diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
index 816ae9aea59..c5102c303af 100644
--- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
+++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
@@ -28,7 +28,7 @@ from contextlib import asynccontextmanager
 from dataclasses import dataclass, replace
 from functools import lru_cache
 from itertools import chain, groupby
-from types import MappingProxyType
+from types import EllipsisType, MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, Generic, Literal, TypeAlias, TypedDict, TypeVar, cast
 from urllib.parse import ParseResult, urlparse
 
@@ -257,6 +257,20 @@ _user_env_vars_cache: Final[dict[tuple[str, str], tuple[dict[str, str], float]]]
 _USER_ENV_VARS_CACHE_TTL: Final = 60  # seconds
 _USER_ENV_VARS_CACHE_MAX_SIZE: Final = 4096  # cap to prevent unbounded growth
 
+_ListedToolsByCaller: TypeAlias = Mapping[str | None, Mapping[str, MCPTool]]
+_LISTED_TOOLS_CALLERS_PER_SERVER: Final = 256
+
+
+@dataclass(frozen=True, slots=True)
+class ListedToolsCaller:
+    """Request inputs that select which upstream catalog a caller was shown by tools/list."""
+
+    user_api_key_auth: UserAPIKeyAuth | None = None
+    mcp_auth_header: str | dict[str, str] | None = None
+    raw_headers: Mapping[str, str] | None = None
+    oauth2_headers: Mapping[str, str] | None = None
+
+
 # Auth types whose upstream OAuth endpoints (protected-resource + authorization-server metadata) the
 # gateway discovers from the upstream itself: interactive oauth2 and the two client-forwarded modes.
 # OBO/M2M endpoint discovery is decided separately via _obo_needs_endpoint_discovery. Shared by the
@@ -1170,6 +1184,57 @@ def _authorization_is_litellm_admission_credential(
     return bool(user_api_key_auth and user_api_key_auth.api_key and not admission_header)
 
 
+def _server_auth_header_for(
+    server: MCPServer,
+    mcp_server_auth_headers: Mapping[str, str | dict[str, str]] | None,
+    mcp_auth_header: str | dict[str, str] | None,
+) -> str | dict[str, str] | None:
+    """Server-specific ``x-mcp-<alias>-authorization`` header, else the deprecated global one."""
+    server_specific: Final = (
+        lookup_mcp_server_auth_in_headers(
+            mcp_server_auth_headers,
+            alias=server.alias,
+            server_name=server.server_name,
+            access_groups=server.access_groups,
+        )
+        if mcp_server_auth_headers
+        else None
+    )
+    return mcp_auth_header if server_specific is None else server_specific
+
+
+def listed_tools_caller_for(
+    server: MCPServer,
+    user_api_key_auth: UserAPIKeyAuth | None,
+    mcp_auth_header: str | dict[str, str] | None,
+    mcp_server_auth_headers: Mapping[str, str | dict[str, str]] | None,
+    raw_headers: Mapping[str, str] | None,
+    oauth2_headers: Mapping[str, str] | None,
+) -> ListedToolsCaller:
+    """The caller a tools/call must look its listed entry up under: the same inputs tools/list keyed by."""
+    return ListedToolsCaller(
+        user_api_key_auth=user_api_key_auth,
+        mcp_auth_header=_server_auth_header_for(server, mcp_server_auth_headers, mcp_auth_header),
+        raw_headers=raw_headers,
+        oauth2_headers=oauth2_headers,
+    )
+
+
+def _admission_identity(
+    auth: UserAPIKeyAuth, raw_headers: Mapping[str, str] | None
+) -> tuple[str | None, str | None, str | None, str | None, str | None]:
+    """The admission identity the served catalog is shaped for: the hashed key, user, team and
+    organization, plus the admission credential (``x-litellm-api-key``, else ``Authorization``) of a
+    caller admitted with neither a key nor a user."""
+    keyless: Final = auth.api_key is None and auth.user_id is None
+    credential: Final = (
+        _raw_header_value(raw_headers, "x-litellm-api-key") or _raw_header_value(raw_headers, "authorization")
+        if keyless
+        else None
+    )
+    return auth.api_key, auth.user_id, auth.team_id, auth.org_id, credential
+
+
 def _format_byok_openapi_auth_header(mcp_server: MCPServer, mcp_auth_header: str) -> str:
     """Format a raw BYOK credential for OpenAPI tool ``Authorization`` injection.
 
@@ -1295,6 +1360,16 @@ async def _resolve_byok_mcp_auth_header(
     return mcp_auth_header
 
 
+def _catalog_auth_header(
+    mcp_auth_header: str | dict[str, str] | None,
+    catalog_auth_header: str | dict[str, str] | None | EllipsisType,
+) -> str | dict[str, str] | None:
+    """The header the client supplied, which keys the caller's catalog slot on both tools/list and
+    tools/call. A caller that already swapped a stored BYOK credential into ``mcp_auth_header`` passes
+    the client's value explicitly, since the stored credential must never be read to find the slot."""
+    return mcp_auth_header if catalog_auth_header is ... else catalog_auth_header
+
+
 def _client_forwarded_authorization_headers(
     mcp_server: MCPServer,
     oauth2_headers: dict[str, str] | None,
@@ -1923,6 +1998,8 @@ class MCPServerManager:
             "gmail_send_email": "zapier_mcp_server",
         }
         """
+        self._listed_tools_by_server_id: dict[str, _ListedToolsByCaller] = {}  # mutable-ok: refreshed per tools/list
+        self._listed_tools_generations: dict[str, int] = {}  # mutable-ok: bumped per server save
         self._upstream_initialize_instructions_by_server_id: dict[str, str] = {}
         # Per-server monotonic timestamp of last upstream prefetch attempt (success,
         # empty result, or failure). Used to throttle re-probes for servers that do
@@ -3240,6 +3317,8 @@ class MCPServerManager:
                 self._invalidate_server_definition_caches(mcp_server.server_id)
                 self.registry[mcp_server.server_id] = new_server
                 await self._maybe_register_openapi_tools(new_server)
+                if new_server.spec_path:
+                    self._drop_listed_tools(mcp_server.server_id)
                 self.prime_oauth_metadata_discovery(new_server)
                 verbose_logger.debug("Added MCP Server: %s", new_server.name)
 
@@ -3277,6 +3356,8 @@ class MCPServerManager:
                 self._invalidate_server_definition_caches(mcp_server.server_id)
                 self.registry[mcp_server.server_id] = new_server
                 await self._maybe_register_openapi_tools(new_server)
+                if new_server.spec_path:
+                    self._drop_listed_tools(mcp_server.server_id)
                 self.prime_oauth_metadata_discovery(new_server)
                 verbose_logger.debug("Updated MCP Server: %s", new_server.name)
 
@@ -3748,25 +3829,14 @@ class MCPServerManager:
                 verbose_logger.warning("MCP Server %s not found", server_id)
                 return []
 
-            # Get server-specific auth header if available
-            server_auth_header: str | dict[str, str] | None = None
-            if mcp_server_auth_headers:
-                server_auth_header = lookup_mcp_server_auth_in_headers(
-                    mcp_server_auth_headers,
-                    alias=server.alias,
-                    server_name=server.server_name,
-                    access_groups=server.access_groups,
-                )
-
-            # Fall back to deprecated mcp_auth_header if no server-specific header found
-            if server_auth_header is None:
-                server_auth_header = mcp_auth_header
+            server_auth_header: Final = _server_auth_header_for(server, mcp_server_auth_headers, mcp_auth_header)
 
             try:
                 tools: Final = await self._get_tools_from_server(
                     server=server,
                     mcp_auth_header=server_auth_header,
                     user_api_key_auth=user_api_key_auth,
+                    record_listing=True,
                 )
                 return tools
             except Exception as e:
@@ -3846,7 +3916,7 @@ class MCPServerManager:
     def _build_stdio_env(
         self,
         server: MCPServer,
-        raw_headers: dict[str, str] | None = None,
+        raw_headers: Mapping[str, str] | None = None,
     ) -> dict[str, str] | None:
         """Resolve stdio env values, supporting header-driven placeholders."""
 
@@ -4141,13 +4211,20 @@ class MCPServerManager:
         oauth2_headers: dict[str, str] | None = None,
         client_ip: str | None = None,
         proxy_logging_obj: ProxyLogging | None = None,
-    ) -> list[MCPTool]:
+        *,
+        catalog_auth_header: str | dict[str, str] | None | EllipsisType = ...,
+        record_listing: bool = False,
+    ) -> Sequence[MCPTool]:
         """
         Helper method to get tools from a single MCP server with prefixed names.
 
         Args:
             server (MCPServer): The server to query tools from
             mcp_auth_header: Optional auth header for MCP server
+            catalog_auth_header: The header the client supplied, keying the caller's catalog slot;
+                defaults to ``mcp_auth_header``
+            record_listing: Record the served catalog into the caller's listed-tools slot; only a
+                listing actually served to the caller sets it
 
         Returns:
             List[MCPTool]: List of tools available on the server with prefixed names
@@ -4163,6 +4240,13 @@ class MCPServerManager:
         verbose_logger.info("_get_tools_from_server for %s...", server.name)
 
         client = None
+        listed_caller: Final = ListedToolsCaller(
+            user_api_key_auth=user_api_key_auth,
+            mcp_auth_header=_catalog_auth_header(mcp_auth_header, catalog_auth_header),
+            raw_headers=raw_headers,
+            oauth2_headers=oauth2_headers,
+        )
+        listed_generation: Final = self._listed_tools_generations.get(server.server_id, 0)
 
         try:
             # Tool *listing* must not be blocked by missing per-user env vars —
@@ -4260,8 +4344,12 @@ class MCPServerManager:
                 # applied (e.g. "test_petstore-getinventory").  Do NOT pass them
                 # through _create_prefixed_tools — that would add the prefix a second
                 # time producing "test_petstore-test_petstore-getinventory".
+                unprefixed_tools: Final = guarded_openapi
+                self._record_listed_tools(
+                    server, unprefixed_tools, listed_caller, listed_generation, record_listing=record_listing
+                )
                 if not add_prefix:
-                    return list(guarded_openapi)
+                    return unprefixed_tools
                 return [t.model_copy(update={"name": registered_names[t.name]}) for t in guarded_openapi]
             else:
                 tools = await self._fetch_tools_with_timeout(client, server.name)
@@ -4275,7 +4363,10 @@ class MCPServerManager:
                 raw_headers=raw_headers,
             )
             prefixed_or_original_tools: Final = self._create_prefixed_tools(
-                list(guarded_tools), server, add_prefix=add_prefix
+                guarded_tools, server, add_prefix=add_prefix
+            )
+            self._record_listed_tools(
+                server, guarded_tools, listed_caller, listed_generation, record_listing=record_listing
             )
 
             return prefixed_or_original_tools
@@ -4326,8 +4417,85 @@ class MCPServerManager:
         )
 
         self._invalidate_discovery_lists(server_id)
+        self._drop_listed_tools(server_id)
         invalidate_oauth_metadata_cache(server_id)
 
+    def _drop_listed_tools(self, server_id: str) -> None:
+        self._listed_tools_by_server_id.pop(server_id, None)
+        self._listed_tools_generations[server_id] = self._listed_tools_generations.get(server_id, 0) + 1
+
+    def _listed_tools_identity(self, server: MCPServer, caller: ListedToolsCaller | None) -> str | None:
+        """Key the listed-tool cache by every request input that can change the served catalog.
+
+        The catalog is guardrail-shaped for the caller's admission identity (default-on guardrails,
+        key or team selections and opt-outs), so every admitted caller gets its own slot, keyed by
+        ``_admission_identity``: the hashed key, user, team and organization, plus the admission
+        credential of a caller admitted with neither a key nor a user (a team-only JWT). Forwarded
+        headers, header-driven stdio env, the caller bearer on every server whose egress forwards it
+        (``_consumes_caller_authorization``) or exchanges it as the OBO subject, and the
+        server-specific auth header also reach upstream and split the slot further. Only unkeyed
+        listings with none of those share the ``None`` slot.
+        """
+        if caller is None:
+            return None
+        auth: Final = caller.user_api_key_auth
+        forwarded: Final = self._forwarded_header_values(server, caller.raw_headers) or None
+        header_env: Final = self._build_stdio_env(server, caller.raw_headers)
+        stdio_env: Final = None if header_env == self._build_stdio_env(server) else header_env
+        caller_bearer: Final = (
+            self._extract_subject_token(caller.oauth2_headers, caller.raw_headers, auth)
+            if _consumes_caller_authorization(server) or server.auth_type == MCPAuth.oauth2_token_exchange
+            else None
+        )
+        identity: Final = None if auth is None else _admission_identity(auth, caller.raw_headers)
+        if not (identity or caller.mcp_auth_header or forwarded or stdio_env or caller_bearer):
+            return None
+        material: Final = json.dumps(
+            (identity, caller.mcp_auth_header, forwarded, stdio_env, caller_bearer),
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        return hashlib.sha256(material.encode()).hexdigest()
+
+    @staticmethod
+    def _forwarded_header_values(
+        server: MCPServer, raw_headers: Mapping[str, str] | None
+    ) -> tuple[tuple[str, str], ...]:
+        if not raw_headers or not server.extra_headers:
+            return ()
+        forwarded_names: Final = frozenset(name.lower() for name in server.extra_headers)
+        return tuple(
+            sorted((name.lower(), value) for name, value in raw_headers.items() if name.lower() in forwarded_names)
+        )
+
+    def _record_listed_tools(
+        self,
+        server: MCPServer,
+        tools: Sequence[MCPTool],
+        caller: ListedToolsCaller | None,
+        generation: int | None = None,
+        *,
+        record_listing: bool = True,
+    ) -> None:
+        """Store the catalog served to ``caller``. ``generation`` is the server's listed-tools generation
+        read before the listing's upstream fetch; the record is skipped when it no longer matches."""
+        if not record_listing:
+            return
+        if generation is not None and generation != self._listed_tools_generations.get(server.server_id, 0):
+            return
+        identity: Final = self._listed_tools_identity(server, caller)
+        listing: Final = MappingProxyType({tool.name: tool for tool in tools})
+        existing: Final = self._listed_tools_by_server_id.get(server.server_id, MappingProxyType({}))
+        shared: Final = existing.get(None)
+        callers: Final = tuple((key, value) for key, value in existing.items() if key not in (None, identity))
+        evicted: Final = 0 if identity is None else max(len(callers) + 1 - _LISTED_TOOLS_CALLERS_PER_SERVER, 0)
+        entries: Final = (
+            *(() if shared is None else ((None, shared),)),
+            *callers[evicted:],
+            (identity, listing),
+        )
+        self._listed_tools_by_server_id[server.server_id] = MappingProxyType(dict(entries))
+
     def _discovery_key(
         self,
         server: MCPServer,
@@ -4337,9 +4505,11 @@ class MCPServerManager:
         stdio_env: dict[str, str] | None,
         subject_token: str | None,
         credential_fingerprint: str | None = None,
+        per_caller: bool = False,
     ) -> _DiscoveryKey:
         per_user: Final = (
-            server.requires_per_user_auth
+            per_caller
+            or server.requires_per_user_auth
             or self._references_per_user_env_var(server)
             or server.delegate_auth_to_upstream
             or server.auth_type in (MCPAuth.oauth2_token_exchange, MCPAuth.oauth2_id_jag)
@@ -5247,7 +5417,12 @@ class MCPServerManager:
             {seen: kept for seen, kept in self._catalog_alert_signatures.items() if seen != key}
         )
 
-    def _create_prefixed_tools(self, tools: list[MCPTool], server: MCPServer, add_prefix: bool = True) -> list[MCPTool]:
+    def _create_prefixed_tools(
+        self,
+        tools: Sequence[MCPTool],
+        server: MCPServer,
+        add_prefix: bool = True,
+    ) -> list[MCPTool]:
         """
         Create prefixed tools and update tool mapping.
 
@@ -5275,6 +5450,13 @@ class MCPServerManager:
         verbose_logger.info("Successfully fetched %s tools from server %s", len(prefixed_tools), server.name)
         return prefixed_tools
 
+    def get_listed_tool(self, server: MCPServer, name: str, caller: ListedToolsCaller | None = None) -> MCPTool | None:
+        identity: Final = self._listed_tools_identity(server, caller)
+        listed: Final = self._listed_tools_by_server_id.get(server.server_id, MappingProxyType({})).get(identity)
+        if not listed:
+            return None
+        return listed.get(name)
+
     def _create_prefixed_prompts(
         self, prompts: Sequence[Prompt], server: MCPServer, add_prefix: bool = True
     ) -> list[Prompt]:
@@ -5508,6 +5690,7 @@ class MCPServerManager:
         raw_headers: dict[str, str] | None = None,
         litellm_logging_obj: "LiteLLMLoggingObj | None" = None,
         guardrail_context: Mapping[str, object] | None = None,
+        tool: MCPTool | None = None,
     ) -> dict[str, Any]:
         """
         Run pre-call checks and guardrail hooks for an MCP tool call.
@@ -5521,6 +5704,9 @@ class MCPServerManager:
         ``pre_mcp_call`` evaluation (or a block) on the spend-log row the Guardrails
         Monitor counts. It stays optional so callers that do no logging are unchanged.
 
+        ``tool`` is the upstream tool definition when one was listed, so guardrails
+        can see its description and input schema, not just the name and arguments.
+
         Returns a dict that may contain:
         - "arguments": hook-modified tool arguments (only if changed)
         - "extra_headers": headers injected by pre_mcp_call guardrail hooks
@@ -5584,6 +5770,8 @@ class MCPServerManager:
             "user_api_key_hash": (getattr(user_api_key_auth, "api_key_hash", None) if user_api_key_auth else None),
             "incoming_bearer_token": incoming_bearer_token,
             "headers": logging_safe_mcp_headers(raw_headers),
+            "tool_description": tool.description if tool is not None else None,
+            "tool_input_schema": tool.input_schema if tool is not None else None,
         }
 
         # Create MCP request object for processing
@@ -5799,21 +5987,7 @@ class MCPServerManager:
             GuardrailRaisedException: If guardrails block the call
             HTTPException: If an HTTP error occurs
         """
-        # Get server-specific auth header if available (case-insensitive)
-        # FIX: Added case-insensitive matching to handle auth header keys that may not match
-        # the exact case of server alias/name (e.g., '1litellmagcgateway' vs '1LiteLLMAGCGateway')
-        server_auth_header: dict[str, str] | str | None = None
-        if mcp_server_auth_headers:
-            server_auth_header = lookup_mcp_server_auth_in_headers(
-                mcp_server_auth_headers,
-                alias=mcp_server.alias,
-                server_name=mcp_server.server_name,
-                access_groups=mcp_server.access_groups,
-            )
-
-        # Fall back to deprecated mcp_auth_header if no server-specific header found
-        if server_auth_header is None:
-            server_auth_header = mcp_auth_header
+        server_auth_header: Final = _server_auth_header_for(mcp_server, mcp_server_auth_headers, mcp_auth_header)
 
         # Extract subject token for OAuth2 Token Exchange (OBO) and ID-JAG flows
         subject_token: str | None = None
@@ -6236,6 +6410,9 @@ class MCPServerManager:
         guardrail_context: Mapping[str, object] | None = None,
         client_ip: str | None = None,
         wire_compat: WireCompat = WireCompat.LEGACY,
+        *,
+        catalog_auth_header: str | None | EllipsisType = ...,
+        listed_tool: MCPTool | None | EllipsisType = ...,
     ) -> CallToolResult | InputRequiredResult:
         """
         Call a tool with the given name and arguments
@@ -6247,6 +6424,8 @@ class MCPServerManager:
             user_api_key_auth: User authentication
             mcp_auth_header: MCP auth header (deprecated)
             mcp_server_auth_headers: Optional dict of server-specific auth headers {server_alias: auth_value}
+            catalog_auth_header: The header the client supplied, keying the caller's catalog slot;
+                defaults to ``mcp_auth_header`` as received, before BYOK resolution
             proxy_logging_obj: Optional ProxyLogging object for hook integration
             litellm_logging_obj: Optional request logger the guardrail hooks record
                 their evaluations onto, so MCP guardrail activity reaches the
@@ -6258,6 +6437,7 @@ class MCPServerManager:
         """
         start_time: Final = datetime.datetime.now()
         mcp_server: Final = self._resolve_mcp_server_for_tool_call(server_name, name)
+        client_auth_header: Final = _catalog_auth_header(mcp_auth_header, catalog_auth_header)
 
         # Resolved before any hook runs so a missing BYOK credential (401) never
         # leaves during-hook side effects (audit logging, rate-limit bookkeeping)
@@ -6267,6 +6447,9 @@ class MCPServerManager:
             user_api_key_auth,
             mcp_auth_header,
         )
+        listed_caller: Final = listed_tools_caller_for(
+            mcp_server, user_api_key_auth, client_auth_header, mcp_server_auth_headers, raw_headers, oauth2_headers
+        )
 
