scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-06 02:48:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 103

fix(mcp): fail closed on authoritative caller team outages

Browse source
This commit is contained in:
Joshua Valluru 2026-09-30 10:20:57 -07:00
parent bd3a240d47
commit 36d57276a3
2 changed files with 28 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py
View file

@ -2755,7 +2755,9 @@ class MCPRequestHandler:
)
return list(servers)
except Exception as e:
if isinstance(e, UnloadableEntitlementError):
if isinstance(e, UnloadableEntitlementError) or (
user_api_key_auth is not None and user_api_key_auth.requires_fresh_policy
):
raise
verbose_logger.warning("Failed to get allowed MCP servers for team: %s", e)
return []

25
tests/test_litellm/proxy/_experimental/mcp_server/auth/test_managed_agent_access.py
View file

@ -532,3 +532,28 @@ async def test_caller_mcp_revocation_uses_fresh_policy(
assert set(await MCPRequestHandler.get_allowed_mcp_servers(auth)) == ({"slack"} if fresh else {"slack", "linear"})
assert await MCPRequestHandler.get_allowed_tools_for_server("slack", auth) == (["read"] if fresh else ["read", "write"])
@pytest.mark.asyncio
@pytest.mark.parametrize("fresh", [False, True])
async def test_caller_team_outage_cannot_remove_authoritative_server_ceiling(
monkeypatch: pytest.MonkeyPatch, fresh: bool,
) -> None:
from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
from litellm.types.agents import AgentCaller
database: Final = MagicMock()
database.writer_db.litellm_teamtable.find_unique = AsyncMock(side_effect=RuntimeError("writer unavailable"))
database.db.litellm_teamtable.find_unique = AsyncMock(side_effect=RuntimeError("reader unavailable"))
monkeypatch.setattr(proxy_server, "prisma_client", database)
monkeypatch.setattr(proxy_server, "user_api_key_cache", UserApiKeyCache())
auth: Final = actor(("read",))
auth.agent_caller = AgentCaller(team_id="caller")
auth.requires_fresh_policy = fresh
if fresh:
with pytest.raises(HTTPException) as failure:
await MCPRequestHandler.get_allowed_mcp_servers(auth)
assert failure.value.status_code == 503
else:
assert set(await MCPRequestHandler.get_allowed_mcp_servers(auth)) == {"slack", "linear"}