diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
index d64dd46cad1..8c12df285bb 100644
--- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
+++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
@@ -67,7 +67,7 @@ def envelope_keys_from_master_key(master_key: str) -> EnvelopeKeys:
 @lru_cache(maxsize=8)
 def _legacy_envelope_keys(master_key: str) -> EnvelopeKeys | None:
     """The pre-rotation scrypt subkeys, kept so envelopes minted before the KDF rotation
-    can still be opened during the opt-in grace window. ``None`` when scrypt is unavailable."""
+    can still be opened during the default-on grace window. ``None`` when scrypt is unavailable."""
     signing: Final = legacy_scrypt(master_key, _SIGNING_KEY_DOMAIN)
     encryption: Final = legacy_scrypt(master_key, _ENCRYPTION_KEY_DOMAIN)
     if signing is None or encryption is None:
@@ -78,7 +78,7 @@ def _legacy_envelope_keys(master_key: str) -> EnvelopeKeys | None:
 def legacy_envelope_keys_from_master_key(
     master_key: str, environ: Callable[[str], str | None] = os.environ.get
 ) -> EnvelopeKeys | None:
-    """The legacy envelope keys when the operator enabled the KDF grace window, else ``None``."""
+    """The legacy envelope keys unless the operator explicitly disabled the KDF grace window."""
     if not legacy_kdf_grace_enabled(environ):
         return None
     return _legacy_envelope_keys(master_key)
diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
index a147a737817..9c20bc573f1 100644
--- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
+++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
@@ -65,7 +65,7 @@ def session_keys_from_master_key(master_key: str) -> SessionKeys:
 @lru_cache(maxsize=8)
 def _legacy_session_keys(master_key: str) -> SessionKeys | None:
     """The pre-rotation scrypt signing key, kept so session tokens minted before the KDF
-    rotation can still be opened during the opt-in grace window. ``None`` when scrypt is
+    rotation can still be opened during the default-on grace window. ``None`` when scrypt is
     unavailable."""
     signing: Final = legacy_scrypt(master_key, _SESSION_SIGNING_KEY_DOMAIN)
     if signing is None:
@@ -78,7 +78,7 @@ def legacy_session_keys_from_master_key(
     active: SessionSigningKeys,
     environ: Callable[[str], str | None] = os.environ.get,
 ) -> SessionKeys | None:
-    """The legacy session key when the operator enabled the KDF grace window, else ``None``.
+    """The legacy session key unless the operator explicitly disabled the KDF grace window.
 
     The fallback only applies to the default master-key HS256 path: a configured
     ``mcp_session_token_signing`` RS256 key was never scrypt-derived, so an