scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-08 03:08:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 114

fix(mcp): treat None/[] team mcp_toolsets as no restriction in key validation

Browse source
This commit is contained in:
Ishaan Jaffer 2026-03-23 13:01:14 -07:00
parent a55d06321c
commit 88af7dca02
1 changed files with 16 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
litellm/proxy/management_helpers/object_permission_utils.py
View file

@ -384,22 +384,19 @@ async def validate_key_mcp_servers_against_team(
# Only enforce the team-based restriction when a team is present — standalone
# keys (no team) can freely be granted any toolset by an admin.
if requested_toolsets and team_obj is not None:
team_toolsets: Set[str] = set()
if (
team_obj.object_permission is not None
and team_obj.object_permission.mcp_toolsets
):
team_toolsets = set(team_obj.object_permission.mcp_toolsets)
disallowed_toolsets = requested_toolsets - team_toolsets
if disallowed_toolsets:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={
"error": (
f"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': "
f"{sorted(disallowed_toolsets)}. "
f"Team allows: {sorted(team_toolsets)}."
)
},
)
team_op = team_obj.object_permission
team_mcp_toolsets = team_op.mcp_toolsets if team_op is not None else None
# None or [] means the team has no toolset restriction — allow any toolsets.
if team_mcp_toolsets:
disallowed_toolsets = requested_toolsets - set(team_mcp_toolsets)
if disallowed_toolsets:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail={
"error": (
f"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': "
f"{sorted(disallowed_toolsets)}. "
f"Team allows: {sorted(team_mcp_toolsets)}."
)
},
)