From 4f3e79ee20670d4833abee98f02a13de71736356 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 21 May 2026 21:19:24 +0000 Subject: [PATCH] refactor(mcp): drop redundant has_client_credentials filter on passthrough probe is_oauth_passthrough already requires auth_type in (None, MCPAuth.none), which is mutually exclusive with has_client_credentials (auth_type == MCPAuth.oauth2), so the extra guard was always True and only added confusion about whether a server could be both passthrough and M2M. Co-authored-by: Yassin Kortam --- litellm/proxy/_experimental/mcp_server/server.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py index 104aff5856a..3ee4c29abd1 100644 --- a/litellm/proxy/_experimental/mcp_server/server.py +++ b/litellm/proxy/_experimental/mcp_server/server.py @@ -3087,12 +3087,11 @@ if MCP_AVAILABLE: # Authorization in extra_headers). Gateway-managed OAuth2 servers # must not receive the ``resource_metadata=`` challenge emitted # below — they require ``authorization_uri=`` pointing at the - # gateway AS metadata. + # gateway AS metadata. ``is_oauth_passthrough`` already requires + # ``auth_type in (None, MCPAuth.none)``, which is mutually + # exclusive with ``has_client_credentials`` (oauth2 + M2M flow), + # so M2M servers are implicitly excluded here. if srv.is_oauth_passthrough - # Exclude M2M servers: _prepare_mcp_server_headers skips caller - # Authorization when has_client_credentials is set, so probing - # those with the caller's token would send the wrong credential. - and not srv.has_client_credentials ] if not passthrough_servers: return