         #########################################################
         # Pre MCP Tool Call Hook
@@ -6283,6 +6466,7 @@ class MCPServerManager:
             raw_headers=raw_headers,
             litellm_logging_obj=litellm_logging_obj,
             guardrail_context=guardrail_context,
+            tool=self.get_listed_tool(mcp_server, name, listed_caller) if listed_tool is ... else listed_tool,
         )
         if "arguments" in hook_result:
             arguments = hook_result["arguments"]
diff --git a/litellm/proxy/_experimental/mcp_server/operations.py b/litellm/proxy/_experimental/mcp_server/operations.py
index f98a8c0ea5a..b0410e87103 100644
--- a/litellm/proxy/_experimental/mcp_server/operations.py
+++ b/litellm/proxy/_experimental/mcp_server/operations.py
@@ -81,12 +81,14 @@ from litellm.proxy._experimental.mcp_server.faults.list_outcomes import (
     outcome_wire_value,
 )
 from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
+    ListedToolsCaller,
     MCPServerManager,
     _caller_authorization_fans_out,
     _client_forwarded_authorization_headers,
     _resolve_openapi_tool_auth,
     _should_strip_caller_authorization,
     global_mcp_server_manager,
+    listed_tools_caller_for,
 )
 from litellm.proxy._experimental.mcp_server.oauth_utils import (
     _redact_mcp_resource_url,
@@ -954,6 +956,8 @@ async def _get_tools_from_mcp_servers(
     request_tags: list[str] | None = None,
     client_ip: str | None = None,
     mcp_proxy_mode: bool = False,
+    *,
+    record_listing: bool = False,
 ) -> AggregateToolListing:
     """
     Helper method to fetch tools from MCP servers based on server filtering criteria.
@@ -964,6 +968,8 @@ async def _get_tools_from_mcp_servers(
         mcp_servers: Optional list of server names/aliases to filter by
         mcp_server_auth_headers: Optional dict of server-specific auth headers
         oauth2_headers: Optional dict of oauth2 headers
+        record_listing: Record each served catalog into the caller's listed-tools slot; only a
+            listing actually served to the caller sets it
 
     Returns:
         AggregateToolListing: Combined tools from filtered servers plus each server's
@@ -1111,12 +1117,14 @@ async def _get_tools_from_mcp_servers(
                     prefetched_creds=_prefetched_oauth_creds,
                 )
 
+            catalog_auth_header: Final = server_auth_header
             if server.is_byok and server.auth_type != MCPAuth.oauth2 and server_auth_header is None:
                 server_auth_header = await _get_byok_credential(server, user_api_key_auth)
 
             try:
                 from litellm.proxy.proxy_server import proxy_logging_obj
 
+                listed_generation: Final = global_mcp_server_manager._listed_tools_generations.get(server.server_id, 0)
                 tools: Final = await global_mcp_server_manager._get_tools_from_server(
                     server=server,
                     mcp_auth_header=server_auth_header,
@@ -1127,6 +1135,8 @@ async def _get_tools_from_mcp_servers(
                     user_api_key_auth=user_api_key_auth,
                     oauth2_headers=oauth2_headers,
                     proxy_logging_obj=proxy_logging_obj,
+                    catalog_auth_header=catalog_auth_header,
+                    record_listing=False,
                 )
                 filtered_tools = filter_tools_by_allowed_tools(tools, server)
 
@@ -1135,6 +1145,21 @@ async def _get_tools_from_mcp_servers(
                     server_id=server.server_id,
                     user_api_key_auth=user_api_key_auth,
                 )
+                global_mcp_server_manager._record_listed_tools(
+                    server,
+                    [
+                        tool.model_copy(update={"name": strip_known_server_prefix(tool.name, server)})
+                        for tool in filtered_tools
+                    ],
+                    ListedToolsCaller(
+                        user_api_key_auth=user_api_key_auth,
+                        mcp_auth_header=catalog_auth_header,
+                        raw_headers=raw_headers,
+                        oauth2_headers=oauth2_headers,
+                    ),
+                    listed_generation,
+                    record_listing=record_listing,
+                )
 
                 if mcp_proxy_mode:
                     from litellm.proxy._experimental.mcp_server.tool_search import with_mcp_proxy_identity
@@ -1458,6 +1483,8 @@ async def _list_mcp_tools(
     list_tools_log_source: str | None = None,
     client_ip: str | None = None,
     mcp_proxy_mode: bool = False,
+    *,
+    record_listing: bool = False,
 ) -> AggregateToolListing:
     """
     List all available MCP tools.
@@ -1468,6 +1495,8 @@ async def _list_mcp_tools(
         mcp_servers: Optional list of server names/aliases to filter by
         mcp_server_auth_headers: Optional dict of server-specific auth headers {server_alias: auth_value}
         client_ip: Client IP for IP-based server access control
+        record_listing: Record each served catalog into the caller's listed-tools slot; only a
+            listing actually served to the caller sets it
 
     Returns:
         AggregateToolListing: Combined tools from all accessible servers plus each server's
@@ -1486,6 +1515,7 @@ async def _list_mcp_tools(
             list_tools_log_source=list_tools_log_source,
             client_ip=client_ip,
             mcp_proxy_mode=mcp_proxy_mode,
+            record_listing=record_listing,
         )
         verbose_logger.debug("Successfully fetched %s tools from managed MCP servers", len(listing.tools))
         return listing
@@ -1798,6 +1828,7 @@ async def _list_tools_before_first_call(
             oauth2_headers=oauth2_headers,
             raw_headers=raw_headers,
             client_ip=client_ip,
+            record_listing=False,
         )
     except Exception as e:  # noqa: BLE001  # best effort: resolution below answers as it did before
         verbose_logger.debug("MCP tools/call: listing %s before its first call failed: %s", server.name, e)
@@ -2001,6 +2032,7 @@ async def _execute_mcp_tool(
     if mcp_server is None:
         mcp_server = global_mcp_server_manager._get_mcp_server_from_tool_name(name)
 
+    client_auth_header: Final = mcp_auth_header
     if mcp_server:
         standard_logging_mcp_tool_call["mcp_server_cost_info"] = (mcp_server.mcp_info or {}).get("mcp_server_cost_info")
         if litellm_logging_obj:
@@ -2071,6 +2103,18 @@ async def _execute_mcp_tool(
             raw_headers=raw_headers,
             litellm_logging_obj=litellm_logging_obj,
             guardrail_context=guardrail_context,
+            tool=global_mcp_server_manager.get_listed_tool(
+                mcp_server,
+                original_tool_name,
+                listed_tools_caller_for(
+                    mcp_server,
+                    user_api_key_auth,
+                    client_auth_header,
+                    mcp_server_auth_headers,
+                    raw_headers,
+                    oauth2_headers,
+                ),
+            ),
         )
         # `pre_call_tool_check` may return guardrail-modified
         # arguments; honor them on the local path too.
@@ -2120,6 +2164,7 @@ async def _execute_mcp_tool(
             arguments=arguments,
             user_api_key_auth=user_api_key_auth,
             mcp_auth_header=mcp_auth_header,
+            catalog_auth_header=client_auth_header,
             mcp_server_auth_headers=mcp_server_auth_headers,
             oauth2_headers=oauth2_headers,
             raw_headers=raw_headers,
@@ -2139,7 +2184,8 @@ async def _execute_mcp_tool(
         # not in the registry either, `_handle_local_mcp_tool` below reports
         # 404 and nothing runs, so demanding a server here would turn every
         # unknown tool name into a misleading 503.
-        if global_mcp_tool_registry.get_tool(original_tool_name) is not None:
+        registered_local_tool: Final = global_mcp_tool_registry.get_tool(original_tool_name)
+        if registered_local_tool is not None:
             # `mcp_server` is None here because the tool name is not in the
             # tool -> server mapping, but the name still carries a prefix
             # that the server-level check above compared against the
@@ -2181,6 +2227,18 @@ async def _execute_mcp_tool(
                 raw_headers=raw_headers,
                 litellm_logging_obj=litellm_logging_obj,
                 guardrail_context=guardrail_context,
+                tool=global_mcp_server_manager.get_listed_tool(
+                    prefix_server,
+                    original_tool_name,
+                    listed_tools_caller_for(
+                        prefix_server,
+                        user_api_key_auth,
+                        client_auth_header,
+                        mcp_server_auth_headers,
+                        raw_headers,
+                        oauth2_headers,
+                    ),
+                ),
             )
             if "arguments" in hook_result:
                 arguments = hook_result["arguments"]  # pyright: ignore[reportAny]  # hook returns untyped args
@@ -2583,8 +2641,12 @@ async def _handle_managed_mcp_tool(
     guardrail_context: Mapping[str, object] | None = None,
     client_ip: str | None = None,
     wire_compat: WireCompat = WireCompat.LEGACY,
+    *,
+    catalog_auth_header: str | None,
 ) -> CallToolResult | InputRequiredResult:
-    """Handle tool execution for managed server tools"""
+    """Handle tool execution for managed server tools. ``catalog_auth_header`` is the header the client
+    supplied, which keys the caller's catalog slot; ``mcp_auth_header`` may already be the resolved
+    BYOK credential."""
     # Import here to avoid circular import
     from litellm.proxy.proxy_server import proxy_logging_obj
 
@@ -2594,6 +2656,7 @@ async def _handle_managed_mcp_tool(
         arguments=arguments,
         user_api_key_auth=user_api_key_auth,
         mcp_auth_header=mcp_auth_header,
+        catalog_auth_header=catalog_auth_header,
         mcp_server_auth_headers=mcp_server_auth_headers,
         oauth2_headers=oauth2_headers,
         raw_headers=raw_headers,
@@ -2712,6 +2775,7 @@ async def _execute_handle_list_tools(
             log_list_tools_to_spendlogs=log_list_tools_to_spendlogs,
             list_tools_log_source="mcp_protocol",
             client_ip=_client_ip,
+            record_listing=True,
         )
         verbose_logger.info("MCP list_tools - Successfully returned %s tools", len(listing.tools))
         if not listing.outcomes:
diff --git a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py
index d17b849750b..c8e12ce370a 100644
--- a/litellm/proxy/_experimental/mcp_server/rest_endpoints.py
+++ b/litellm/proxy/_experimental/mcp_server/rest_endpoints.py
@@ -223,6 +223,7 @@ if MCP_AVAILABLE:
     )
     from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
         _UPSTREAM_OAUTH_DISCOVERY_AUTH_TYPES,
+        ListedToolsCaller,
         global_mcp_server_manager,
     )
     from litellm.proxy._experimental.mcp_server.oauth_utils import (
@@ -703,6 +704,8 @@ if MCP_AVAILABLE:
         extra_headers: dict[str, str] | None,
         client_ip: str | None,
         proxy_logging_obj: "ProxyLogging | None",
+        *,
+        record_listing: bool,
     ) -> list[MCPTool]:
         return await global_mcp_server_manager._get_tools_from_server(
             server=server,
@@ -713,11 +716,12 @@ if MCP_AVAILABLE:
             client_ip=client_ip,
             user_api_key_auth=user_api_key_auth,
             proxy_logging_obj=proxy_logging_obj,
+            record_listing=record_listing,
         )
 
     async def _get_tools_for_single_server(
-        server,
-        server_auth_header,
+        server: MCPServer,
+        server_auth_header: dict[str, str] | str | None,
         raw_headers: dict[str, str] | None = None,
         user_api_key_auth: UserAPIKeyAuth | None = None,
         extra_headers: dict[str, str] | None = None,
@@ -733,31 +737,40 @@ if MCP_AVAILABLE:
         """
         from litellm.proxy.proxy_server import proxy_logging_obj
 
-        tools = await _list_server_tools(
-            server, server_auth_header, raw_headers, user_api_key_auth, extra_headers, client_ip, proxy_logging_obj
+        listed_generation: Final = global_mcp_server_manager._listed_tools_generations.get(server.server_id, 0)
+        tools: Final = await _list_server_tools(
+            server,
+            server_auth_header,
+            raw_headers,
+            user_api_key_auth,
+            extra_headers,
+            client_ip,
+            proxy_logging_obj,
+            record_listing=False,
         )
 
-        if not apply_tool_filters:
-            return _create_tool_response_objects(tools, server)
-
-        # Always apply allowed_tools/disallowed_tools so the blacklist is
-        # enforced even when no allowlist is set (matches the SSE/HTTP path).
-        tools = filter_tools_by_allowed_tools(tools, server)
-
-        # Filter by the key's effective tool permissions through the same
-        # function the MCP protocol path uses (direct grants, toolset grants,
-        # and team/agent/org ceilings), so REST listing cannot drift from it.
-        # Entries here are tool names on one server, written bare by every
-        # writer, and dispatch compares them bare; matching a wider set of
-        # spellings would advertise a tool that tools/call then refuses
-        if user_api_key_auth:
-            tools = await filter_tools_by_key_team_permissions(
-                tools=tools,
+        server_filtered: Final = filter_tools_by_allowed_tools(tools, server) if apply_tool_filters else tools
+        served_tools: Final = (
+            await filter_tools_by_key_team_permissions(
+                tools=server_filtered,
                 server_id=server.server_id,
                 user_api_key_auth=user_api_key_auth,
             )
+            if apply_tool_filters and user_api_key_auth
+            else server_filtered
+        )
+        global_mcp_server_manager._record_listed_tools(
+            server,
+            served_tools,
+            ListedToolsCaller(
+                user_api_key_auth=user_api_key_auth,
+                mcp_auth_header=server_auth_header,
+                raw_headers=raw_headers,
+            ),
+            listed_generation,
+        )
 
-        return _create_tool_response_objects(tools, server)
+        return _create_tool_response_objects(served_tools, server)
 
     async def fetch_pinnable_tool_catalog(
         server: MCPServer, request: Request, user_api_key_dict: UserAPIKeyAuth
@@ -776,6 +789,7 @@ if MCP_AVAILABLE:
             await _get_user_oauth_extra_headers(server, user_api_key_dict),
             IPAddressUtils.get_mcp_client_ip(request),
             None,
+            record_listing=False,
         )
         scan: Final = await scan_tool_descriptions(
             apply_description_overrides(upstream, server), server, proxy_logging_obj, user_api_key_dict, raw_headers
diff --git a/litellm/proxy/guardrails/guardrail_hooks/agent_365/agent_365.py b/litellm/proxy/guardrails/guardrail_hooks/agent_365/agent_365.py
index 6621d94ed96..c683e1f2c5d 100644
--- a/litellm/proxy/guardrails/guardrail_hooks/agent_365/agent_365.py
+++ b/litellm/proxy/guardrails/guardrail_hooks/agent_365/agent_365.py
@@ -19,7 +19,7 @@ from typing import TYPE_CHECKING, ClassVar, Final, Literal, NoReturn
 
 import httpx
 from fastapi import HTTPException
-from pydantic import TypeAdapter, ValidationError
+from pydantic import BaseModel, ConfigDict, Field, TypeAdapter, ValidationError
 from typing_extensions import ReadOnly, TypedDict
 
 from litellm._logging import verbose_proxy_logger
@@ -61,6 +61,7 @@ _GATEWAY_OWNED_TOKEN_ERRORS: Final = frozenset(
 _INVALID_ASSERTION_AADSTS_PREFIX: Final = "50027"
 _AADSTS_CODES_ADAPTER: Final = TypeAdapter(tuple[int, ...])
 _MCP_CALL_TYPES: Final[tuple[str, ...]] = ("mcp_call", "call_mcp_tool")
+_TOOL_INPUT_SCHEMA_ADAPTER: Final = TypeAdapter(dict[str, object])
 _OBO_CACHE_MAX_ENTRIES: Final = 1000
 _DEFAULT_TOKEN_TTL_SECONDS: Final = 3599.0
 _TOKEN_EXPIRY_SLACK_SECONDS: Final = 60.0
@@ -82,6 +83,13 @@ def _parse_aadsts_codes(raw: object) -> tuple[int, ...]:
         return ()
 
 
+def _parse_tool_input_schema(raw: object) -> Mapping[str, object] | None:
+    try:
+        return _TOOL_INPUT_SCHEMA_ADAPTER.validate_python(raw)
+    except ValidationError:
+        return None
+
+
 def entra_assertion(value: object) -> str | None:
     """``value`` when it is a compact JWS, the only bearer shape the OBO exchange accepts as its assertion.
     A LiteLLM virtual key, session bearer, or opaque upstream token in ``Authorization`` yields ``None``."""
@@ -100,6 +108,14 @@ class _EvaluateResponse(TypedDict, total=False):
     correlationId: ReadOnly[str]
 
 
+class _ToolReference(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    name: str
+    description: str | None = None
+    input_schema: Mapping[str, object] | None = Field(default=None, serialization_alias="inputSchema")
+
+
 class _UnavailableDetail(TypedDict):
     error: ReadOnly[str]
     message: ReadOnly[str]
@@ -392,8 +408,14 @@ class Agent365Guardrail(CustomGuardrail):
         arguments: Final = data.get("mcp_arguments")
         server_name: Final = str(data.get("mcp_server_name") or "litellm")
         agent_id: Final = user_api_key_dict.key_alias
+        description: Final = data.get("mcp_tool_description")
+        tool_reference: Final = _ToolReference(
+            name=tool_name,
+            description=description if isinstance(description, str) and description else None,
+            input_schema=_parse_tool_input_schema(data.get("mcp_input_schema")),
+        )
         payload: Final[dict[str, object]] = {  # mutable-ok: JSON body with optional fields added below
-            "tool": {"name": tool_name},
+            "tool": tool_reference.model_dump(by_alias=True, exclude_none=True),
             "serverName": server_name,
             "conversationId": self._resolve_conversation_id(data),
         }
diff --git a/litellm/proxy/management_endpoints/mcp_management_endpoints.py b/litellm/proxy/management_endpoints/mcp_management_endpoints.py
index 0d358302fa2..6403054783f 100644
--- a/litellm/proxy/management_endpoints/mcp_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/mcp_management_endpoints.py
@@ -1014,6 +1014,7 @@ if MCP_AVAILABLE:
             mcp_auth_header=None,
             mcp_servers=None,
             mcp_server_auth_headers=None,
+            record_listing=True,
         )
         tools: Final = listing.tools
         dumped_tools: Final = [tool.model_dump(by_alias=True) for tool in tools]
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index 5828ed94984..e447bcca703 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -1148,6 +1148,8 @@ def _overrides_moderation_hook(callback: CustomLogger) -> bool:
 
 
 _LISTED_MODEL_NAMES: Final = TypeAdapter(tuple[str, ...])
+_MCP_TOOL_DESCRIPTION: Final[TypeAdapter[str | None]] = TypeAdapter(str | None)
+_MCP_TOOL_INPUT_SCHEMA: Final[TypeAdapter[Mapping[str, object] | None]] = TypeAdapter(Mapping[str, object] | None)
 
 
 @dataclass(frozen=True, slots=True)
@@ -1472,9 +1474,14 @@ class ProxyLogging:
             TypeAdapter(dict[str, object]).validate_python(guardrail_context.get("metadata") or MappingProxyType({}))
         )
 
