params_to_add = {
-            k: v for k, v in litellm_params.items()
+            k: v
+            for k, v in litellm_params.items()
             if k not in ("model", "custom_llm_provider")
         }
         completion_params.update(litellm_params_to_add)
@@ -107,9 +108,11 @@ class A2ACompletionBridgeHandler:
         response = await litellm.acompletion(**completion_params)
 
         # Transform response to A2A format
-        a2a_response = A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
-            response=response,
-            request_id=request_id,
+        a2a_response = (
+            A2ACompletionBridgeTransformation.openai_response_to_a2a_response(
+                response=response,
+                request_id=request_id,
+            )
         )
 
         verbose_logger.info(f"A2A completion bridge completed: request_id={request_id}")
@@ -146,27 +149,27 @@ class A2ACompletionBridgeHandler:
         if custom_llm_provider == "pydantic_ai_agents":
             if api_base is None:
                 raise ValueError("api_base is required for Pydantic AI agents")
-            
+
             verbose_logger.info(
                 f"Pydantic AI: Faking streaming for Pydantic AI agent at {api_base}"
             )
-            
+
             # Get non-streaming response first
             response_data = await PydanticAITransformation.send_non_streaming_request(
                 api_base=api_base,
                 request_id=request_id,
                 params=params,
             )
-            
+
             # Convert to fake streaming
             async for chunk in PydanticAITransformation.fake_streaming_from_response(
                 response_data=response_data,
                 request_id=request_id,
             ):
                 yield chunk
-            
+
             return
-        
+
         # Extract message from params
         message = params.get("message", {})
 
@@ -177,8 +180,8 @@ class A2ACompletionBridgeHandler:
         )
 
         # Transform A2A message to OpenAI format
-        openai_messages = A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(
-            message
+        openai_messages = (
+            A2ACompletionBridgeTransformation.a2a_message_to_openai_messages(message)
         )
 
         # Get completion params
@@ -205,7 +208,8 @@ class A2ACompletionBridgeHandler:
         }
         # Add litellm_params (contains api_key, client_id, client_secret, tenant_id, etc.)
         litellm_params_to_add = {
-            k: v for k, v in litellm_params.items()
+            k: v
+            for k, v in litellm_params.items()
             if k not in ("model", "custom_llm_provider")
         }
         completion_params.update(litellm_params_to_add)
@@ -244,9 +248,11 @@ class A2ACompletionBridgeHandler:
 
         # Emit artifact update with accumulated content
         if accumulated_text:
-            artifact_event = A2ACompletionBridgeTransformation.create_artifact_update_event(
-                ctx=ctx,
-                text=accumulated_text,
+            artifact_event = (
+                A2ACompletionBridgeTransformation.create_artifact_update_event(
+                    ctx=ctx,
+                    text=accumulated_text,
+                )
             )
             yield artifact_event
 

litellm/a2a_protocol/providers/litellm_completion/transformation.py

@@ -124,9 +124,7 @@ class A2ACompletionBridgeTransformation:
             },
         }
 
-        verbose_logger.debug(
-            f"OpenAI -> A2A transform: content_length={len(content)}"
-        )
+        verbose_logger.debug(f"OpenAI -> A2A transform: content_length={len(content)}")
 
         return a2a_response
 

litellm/a2a_protocol/providers/pydantic_ai_agents/__init__.py

@@ -14,4 +14,3 @@ from litellm.a2a_protocol.providers.pydantic_ai_agents.transformation import (
 )
 
 __all__ = ["PydanticAIHandler", "PydanticAITransformation", "PydanticAIProviderConfig"]
-

litellm/a2a_protocol/providers/pydantic_ai_agents/config.py

@@ -11,7 +11,7 @@ from litellm.a2a_protocol.providers.pydantic_ai_agents.handler import PydanticAI
 class PydanticAIProviderConfig(BaseA2AProviderConfig):
     """
     Provider configuration for Pydantic AI agents.
-    
+
     Pydantic AI agents follow A2A protocol but don't support streaming natively.
     This config provides fake streaming by converting non-streaming responses into streaming chunks.
     """
@@ -48,4 +48,3 @@ class PydanticAIProviderConfig(BaseA2AProviderConfig):
             delay_ms=kwargs.get("delay_ms", 10),
         ):
             yield chunk
-

litellm/a2a_protocol/providers/pydantic_ai_agents/handler.py

@@ -16,7 +16,7 @@ from litellm.a2a_protocol.providers.pydantic_ai_agents.transformation import (
 class PydanticAIHandler:
     """
     Handler for Pydantic AI agent requests.
-    
+
     Provides:
     - Direct non-streaming requests to Pydantic AI agents
     - Fake streaming by converting non-streaming responses into streaming chunks
@@ -41,9 +41,7 @@ class PydanticAIHandler:
         Returns:
             A2A SendMessageResponse dict
         """
-        verbose_logger.info(
-            f"Pydantic AI: Routing to Pydantic AI agent at {api_base}"
-        )
+        verbose_logger.info(f"Pydantic AI: Routing to Pydantic AI agent at {api_base}")
 
         # Send request directly to Pydantic AI agent
         response_data = await PydanticAITransformation.send_non_streaming_request(
@@ -102,5 +100,3 @@ class PydanticAIHandler:
             delay_ms=delay_ms,
         ):
             yield chunk
-
-