From 3b3a244c1ac7d40125db4a080a99d681c5a7c05f Mon Sep 17 00:00:00 2001 From: awais qureshi Date: Tue, 10 Mar 2026 17:35:29 +0500 Subject: [PATCH] Fix: Add a log warning when we suppress auto-discovery so existing users know what happened. --- .../mcp_server/mcp_server_manager.py | 16 ++++++++++++---- .../mcp_server/test_mcp_server_manager.py | 2 +- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py index 240501e5085..c2f1805f7c3 100644 --- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py +++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py @@ -299,13 +299,21 @@ class MCPServerManager: mcp_oauth_metadata.authorization_url if mcp_oauth_metadata else None ) _explicit_token_url = server_config.get("token_url") - _has_pkce_creds = bool( + _has_client_creds = bool( server_config.get("client_id") and server_config.get("client_secret") ) + _discovered_token_url = mcp_oauth_metadata.token_url if mcp_oauth_metadata else None + if not _explicit_token_url and _has_client_creds and _discovered_token_url: + verbose_logger.warning( + "MCP server '%s': auto-discovered token_url '%s' ignored because " + "client_id + client_secret are set without an explicit token_url, " + "which signals a 3LO (authorization_code) flow. " + "Set token_url explicitly in config to use 2LO (client_credentials).", + server_id, + _discovered_token_url, + ) resolved_token_url = _explicit_token_url or ( - (mcp_oauth_metadata.token_url if mcp_oauth_metadata else None) - if not _has_pkce_creds - else None + _discovered_token_url if not _has_client_creds else None ) resolved_registration_url = server_config.get("registration_url") or ( mcp_oauth_metadata.registration_url if mcp_oauth_metadata else None diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py index c5cfeb165c4..15760a045e3 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py @@ -1218,7 +1218,7 @@ class TestMCPServerManager: When client_id + client_secret are configured but token_url is absent (3LO intent), auto-discovered token_url must NOT be stored on the server — otherwise has_client_credentials returns True and incorrectly triggers the - client_credentials (2LO) grant, leaving the tool set empty. + client_credentials (2LO) grant, leaving the tool set empty """ manager = MCPServerManager()