-        mcp_tool_description: Final = kwargs.get("mcp_tool_description")
-        mcp_input_schema: Final = kwargs.get("mcp_input_schema")
-        description_line: Final = f"\nDescription: {mcp_tool_description}" if mcp_tool_description else ""
+        mcp_tool_description: Final = request_obj.tool_description or kwargs.get("mcp_tool_description")
+        mcp_input_schema: Final = (
+            request_obj.tool_input_schema
+            if request_obj.tool_input_schema is not None
+            else kwargs.get("mcp_input_schema")
+        )
+        listing_description: Final = kwargs.get("mcp_tool_description")
+        description_line: Final = f"\nDescription: {listing_description}" if listing_description else ""
         tool_call_content: Final = (
             f"Tool: {request_obj.tool_name}{description_line}\nArguments: {request_obj.arguments}"
         )
@@ -1732,6 +1739,8 @@ class ProxyLogging:
             tool_name=kwargs.get("name", ""),
             arguments=kwargs.get("arguments", {}),
             server_name=kwargs.get("server_name"),
+            tool_description=_MCP_TOOL_DESCRIPTION.validate_python(kwargs.get("tool_description")),
+            tool_input_schema=_MCP_TOOL_INPUT_SCHEMA.validate_python(kwargs.get("tool_input_schema")),
             user_api_key_auth=user_api_key_auth_dict,
             hidden_params=HiddenParams(),
         )
diff --git a/litellm/responses/main.py b/litellm/responses/main.py
index 14c12fc571d..5e2793ed40d 100644
--- a/litellm/responses/main.py
+++ b/litellm/responses/main.py
@@ -286,6 +286,7 @@ async def aresponses_api_with_mcp(
             call_params=call_params,
             previous_response_id=previous_response_id,
             tool_server_map=tool_server_map,
+            served_tools=original_mcp_tools,
             **kwargs,
         )
         await mcp_streaming_response._create_initial_response_iterator()
@@ -339,6 +340,7 @@ async def aresponses_api_with_mcp(
 
             tool_results: Final = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls(
                 tool_server_map=tool_server_map,
+                served_tools=original_mcp_tools,
                 tool_calls=tool_calls,
                 user_api_key_auth=user_api_key_auth,
                 mcp_auth_header=mcp_auth_header,
@@ -395,6 +397,7 @@ async def aresponses_api_with_mcp(
 
                     final_response = MCPEnhancedStreamingIterator(
                         tool_server_map=tool_server_map,
+                        served_tools=original_mcp_tools,
                         base_iterator=final_response,
                         mcp_events=tool_execution_events,
                         user_api_key_auth=user_api_key_auth,
diff --git a/litellm/responses/mcp/chat_completions_handler.py b/litellm/responses/mcp/chat_completions_handler.py
index b17e0befba6..8aa4181cc8a 100644
--- a/litellm/responses/mcp/chat_completions_handler.py
+++ b/litellm/responses/mcp/chat_completions_handler.py
@@ -435,6 +435,7 @@ async def acompletion_with_mcp(
                         # Execute tool calls
                         self.tool_results = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls(
                             tool_server_map=self.tool_server_map,
+                            served_tools=deduplicated_mcp_tools,
                             tool_calls=self.tool_calls,
                             user_api_key_auth=self.user_api_key_auth,
                             mcp_auth_header=self.mcp_auth_header,
@@ -609,6 +610,7 @@ async def acompletion_with_mcp(
     tool_results: Final = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls(
         tool_server_map=tool_server_map,
         tool_calls=tool_calls,
+        served_tools=deduplicated_mcp_tools,
         user_api_key_auth=user_api_key_auth,
         mcp_auth_header=mcp_auth_header,
         mcp_server_auth_headers=mcp_server_auth_headers,
diff --git a/litellm/responses/mcp/litellm_proxy_mcp_handler.py b/litellm/responses/mcp/litellm_proxy_mcp_handler.py
index fb7882adcb4..1d6c0695621 100644
--- a/litellm/responses/mcp/litellm_proxy_mcp_handler.py
+++ b/litellm/responses/mcp/litellm_proxy_mcp_handler.py
@@ -696,6 +696,7 @@ class LiteLLM_Proxy_MCP_Handler:
         litellm_trace_id: str | None = None,
         request_tags: list[str] | None = None,
         guardrail_context: Mapping[str, object] | None = None,
+        served_tools: Sequence[MCPTool] | None = None,
     ) -> list[MCPToolResult]:
         """Execute tool calls and return results."""
         from fastapi import HTTPException
@@ -860,6 +861,11 @@ class LiteLLM_Proxy_MCP_Handler:
                     proxy_logging_obj=proxy_logging_obj,
                     litellm_logging_obj=litellm_logging_obj,
                     guardrail_context=guardrail_context,
+                    listed_tool=(
+                        next((tool for tool in served_tools if tool.name == tool_name), None)
+                        if served_tools is not None
+                        else ...
+                    ),
                 )
 
                 if proxy_logging_obj:
@@ -1152,6 +1158,7 @@ class LiteLLM_Proxy_MCP_Handler:
         call_params: Mapping[str, object],
         previous_response_id: str | None,
         tool_server_map: dict[str, str],
+        served_tools: Sequence[MCPTool] | None = None,
         **kwargs,
     ) -> Any:
         """
@@ -1181,6 +1188,7 @@ class LiteLLM_Proxy_MCP_Handler:
             base_iterator=None,  # Will be created internally
             mcp_events=mcp_discovery_events,  # Pre-generated MCP discovery events
             tool_server_map=tool_server_map,
+            served_tools=served_tools,
             mcp_tools_with_litellm_proxy=mcp_tools_with_litellm_proxy,
             user_api_key_auth=kwargs.get("user_api_key_auth")
             or kwargs.get("litellm_metadata", {}).get("user_api_key_auth"),
diff --git a/litellm/responses/mcp/mcp_streaming_iterator.py b/litellm/responses/mcp/mcp_streaming_iterator.py
index c0bb92cfb2a..b1f12233f33 100644
--- a/litellm/responses/mcp/mcp_streaming_iterator.py
+++ b/litellm/responses/mcp/mcp_streaming_iterator.py
@@ -281,6 +281,7 @@ class MCPEnhancedStreamingIterator(BaseResponsesAPIStreamingIterator):
         mcp_tools_with_litellm_proxy: Sequence[Mapping[str, object]] | None = None,
         user_api_key_auth: "UserAPIKeyAuth | None" = None,
         original_request_params: dict[str, Any] | None = None,
+        served_tools: Sequence[MCPTool] | None = None,
     ):
         # MCP setup
         self.mcp_tools_with_litellm_proxy = mcp_tools_with_litellm_proxy or []
@@ -300,6 +301,7 @@ class MCPEnhancedStreamingIterator(BaseResponsesAPIStreamingIterator):
         self.mcp_discovery_generated = True  # Events are already generated
         self.mcp_events = mcp_events  # Store the initial MCP events for backward compatibility
         self.tool_server_map = tool_server_map
+        self.served_tools = tuple(served_tools) if served_tools is not None else None
 
         # Iterator references
         self.base_iterator: BaseResponsesAPIStreamingIterator | ResponsesAPIResponse | None = (
@@ -796,6 +798,7 @@ class MCPEnhancedStreamingIterator(BaseResponsesAPIStreamingIterator):
             # Execute the tools
             tool_results: Final = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls(
                 tool_server_map=self.tool_server_map,
+                served_tools=self.served_tools,
                 tool_calls=tool_calls,
                 user_api_key_auth=self.user_api_key_auth,
                 mcp_auth_header=self.mcp_auth_header,
diff --git a/litellm/types/mcp.py b/litellm/types/mcp.py
index da7401e2a2e..ce86e79a6f0 100644
--- a/litellm/types/mcp.py
+++ b/litellm/types/mcp.py
@@ -429,6 +429,8 @@ class MCPPreCallRequestObject(BaseModel):
     tool_name: str
     arguments: dict[str, Any]
     server_name: str | None = None
+    tool_description: str | None = None
+    tool_input_schema: Mapping[str, object] | None = None
     user_api_key_auth: dict[str, Any] | None = None
     hidden_params: HiddenParams = HiddenParams()
 
@@ -452,6 +454,8 @@ class MCPDuringCallRequestObject(BaseModel):
     tool_name: str
     arguments: dict[str, Any]
     server_name: str | None = None
+    tool_description: str | None = None
+    tool_input_schema: Mapping[str, object] | None = None
     start_time: float | None = None
     hidden_params: HiddenParams = HiddenParams()
 
diff --git a/tests/integration/_support/mcp.py b/tests/integration/_support/mcp.py
index a3693433de4..d39d7e4029e 100644
--- a/tests/integration/_support/mcp.py
+++ b/tests/integration/_support/mcp.py
@@ -216,6 +216,16 @@ JsonRpc = Mapping[str, object]
 class ScriptedTool:
     name: str
     respond: Callable[[JsonRpc], Reply | JsonRpc]
+    description: str | Callable[[Mapping[str, str]], str] | None = None
+    input_schema: JsonRpc = field(default_factory=lambda: {"type": "object"})
+
+    def listing(self, headers: Mapping[str, str]) -> JsonRpc:
+        described: Final = self.description(headers) if callable(self.description) else self.description
+        return {
+            "name": self.name,
+            "inputSchema": self.input_schema,
+            **({} if described is None else {"description": described}),
+        }
 
 
 def jsonrpc_reply(identity: object, result: JsonRpc) -> Reply:
@@ -253,9 +263,7 @@ def scripted_peer(*tools: ScriptedTool) -> Iterator[McpPeer]:
                 },
             )
         if method == "tools/list":
-            return jsonrpc_reply(
-                identity, {"tools": [{"name": name, "inputSchema": {"type": "object"}} for name in by_name]}
-            )
+            return jsonrpc_reply(identity, {"tools": [tool.listing(request.headers) for tool in by_name.values()]})
         if method != "tools/call":
             return jsonrpc_error(identity, -32601, f"unsupported method {method}")
         tool: Final = by_name.get(body["params"]["name"])
diff --git a/tests/integration/mcp/test_mcp_credentials.py b/tests/integration/mcp/test_mcp_credentials.py
index 95a5e46646b..e53707a38cc 100644
--- a/tests/integration/mcp/test_mcp_credentials.py
+++ b/tests/integration/mcp/test_mcp_credentials.py
@@ -16,6 +16,7 @@ from integration._support.mcp import (
     tool_calls,
     tool_names,
 )
+from integration._support.oauth_server import oauth_server
 
 ADD: Final = {"a": 2, "b": 3}
 STATIC_MODES: Final = (
@@ -192,3 +193,111 @@ def test_byok_server_uses_the_calling_users_stored_credential_and_fails_closed_w
         assert removed.status_code in (200, 204), removed.text
         eventually(lambda: call_tool(gateway, owner_key, identity, name, ADD), lambda value: value.status_code == 401)
         assert tool_calls(peer.drain()) == ()
+
+
+def _listings(peer: McpPeer) -> tuple[dict[str, object], ...]:
+    return tuple(
+        item
+        for item in peer.drain()
+        if isinstance(item.get("body"), dict) and item["body"].get("method") == "tools/list"
+    )
+
+
+def test_oauth2_byok_listing_sends_the_minted_token_not_the_users_stored_secret(gateway: Gateway) -> None:
+    with mcp_peer() as peer, oauth_server() as auth, gateway.scenario() as scenario:
+        alias: Final = "cc" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(
+            scenario,
+            peer,
+            alias,
+            auth_type="oauth2",
+            oauth2_flow="client_credentials",
+            is_byok=True,
+            token_url=auth.issuer + "/token",
+            credentials={"client_id": "cc-client", "client_secret": "cc-secret-" + uuid.uuid4().hex},
+        )
+        owner: Final = scenario.user()
+        owner_key: Final = scenario.key(user_id=owner, object_permission={"mcp_servers": [identity]})
+        secret: Final = "byok-" + uuid.uuid4().hex
+        stored: Final = gateway.client.post(
+            f"/v1/mcp/server/{identity}/user-credential",
+            json={"credential": secret},
+            headers={"x-litellm-api-key": owner_key},
+        )
+        assert stored.status_code in (200, 201), stored.text
+        scenario.cleanups.callback(
+            gateway.client.delete,
+            f"/v1/mcp/server/{identity}/user-credential",
+            headers={"x-litellm-api-key": owner_key},
+        )
+        peer.drain()
+        auth.drain()
+        response: Final = gateway.client.get(
+            "/mcp-rest/tools/list", params={"server_id": identity}, headers={"x-litellm-api-key": owner_key}
+        )
+        assert response.status_code == 200, response.text
+        assert "add" in {tool["name"] for tool in response.json()["tools"]}, response.text
+        assert [request["grant_type"] for request in auth.token_requests()] == ["client_credentials"]
+        listings: Final = _listings(peer)
+        assert len(listings) == 1, listings
+        sent: Final = _header(listings[0], b"authorization")
+        assert sent is not None and auth.is_live(sent.decode().removeprefix("Bearer ")), sent
+        assert secret.encode() not in sent, "stored BYOK secret replaced the minted token on tools/list"
+
+
+@pytest.mark.parametrize(("auth_type", "header", "shape"), STATIC_MODES[:2])
+def test_byok_rest_listing_sends_the_servers_static_credential_not_the_users_stored_secret(
+    gateway: Gateway, auth_type: str, header: bytes, shape: str
+) -> None:
+    with mcp_peer() as peer, gateway.scenario() as scenario:
+        alias: Final = "byok" + uuid.uuid4().hex[:8]
+        static: Final = "static-" + uuid.uuid4().hex
+        identity: Final = register_mcp(
+            scenario, peer, alias, auth_type=auth_type, is_byok=True, credentials={"auth_value": static}
+        )
+        owner: Final = scenario.user()
+        owner_key: Final = scenario.key(user_id=owner, object_permission={"mcp_servers": [identity]})
+        secret: Final = "byok-" + uuid.uuid4().hex
+        stored: Final = gateway.client.post(
+            f"/v1/mcp/server/{identity}/user-credential",
+            json={"credential": secret},
+            headers={"x-litellm-api-key": owner_key},
+        )
+        assert stored.status_code in (200, 201), stored.text
+        scenario.cleanups.callback(
+            gateway.client.delete,
+            f"/v1/mcp/server/{identity}/user-credential",
+            headers={"x-litellm-api-key": owner_key},
+        )
+        peer.drain()
+        response: Final = gateway.client.get(
+            "/mcp-rest/tools/list", params={"server_id": identity}, headers={"x-litellm-api-key": owner_key}
+        )
+        assert response.status_code == 200, response.text
+        assert "add" in {tool["name"] for tool in response.json()["tools"]}, response.text
+        listings: Final = _listings(peer)
+        assert len(listings) == 1, listings
+        assert _header(listings[0], header) == shape.format(secret=static, basic="").encode(), listings[0]["headers"]
+        peer.drain()
+        called: Final = call_tool(gateway, owner_key, identity, f"{alias}-add", ADD)
+        assert called.status_code == 200, called.text
+        assert _header(_one_call(peer), header) == shape.format(secret=secret, basic="").encode()
+
+
+def test_deprecated_string_x_mcp_auth_lists_a_byok_server_for_a_key_without_a_user(gateway: Gateway) -> None:
+    with mcp_peer() as peer, gateway.scenario() as scenario:
+        alias: Final = "byok" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(scenario, peer, alias, auth_type="bearer_token", is_byok=True)
+        key: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        peer.drain()
+        response: Final = gateway.client.get(
+            "/mcp-rest/tools/list",
+            params={"server_id": identity},
+            headers={"x-litellm-api-key": key, "x-mcp-auth": "Bearer hdr"},
+        )
+        assert response.status_code == 200, response.text
+        names: Final = {tool["name"] for tool in response.json()["tools"]}
+        assert "add" in names, names
+        listings: Final = _listings(peer)
+        assert len(listings) == 1, listings
+        assert listings[0]["headers"].get(b"authorization") == b"Bearer hdr"
diff --git a/tests/integration/mcp/test_mcp_listed_tool_metadata.py b/tests/integration/mcp/test_mcp_listed_tool_metadata.py
new file mode 100644
index 00000000000..92cf56e9899
--- /dev/null
+++ b/tests/integration/mcp/test_mcp_listed_tool_metadata.py
@@ -0,0 +1,194 @@
+"""pre_mcp_call guardrails are handed the tool entry ``tools/list`` served to the caller.
+
+One owned proxy carries a default-on ``custom_code`` pre_mcp_call guardrail. At listing time it masks
+``SECRET`` out of every scanned text. At call time, when an argument carries the probe marker, it
+blocks and echoes the description and parameters it was handed, which is the only way to observe from outside
+what metadata the gateway attached to the hook
+"""
+
+import json
+import uuid
+from collections.abc import Iterator, Mapping
+from pathlib import Path
+from typing import Final
+
+import pytest
+import yaml
+from integration._support.client import Gateway, gateway_from_environment
+from integration._support.mcp import (
+    EntryPoint,
+    McpCaller,
+    ScriptedTool,
+    listed_tools,
+    openapi_peer,
+    register_mcp,
+    scripted_peer,
+    text_result,
+)
+from integration._support.process import owned_proxy
+
+_ECHO: Final = "catalog-echo:"
+_PROBE: Final = "catalog-probe"
+_GUARDRAIL_CODE: Final = (
+    "def apply_guardrail(inputs, request_data, input_type):\n"
+    '    texts = list(inputs.get("texts") or [])\n'
+    '    function = inputs.get("tools", [{}])[0].get("function", {})\n'
+    f'    if "{_PROBE}" in texts:\n'
+    f'        return block("{_ECHO}" + json_stringify('
+    '{"description": function.get("description"), "parameters": function.get("parameters")}))\n'
+    '    masked = [text.replace("SECRET", "[MASKED]") for text in texts]\n'
+    "    if masked != texts:\n"
+    "        return modify(texts=masked)\n"
+    "    return allow()\n"
+)
+
+
+@pytest.fixture(scope="module")
+def rig(tmp_path_factory: pytest.TempPathFactory) -> Iterator[Gateway]:
+    directory: Final = tmp_path_factory.mktemp("listed-tool-metadata")
+    config: Final = yaml.safe_load(Path("tests/integration/proxy_config.yaml").read_text())
+    config["guardrails"] = [
+        {
+            "guardrail_name": "catalog-echo-" + uuid.uuid4().hex[:8],
+            "litellm_params": {
+                "guardrail": "custom_code",
+                "mode": "pre_mcp_call",
+                "default_on": True,
+                "custom_code": _GUARDRAIL_CODE,
+            },
+        }
+    ]
+    path: Final = directory / "config.yaml"
+    path.write_text(yaml.safe_dump(config))
+    with gateway_from_environment() as gateway, owned_proxy(gateway, directory, {}, config=path) as candidate:
+        yield candidate
+
+
+def _strings(value: object) -> Iterator[str]:
+    if isinstance(value, str):
+        yield value
+        return
+    children: Final = value.values() if isinstance(value, Mapping) else value if isinstance(value, list) else ()
+    for child in children:
+        yield from _strings(child)
+
+
+def _decoded(raw: str) -> object:
+    data: Final = tuple(line[5:].strip() for line in raw.splitlines() if line.startswith("data:"))
+    return json.loads(data[-1] if data else raw)
+
+
+def _echoed(raw: str) -> tuple[str | None, Mapping[str, object] | None]:
+    """The (description, parameters) the guardrail was handed, recovered from its block reason."""
+    carrier: Final = next((text for text in _strings(_decoded(raw)) if _ECHO in text), None)
+    assert carrier is not None, raw
+    echoed, _ = json.JSONDecoder().raw_decode(carrier.split(_ECHO, 1)[1])
+    assert isinstance(echoed, dict), carrier
+    return echoed.get("description"), echoed.get("parameters")
+
+
+def _probe(caller: McpCaller, name: str, server_id: str) -> tuple[str | None, Mapping[str, object] | None]:
+    outcome: Final = caller.call(name, {"probe": _PROBE}, server_id=server_id)
+    assert outcome.error is not None, outcome.raw
+    return _echoed(outcome.raw)
+
+
+@pytest.mark.parametrize("entry", ["rest", "mcp"])
+def test_pre_call_hook_receives_the_description_and_input_schema_the_caller_was_listed(
+    rig: Gateway, entry: EntryPoint
+) -> None:
+    schema: Final = {"type": "object", "properties": {"probe": {"type": "string", "description": "a probe marker"}}}
+    tool: Final = ScriptedTool(
+        "lookup", lambda _: text_result("found"), description="Look up one record", input_schema=schema
+    )
+    with scripted_peer(tool) as peer, rig.scenario() as scenario:
+        alias: Final = "meta" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(scenario, peer, alias)
+        key: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        caller: Final = McpCaller(rig, key, entry, headers={"x-mcp-servers": alias})
+        assert caller.initialize().ok
+        listed: Final = caller.list_tools(server_id=identity)
+        assert listed.ok, listed.raw
+        name: Final = next(full for full in listed.tools if full.endswith("lookup"))
+        description, parameters = _probe(caller, name, identity)
+        assert description == "Look up one record", (description, parameters)
+        assert parameters is not None and parameters.get("properties") == schema["properties"], parameters
+
+
+def test_each_caller_is_evaluated_against_the_catalog_its_own_forwarded_headers_produced(rig: Gateway) -> None:
+    tool: Final = ScriptedTool(
+        "report",
+        lambda _: text_result("ok"),
+        description=lambda headers: f"Report for tenant {headers.get('x-tenant', 'nobody')}",
+    )
+    with scripted_peer(tool) as peer, rig.scenario() as scenario:
+        alias: Final = "tenant" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(scenario, peer, alias, extra_headers=["x-tenant"])
+        key: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        acme: Final = McpCaller(rig, key, "server_mcp", alias, headers={"x-tenant": "acme"})
+        globex: Final = McpCaller(rig, key, "server_mcp", alias, headers={"x-tenant": "globex"})
+        acme_listing: Final = acme.list_tools()
+        globex_listing: Final = globex.list_tools()
+        assert acme_listing.ok and globex_listing.ok, (acme_listing.raw, globex_listing.raw)
+        name: Final = next(full for full in acme_listing.tools if full.endswith("report"))
+        acme_seen, _ = _probe(acme, name, identity)
+        globex_seen, _ = _probe(globex, name, identity)
+        assert (acme_seen, globex_seen) == ("Report for tenant acme", "Report for tenant globex"), (
+            "each caller's tools/call must be evaluated against the catalog its own headers listed"
+        )
+
+
+def test_call_is_evaluated_against_the_masked_description_the_listing_served(rig: Gateway) -> None:
+    tool: Final = ScriptedTool("read_note", lambda _: text_result("note"), description="Read a note")
+    with scripted_peer(tool) as peer, rig.scenario() as scenario:
+        alias: Final = "note" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(
+            scenario, peer, alias, tool_name_to_description={"read_note": "Read a SECRET note"}
+        )
+        key: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        served: Final = listed_tools(rig, key, identity)
+        name: Final = next(full for full in served if full.endswith("read_note"))
+        assert served[name]["description"] == "Read a [MASKED] note", served[name]
+        seen, _ = _probe(McpCaller(rig, key, "rest"), name, identity)
+        assert seen == "Read a [MASKED] note", "the admin override must not restore wording the listing masked"
+
+
+def test_openapi_call_is_evaluated_against_the_masked_override_the_listing_served(rig: Gateway) -> None:
+    with openapi_peer() as peer, rig.scenario() as scenario:
+        alias: Final = "pets" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(
+            scenario, peer, alias, tool_name_to_description={"getpet": "Fetch one SECRET pet"}
+        )
+        key: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        served: Final = listed_tools(rig, key, identity)
+        name: Final = next(full for full in served if full.endswith("getpet"))
+        assert served[name]["description"] == "Fetch one [MASKED] pet", served[name]
+        seen, parameters = _probe(McpCaller(rig, key, "rest"), name, identity)
+        assert seen == "Fetch one [MASKED] pet", "the OpenAPI call path must hand hooks the entry the listing served"
+        assert parameters is not None and "petId" in parameters.get("properties", {}), parameters
+        assert not [call for call in peer.drain() if call["path"].startswith("/pets")], "blocked before upstream"
+
+
+def test_openapi_call_is_evaluated_against_the_entry_this_key_was_listed_not_the_last_listing(
+    rig: Gateway,
+) -> None:
+    with openapi_peer() as peer, rig.scenario() as scenario:
+        alias: Final = "pets" + uuid.uuid4().hex[:8]
+        identity: Final = register_mcp(
+            scenario, peer, alias, tool_name_to_description={"getpet": "Fetch one SECRET pet"}
+        )
+        guarded: Final = scenario.key(object_permission={"mcp_servers": [identity]})
+        opted_out: Final = scenario.key(
+            object_permission={"mcp_servers": [identity]}, metadata={"disable_global_guardrails": True}
+        )
+        guarded_served: Final = listed_tools(rig, guarded, identity)
+        opted_out_served: Final = listed_tools(rig, opted_out, identity)
+        name: Final = next(full for full in guarded_served if full.endswith("getpet"))
+        assert (guarded_served[name]["description"], opted_out_served[name]["description"]) == (
+            "Fetch one [MASKED] pet",
+            "Fetch one SECRET pet",
+        ), (guarded_served[name], opted_out_served[name])
+        seen, _ = _probe(McpCaller(rig, guarded, "rest"), name, identity)
+        assert seen == "Fetch one [MASKED] pet", (
+            "the guarded key must be evaluated against its own listing, not the opted-out key's later one"
+        )
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_guardrail_usage_monitor.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_guardrail_usage_monitor.py
index e1e4cd3d161..8e87837611a 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_guardrail_usage_monitor.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_guardrail_usage_monitor.py
@@ -48,6 +48,7 @@ def _bare_manager() -> MOD.MCPServerManager:
     reaches the guardrail hooks; they have their own coverage elsewhere.
     """
     mgr = MOD.MCPServerManager.__new__(MOD.MCPServerManager)
+    mgr._listed_tools_by_server_id = {}
     mgr.check_allowed_or_banned_tools = lambda name, server: True
     mgr.validate_allowed_params = lambda tool_name, arguments, server: None
 
