From 88af7dca021f7c4396bd39ad131bf3daca389f58 Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Mon, 23 Mar 2026 13:01:14 -0700 Subject: [PATCH] fix(mcp): treat None/[] team mcp_toolsets as no restriction in key validation --- .../object_permission_utils.py | 35 +++++++++---------- 1 file changed, 16 insertions(+), 19 deletions(-) diff --git a/litellm/proxy/management_helpers/object_permission_utils.py b/litellm/proxy/management_helpers/object_permission_utils.py index ed4d1bc36c0..410f636693f 100644 --- a/litellm/proxy/management_helpers/object_permission_utils.py +++ b/litellm/proxy/management_helpers/object_permission_utils.py @@ -384,22 +384,19 @@ async def validate_key_mcp_servers_against_team( # Only enforce the team-based restriction when a team is present — standalone # keys (no team) can freely be granted any toolset by an admin. if requested_toolsets and team_obj is not None: - team_toolsets: Set[str] = set() - if ( - team_obj.object_permission is not None - and team_obj.object_permission.mcp_toolsets - ): - team_toolsets = set(team_obj.object_permission.mcp_toolsets) - - disallowed_toolsets = requested_toolsets - team_toolsets - if disallowed_toolsets: - raise HTTPException( - status_code=status.HTTP_403_FORBIDDEN, - detail={ - "error": ( - f"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': " - f"{sorted(disallowed_toolsets)}. " - f"Team allows: {sorted(team_toolsets)}." - ) - }, - ) + team_op = team_obj.object_permission + team_mcp_toolsets = team_op.mcp_toolsets if team_op is not None else None + # None or [] means the team has no toolset restriction — allow any toolsets. + if team_mcp_toolsets: + disallowed_toolsets = requested_toolsets - set(team_mcp_toolsets) + if disallowed_toolsets: + raise HTTPException( + status_code=status.HTTP_403_FORBIDDEN, + detail={ + "error": ( + f"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': " + f"{sorted(disallowed_toolsets)}. " + f"Team allows: {sorted(team_mcp_toolsets)}." + ) + }, + )