From 2d8b2dcb25b6cb21b592a5bf434a52a232b9b666 Mon Sep 17 00:00:00 2001
From: yucheng-berri <293926326+yucheng-berri@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:11:08 -0700
Subject: [PATCH] docs(mcp): describe the legacy KDF grace window as default-on

litereview flagged that the session/bridge docstrings still called the
grace window opt-in after the default flipped on; align them with the
LITELLM_MCP_LEGACY_KDF_GRACE=false opt-out semantics.
---
 .../mcp_server/outbound_credentials/bridge_credentials.py     | 4 ++--
 .../mcp_server/outbound_credentials/session_credentials.py    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
index d64dd46cad1..8c12df285bb 100644
--- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
+++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/bridge_credentials.py
@@ -67,7 +67,7 @@ def envelope_keys_from_master_key(master_key: str) -> EnvelopeKeys:
 @lru_cache(maxsize=8)
 def _legacy_envelope_keys(master_key: str) -> EnvelopeKeys | None:
     """The pre-rotation scrypt subkeys, kept so envelopes minted before the KDF rotation
-    can still be opened during the opt-in grace window. ``None`` when scrypt is unavailable."""
+    can still be opened during the default-on grace window. ``None`` when scrypt is unavailable."""
     signing: Final = legacy_scrypt(master_key, _SIGNING_KEY_DOMAIN)
     encryption: Final = legacy_scrypt(master_key, _ENCRYPTION_KEY_DOMAIN)
     if signing is None or encryption is None:
@@ -78,7 +78,7 @@ def _legacy_envelope_keys(master_key: str) -> EnvelopeKeys | None:
 def legacy_envelope_keys_from_master_key(
     master_key: str, environ: Callable[[str], str | None] = os.environ.get
 ) -> EnvelopeKeys | None:
-    """The legacy envelope keys when the operator enabled the KDF grace window, else ``None``."""
+    """The legacy envelope keys unless the operator explicitly disabled the KDF grace window."""
     if not legacy_kdf_grace_enabled(environ):
         return None
     return _legacy_envelope_keys(master_key)
diff --git a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
index a147a737817..9c20bc573f1 100644
--- a/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
+++ b/litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py
@@ -65,7 +65,7 @@ def session_keys_from_master_key(master_key: str) -> SessionKeys:
 @lru_cache(maxsize=8)
 def _legacy_session_keys(master_key: str) -> SessionKeys | None:
     """The pre-rotation scrypt signing key, kept so session tokens minted before the KDF
-    rotation can still be opened during the opt-in grace window. ``None`` when scrypt is
+    rotation can still be opened during the default-on grace window. ``None`` when scrypt is
     unavailable."""
     signing: Final = legacy_scrypt(master_key, _SESSION_SIGNING_KEY_DOMAIN)
     if signing is None:
@@ -78,7 +78,7 @@ def legacy_session_keys_from_master_key(
     active: SessionSigningKeys,
     environ: Callable[[str], str | None] = os.environ.get,
 ) -> SessionKeys | None:
-    """The legacy session key when the operator enabled the KDF grace window, else ``None``.
+    """The legacy session key unless the operator explicitly disabled the KDF grace window.
 
     The fallback only applies to the default master-key HS256 path: a configured
     ``mcp_session_token_signing`` RS256 key was never scrypt-derived, so an