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_proxy_mode.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_proxy_mode.py
index ed5d67164bd..e52a86d76af 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_proxy_mode.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_proxy_mode.py
@@ -1,17 +1,29 @@
 from litellm.proxy._experimental.mcp_server import operations as mcp_operations
+import asyncio
 import json
 from datetime import datetime
+from unittest.mock import AsyncMock, patch
 
 import pytest
 from fastapi import HTTPException
 from mcp.shared.exceptions import MCPError
+from mcp.types import CallToolResult, TextContent
+from mcp.types import Tool as MCPTool
 from pydantic import AnyUrl
 
 import litellm
 from litellm.integrations.custom_logger import CustomLogger
 from litellm.proxy._experimental.mcp_server import server
 from litellm.proxy._experimental.mcp_server.mcp_context import _mcp_proxy_mode
+from litellm.proxy._experimental.mcp_server.mcp_server_manager import ListedToolsCaller
+from litellm.proxy._experimental.mcp_server.tool_search import (
+    handle_mcp_proxy_tool,
+    mcp_proxy_tool_id,
+    with_mcp_proxy_identity,
+)
 from litellm.proxy._types import LiteLLM_ObjectPermissionTable, UserAPIKeyAuth
+from litellm.types.mcp import MCPTransport
+from litellm.types.mcp_server.mcp_server_manager import MCPServer
 
 AUTH = UserAPIKeyAuth(api_key="key")
 
@@ -130,3 +142,46 @@ async def test_proxy_scope_exception_emits_failure_log(monkeypatch: pytest.Monke
     assert hook_payload["arguments"] == arguments
     assert "raw_headers" not in hook_payload
     assert "raw-scope-secret" not in recorder.events[1][1]
+
+
+@pytest.mark.asyncio
+async def test_proxy_call_tool_on_a_never_listed_tool_hands_the_pre_hook_no_listed_tool() -> None:
+    """/mcp/proxy tools/list serves only the meta-tools, so the catalog call_tool reads to resolve its
+    tool_id was never served: it must not fill the caller's listed-tools slot, and the pre-call hook
+    must see no listed tool for the call."""
+    manager = mcp_operations.global_mcp_server_manager
+    server = MCPServer(server_id="proxy-meta", name="proxy-meta", transport=MCPTransport.http, url="http://meta")
+    auth = UserAPIKeyAuth(api_key="sk-proxy-meta", user_id="proxy-caller")
+    upstream = [MCPTool(name="echo", description="Echo text back", inputSchema={"type": "object"})]
+    served_as = with_mcp_proxy_identity(MCPTool(name="proxy-meta-echo", inputSchema={}), server.server_id)
+    pre_call_tool_check = AsyncMock(return_value={})
+
+    async def call_regular_mcp_tool(*, tasks: list[asyncio.Task[object]], **_: object) -> CallToolResult:
+        await asyncio.gather(*tasks)
+        return CallToolResult(content=[TextContent(type="text", text="echoed")])
+
+    with (
+        patch.dict(manager.registry, {server.server_id: server}),
+        patch.dict(manager.tool_name_to_mcp_server_name_mapping),
+        patch.object(mcp_operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[server])),
+        patch.object(manager, "_create_mcp_client", AsyncMock(return_value=object())),
+        patch.object(manager, "_fetch_tools_with_timeout", AsyncMock(return_value=upstream)),
+        patch.object(manager, "pre_call_tool_check", pre_call_tool_check),
+        patch.object(manager, "_call_regular_mcp_tool", call_regular_mcp_tool),
+    ):
+        try:
+            result = await handle_mcp_proxy_tool(
+                name="call_tool",
+                arguments={"tool_id": mcp_proxy_tool_id(served_as), "arguments": {}},
+                user_api_key_dict=auth,
+            )
+            listed = manager.get_listed_tool(server, "echo", ListedToolsCaller(user_api_key_auth=auth))
+        finally:
+            manager._drop_listed_tools(server.server_id)
+
+    assert result.is_error is False
+    assert result.content[0].text == "echoed"
+    pre_call_tool_check.assert_awaited_once()
+    assert pre_call_tool_check.await_args.kwargs["name"] == "echo"
+    assert pre_call_tool_check.await_args.kwargs["tool"] is None
+    assert listed is None
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server.py
index d3679506a2f..316988ef175 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server.py
@@ -963,6 +963,8 @@ async def test_get_tools_from_mcp_servers():
                 user_api_key_auth=None,
                 oauth2_headers=None,
                 proxy_logging_obj=None,
+                catalog_auth_header=None,
+                record_listing=True,
             ):
                 if server.server_id == "server1_id":
                     return [mock_tool_1]
@@ -1998,6 +2000,7 @@ async def test_get_tools_for_single_server():
             client_ip=None,
             user_api_key_auth=None,
             proxy_logging_obj=ANY,
+            record_listing=False,
         )
 
         # Verify the result
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
index 4b460fc67ae..0d2597975ae 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_manager.py
@@ -6,6 +6,7 @@ import json
 import logging
 import os
 import sys
+import time
 from collections.abc import AsyncIterator
 from datetime import datetime
 from pathlib import Path
@@ -41,8 +42,10 @@ from mcp.types import Tool as MCPTool
 from pydantic import AnyUrl, TypeAdapter
 
 from litellm.constants import MCP_METADATA_TIMEOUT
+from litellm.proxy._experimental.mcp_server import discoverable_endpoints
 from litellm.proxy._experimental.mcp_server.tool_outcome import TextResult
 from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
+    ListedToolsCaller,
     MCPServerManager,
     _deserialize_json_dict,
     _flow_endpoints_missing,
@@ -53,6 +56,7 @@ from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
     _obo_retry_applies,
     _resolve_openapi_tool_auth,
     _should_strip_caller_authorization,
+    listed_tools_caller_for,
 )
 from litellm.proxy._types import (
     LiteLLM_MCPServerTable,
@@ -116,7 +120,6 @@ async def test_manager_sampling_preserves_explicit_headers_without_ambient_conte
     assert sampling.await_args.kwargs["raw_headers"] == {"x-test-caller": "sampling-caller"}
 
 
-
 @pytest.mark.asyncio
 async def test_sampling_callback_keeps_creation_context_after_caller_switch():
     from mcp.server.auth.middleware.auth_context import auth_context_var
@@ -218,8 +221,6 @@ def _reload_mcp_manager_module():
     return reloaded
 
 
-
-
 @pytest.fixture(autouse=True)
 def enable_eager_mcp_oauth_discovery(monkeypatch):
     monkeypatch.setenv("LITELLM_MCP_OAUTH_DISCOVERY_ON_STARTUP", "1")
@@ -1576,7 +1577,9 @@ class TestMCPServerManager:
         assert not any("oauth2_id_jag" in message for message in caplog.messages)
 
     @pytest.mark.asyncio
-    async def test_load_servers_from_config_does_not_warn_for_api_key_with_google_sso(self, config_only_mcp_manager_factory, monkeypatch, caplog):
+    async def test_load_servers_from_config_does_not_warn_for_api_key_with_google_sso(
+        self, config_only_mcp_manager_factory, monkeypatch, caplog
+    ):
         self._clear_sso_env(monkeypatch)
         monkeypatch.setenv("GOOGLE_CLIENT_ID", "google-cid")
         manager = config_only_mcp_manager_factory()
@@ -4862,7 +4865,9 @@ class TestMCPServerManager:
     @pytest.mark.parametrize("auth_type", [MCPAuth.none, MCPAuth.bearer_token, MCPAuth.api_key, MCPAuth.oauth2])
     @pytest.mark.parametrize("is_byok", [False, True])
     @pytest.mark.parametrize("scheme", ["http", "https"])
-    async def test_openapi_health_loads_spec_without_mcp_handshake(self, respx_mock, monkeypatch, auth_type, is_byok, scheme):
+    async def test_openapi_health_loads_spec_without_mcp_handshake(
+        self, respx_mock, monkeypatch, auth_type, is_byok, scheme
+    ):
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
         manager = MCPServerManager()
         server = MCPServer(
@@ -4912,14 +4917,28 @@ class TestMCPServerManager:
     @pytest.mark.parametrize(
         ("failure", "expected_status", "expected_error"),
         [
-            (httpx.Response(401, text="secret response content"), "unhealthy", "OpenAPI specification request failed (HTTP 401)"),
+            (
+                httpx.Response(401, text="secret response content"),
+                "unhealthy",
+                "OpenAPI specification request failed (HTTP 401)",
+            ),
             (httpx.Response(404), "unhealthy", "OpenAPI specification request failed (HTTP 404)"),
             (httpx.Response(500), "unhealthy", "OpenAPI specification request failed (HTTP 500)"),
-            (httpx.ConnectError("secret network details"), "unhealthy", "OpenAPI specification could not be loaded (ConnectError)"),
-            (httpx.Response(200, text="secret invalid JSON body"), "unhealthy", "OpenAPI specification could not be loaded (JSONDecodeError)"),
+            (
+                httpx.ConnectError("secret network details"),
+                "unhealthy",
+                "OpenAPI specification could not be loaded (ConnectError)",
+            ),
+            (
+                httpx.Response(200, text="secret invalid JSON body"),
+                "unhealthy",
+                "OpenAPI specification could not be loaded (JSONDecodeError)",
+            ),
         ],
     )
-    async def test_openapi_health_reports_safe_failures(self, respx_mock, monkeypatch, failure, expected_status, expected_error):
+    async def test_openapi_health_reports_safe_failures(
+        self, respx_mock, monkeypatch, failure, expected_status, expected_error
+    ):
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
         manager = MCPServerManager()
         server = MCPServer(
@@ -5077,7 +5096,10 @@ class TestMCPServerManager:
     @pytest.mark.asyncio
     @pytest.mark.parametrize("oauth2_flow", [None, "authorization_code", "client_credentials"])
     async def test_health_check_server_oauth2_reports_reachability(
-        self, monkeypatch: pytest.MonkeyPatch, respx_mock: MockRouter, oauth2_flow: Literal["authorization_code", "client_credentials"] | None
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        respx_mock: MockRouter,
+        oauth2_flow: Literal["authorization_code", "client_credentials"] | None,
     ) -> None:
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
         manager: Final = MCPServerManager()
@@ -5106,14 +5128,28 @@ class TestMCPServerManager:
         assert not {"authorization", "x-api-key", "cookie"}.intersection(route.calls[0].request.headers)
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type", [
-        MCPAuth.bearer_token, MCPAuth.api_key, MCPAuth.basic, MCPAuth.authorization, MCPAuth.token,
-        MCPAuth.oauth2_token_exchange, MCPAuth.oauth2_id_jag, MCPAuth.true_passthrough, MCPAuth.oauth_delegate,
-    ])
+    @pytest.mark.parametrize(
+        "auth_type",
+        [
+            MCPAuth.bearer_token,
+            MCPAuth.api_key,
+            MCPAuth.basic,
+            MCPAuth.authorization,
+            MCPAuth.token,
+            MCPAuth.oauth2_token_exchange,
+            MCPAuth.oauth2_id_jag,
+            MCPAuth.true_passthrough,
+            MCPAuth.oauth_delegate,
+        ],
+    )
     @pytest.mark.parametrize("transport", [MCPTransport.http, MCPTransport.sse])
     @pytest.mark.parametrize("response_code", [200, 204, 302, 401, 403, 405, 503])
     async def test_health_check_without_credentials_accepts_any_http_response(
-        self, monkeypatch: pytest.MonkeyPatch, respx_mock: MockRouter, auth_type: MCPAuthType, transport: Literal[MCPTransport.http, MCPTransport.sse],
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        respx_mock: MockRouter,
+        auth_type: MCPAuthType,
+        transport: Literal[MCPTransport.http, MCPTransport.sse],
         response_code: int,
     ) -> None:
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
@@ -5144,6 +5180,7 @@ class TestMCPServerManager:
         self, monkeypatch: pytest.MonkeyPatch, respx_mock: MockRouter, response_code: int
     ) -> None:
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
+
         class UnreadBody(httpx.AsyncByteStream):
             def __init__(self) -> None:
                 self.read = False
@@ -5158,17 +5195,28 @@ class TestMCPServerManager:
 
         manager: Final = MCPServerManager()
         server: Final = MCPServer(
-            server_id="streaming-health", name="streaming-health", transport=MCPTransport.sse,
-            auth_type=MCPAuth.oauth2, url="https://mcp.example.test/events",
+            server_id="streaming-health",
+            name="streaming-health",
+            transport=MCPTransport.sse,
+            auth_type=MCPAuth.oauth2,
+            url="https://mcp.example.test/events",
         )
         manager.registry[server.server_id] = server
         bodies: Final = (UnreadBody(), UnreadBody())
-        route: Final = respx_mock.get(server.url).mock(side_effect=[
-            httpx.Response(response_code, stream=body, headers={
-                "Content-Type": "text/event-stream", "Set-Cookie": "health=secret; Path=/",
-                "Location": "http://127.0.0.1/private",
-            }) for body in bodies
-        ])
+        route: Final = respx_mock.get(server.url).mock(
+            side_effect=[
+                httpx.Response(
+                    response_code,
+                    stream=body,
+                    headers={
+                        "Content-Type": "text/event-stream",
+                        "Set-Cookie": "health=secret; Path=/",
+                        "Location": "http://127.0.0.1/private",
+                    },
+                )
+                for body in bodies
+            ]
+        )
 
         first: Final = await manager.health_check_server(server.server_id)
         second: Final = await manager.health_check_server(server.server_id)
@@ -5179,19 +5227,28 @@ class TestMCPServerManager:
         assert all("cookie" not in call.request.headers for call in route.calls)
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize(("transport", "url"), [
-        (MCPTransport.stdio, "https://mcp.example.test"),
-        (MCPTransport.http, None), (MCPTransport.http, ""), (MCPTransport.http, "not-a-url"),
-        (MCPTransport.http, "ftp://mcp.example.test"),
-        (MCPTransport.http, "https://user:secret@mcp.example.test"),
-        (MCPTransport.http, "https://mcp.example.test:bad/mcp"),
-    ])
+    @pytest.mark.parametrize(
+        ("transport", "url"),
+        [
+            (MCPTransport.stdio, "https://mcp.example.test"),
+            (MCPTransport.http, None),
+            (MCPTransport.http, ""),
+            (MCPTransport.http, "not-a-url"),
+            (MCPTransport.http, "ftp://mcp.example.test"),
+            (MCPTransport.http, "https://user:secret@mcp.example.test"),
+            (MCPTransport.http, "https://mcp.example.test:bad/mcp"),
+        ],
+    )
     async def test_health_reachability_rejects_unprobeable_urls_without_requests(
         self, respx_mock: MockRouter, transport: Literal[MCPTransport.http, MCPTransport.stdio], url: str | None
     ) -> None:
         manager: Final = MCPServerManager()
         server: Final = MCPServer(
-            server_id="unprobeable", name="unprobeable", transport=transport, auth_type=MCPAuth.oauth2, url=url,
+            server_id="unprobeable",
+            name="unprobeable",
+            transport=transport,
+            auth_type=MCPAuth.oauth2,
+            url=url,
         )
         manager.registry[server.server_id] = server
 
@@ -5202,19 +5259,26 @@ class TestMCPServerManager:
         assert not respx_mock.calls
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("failure", [
-        httpx.ConnectError("TLS/connection failure with secret details"),
-        httpx.ReadTimeout("secret timeout details"),
-        httpx.RemoteProtocolError("secret malformed response"),
-    ])
+    @pytest.mark.parametrize(
+        "failure",
+        [
+            httpx.ConnectError("TLS/connection failure with secret details"),
+            httpx.ReadTimeout("secret timeout details"),
+            httpx.RemoteProtocolError("secret malformed response"),
+        ],
+    )
     async def test_health_reachability_reports_no_response_without_secret_details(
         self, monkeypatch: pytest.MonkeyPatch, respx_mock: MockRouter, failure: httpx.RequestError
     ) -> None:
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
         manager: Final = MCPServerManager()
         server: Final = MCPServer(
-            server_id="failed-health", name="failed-health", transport=MCPTransport.http,
-            auth_type=MCPAuth.bearer_token, is_byok=True, url="https://mcp.example.test/secret?token=secret",
+            server_id="failed-health",
+            name="failed-health",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.bearer_token,
+            is_byok=True,
+            url="https://mcp.example.test/secret?token=secret",
         )
         manager.registry[server.server_id] = server
         route: Final = respx_mock.get(server.url).mock(side_effect=failure)
@@ -5230,8 +5294,11 @@ class TestMCPServerManager:
         monkeypatch.setenv("SSL_SECURITY_LEVEL", "invalid-secret-cipher")
         manager: Final = MCPServerManager()
         server: Final = MCPServer(
-            server_id="bad-tls", name="bad-tls", transport=MCPTransport.http,
-            auth_type=MCPAuth.oauth2, url="https://mcp.example.test",
+            server_id="bad-tls",
+            name="bad-tls",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.oauth2,
+            url="https://mcp.example.test",
         )
         manager.registry[server.server_id] = server
 
@@ -5249,8 +5316,11 @@ class TestMCPServerManager:
         monkeypatch.setattr("litellm.proxy._experimental.mcp_server.mcp_server_manager.MCP_HEALTH_CHECK_TIMEOUT", 0.1)
         manager: Final = MCPServerManager()
         server: Final = MCPServer(
-            server_id="slow-health", name="slow-health", transport=MCPTransport.http,
-            auth_type=MCPAuth.oauth2, url="https://mcp.example.test/slow",
+            server_id="slow-health",
+            name="slow-health",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.oauth2,
+            url="https://mcp.example.test/slow",
         )
         manager.registry[server.server_id] = server
         started: Final = asyncio.Event()
@@ -5303,8 +5373,11 @@ class TestMCPServerManager:
         server_ids: Final = [f"health-{index}" for index in range(server_count)]
         manager.registry = {
             server_id: MCPServer(
-                server_id=server_id, name=server_id, transport=MCPTransport.http,
-                auth_type=MCPAuth.oauth2, url=f"https://health.example.test/{server_id}",
+                server_id=server_id,
+                name=server_id,
+                transport=MCPTransport.http,
+                auth_type=MCPAuth.oauth2,
+                url=f"https://health.example.test/{server_id}",
             )
             for server_id in server_ids
         }
@@ -5631,8 +5704,15 @@ class TestMCPServerManager:
         captured: dict = {}
 
         def fake_create_tool_function(
-            path, method, operation, base_url, headers=None, server_label=None, relays_upstream_auth=False,
-            auth_type=None, upstream_token_header=None,
+            path,
+            method,
+            operation,
+            base_url,
+            headers=None,
+            server_label=None,
+            relays_upstream_auth=False,
+            auth_type=None,
+            upstream_token_header=None,
         ):
             captured["headers"] = headers
             captured["server_label"] = server_label
@@ -5717,8 +5797,15 @@ class TestMCPServerManager:
         captured: dict = {}
 
         def fake_create_tool_function(
-            path, method, operation, base_url, headers=None, server_label=None, relays_upstream_auth=False,
-            auth_type=None, upstream_token_header=None,
+            path,
+            method,
+            operation,
+            base_url,
+            headers=None,
+            server_label=None,
+            relays_upstream_auth=False,
+            auth_type=None,
+            upstream_token_header=None,
         ):
             captured["headers"] = headers
 
@@ -7091,8 +7178,7 @@ class TestMCPServerManager:
         # Mock _create_mcp_client to return our mock client
         manager._create_mcp_client = AsyncMock(return_value=mock_client)
 
-        # Mock user auth with no restrictions
-        user_api_key_auth: Final = UserAPIKeyAuth()
+        user_api_key_auth: Final = UserAPIKeyAuth(api_key="sk-test")
 
         # Mock proxy logging
         proxy_logging_obj = MagicMock()
@@ -7118,6 +7204,1051 @@ class TestMCPServerManager:
         # Verify the MCP client call was awaited exactly once
         assert mock_client.call_tool.await_count == 1
 
+    @staticmethod
+    def _manager_ready_for_call_tool(
+        listed_tools: list[MCPTool], caller: ListedToolsCaller | None = None
+    ) -> tuple[MCPServerManager, MagicMock]:
+        from mcp.types import CallToolResult
+
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="test-server",
+            name="test-server",
+            transport=MCPTransport.http,
+            url="http://test-server.com",
+        )
+        manager.registry = {"test-server": server}
+        manager.tool_name_to_mcp_server_name_mapping["test_tool"] = "test-server"
+        manager.tool_name_to_mcp_server_name_mapping["test-server-test_tool"] = "test-server"
+        manager._create_prefixed_tools(listed_tools, server)
+        manager._record_listed_tools(server, listed_tools, caller)
+
+        mock_client = AsyncMock()
+        mock_client.call_tool.return_value = MagicMock(spec=CallToolResult, content=[], isError=False)
+        manager._create_mcp_client = AsyncMock(return_value=mock_client)
+
+        proxy_logging_obj = MagicMock()
+        proxy_logging_obj._create_mcp_request_object_from_kwargs = MagicMock(return_value={})
+        proxy_logging_obj._convert_mcp_to_llm_format = MagicMock(return_value={})
+        proxy_logging_obj.pre_call_hook = AsyncMock(return_value={})
+        proxy_logging_obj.during_call_hook = AsyncMock(return_value=None)
+        return manager, proxy_logging_obj
+
+    @staticmethod
+    def _unrestricted_auth() -> UserAPIKeyAuth:
+        return UserAPIKeyAuth(api_key="sk-test")
+
+    @pytest.mark.asyncio
+    async def test_call_tool_hands_listed_tool_description_and_schema_to_pre_call_hooks(self):
+        schema = {"type": "object", "properties": {"param": {"type": "string"}}, "required": ["param"]}
+        listed = [MCPTool(name="test_tool", description="Runs the test tool", inputSchema=schema)]
+        auth = self._unrestricted_auth()
+        manager, proxy_logging_obj = self._manager_ready_for_call_tool(
+            listed, caller=ListedToolsCaller(user_api_key_auth=auth)
+        )
+
+        await manager.call_tool(
+            server_name="test-server",
+            name="test_tool",
+            arguments={"param": "value"},
+            user_api_key_auth=auth,
+            proxy_logging_obj=proxy_logging_obj,
+        )
+
+        hook_kwargs = proxy_logging_obj._create_mcp_request_object_from_kwargs.call_args.args[0]
+        assert (hook_kwargs["tool_description"], hook_kwargs["tool_input_schema"]) == ("Runs the test tool", schema)
+
+    @pytest.mark.asyncio
+    async def test_call_tool_hands_during_call_hooks_name_and_arguments_only_even_for_a_listed_tool(self):
+        """A during_mcp_call guardrail evaluates the call in flight, so it keeps seeing only the name and
+        arguments it always did; the listed description and schema go to the pre-call hooks alone."""
+        schema = {"type": "object", "properties": {"param": {"type": "string"}}}
+        listed = [MCPTool(name="test_tool", description="Runs the test tool", inputSchema=schema)]
+        auth = UserAPIKeyAuth(api_key="sk-test")
+        manager, _ = self._manager_ready_for_call_tool(listed, caller=ListedToolsCaller(user_api_key_auth=auth))
+        proxy_logging_obj = ProxyLogging(user_api_key_cache=DualCache())
+        proxy_logging_obj.pre_call_hook = AsyncMock(return_value={})
+        proxy_logging_obj.during_call_hook = AsyncMock(return_value=None)
+
+        await manager.call_tool(
+            server_name="test-server",
+            name="test_tool",
+            arguments={"param": "value"},
+            user_api_key_auth=auth,
+            proxy_logging_obj=proxy_logging_obj,
+        )
+
+        during_data = proxy_logging_obj.during_call_hook.call_args.kwargs["data"]
+        assert during_data["mcp_arguments"] == {"param": "value"}
+        assert (during_data.get("mcp_tool_description"), during_data.get("mcp_input_schema")) == (None, None)
+        assert "Description:" not in during_data["messages"][0]["content"]
+
+    @pytest.mark.asyncio
+    async def test_call_tool_passes_no_tool_metadata_when_tool_was_never_listed(self):
+        auth = self._unrestricted_auth()
+        manager, proxy_logging_obj = self._manager_ready_for_call_tool(
+            [MCPTool(name="other_tool", description="Unrelated", inputSchema={"type": "object"})],
+            caller=ListedToolsCaller(user_api_key_auth=auth),
+        )
+
+        await manager.call_tool(
+            server_name="test-server",
+            name="test_tool",
+            arguments={"param": "value"},
+            user_api_key_auth=auth,
+            proxy_logging_obj=proxy_logging_obj,
+        )
+
+        hook_kwargs = proxy_logging_obj._create_mcp_request_object_from_kwargs.call_args.args[0]
+        assert (hook_kwargs["tool_description"], hook_kwargs["tool_input_schema"]) == (None, None)
+
+    def test_get_listed_tool_resolves_the_bare_name_from_the_latest_listing(self):
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager._record_listed_tools(server, [MCPTool(name="echo", description="v1", inputSchema={})], None)
+        manager._record_listed_tools(server, [MCPTool(name="echo", description="v2", inputSchema={})], None)
+
+        latest = manager.get_listed_tool(server, "echo")
+        assert latest is not None and latest.description == "v2"
+        assert manager.get_listed_tool(server, "missing") is None
+
+    def test_get_listed_tool_never_strips_the_bare_name_it_is_given(self):
+        """The lookup is exact: a never-listed tool whose bare name starts with the server prefix is not the
+        listed sibling that stripping the prefix again would name."""
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv-id", name="srv", alias="srv", transport=MCPTransport.http, url="http://srv")
+        caller = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(api_key="sk-user", user_id="alice"))
+        manager._record_listed_tools(
+            server,
+            [
+                MCPTool(name="foo", description="Fetches foo records", inputSchema={"type": "object"}),
+                MCPTool(name="bar", description="Fetches bar records", inputSchema={"type": "object"}),
+            ],
+            caller,
+        )
+
+        assert manager.get_listed_tool(server, "srv-foo", caller) is None
+        listed = manager.get_listed_tool(server, "foo", caller)
+        assert listed is not None and listed.description == "Fetches foo records"
+
+    @pytest.mark.asyncio
+    async def test_get_listed_tool_uses_admin_description_override_clients_saw(self):
+        schema = {"type": "object", "properties": {"text": {"type": "string"}}}
+        manager = _catalog_manager(
+            MCPTool(name="echo", description="Upstream wording", inputSchema=schema),
+            MCPTool(name="ping", description="Untouched", inputSchema={}),
+        )
+        server = MCPServer(
+            server_id="srv",
+            name="srv",
+            transport=MCPTransport.http,
+            url="http://srv",
+            tool_name_to_description={"echo": "Admin wording"},
+        )
+        await manager._get_tools_from_server(server, add_prefix=True, record_listing=True)
+
+        overridden = manager.get_listed_tool(server, "echo")
+        assert overridden is not None
+        assert (overridden.name, overridden.description, overridden.input_schema) == ("echo", "Admin wording", schema)
+        untouched = manager.get_listed_tool(server, "ping")
+        assert untouched is not None and untouched.description == "Untouched"
+
+    @pytest.mark.asyncio
+    async def test_get_listed_tool_keeps_the_masked_description_over_the_admin_override(self, catalog_guardrail):
+        """A discovery guardrail masked the admin override in tools/list, so the tool-call hooks must see
+        the masked wording, not the original override the caller never saw."""
+        _, proxy_logging_obj = catalog_guardrail
+        manager = _catalog_manager(MCPTool(name="read_note", description="Read a note", inputSchema={"type": "object"}))
+        server = MCPServer(
+            server_id="notes",
+            name="notes",
+            transport=MCPTransport.http,
+            tool_name_to_description={"read_note": "Read a SECRET note"},
+        )
+        served = await manager._get_tools_from_server(
+            server, add_prefix=True, proxy_logging_obj=proxy_logging_obj, record_listing=True
+        )
+        assert [tool.description for tool in served] == ["Read a [MASKED] note"]
+
+        listed = manager.get_listed_tool(server, "read_note")
+        assert listed is not None and listed.description == "Read a [MASKED] note", (
+            "tools/call must be evaluated against the description tools/list served"
+        )
+
+    def test_server_definition_change_drops_listed_tools(self):
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        other = MCPServer(server_id="other", name="other", transport=MCPTransport.http, url="http://other")
+        manager._record_listed_tools(server, [MCPTool(name="echo", description="old", inputSchema={})], None)
+        manager._record_listed_tools(other, [MCPTool(name="ping", description="kept", inputSchema={})], None)
+
+        manager._invalidate_server_definition_caches(server.server_id)
+
+        assert manager.get_listed_tool(server, "echo") is None
+        kept = manager.get_listed_tool(other, "ping")
+        assert kept is not None and kept.description == "kept"
+
+    @pytest.mark.asyncio
+    async def test_server_save_during_an_in_flight_listing_is_not_undone_by_the_stale_record(self):
+        """A PUT /v1/mcp/server that lands while a listing awaits its upstream fetch drops the server's
+        catalog; the fetch completing afterwards must not write the pre-save catalog back, or hooks see
+        the old description next to the new definition until the next listing."""
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        user = UserAPIKeyAuth(api_key="sk-litellm", user_id="saver")
+        fetch_started = asyncio.Event()
+        release_fetch = asyncio.Event()
+
+        async def fetch(client, name):
+            fetch_started.set()
+            await release_fetch.wait()
+            return [MCPTool(name="turn", description="before save", inputSchema={})]
+
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+        manager._fetch_tools_with_timeout = fetch
+        caller = ListedToolsCaller(user_api_key_auth=user)
+
+        async def list_tools() -> None:
+            await manager._get_tools_from_server(server=server, user_api_key_auth=user, record_listing=True)
+
+        listing = asyncio.create_task(list_tools())
+        await fetch_started.wait()
+        manager._invalidate_server_definition_caches(server.server_id)
+        release_fetch.set()
+        await listing
+
+        assert manager.get_listed_tool(server, "turn", caller) is None
+
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="turn", description="after save", inputSchema={})]
+        )
+        await manager._get_tools_from_server(server=server, user_api_key_auth=user, record_listing=True)
+        listed = manager.get_listed_tool(server, "turn", caller)
+        assert listed is not None and listed.description == "after save"
+
+    @pytest.mark.asyncio
+    async def test_update_server_refreshing_openapi_tools_drops_a_listing_recorded_during_the_spec_fetch(self):
+        """An OpenAPI server's registry entries are rebuilt after the save is published, so a listing that
+        records while the spec is fetched holds the pre-save entries; the catalog is dropped again once the
+        registry is current."""
+        manager = MCPServerManager()
+        old = MCPServer(
+            server_id="srv", name="srv", transport=MCPTransport.http, url="http://old", spec_path="/old.json"
+        )
+        manager.registry[old.server_id] = old
+        new = MCPServer(
+            server_id="srv", name="srv", transport=MCPTransport.http, url="http://new", spec_path="/new.json"
+        )
+        caller = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm", user_id="lister"))
+
+        async def register_while_a_listing_records(server: MCPServer, *, initialize_mapping: bool = True) -> None:
+            manager._record_listed_tools(
+                server,
+                [MCPTool(name="search", description="pre-save", inputSchema={})],
+                caller,
+                manager._listed_tools_generations.get(server.server_id, 0),
+            )
+
+        manager.build_mcp_server_from_table = AsyncMock(return_value=new)
+        manager._maybe_register_openapi_tools = register_while_a_listing_records
+        manager.prime_oauth_metadata_discovery = MagicMock()
+        record = LiteLLM_MCPServerTable(
+            server_id="srv", server_name="srv", url="http://new", transport=MCPTransport.http
+        )
+
+        await manager.update_server(record)
+
+        assert manager.registry["srv"] is new
+        assert manager.get_listed_tool(new, "search", caller) is None
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("already_registered", [False, True], ids=["add_server", "update_server"])
+    async def test_openapi_spec_re_read_keeps_discovery_and_oauth_metadata_filled_during_the_fetch(
+        self, already_registered: bool
+    ):
+        """The listed-tool catalog recorded during the spec fetch holds pre-save entries, but a prompts
+        discovery or OAuth protected-resource fetch answered in that window already saw the published
+        definition; dropping those too sends the next request upstream again."""
+        manager = MCPServerManager()
+        if already_registered:
+            manager.registry["srv"] = MCPServer(
+                server_id="srv", name="srv", transport=MCPTransport.http, url="http://old", spec_path="/old.json"
+            )
+        new = MCPServer(
+            server_id="srv", name="srv", transport=MCPTransport.http, url="http://new", spec_path="/new.json"
+        )
+        caller = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm", user_id="lister"))
+        metadata_key: Final = (new.server_id, new.url)
+        prompt_fetches = 0
+
+        async def fetch_prompts() -> list[Prompt]:
+            nonlocal prompt_fetches
+            prompt_fetches += 1
+            return [Prompt(name="greet")]
+
+        async def register_while_discovery_fills(server: MCPServer, *, initialize_mapping: bool = True) -> None:
+            manager._record_listed_tools(
+                server,
+                [MCPTool(name="search", description="pre-save", inputSchema={})],
+                caller,
+                manager._listed_tools_generations.get(server.server_id, 0),
+            )
+            await manager._prompt_discovery_cache.get((server.server_id, None), fetch_prompts)
+            discoverable_endpoints._OAUTH_METADATA_CACHE[metadata_key] = (time.time() + 300, {"resource": new.url})
+
+        manager.build_mcp_server_from_table = AsyncMock(return_value=new)
+        manager._maybe_register_openapi_tools = register_while_discovery_fills
+        manager.prime_oauth_metadata_discovery = MagicMock()
+        record = LiteLLM_MCPServerTable(
+            server_id="srv", server_name="srv", url="http://new", transport=MCPTransport.http
+        )
+        save = manager.update_server if already_registered else manager.add_server
+
+        try:
+            await save(record)
+
+            assert manager.registry["srv"] is new
+            assert manager.get_listed_tool(new, "search", caller) is None
+            prompts = await manager._prompt_discovery_cache.get((new.server_id, None), fetch_prompts)
+            assert [prompt.name for prompt in prompts] == ["greet"]
+            assert prompt_fetches == 1, "the prompts list filled after the save was published went upstream again"
+            cached_metadata = discoverable_endpoints._OAUTH_METADATA_CACHE.get(metadata_key)
+            assert cached_metadata is not None and cached_metadata[1] == {"resource": new.url}
+        finally:
+            discoverable_endpoints._OAUTH_METADATA_CACHE.pop(metadata_key, None)
+
+    @pytest.mark.asyncio
+    async def test_user_oauth_refresh_keeps_listed_tools(self):
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager._record_listed_tools(server, [MCPTool(name="echo", description="shared", inputSchema={})], None)
+
+        await manager.invalidate_user_oauth_token_cache("alice", server.server_id)
+
+        listed = manager.get_listed_tool(server, "echo")
+        assert listed is not None and listed.description == "shared"
+
+    def test_per_caller_server_keeps_listed_tools_per_identity(self):
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="srv",
+            name="srv",
+            transport=MCPTransport.http,
+            url="http://srv",
+            auth_type=MCPAuth.oauth2_token_exchange,
+        )
+        alice = UserAPIKeyAuth(user_id="alice", token="hashed-alice")
+        bob = UserAPIKeyAuth(user_id="bob", token="hashed-bob")
+        alice_schema = {"type": "object", "properties": {"path": {"type": "string"}}}
+        bob_schema = {"type": "object", "properties": {"path": {"type": "string"}, "site": {"type": "string"}}}
+        manager._record_listed_tools(
+            server,
+            [MCPTool(name="read", description="alice view", inputSchema=alice_schema)],
+            ListedToolsCaller(user_api_key_auth=alice),
+        )
+        manager._record_listed_tools(
+            server,
+            [MCPTool(name="read", description="bob view", inputSchema=bob_schema)],
+            ListedToolsCaller(user_api_key_auth=bob),
+        )
+
+        alice_tool = manager.get_listed_tool(server, "read", ListedToolsCaller(user_api_key_auth=alice))
+        bob_tool = manager.get_listed_tool(server, "read", ListedToolsCaller(user_api_key_auth=bob))
+        assert alice_tool is not None and (alice_tool.description, alice_tool.input_schema) == (
+            "alice view",
+            alice_schema,
+        )
+        assert bob_tool is not None and (bob_tool.description, bob_tool.input_schema) == ("bob view", bob_schema)
+        carol = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="carol", token="k"))
+        assert manager.get_listed_tool(server, "read", carol) is None
+
+        shared = MCPServer(server_id="shared", name="shared", transport=MCPTransport.http, url="http://shared")
+        manager._record_listed_tools(
+            shared,
+            [MCPTool(name="echo", description="everyone", inputSchema={})],
+            ListedToolsCaller(user_api_key_auth=alice),
+        )
+        for_bob = manager.get_listed_tool(shared, "echo", ListedToolsCaller(user_api_key_auth=bob))
+        assert for_bob is None, "keyed callers get their own slot even on servers without upstream per-user auth"
+        anonymous = manager.get_listed_tool(shared, "echo")
+        assert anonymous is None
+
+    @pytest.mark.parametrize(
+        ("server_kwargs", "caller_a", "caller_b"),
+        [
+            pytest.param(
+                {"extra_headers": ["X-Workspace"]},
+                ListedToolsCaller(raw_headers={"x-workspace": "A"}),
+                ListedToolsCaller(raw_headers={"X-Workspace": "B"}),
+                id="forwarded-header",
+            ),
+            pytest.param(
+                {"auth_type": MCPAuth.true_passthrough},
+                ListedToolsCaller(raw_headers={"authorization": "Bearer upstream-a"}),
+                ListedToolsCaller(raw_headers={"authorization": "Bearer upstream-b"}),
+                id="anonymous-passthrough-bearer",
+            ),
+            pytest.param(
+                {"auth_type": MCPAuth.bearer_token},
+                ListedToolsCaller(mcp_auth_header="byok-a"),
+                ListedToolsCaller(mcp_auth_header="byok-b"),
+                id="per-server-auth-header",
+            ),
+            pytest.param(
+                {"auth_type": MCPAuth.oauth2_token_exchange},
+                ListedToolsCaller(
+                    user_api_key_auth=UserAPIKeyAuth(user_id="team-bot", token="hashed-shared"),
+                    raw_headers={"x-litellm-api-key": "sk-shared", "authorization": "Bearer entra-alice"},
+                ),
+                ListedToolsCaller(
+                    user_api_key_auth=UserAPIKeyAuth(user_id="team-bot", token="hashed-shared"),
+                    raw_headers={"x-litellm-api-key": "sk-shared", "authorization": "Bearer entra-bob"},
+                ),
+                id="shared-key-different-obo-subjects",
+            ),
+            pytest.param(
+                {"transport": MCPTransport.stdio, "command": "srv", "env": {"WS": "${X-WS}"}},
+                ListedToolsCaller(raw_headers={"X-WS": "A"}),
+                ListedToolsCaller(raw_headers={"X-WS": "B"}),
+                id="header-driven-stdio-env",
+            ),
+        ],
+    )
+    def test_upstream_identity_inputs_keep_listed_tools_apart(self, server_kwargs, caller_a, caller_b):
+        manager = MCPServerManager()
+        server = MCPServer(
+            **{"server_id": "srv", "name": "srv", "transport": MCPTransport.http, "url": "http://srv", **server_kwargs}
+        )
+        manager._record_listed_tools(server, [MCPTool(name="turn", description="Catalog A", inputSchema={})], caller_a)
+        manager._record_listed_tools(server, [MCPTool(name="turn", description="Catalog B", inputSchema={})], caller_b)
+
+        for_a = manager.get_listed_tool(server, "turn", caller_a)
+        for_b = manager.get_listed_tool(server, "turn", caller_b)
+        assert for_a is not None and for_a.description == "Catalog A"
+        assert for_b is not None and for_b.description == "Catalog B"
+        assert manager.get_listed_tool(server, "turn", ListedToolsCaller()) is None
+
+    def test_shared_server_ignores_headers_it_never_forwards(self):
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager._record_listed_tools(
+            server,
+            [MCPTool(name="turn", description="everyone", inputSchema={})],
+            ListedToolsCaller(raw_headers={"authorization": "Bearer sk-litellm", "x-workspace": "A"}),
+        )
+
+        other = ListedToolsCaller(raw_headers={"authorization": "Bearer sk-other", "x-workspace": "B"})
+        listed = manager.get_listed_tool(server, "turn", other)
+        assert listed is not None and listed.description == "everyone"
+
+    @pytest.mark.asyncio
+    async def test_byok_listing_never_reads_the_credential_store(self):
+        """tools/list keys the caller's catalog slot by what the client supplied plus the caller's key.
+        Resolving the stored BYOK credential for that would fail every REST listing while the DB is
+        down and would seed a per-worker cache the next tools/call trusts over the store."""
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="byok-cold",
+            name="byok_cold",
+            transport=MCPTransport.http,
+            url="http://byok-cold",
+            is_byok=True,
+            auth_type=MCPAuth.api_key,
+        )
+        user = UserAPIKeyAuth(api_key="sk-litellm", user_id="byok-cold-user")
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="turn", description="listed while db down", inputSchema={})]
+        )
+
+        with (
+            patch("litellm.proxy.proxy_server.prisma_client", MagicMock()),
+            patch(
+                "litellm.proxy._experimental.mcp_server.db.get_user_credential",
+                AsyncMock(side_effect=RuntimeError("DB DOWN")),
+            ),
+        ):
+            await manager._get_tools_from_server(server=server, user_api_key_auth=user, record_listing=True)
+
+        listed = manager.get_listed_tool(server, "turn", listed_tools_caller_for(server, user, None, None, None, None))
+        assert listed is not None and listed.description == "listed while db down"
+
+    @pytest.mark.parametrize(
+        ("list_header", "call_kwargs"),
+        [
+            pytest.param(
+                None, {"mcp_auth_header": "stored-secret", "catalog_auth_header": None}, id="execute-mcp-tool"
+            ),
+            pytest.param(None, {"mcp_auth_header": None}, id="responses-api"),
+            pytest.param("Bearer hdr", {"mcp_auth_header": "Bearer hdr"}, id="client-supplied-header"),
+        ],
+    )
+    @pytest.mark.asyncio
+    async def test_byok_tools_call_reads_the_slot_the_clients_own_header_listed(
+        self, list_header: str | None, call_kwargs: dict[str, str | None]
+    ):
+        """A REST listing records under the header the client sent (none here). tools/call then swaps the
+        stored credential in, either before reaching ``call_tool`` (``execute_mcp_tool``) or inside it (the
+        Responses API), and must still read that slot rather than one keyed by the credential."""
+        from litellm.proxy._experimental.mcp_server.byok_credential_cache import (
+            byok_credential_cache_key,
+            cache_byok_credential,
+        )
+        from litellm.proxy._experimental.mcp_server.operations import byok_credential_cache
+
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="byok-catalog",
+            name="byok_catalog",
+            transport=MCPTransport.http,
+            url="http://byok-catalog",
+            is_byok=True,
+        )
+        manager.registry = {"byok-catalog": server}
+        user = UserAPIKeyAuth(api_key="sk-litellm", user_id="byok-user")
+        mock_client = AsyncMock()
+        mock_client.call_tool.return_value = MagicMock(spec=CallToolResult, content=[], isError=False)
+        manager._create_mcp_client = AsyncMock(return_value=mock_client)
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="turn", description="stored cred catalog", inputSchema={})]
+        )
+        proxy_logging_obj = MagicMock()
+        proxy_logging_obj._create_mcp_request_object_from_kwargs = MagicMock(return_value={})
+        proxy_logging_obj._convert_mcp_to_llm_format = MagicMock(return_value={})
+        proxy_logging_obj.pre_call_hook = AsyncMock(return_value={})
+        proxy_logging_obj.during_call_hook = AsyncMock(return_value=None)
+        cache_byok_credential("byok-user", "byok-catalog", "stored-secret")
+        try:
+            await manager._get_tools_from_server(
+                server=server, mcp_auth_header=list_header, user_api_key_auth=user, record_listing=True
+            )
+            listed = manager.get_listed_tool(
+                server, "turn", listed_tools_caller_for(server, user, list_header, None, None, None)
+            )
+            assert listed is not None and listed.description == "stored cred catalog"
+
+            await manager.call_tool(
+                server_name="byok_catalog",
+                name="turn",
+                arguments={},
+                user_api_key_auth=user,
+                proxy_logging_obj=proxy_logging_obj,
+                **call_kwargs,
+            )
+        finally:
+            byok_credential_cache.delete_cache(byok_credential_cache_key("byok-user", "byok-catalog"))
+
+        hook_kwargs = proxy_logging_obj._create_mcp_request_object_from_kwargs.call_args.args[0]
+        assert hook_kwargs["tool_description"] == "stored cred catalog"
+
+    @pytest.mark.asyncio
+    async def test_byok_supplied_header_lists_without_credential_validation(self):
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="byok-catalog",
+            name="byok_catalog",
+            transport=MCPTransport.http,
+            url="http://byok-catalog",
+            is_byok=True,
+        )
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="turn", description="t", inputSchema={})]
+        )
+
+        with patch("litellm.proxy.proxy_server.prisma_client", None):
+            await manager._get_tools_from_server(
+                server=server,
+                mcp_auth_header="Bearer hdr",
+                user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm"),
+                record_listing=True,
+            )
+
+        caller: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm"), mcp_auth_header="Bearer hdr"
+        )
+        listed = manager.get_listed_tool(server, "turn", caller)
+        assert listed is not None and listed.description == "t"
+        assert manager._create_mcp_client.await_args.kwargs["mcp_auth_header"] == "Bearer hdr"
+
+    @pytest.mark.parametrize(
+        "server_auth",
+        [
+            pytest.param(
+                {
+                    "auth_type": MCPAuth.oauth2,
+                    "client_id": "cid",
+                    "client_secret": "csec",
+                    "token_url": "http://cc1/token",
+                },
+                id="oauth2",
+            ),
+            pytest.param({"auth_type": MCPAuth.api_key, "authentication_token": "STATIC-ADMIN-TOKEN"}, id="api_key"),
+            pytest.param(
+                {"auth_type": MCPAuth.bearer_token, "authentication_token": "STATIC-ADMIN-TOKEN"}, id="bearer_token"
+            ),
+            pytest.param({"auth_type": MCPAuth.none}, id="none"),
+        ],
+    )
+    @pytest.mark.asyncio
+    async def test_byok_listing_keys_the_catalog_by_the_caller_and_never_touches_the_stored_secret(
+        self, server_auth: dict[str, object]
+    ):
+        """The caller's key plus what the caller supplied (nothing here) keys the catalog slot tools/call
+        reads, even with the stored BYOK secret at hand in the cache, and tools/list sends upstream exactly
+        what the caller supplied, so the static token, the M2M mint and MCPJWTSigner all behave as they
+        did before the catalog existed, whatever the auth_type."""
+        from litellm.proxy._experimental.mcp_server.byok_credential_cache import (
+            byok_credential_cache_key,
+            cache_byok_credential,
+        )
+        from litellm.proxy._experimental.mcp_server.operations import byok_credential_cache
+
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="cc1",
+            name="cc1",
+            transport=MCPTransport.http,
+            url="http://cc1",
+            is_byok=True,
+            **server_auth,
+        )
+        alice = UserAPIKeyAuth(api_key="sk-alice", user_id="alice")
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="echo", description="listed catalog", inputSchema={})]
+        )
+        signer_headers = AsyncMock(return_value={"Authorization": "Bearer signed-jwt"})
+        cache_byok_credential("alice", "cc1", "BYOK-ALICE-SECRET")
+        try:
+            with (
+                patch(  # test-quality-ok: the signer is a process-wide singleton the manager reads, no injection seam
+                    "litellm.proxy.guardrails.guardrail_hooks.mcp_jwt_signer.mcp_jwt_signer.get_mcp_jwt_signer",
+                    return_value=MagicMock(),
+                ),
+                patch(  # test-quality-ok: same singleton's header injection, asserted on by call
+                    "litellm.proxy.guardrails.guardrail_hooks.mcp_jwt_signer.mcp_jwt_signer.inject_mcp_jwt_headers_for_upstream",
+                    signer_headers,
+                ),
+            ):
+                await manager._get_tools_from_server(server=server, user_api_key_auth=alice, record_listing=True)
+        finally:
+            byok_credential_cache.delete_cache(byok_credential_cache_key("alice", "cc1"))
+
+        client_kwargs = manager._create_mcp_client.await_args.kwargs
+        assert client_kwargs["mcp_auth_header"] is None, client_kwargs
+        assert client_kwargs["extra_headers"] == {"Authorization": "Bearer signed-jwt"}
+        signer_headers.assert_awaited_once()
+        listed = manager.get_listed_tool(server, "echo", ListedToolsCaller(user_api_key_auth=alice))
+        assert listed is not None and listed.description == "listed catalog"
+
+    @pytest.mark.parametrize(
+        ("signer", "static_headers"),
+        [
+            pytest.param(MagicMock(), None, id="signer"),
+            pytest.param(MagicMock(), {"Authorization": "Bearer admin-token"}, id="static-authorization"),
+            pytest.param(None, None, id="no-signer"),
+        ],
+    )
+    def test_keyed_callers_always_list_into_their_own_slot(self, signer, static_headers):
+        """The catalog is guardrail-shaped per key, so a keyed caller never reads another caller's
+        listing regardless of the signer or static authorization configuration."""
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv", static_headers=static_headers
+        )
+        alice = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="alice", token="hashed-alice"))
+        bob = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="bob", token="hashed-bob"))
+
+        with patch(  # test-quality-ok: the signer is a process-wide singleton the manager reads, no injection seam
+            "litellm.proxy.guardrails.guardrail_hooks.mcp_jwt_signer.mcp_jwt_signer.get_mcp_jwt_signer",
+            return_value=signer,
+        ):
+            manager._record_listed_tools(
+                server, [MCPTool(name="turn", description="alice view", inputSchema={})], alice
+            )
+            assert manager.get_listed_tool(server, "turn", bob) is None
+
+        for_alice = manager.get_listed_tool(server, "turn", alice)
+        assert for_alice is not None and for_alice.description == "alice view"
+
+    def test_signed_server_slot_splits_on_the_callers_key_not_only_the_user(self):
+        """Two keys sharing a user_id get different signed JWTs, so they split; the same key
+        presented again lands on its own slot."""
+        manager = MCPServerManager()
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        alice = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="same-user", api_key="sk-alpha"))
+        bob = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="same-user", api_key="sk-beta"))
+
+        with patch(  # test-quality-ok: the signer is a process-wide singleton the manager reads, no injection seam
+            "litellm.proxy.guardrails.guardrail_hooks.mcp_jwt_signer.mcp_jwt_signer.get_mcp_jwt_signer",
+            return_value=MagicMock(),
+        ):
+            manager._record_listed_tools(server, [MCPTool(name="turn", description="slot a", inputSchema={})], alice)
+            assert manager.get_listed_tool(server, "turn", bob) is None
+
+            same_key = ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id="same-user", api_key="sk-alpha"))
+            listed = manager.get_listed_tool(server, "turn", same_key)
+
+        assert listed is not None and listed.description == "slot a"
+
+    def test_listed_tools_slot_is_split_per_team_for_keyless_callers(self):
+        """A team-only JWT admits a caller with neither a key nor a user, so the team keys the slot."""
+        manager: Final = MCPServerManager()
+        server: Final = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        team_one: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id=None, team_id="team-one")
+        )
+        team_two: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id=None, team_id="team-two")
+        )
+        manager._record_listed_tools(
+            server, [MCPTool(name="foo", description="Fetch rows FLAGWORD", inputSchema={})], team_one
+        )
+
+        assert manager.get_listed_tool(server, "foo", team_two) is None
+        listed: Final = manager.get_listed_tool(server, "foo", team_one)
+        assert listed is not None and listed.description == "Fetch rows FLAGWORD"
+
+    def test_listed_tools_slot_is_split_per_team_for_the_same_keyless_user(self):
+        """One JWT user acting in two teams is served two team-shaped catalogs, so each team is a slot."""
+        manager: Final = MCPServerManager()
+        server: Final = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        alice_in_one: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id="alice", team_id="team-one")
+        )
+        alice_in_two: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id="alice", team_id="team-two")
+        )
+        manager._record_listed_tools(
+            server, [MCPTool(name="foo", description="Fetch rows FLAGWORD", inputSchema={})], alice_in_one
+        )
+
+        assert manager.get_listed_tool(server, "foo", alice_in_two) is None
+        listed: Final = manager.get_listed_tool(server, "foo", alice_in_one)
+        assert listed is not None and listed.description == "Fetch rows FLAGWORD"
+
+    def test_listed_tools_slot_is_split_by_the_admission_bearer_of_keyless_callers_without_a_user(self):
+        """Two team-only JWT callers of one team differ only in the JWT they were admitted with, so that
+        credential keys the slot, on a server that never forwards it."""
+        manager: Final = MCPServerManager()
+        server: Final = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        alice: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id=None, team_id="team-one"),
+            raw_headers={"authorization": "Bearer jwt-alice"},
+        )
+        bob: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key=None, user_id=None, team_id="team-one"),
+            raw_headers={"authorization": "Bearer jwt-bob"},
+        )
+        manager._record_listed_tools(server, [MCPTool(name="foo", description="alice view", inputSchema={})], alice)
+
+        assert manager.get_listed_tool(server, "foo", bob) is None
+        listed: Final = manager.get_listed_tool(server, "foo", alice)
+        assert listed is not None and listed.description == "alice view"
+
+    @pytest.mark.parametrize(
+        ("server_kwargs", "forwards_bearer"),
+        [
+            pytest.param(
+                {"auth_type": MCPAuth.oauth2, "delegate_auth_to_upstream": True, "oauth2_flow": "authorization_code"},
+                True,
+                id="oauth2-delegated-to-upstream",
+            ),
+            pytest.param({"auth_type": MCPAuth.oauth_delegate}, True, id="oauth-delegate"),
+            pytest.param({"auth_type": MCPAuth.true_passthrough}, True, id="true-passthrough"),
+            pytest.param({"auth_type": MCPAuth.oauth2_token_exchange}, True, id="token-exchange"),
+            pytest.param(
+                {"auth_type": MCPAuth.none, "extra_headers": ["Authorization"], "oauth_passthrough": True},
+                True,
+                id="oauth-passthrough",
+            ),
+            pytest.param({}, False, id="plain"),
+            pytest.param(
+                {"auth_type": MCPAuth.oauth2, "oauth2_flow": "authorization_code"},
+                False,
+                id="oauth2-gateway-managed",
+            ),
+            pytest.param(
+                {
+                    "auth_type": MCPAuth.oauth2,
+                    "oauth2_flow": "client_credentials",
+                    "delegate_auth_to_upstream": True,
+                    "client_id": "gateway",
+                    "client_secret": "secret",
+                    "token_url": "http://idp/token",
+                },
+                False,
+                id="oauth2-client-credentials",
+            ),
+        ],
+    )
+    def test_listed_tools_slot_is_split_by_the_forwarded_bearer_on_servers_that_forward_it(
+        self, server_kwargs: dict[str, object], forwards_bearer: bool
+    ):
+        """Two callers sharing one key but carrying different upstream bearers are served two upstream
+        catalogs exactly on the servers whose egress forwards or exchanges that bearer."""
+        manager: Final = MCPServerManager()
+        server: Final = MCPServer(
+            **{"server_id": "dg", "name": "dg", "transport": MCPTransport.http, "url": "http://dg", **server_kwargs}
+        )
+        caller_a: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key="sk-master"),
+            raw_headers={"x-litellm-api-key": "Bearer sk-master", "authorization": "Bearer UP-A"},
+        )
+        caller_b: Final = ListedToolsCaller(
+            user_api_key_auth=UserAPIKeyAuth(api_key="sk-master"),
+            raw_headers={"x-litellm-api-key": "Bearer sk-master", "authorization": "Bearer UP-B"},
+        )
+        manager._record_listed_tools(
+            server, [MCPTool(name="lookup", description="Workspace A lookup FLAGWORD", inputSchema={})], caller_a
+        )
+
+        for_b: Final = manager.get_listed_tool(server, "lookup", caller_b)
+        assert (for_b is None) is forwards_bearer
+        for_a: Final = manager.get_listed_tool(server, "lookup", caller_a)
+        assert for_a is not None and for_a.description == "Workspace A lookup FLAGWORD"
+
+    @pytest.mark.asyncio
+    async def test_call_tool_hands_hooks_the_catalog_the_same_forwarded_headers_listed(self):
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="catalog",
+            name="catalog",
+            transport=MCPTransport.http,
+            url="http://catalog",
+            extra_headers=["X-Workspace"],
+        )
+        manager.registry = {"catalog": server}
+        catalogs = {
+            "A": [
+                MCPTool(
+                    name="turn", description="Catalog A", inputSchema={"properties": {"turn": {"description": "A"}}}
+                )
+            ],
+            "B": [
+                MCPTool(
+                    name="turn", description="Catalog B", inputSchema={"properties": {"turn": {"description": "B"}}}
+                )
+            ],
+        }
+        mock_client = AsyncMock()
+        mock_client.call_tool.return_value = MagicMock(spec=CallToolResult, content=[], isError=False)
+        manager._create_mcp_client = AsyncMock(return_value=mock_client)
+        manager._fetch_tools_with_timeout = AsyncMock(side_effect=lambda client, name: catalogs[client.workspace])
+        for workspace in ("A", "B"):
+            manager._create_mcp_client.return_value.workspace = workspace
+            await manager._get_tools_from_server(
+                server=server,
+                extra_headers={"X-Workspace": workspace},
+                raw_headers={"x-workspace": workspace, "authorization": "Bearer sk-litellm"},
+                user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm", user_id="shared-key"),
+                record_listing=True,
+            )
+
+        proxy_logging_obj = MagicMock()
+        proxy_logging_obj._create_mcp_request_object_from_kwargs = MagicMock(return_value={})
+        proxy_logging_obj._convert_mcp_to_llm_format = MagicMock(return_value={})
+        proxy_logging_obj.pre_call_hook = AsyncMock(return_value={})
+        proxy_logging_obj.during_call_hook = AsyncMock(return_value=None)
+        await manager.call_tool(
+            server_name="catalog",
+            name="turn",
+            arguments={"turn": "A-1"},
+            user_api_key_auth=UserAPIKeyAuth(api_key="sk-litellm", user_id="shared-key"),
+            proxy_logging_obj=proxy_logging_obj,
+            raw_headers={"x-workspace": "A", "authorization": "Bearer sk-litellm"},
+        )
+
+        hook_kwargs = proxy_logging_obj._create_mcp_request_object_from_kwargs.call_args.args[0]
+        assert (hook_kwargs["tool_description"], hook_kwargs["tool_input_schema"]) == (
+            "Catalog A",
+            {"properties": {"turn": {"description": "A"}}},
+        )
+
+    def test_per_caller_listed_tools_evict_oldest_caller_and_keep_shared(self):
+        from litellm.proxy._experimental.mcp_server.mcp_server_manager import _LISTED_TOOLS_CALLERS_PER_SERVER
+
+        manager = MCPServerManager()
+        server = MCPServer(
+            server_id="srv",
+            name="srv",
+            transport=MCPTransport.http,
+            url="http://srv",
+            auth_type=MCPAuth.oauth2_token_exchange,
+        )
+        manager._record_listed_tools(server, [MCPTool(name="read", description="shared", inputSchema={})], None)
+        callers = [
+            ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(user_id=f"u{i}", api_key=f"k{i}"))
+            for i in range(_LISTED_TOOLS_CALLERS_PER_SERVER + 1)
+        ]
+        for caller in callers:
+            manager._record_listed_tools(
+                server,
+                [MCPTool(name="read", description=caller.user_api_key_auth.user_id, inputSchema={})],
+                caller,
+            )
+        manager._record_listed_tools(server, [MCPTool(name="read", description="u1 again", inputSchema={})], callers[1])
+
+        assert manager.get_listed_tool(server, "read", callers[0]) is None
+        second = manager.get_listed_tool(server, "read", callers[1])
+        assert second is not None and second.description == "u1 again"
+        newest = manager.get_listed_tool(server, "read", callers[-1])
+        assert newest is not None and newest.description == callers[-1].user_api_key_auth.user_id
+        assert len(manager._listed_tools_by_server_id[server.server_id]) == _LISTED_TOOLS_CALLERS_PER_SERVER + 1
+        shared = manager.get_listed_tool(server, "read")
+        assert shared is not None and shared.description == "shared"
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("add_prefix", [True, False])
+    async def test_openapi_listing_records_listed_tools(self, add_prefix):
+        from litellm.proxy._experimental.mcp_server.tool_registry import global_mcp_tool_registry
+
+        server = MCPServer(
+            server_id="petstore-id",
+            name="petstore",
+            alias="petstore",
+            transport=MCPTransport.http,
+            url=None,
+            spec_path="/spec.yaml",
+        )
+        manager = MCPServerManager()
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+
+        async def _handler(**kwargs):
+            return None
+
+        global_mcp_tool_registry.unregister_tools_with_prefix("petstore-")
+        global_mcp_tool_registry.register_tool(
+            name="petstore-list_pets",
+            description="List pets",
+            input_schema={"type": "object", "properties": {"limit": {"type": "integer"}}},
+            handler=_handler,
+        )
+        try:
+            listed = await manager._get_tools_from_server(server=server, add_prefix=add_prefix, record_listing=True)
+        finally:
+            global_mcp_tool_registry.unregister_tools_with_prefix("petstore-")
+
+        assert [t.name for t in listed] == ["petstore-list_pets" if add_prefix else "list_pets"]
+        tool = manager.get_listed_tool(server, "list_pets")
+        assert tool is not None and tool.description == "List pets"
+        assert tool.input_schema["properties"] == {"limit": {"type": "integer"}}
+
+    @pytest.mark.asyncio
+    async def test_openapi_listing_ignores_overlapping_server_prefix(self):
+        from litellm.proxy._experimental.mcp_server.tool_registry import global_mcp_tool_registry
+
+        server = MCPServer(
+            server_id="pet-id",
+            name="pet",
+            alias="pet",
+            transport=MCPTransport.http,
+            url=None,
+            spec_path="/spec.yaml",
+        )
+        manager = MCPServerManager()
+        manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+
+        async def _handler(**kwargs):
+            return None
+
+        for prefix in ("pet-", "petstore-"):
+            global_mcp_tool_registry.unregister_tools_with_prefix(prefix)
+        global_mcp_tool_registry.register_tool(
+            name="pet-petstore-list",
+            description="Local pet tool",
+            input_schema={"type": "object", "properties": {"limit": {"type": "integer"}}},
+            handler=_handler,
+        )
+        global_mcp_tool_registry.register_tool(
+            name="petstore-list",
+            description="Foreign petstore tool",
+            input_schema={"type": "object", "properties": {"status": {"type": "string"}}},
+            handler=_handler,
+        )
+        try:
+            listed = await manager._get_tools_from_server(server=server, add_prefix=True, record_listing=True)
+        finally:
+            for prefix in ("pet-", "petstore-"):
+                global_mcp_tool_registry.unregister_tools_with_prefix(prefix)
+
+        assert [t.name for t in listed] == ["pet-petstore-list"]
+        tool = manager.get_listed_tool(server, "petstore-list")
+        assert tool is not None and tool.description == "Local pet tool"
+        assert tool.input_schema["properties"] == {"limit": {"type": "integer"}}
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("openapi", [False, True], ids=["remote", "openapi"])
+    async def test_get_tools_from_server_records_the_catalog_only_when_asked_to(self, openapi):
+        """The startup fill, the implicit pre-call listing and the pin snapshot reuse this fetch without
+        serving its result, so only a listing that asks to be recorded sets what tools/call hooks see."""
+        from litellm.proxy._experimental.mcp_server.tool_registry import global_mcp_tool_registry
+
+        if openapi:
+            server = MCPServer(
+                server_id="srv", name="srv", alias="srv", transport=MCPTransport.http, url=None, spec_path="/spec.yaml"
+            )
+            manager = MCPServerManager()
+            manager._create_mcp_client = AsyncMock(return_value=AsyncMock())
+            global_mcp_tool_registry.unregister_tools_with_prefix("srv-")
+            global_mcp_tool_registry.register_tool(
+                name="srv-echo", description="Echoes", input_schema={"type": "object"}, handler=lambda **kwargs: None
+            )
+        else:
+            server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+            manager = _catalog_manager(MCPTool(name="echo", description="Echoes", inputSchema={"type": "object"}))
+        user = UserAPIKeyAuth(api_key="sk-litellm", user_id="lister")
+
+        try:
+            listed = await manager._get_tools_from_server(server=server, user_api_key_auth=user)
+            assert [t.name for t in listed] == ["srv-echo"]
+            assert server.server_id not in manager._listed_tools_by_server_id
+
+            await manager._get_tools_from_server(server=server, user_api_key_auth=user, record_listing=True)
+        finally:
+            global_mcp_tool_registry.unregister_tools_with_prefix("srv-")
+
+        recorded = manager.get_listed_tool(server, "echo", ListedToolsCaller(user_api_key_auth=user))
+        assert recorded is not None and recorded.description == "Echoes"
+
+    @pytest.mark.asyncio
+    async def test_list_tools_records_the_served_catalog(self):
+        manager = _catalog_manager(MCPTool(name="echo", description="Echoes", inputSchema={"type": "object"}))
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager.registry = {"srv": server}
+        manager.get_allowed_mcp_servers = AsyncMock(return_value=["srv"])
+        user = UserAPIKeyAuth(api_key="sk-litellm", user_id="lister")
+
+        listed = await manager.list_tools(user_api_key_auth=user)
+
+        assert [t.name for t in listed] == ["srv-echo"]
+        recorded = manager.get_listed_tool(server, "echo", ListedToolsCaller(user_api_key_auth=user))
+        assert recorded is not None and recorded.description == "Echoes"
+
+    @pytest.mark.asyncio
+    async def test_startup_tool_name_mapping_records_no_listed_catalog(self):
+        manager = _catalog_manager(MCPTool(name="echo", description="Echoes", inputSchema={"type": "object"}))
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager.registry = {"srv": server}
+
+        await manager._initialize_tool_name_to_mcp_server_name_mapping()
+
+        assert manager.server_exposes_tool(server, "echo") is True
+        assert server.server_id not in manager._listed_tools_by_server_id
+        assert manager.get_listed_tool(server, "echo") is None
+
+    @pytest.mark.asyncio
+    async def test_get_tools_for_server_records_no_listed_catalog(self):
+        manager = _catalog_manager(MCPTool(name="echo", description="Echoes", inputSchema={"type": "object"}))
+        server = MCPServer(server_id="srv", name="srv", transport=MCPTransport.http, url="http://srv")
+        manager.registry = {"srv": server}
+
+        listed = await manager.get_tools_for_server("srv")
+
+        assert [t.name for t in listed] == ["srv-echo"]
+        assert server.server_id not in manager._listed_tools_by_server_id
+
     @pytest.mark.asyncio
     async def test_get_allowed_mcp_servers_with_user_api_key_auth(self):
         """
@@ -9763,15 +10894,11 @@ class TestGetPublicMCPServers:
             if registered_in == "both"
             else server
         )
-        manager.config_mcp_servers = (
-            {server.server_id: config_server} if registered_in in ("config", "both") else {}
-        )
+        manager.config_mcp_servers = {server.server_id: config_server} if registered_in in ("config", "both") else {}
         manager.registry = {server.server_id: server} if registered_in in ("database", "both") else {}
         original_server: Final = server.model_dump()
         original_config_server: Final = config_server.model_dump()
-        expected_public: Final = registered_in != "neither" and (
-            public_ids == [server.server_id] or implicitly_public
-        )
+        expected_public: Final = registered_in != "neither" and (public_ids == [server.server_id] or implicitly_public)
 
