fix(mcp): use enum type for approval_status; true count query; block view-only admin from /register

litellm/proxy/_experimental/mcp_server/db.py

@@ -511,10 +511,12 @@ async def get_mcp_submissions(
     along with a summary count breakdown by approval_status.
     Mirrors get_guardrail_submissions() from guardrail_endpoints.py.
     """
+    _where = {"submitted_at": {"not": None}}
+    total_count = await prisma_client.db.litellm_mcpservertable.count(where=_where)
     rows = await prisma_client.db.litellm_mcpservertable.find_many(
-        where={"submitted_at": {"not": None}},
+        where=_where,
         order={"submitted_at": "desc"},
-        take=500,  # safety cap; paginate if needed in a future iteration
+        take=500,  # page 1 cap; paginate if needed in a future iteration
     )
     items = [LiteLLM_MCPServerTable(**r.model_dump()) for r in rows]
 
@@ -523,7 +525,7 @@ async def get_mcp_submissions(
     rejected = sum(1 for i in items if i.approval_status == MCPApprovalStatus.rejected)
 
     return MCPSubmissionsSummary(
-        total=len(items),
+        total=total_count,  # true total even when items is capped at 500
         pending_review=pending,
         active=active,
         rejected=rejected,

litellm/proxy/_types.py

@@ -1126,7 +1126,7 @@ class NewMCPServerRequest(LiteLLMPydanticObjectBase):
     source_url: Optional[str] = None
     # BYOM submission fields — set by the endpoint, not by the caller.
     # Any caller-provided values are silently overridden before persistence.
-    approval_status: Optional[str] = Field(
+    approval_status: Optional[MCPApprovalStatus] = Field(
         None, description="Server-managed: set by the endpoint; caller values are overridden."
     )
     submitted_by: Optional[str] = Field(
@@ -1260,8 +1260,8 @@ class LiteLLM_MCPServerTable(LiteLLMPydanticObjectBase):
     has_user_credential: Optional[bool] = None
     source_url: Optional[str] = None
     # BYOM submission fields
-    approval_status: Optional[str] = Field(
-        default="active",
+    approval_status: Optional[MCPApprovalStatus] = Field(
+        default=MCPApprovalStatus.active,
         description="Approval status: 'pending_review', 'active', 'rejected'",
     )
     submitted_by: Optional[str] = None

litellm/proxy/management_endpoints/mcp_management_endpoints.py

@@ -765,7 +765,10 @@ if MCP_AVAILABLE:
         Creates the server with approval_status=pending_review.
         Requires a team-scoped API key.
         """
-        if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN:
+        if user_api_key_dict.user_role in (
+            LitellmUserRoles.PROXY_ADMIN,
+            LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+        ):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail={