From 73313c600fcb6b5705a35bad18568445c9d7355a Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 1 May 2026 11:58:35 -0700 Subject: [PATCH] fix(mcp): warn when OBO server has no subject_token and incomplete client credentials --- .../proxy/_experimental/mcp_server/oauth2_token_cache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 7c67206863c..5fe8f078a55 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -287,6 +287,14 @@ async def resolve_mcp_auth( if server.client_id and server.client_secret and server.token_url: token, _ = await mcp_oauth2_token_cache._fetch_token(server) return token + # OBO configured but no subject_token and missing client credentials — warn + # rather than silently proceeding unauthenticated. + verbose_logger.warning( + "MCP server '%s' is configured for token exchange (OBO) but no subject_token " + "was provided and client credentials (client_id/client_secret/token_url) are " + "incomplete. The request will proceed without authentication.", + server.server_id, + ) if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token