         with (
             patch("litellm.public_mcp_servers", public_ids),
@@ -9779,9 +10906,7 @@ class TestGetPublicMCPServers:
         ):
             public_servers: Final = manager.get_public_mcp_servers()
             assert manager.is_mcp_server_public(server.server_id) is expected_public
-            assert [item.server_id for item in public_servers] == (
-                [server.server_id] if expected_public else []
-            )
+            assert [item.server_id for item in public_servers] == ([server.server_id] if expected_public else [])
             assert manager.is_mcp_server_public("server-alias") is False
             assert manager.is_mcp_server_public("missing-server") is False
             assert manager.is_mcp_server_public(server.server_id, public_ids=frozenset()) is (
@@ -10681,7 +11806,9 @@ class TestOBOConcurrencyLimit:
         inflight = {"current": 0, "peak": 0}
 
         class _ConcurrencyRecordingClient:
-            async def call_tool(self, params, host_progress_callback=None, raise_on_error=False, allow_input_required=False):
+            async def call_tool(
+                self, params, host_progress_callback=None, raise_on_error=False, allow_input_required=False
+            ):
                 inflight["current"] += 1
                 inflight["peak"] = max(inflight["peak"], inflight["current"])
                 try:
@@ -13016,7 +14143,9 @@ class TestConfigServerIdPinning:
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize("aliasing_entry_first", [True, False])
-    async def test_pinning_own_name_that_is_another_entrys_alias_is_rejected(self, config_only_mcp_manager_factory, aliasing_entry_first: bool):
+    async def test_pinning_own_name_that_is_another_entrys_alias_is_rejected(
+        self, config_only_mcp_manager_factory, aliasing_entry_first: bool
+    ):
         """A grant naming 'docs_server' reaches both servers unpinned; the pin would narrow it to one."""
         manager = config_only_mcp_manager_factory()
         wiki = (
@@ -13032,7 +14161,9 @@ class TestConfigServerIdPinning:
             await manager.load_servers_from_config(dict((wiki, docs) if aliasing_entry_first else (docs, wiki)))
 
     @pytest.mark.asyncio
-    async def test_pinning_own_name_that_is_another_entrys_mapped_alias_is_rejected(self, config_only_mcp_manager_factory):
+    async def test_pinning_own_name_that_is_another_entrys_mapped_alias_is_rejected(
+        self, config_only_mcp_manager_factory
+    ):
         manager = config_only_mcp_manager_factory()
 
         with pytest.raises(ValueError, match="server_name or alias of MCP server 'wiki_server'"):
@@ -13120,7 +14251,9 @@ class TestConfigServerIdPinning:
         assert second_round == first_round
 
     @pytest.mark.asyncio
-    async def test_shadow_warning_fires_again_when_the_shadowed_set_changes(self, config_only_mcp_manager_factory, caplog):
+    async def test_shadow_warning_fires_again_when_the_shadowed_set_changes(
+        self, config_only_mcp_manager_factory, caplog
+    ):
         manager = config_only_mcp_manager_factory()
         await manager.load_servers_from_config(self._config(server_id="docs-prod-1"))
 
@@ -13291,7 +14424,9 @@ class TestConfigServerIdPinning:
         assert manager.config_mcp_servers["wiki"].url == "https://example.com/mcp"
 
     @pytest.mark.asyncio
-    async def test_a_row_that_shadows_one_id_still_reports_capturing_another(self, config_only_mcp_manager_factory, caplog):
+    async def test_a_row_that_shadows_one_id_still_reports_capturing_another(
+        self, config_only_mcp_manager_factory, caplog
+    ):
         """Skipping is per identifier, not per row, so the second collision is not lost."""
         manager = config_only_mcp_manager_factory()
         await manager.load_servers_from_config(
@@ -13663,7 +14798,8 @@ async def test_pre_call_tool_check_honors_guardrail_attached_to_key(monkeypatch,
         ("none", {"Authorization": "Bearer injected"}, "extra-headers", "Bearer injected"),
     ],
 )
-async def test_debug_resolution_matches_final_header_conflict_winner(_mcp_request_ctx,
+async def test_debug_resolution_matches_final_header_conflict_winner(
+    _mcp_request_ctx,
     config: Literal["stored", "static", "none"],
     extra_headers: dict[str, str] | None,
     expected_source: str,
@@ -13782,12 +14918,16 @@ async def test_debug_reports_legacy_signing_and_non_http_transport(
 async def test_temporary_server_discovery_reuses_resolved_metadata_without_publishing() -> None:
     manager: Final = MCPServerManager()
     server: Final = MCPServer(
-        server_id="temporary-oauth-discovery", name="temporary", url="https://idp.example.com/mcp",
-        transport=MCPTransport.http, auth_type=MCPAuth.true_passthrough,
+        server_id="temporary-oauth-discovery",
+        name="temporary",
+        url="https://idp.example.com/mcp",
+        transport=MCPTransport.http,
+        auth_type=MCPAuth.true_passthrough,
     )
     manager._set_oauth_discovery_deferred(server.server_id, True)
     metadata: Final = MCPOAuthMetadata(
-        authorization_url="https://idp.example.com/authorize", token_url="https://idp.example.com/token",
+        authorization_url="https://idp.example.com/authorize",
+        token_url="https://idp.example.com/token",
         registration_url="https://idp.example.com/register",
     )
     with patch.object(manager, "_discover_oauth_metadata_for_server", AsyncMock(return_value=metadata)) as discovery:
@@ -13807,13 +14947,18 @@ async def test_temporary_server_discovery_reuses_resolved_metadata_without_publi
 async def test_repeated_stale_oauth_discovery_is_bounded(auth_type: MCPAuth) -> None:
     manager: Final = MCPServerManager()
     server: Final = MCPServer(
-        server_id="repeated-stale", name="stale", url="https://idp.example.com/mcp",
-        transport=MCPTransport.http, auth_type=auth_type, oauth2_flow="authorization_code",
+        server_id="repeated-stale",
+        name="stale",
+        url="https://idp.example.com/mcp",
+        transport=MCPTransport.http,
+        auth_type=auth_type,
+        oauth2_flow="authorization_code",
     )
     manager.registry[server.server_id] = server
     manager._set_oauth_discovery_deferred(server.server_id, True)
     metadata: Final = MCPOAuthMetadata(
-        authorization_url="https://idp.example.com/authorize", token_url="https://idp.example.com/token",
+        authorization_url="https://idp.example.com/authorize",
+        token_url="https://idp.example.com/token",
     )
     with (
         patch.object(manager, "_discover_oauth_metadata_for_server", AsyncMock(return_value=metadata)) as discovery,
@@ -13833,13 +14978,20 @@ async def test_repeated_stale_oauth_discovery_is_bounded(auth_type: MCPAuth) ->
 async def test_stale_discovery_falls_back_to_resolved_registered_server() -> None:
     manager: Final = MCPServerManager()
     original: Final = MCPServer(
-        server_id="resolved-replacement", name="replacement", url="https://old.example.com/mcp",
-        transport=MCPTransport.http, auth_type=MCPAuth.oauth2, oauth2_flow="authorization_code",
+        server_id="resolved-replacement",
+        name="replacement",
+        url="https://old.example.com/mcp",
+        transport=MCPTransport.http,
+        auth_type=MCPAuth.oauth2,
+        oauth2_flow="authorization_code",
+    )
+    replacement: Final = original.model_copy(
+        update={
+            "url": "https://new.example.com/mcp",
+            "authorization_url": "https://new.example.com/authorize",
+            "token_url": "https://new.example.com/token",
+        }
     )
-    replacement: Final = original.model_copy(update={
-        "url": "https://new.example.com/mcp", "authorization_url": "https://new.example.com/authorize",
-        "token_url": "https://new.example.com/token",
-    })
     manager.registry[original.server_id] = replacement
     assert await manager._rejoin_oauth_metadata_discovery(original, retry_stale=False) is replacement
 
@@ -13847,8 +14999,11 @@ async def test_stale_discovery_falls_back_to_resolved_registered_server() -> Non
 def test_stale_discovery_cannot_overwrite_new_registered_server() -> None:
     manager: Final = MCPServerManager()
     original: Final = MCPServer(
-        server_id="stale-publication", name="publication", url="https://old.example.com/mcp",
-        transport=MCPTransport.http, auth_type=MCPAuth.oauth2,
+        server_id="stale-publication",
+        name="publication",
+        url="https://old.example.com/mcp",
+        transport=MCPTransport.http,
+        auth_type=MCPAuth.oauth2,
     )
     manager._set_oauth_discovery_deferred(original.server_id, True)
     original_slot: Final = manager._oauth_discovery_slot(original.server_id)
@@ -13864,9 +15019,13 @@ def test_stale_discovery_cannot_overwrite_new_registered_server() -> None:
 async def test_temporary_oauth_discovery_expires_without_more_requests() -> None:
     manager: Final = MCPServerManager()
     server: Final = MCPServer(
-        server_id="expiring-session", name="temporary", url="https://idp.example.com/mcp",
-        transport=MCPTransport.http, auth_type=MCPAuth.true_passthrough,
-        authorization_url="https://idp.example.com/authorize", token_url="https://idp.example.com/token",
+        server_id="expiring-session",
+        name="temporary",
+        url="https://idp.example.com/mcp",
+        transport=MCPTransport.http,
+        auth_type=MCPAuth.true_passthrough,
+        authorization_url="https://idp.example.com/authorize",
+        token_url="https://idp.example.com/token",
     )
     manager._set_oauth_discovery_deferred(server.server_id, True)
     resolved: Final = await manager.ensure_oauth_metadata_discovered(server)
@@ -13967,7 +15126,9 @@ async def test_openapi_health_reports_size_limit_as_unknown_and_caches_failure(r
     result = await manager.health_check_server(server.server_id)
     cached = await manager.health_check_server(server.server_id)
     assert result.status == "unknown"
-    assert result.health_check_error == "OpenAPI specification probe refused: Response exceeds the configured size limit"
+    assert (
+        result.health_check_error == "OpenAPI specification probe refused: Response exceeds the configured size limit"
+    )
     assert cached.health_check_error == result.health_check_error
     assert cached.last_health_check == result.last_health_check
     assert route.call_count == 1
@@ -13979,8 +15140,11 @@ async def test_openapi_health_cancellation_does_not_poison_cache(respx_mock, mon
     monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
     manager = MCPServerManager()
     server = MCPServer(
-        server_id="cancelled-cache", name="cancelled-cache", transport=MCPTransport.http,
-        spec_path="https://93.184.216.34/cancelled-cache.json", auth_type=MCPAuth.none,
+        server_id="cancelled-cache",
+        name="cancelled-cache",
+        transport=MCPTransport.http,
+        spec_path="https://93.184.216.34/cancelled-cache.json",
+        auth_type=MCPAuth.none,
     )
     manager.registry = {server.server_id: server}
     started = asyncio.Event()
@@ -14109,7 +15273,9 @@ class _DiscoveryUpstream:
 
 
 def _discovery_server() -> MCPServer:
-    return MCPServer(server_id="discovery", name="discovery", url="https://discovery.example/mcp", transport=MCPTransport.http)
+    return MCPServer(
+        server_id="discovery", name="discovery", url="https://discovery.example/mcp", transport=MCPTransport.http
+    )
 
