scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-12 08:42:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 207

feat(mcp): reject secret_headers for config.yaml servers

Browse source
This commit is contained in:
shrey kharbanda 2026-11-07 09:32:33 -08:00
parent c89908d035
commit 41456fc16a
2 changed files with 38 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
litellm/proxy/mcp_server/mcp_server_manager.py
View file

@ -2643,6 +2643,12 @@ class MCPServerManager:
warn_if_mcp_stdio_blocked(server_name, server_config.get("transport"))
auth_type = server_config.get("auth_type", None)
if auth_type == MCPAuth.secret_headers:
raise ValueError(
f"Invalid config for MCP server '{server_name}': auth_type secret_headers is not supported in "
"config.yaml, because the headers are stored encrypted with the server. Create the server in "
"the dashboard or through the API instead."
)
manual_issuer = _blank_to_none(server_config.get("issuer"))
manual_authorization_url = _blank_to_none(server_config.get("authorization_url"))
manual_token_url = _blank_to_none(server_config.get("token_url"))

32
tests/unit/proxy/mcp_server/test_mcp_secret_headers.py
View file

@ -263,3 +263,35 @@ def test_preview_ignores_credential_headers_for_any_other_auth_type(auth_type: M
)
assert rest_endpoints._preview_static_headers(request) == _STATIC_HEADERS
assert rest_endpoints._preview_credential_header_names(request) == ()
@pytest.mark.asyncio
async def test_config_file_server_with_secret_headers_is_rejected_when_loaded() -> None:
manager: Final = MCPServerManager()
config: Final = {
"datadog": {
"url": _URL,
"transport": MCPTransport.http,
"auth_type": MCPAuth.secret_headers,
"credentials": {"headers": dict(_CREDENTIAL_HEADERS)},
}
}
with pytest.raises(ValueError, match="'datadog'.*secret_headers"):
await manager.load_servers_from_config(config)
assert not manager.config_mcp_servers
@pytest.mark.asyncio
@pytest.mark.parametrize("auth_type", [MCPAuth.none, MCPAuth.api_key])
async def test_config_file_server_with_another_auth_type_still_loads(auth_type: MCPAuth) -> None:
manager: Final = MCPServerManager()
config: Final = {
"datadog": {
"url": _URL,
"transport": MCPTransport.http,
"auth_type": auth_type,
"static_headers": _STATIC_HEADERS,
}
}
await manager.load_servers_from_config(config)
assert [server.auth_type for server in manager.config_mcp_servers.values()] == [auth_type]