 
 @pytest.mark.asyncio
@@ -14277,7 +15443,9 @@ async def test_discovery_cache_can_be_disabled(monkeypatch: pytest.MonkeyPatch)
         assert upstream.initializes == 2
 
 
-@pytest.mark.parametrize("value,expected", (("invalid", 60.0), ("nan", 60.0), ("inf", 60.0), ("-1", 60.0), ("12.5", 12.5)))
+@pytest.mark.parametrize(
+    "value,expected", (("invalid", 60.0), ("nan", 60.0), ("inf", 60.0), ("-1", 60.0), ("12.5", 12.5))
+)
 def test_discovery_cache_ttl_validation(value: str, expected: float, monkeypatch: pytest.MonkeyPatch) -> None:
     from litellm.proxy._experimental.mcp_server.mcp_server_manager import _mcp_discovery_cache_ttl
 
@@ -14594,26 +15762,45 @@ async def test_discovery_cache_returns_oversized_results_without_retaining_them(
 
 class TestProtectedCredentialPreparation:
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,credential", [
-        (MCPAuth.bearer_token, None),
-        (MCPAuth.bearer_token, "Bearer"),
-        (MCPAuth.api_key, None),
-        (MCPAuth.basic, "Basic"),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,credential",
+        [
+            (MCPAuth.bearer_token, None),
+            (MCPAuth.bearer_token, "Bearer"),
+            (MCPAuth.api_key, None),
+            (MCPAuth.basic, "Basic"),
+        ],
+    )
     @pytest.mark.parametrize("dispatch", ["managed", "local"])
     async def test_openapi_dispatch_rejects_unusable_effective_credentials(
-        self, tmp_path: Path, respx_mock: MockRouter, monkeypatch: pytest.MonkeyPatch,
-        auth_type: MCPAuthType, credential: str | None, dispatch: str,
+        self,
+        tmp_path: Path,
+        respx_mock: MockRouter,
+        monkeypatch: pytest.MonkeyPatch,
+        auth_type: MCPAuthType,
+        credential: str | None,
+        dispatch: str,
     ) -> None:
         from litellm.proxy._experimental.mcp_server.server import _handle_local_mcp_tool
         from litellm.proxy._experimental.mcp_server.utils import add_server_prefix_to_name, get_server_prefix
 
         spec_path: Final = tmp_path / "openapi.json"
-        spec_path.write_text(json.dumps({"openapi": "3.0.0", "info": {"title": "Auth", "version": "1"},
-                                        "paths": {"/echo": {"get": {"operationId": "echo"}}}}))
+        spec_path.write_text(
+            json.dumps(
+                {
+                    "openapi": "3.0.0",
+                    "info": {"title": "Auth", "version": "1"},
+                    "paths": {"/echo": {"get": {"operationId": "echo"}}},
+                }
+            )
+        )
         server: Final = MCPServer(
-            server_id="dispatch-auth", name="dispatch-auth", url="https://upstream.example",
-            transport=MCPTransport.http, auth_type=auth_type, authentication_token=credential,
+            server_id="dispatch-auth",
+            name="dispatch-auth",
+            url="https://upstream.example",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            authentication_token=credential,
         )
         manager: Final = MCPServerManager()
         await manager._register_openapi_tools(str(spec_path), server, server.url)
@@ -14636,14 +15823,21 @@ class TestProtectedCredentialPreparation:
         self, transport: MCPTransport, client_secret: str | None, subject: str | None
     ) -> None:
         server = MCPServer(
-            server_id="incomplete-obo", name="incomplete-obo", url="https://upstream.example/mcp",
-            transport=transport, auth_type=MCPAuth.oauth2_token_exchange,
-            client_id="gateway", client_secret=client_secret,
-            token_exchange_endpoint="https://idp.example/token", authentication_token="static-fallback",
+            server_id="incomplete-obo",
+            name="incomplete-obo",
+            url="https://upstream.example/mcp",
+            transport=transport,
+            auth_type=MCPAuth.oauth2_token_exchange,
+            client_id="gateway",
+            client_secret=client_secret,
+            token_exchange_endpoint="https://idp.example/token",
+            authentication_token="static-fallback",
         )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(
-                server, mcp_auth_header="Bearer override", subject_token=subject,
+                server,
+                mcp_auth_header="Bearer override",
+                subject_token=subject,
             )
         assert exc.value.status_code == (401 if subject is None else 500)
         assert "static-fallback" not in str(exc.value.detail)
@@ -14656,8 +15850,11 @@ class TestProtectedCredentialPreparation:
         self, auth_type: MCPAuthType, credential: str | dict[str, str] | None
     ) -> None:
         server = MCPServer(
-            server_id="empty-static", name="empty-static", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type,
+            server_id="empty-static",
+            name="empty-static",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
         )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, mcp_auth_header=credential)
@@ -14665,16 +15862,22 @@ class TestProtectedCredentialPreparation:
         assert "credential" in str(exc.value.detail).lower()
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,headers", [
-        (MCPAuth.api_key, {"X-API-Key": "key"}),
-        (MCPAuth.bearer_token, {"Authorization": "Bearer token"}),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,headers",
+        [
+            (MCPAuth.api_key, {"X-API-Key": "key"}),
+            (MCPAuth.bearer_token, {"Authorization": "Bearer token"}),
+        ],
+    )
     async def test_static_auth_accepts_actual_forwarded_credential(
         self, auth_type: MCPAuthType, headers: dict[str, str]
     ) -> None:
         server = MCPServer(
-            server_id="header-static", name="header-static", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type,
+            server_id="header-static",
+            name="header-static",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
         )
         client = await MCPServerManager()._create_mcp_client(server, extra_headers=headers)
         assert client._get_auth_headers() == headers
@@ -14683,29 +15886,48 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.parametrize("auth_type", [MCPAuth.oauth2_token_exchange])
     async def test_openapi_protected_auth_rejects_missing_credentials(self, auth_type: MCPAuthType) -> None:
         server = MCPServer(
-            server_id="openapi-empty", name="openapi-empty", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type,
+            server_id="openapi-empty",
+            name="openapi-empty",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
             token_exchange_endpoint="https://idp.example/token",
         )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager().resolve_openapi_upstream_auth(
-                mcp_server=server, oauth2_headers=None, raw_headers=None, mcp_auth_header=None,
-                user_api_key_auth=None, forwarded_headers=None,
+                mcp_server=server,
+                oauth2_headers=None,
+                raw_headers=None,
+                mcp_auth_header=None,
+                user_api_key_auth=None,
+                forwarded_headers=None,
             )
         assert exc.value.status_code in (401, 500)
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,slot,value", [
-        (MCPAuth.api_key, "X-API-Key", "token"),
-        (MCPAuth.authorization, "Authorization", "opaque-secret-value"),
-        (MCPAuth.authorization, "Authorization", "Bearer abc"),
-        (MCPAuth.authorization, "Authorization", "Custom abc"),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,slot,value",
+        [
+            (MCPAuth.api_key, "X-API-Key", "token"),
+            (MCPAuth.authorization, "Authorization", "opaque-secret-value"),
+            (MCPAuth.authorization, "Authorization", "Bearer abc"),
+            (MCPAuth.authorization, "Authorization", "Custom abc"),
+        ],
+    )
     async def test_raw_static_credentials_are_forwarded_unchanged(
-        self, auth_type: MCPAuthType, slot: str, value: str,
+        self,
+        auth_type: MCPAuthType,
+        slot: str,
+        value: str,
     ) -> None:
-        server = MCPServer(server_id="raw-key", name="raw-key", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=auth_type, authentication_token=value)
+        server = MCPServer(
+            server_id="raw-key",
+            name="raw-key",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            authentication_token=value,
+        )
         client = await MCPServerManager()._create_mcp_client(server)
         assert client._resolved_auth is not None
         request = httpx.Request("GET", server.url)
@@ -14719,17 +15941,24 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.parametrize("value", ["Bearer", "basic", "token", "ApiKey", " bEaReR ", "\tTOKEN\t"])
     @pytest.mark.parametrize("source", ["configured", "caller", "forwarded"])
     async def test_raw_authorization_rejects_bare_schemes_before_dispatch(
-        self, respx_mock: MockRouter, value: str, source: str,
+        self,
+        respx_mock: MockRouter,
+        value: str,
+        source: str,
     ) -> None:
         server: Final = MCPServer(
-            server_id="raw-empty", name="raw-empty", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.authorization,
+            server_id="raw-empty",
+            name="raw-empty",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.authorization,
             authentication_token=value if source == "configured" else None,
         )
         destination: Final = respx_mock.route().respond(200)
         with pytest.raises(HTTPException, match="requires a usable upstream credential") as exc:
             await MCPServerManager()._create_mcp_client(
-                server, mcp_auth_header=value if source == "caller" else None,
+                server,
+                mcp_auth_header=value if source == "caller" else None,
                 extra_headers={"Authorization": value} if source == "forwarded" else None,
             )
         assert exc.value.status_code == 500
@@ -14737,9 +15966,15 @@ class TestProtectedCredentialPreparation:
 
     @pytest.mark.asyncio
     async def test_byok_flag_cannot_bypass_incomplete_obo(self) -> None:
-        server = MCPServer(server_id="obo-byok", name="obo-byok", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.oauth2_token_exchange, is_byok=True,
-                           token_exchange_endpoint="https://idp.example/token")
+        server = MCPServer(
+            server_id="obo-byok",
+            name="obo-byok",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.oauth2_token_exchange,
+            is_byok=True,
+            token_exchange_endpoint="https://idp.example/token",
+        )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, mcp_auth_header="Bearer override")
         assert exc.value.status_code == 401
@@ -14747,41 +15982,66 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.asyncio
     @pytest.mark.parametrize("configured,override", [(None, "Bearer usable"), ("shared", "Bearer usable")])
     async def test_bearer_override_remains_usable(self, configured: str | None, override: str) -> None:
-        server = MCPServer(server_id="override", name="override", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.bearer_token, authentication_token=configured)
+        server = MCPServer(
+            server_id="override",
+            name="override",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.bearer_token,
+            authentication_token=configured,
+        )
         client = await MCPServerManager()._create_mcp_client(server, mcp_auth_header=override)
         assert client._get_auth_headers()["Authorization"] == override
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize("token", [None, "shared"])
     async def test_empty_injected_header_cannot_satisfy_protected_auth(self, token: str | None) -> None:
-        server = MCPServer(server_id="empty-header", name="empty-header", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.bearer_token, authentication_token=token)
+        server = MCPServer(
+            server_id="empty-header",
+            name="empty-header",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.bearer_token,
+            authentication_token=token,
+        )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, extra_headers={"authorization": " "})
         assert exc.value.status_code == 500
 
     @pytest.mark.asyncio
     async def test_custom_slot_uses_its_actual_credential(self) -> None:
-        server = MCPServer(server_id="custom", name="custom", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.api_key,
-                           upstream_token_header="X-Custom", authentication_token="key")
+        server = MCPServer(
+            server_id="custom",
+            name="custom",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
+            upstream_token_header="X-Custom",
+            authentication_token="key",
+        )
         client = await MCPServerManager()._create_mcp_client(server, extra_headers={"X-Trace": "trace"})
         assert client._credential_slot == "X-Custom"
         assert await client.discovery_auth_fingerprint()
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("static_headers,accepted", [
-        ({"apikey": "static-key"}, True),
-        ({"apikey": ""}, False),
-        ({"X-Tenant": "tenant"}, True),
-    ])
+    @pytest.mark.parametrize(
+        "static_headers,accepted",
+        [
+            ({"apikey": "static-key"}, True),
+            ({"apikey": ""}, False),
+            ({"X-Tenant": "tenant"}, True),
+        ],
+    )
     async def test_api_key_carried_by_static_header_passes_fail_closed_check(
         self, static_headers: dict[str, str], accepted: bool
     ) -> None:
         server: Final = MCPServer(
-            server_id="static-slot", name="static-slot", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.api_key, static_headers=static_headers,
+            server_id="static-slot",
+            name="static-slot",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
+            static_headers=static_headers,
         )
         if not accepted:
             with pytest.raises(HTTPException) as exc:
@@ -14793,21 +16053,36 @@ class TestProtectedCredentialPreparation:
         assert all(request.headers[name] == value for name, value in static_headers.items())
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("static,forwarded,caller", [
-        ({"X-API-Key": "static"}, {"x-api-key": "forwarded"}, None),
-        ({}, {"X-API-Key": "forwarded"}, None),
-        ({}, None, "ApiKey caller"),
-        ({"X-API-Key": "static"}, {"Authorization": ""}, None),
-    ])
+    @pytest.mark.parametrize(
+        "static,forwarded,caller",
+        [
+            ({"X-API-Key": "static"}, {"x-api-key": "forwarded"}, None),
+            ({}, {"X-API-Key": "forwarded"}, None),
+            ({}, None, "ApiKey caller"),
+            ({"X-API-Key": "static"}, {"Authorization": ""}, None),
+        ],
+    )
     async def test_openapi_static_credentials_remain_supported(
-        self, respx_mock: MockRouter, monkeypatch: pytest.MonkeyPatch,
-        static: dict[str, str], forwarded: dict[str, str] | None, caller: str | None
+        self,
+        respx_mock: MockRouter,
+        monkeypatch: pytest.MonkeyPatch,
+        static: dict[str, str],
+        forwarded: dict[str, str] | None,
+        caller: str | None,
     ) -> None:
         from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import (
-            _request_auth_header, _request_extra_headers, create_tool_function,
+            _request_auth_header,
+            _request_extra_headers,
+            create_tool_function,
         )
+
         tool: Final = create_tool_function(
-            "/echo", "get", {}, "https://upstream.example", headers=static, auth_type=MCPAuth.api_key,
+            "/echo",
+            "get",
+            {},
+            "https://upstream.example",
+            headers=static,
+            auth_type=MCPAuth.api_key,
         )
         monkeypatch.setenv("DISABLE_AIOHTTP_TRANSPORT", "True")
         destination: Final = respx_mock.get("https://upstream.example/echo").respond(200, text="authenticated")
@@ -14841,8 +16116,13 @@ class TestProtectedCredentialPreparation:
                     self.closed = True
 
         auth = CancelledAuth()
-        server = MCPServer(server_id="cancel", name="cancel", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.api_key)
+        server = MCPServer(
+            server_id="cancel",
+            name="cancel",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
+        )
         client = MCPClient(server_url=server.url, auth_type=MCPAuth.api_key, resolved_auth=auth)
         with pytest.raises(asyncio.CancelledError):
             await prepare_mcp_client(server, client)
@@ -14851,8 +16131,14 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.asyncio
     @pytest.mark.parametrize("auth_type", [MCPAuth.basic, MCPAuth.token, MCPAuth.authorization])
     async def test_other_static_schemes_reject_whitespace_credentials(self, auth_type: MCPAuthType) -> None:
-        server = MCPServer(server_id="blank-static", name="blank-static", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=auth_type, authentication_token=" ")
+        server = MCPServer(
+            server_id="blank-static",
+            name="blank-static",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            authentication_token=" ",
+        )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server)
         assert exc.value.status_code == 500
@@ -14860,8 +16146,13 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.asyncio
     @pytest.mark.parametrize("header", ["Basic", "Basic @@@", "Other abc", "Basic QmFzaWM=", "Basic bm8tY29sb24="])
     async def test_basic_headers_without_usable_credentials_reject(self, header: str) -> None:
-        server = MCPServer(server_id="bad-basic", name="bad-basic", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.basic)
+        server = MCPServer(
+            server_id="bad-basic",
+            name="bad-basic",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.basic,
+        )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, extra_headers={"Authorization": header})
         assert exc.value.status_code == 500
@@ -14870,34 +16161,48 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.parametrize("value", ["Basic", "Basic ", "basic"])
     @pytest.mark.parametrize("source", ["configured", "caller"])
     async def test_basic_scheme_alone_is_not_a_credential(self, value: str, source: str) -> None:
-        server = MCPServer(server_id="basic-scheme", name="basic-scheme", url="https://upstream.example/mcp",
-                           transport=MCPTransport.http, auth_type=MCPAuth.basic,
-                           authentication_token=value if source == "configured" else None)
+        server = MCPServer(
+            server_id="basic-scheme",
+            name="basic-scheme",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.basic,
+            authentication_token=value if source == "configured" else None,
+        )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, mcp_auth_header=value if source == "caller" else None)
         assert exc.value.status_code == 500
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,value,default_slot", [
-        (MCPAuth.api_key, "fixture-key", "X-API-Key"),
-        (MCPAuth.bearer_token, "fixture-key", "Authorization"),
-        (MCPAuth.basic, "user:pass", "Authorization"),
-        (MCPAuth.token, "fixture-key", "Authorization"),
-        (MCPAuth.authorization, "fixture-key", "Authorization"),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,value,default_slot",
+        [
+            (MCPAuth.api_key, "fixture-key", "X-API-Key"),
+            (MCPAuth.bearer_token, "fixture-key", "Authorization"),
+            (MCPAuth.basic, "user:pass", "Authorization"),
+            (MCPAuth.token, "fixture-key", "Authorization"),
+            (MCPAuth.authorization, "fixture-key", "Authorization"),
+        ],
+    )
     @pytest.mark.parametrize("source", ["configured", "caller"])
     async def test_usable_credential_survives_an_empty_alternate_header(
         self, auth_type: MCPAuthType, value: str, default_slot: str, source: str
     ) -> None:
         server: Final = MCPServer(
-            server_id="alternate", name="alternate", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type, upstream_token_header="X-Custom",
+            server_id="alternate",
+            name="alternate",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            upstream_token_header="X-Custom",
             authentication_token=value if source == "configured" else None,
         )
         empty_slot: Final = default_slot if source == "configured" else "X-Custom"
         selected_slot: Final = "X-Custom" if source == "configured" else default_slot
         client: Final = await MCPServerManager()._create_mcp_client(
-            server, mcp_auth_header=value if source == "caller" else None, extra_headers={empty_slot: ""},
+            server,
+            mcp_auth_header=value if source == "caller" else None,
+            extra_headers={empty_slot: ""},
         )
         request: Final = await client.prepare_request_auth()
         assert request.headers[selected_slot]
@@ -14906,8 +16211,12 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.asyncio
     async def test_empty_custom_and_default_headers_do_not_satisfy_auth(self) -> None:
         server: Final = MCPServer(
-            server_id="both-empty", name="both-empty", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.api_key, upstream_token_header="X-Custom",
+            server_id="both-empty",
+            name="both-empty",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
+            upstream_token_header="X-Custom",
         )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, extra_headers={"X-Custom": "", "X-API-Key": ""})
@@ -14920,12 +16229,17 @@ class TestProtectedCredentialPreparation:
         self, custom_slot: str | None, source: str
     ) -> None:
         server: Final = MCPServer(
-            server_id="caller-auth", name="caller-auth", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.api_key, upstream_token_header=custom_slot,
+            server_id="caller-auth",
+            name="caller-auth",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
+            upstream_token_header=custom_slot,
         )
         headers: Final = {"Authorization": "Bearer caller-credential", "X-API-Key": ""}
         client: Final = await MCPServerManager()._create_mcp_client(
-            server, mcp_auth_header=headers if source == "caller" else None,
+            server,
+            mcp_auth_header=headers if source == "caller" else None,
             extra_headers=headers if source == "forwarded" else None,
         )
         request: Final = await client.prepare_request_auth()
@@ -14934,14 +16248,29 @@ class TestProtectedCredentialPreparation:
         assert custom_slot is None or custom_slot not in request.headers
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("value", [
-        "", " ", "Bearer", "Basic", "token", "ApiKey",
-        "Bearer Bearer", "ApiKey ApiKey", "token token", "bEaReR   BEARER", "aPiKeY\tAPIKEY",
-    ])
+    @pytest.mark.parametrize(
+        "value",
+        [
+            "",
+            " ",
+            "Bearer",
+            "Basic",
+            "token",
+            "ApiKey",
+            "Bearer Bearer",
+            "ApiKey ApiKey",
+            "token token",
+            "bEaReR   BEARER",
+            "aPiKeY\tAPIKEY",
+        ],
+    )
     async def test_api_key_rejects_authorization_without_a_credential(self, value: str) -> None:
         server: Final = MCPServer(
-            server_id="caller-empty", name="caller-empty", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.api_key,
+            server_id="caller-empty",
+            name="caller-empty",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.api_key,
         )
         with pytest.raises(HTTPException) as exc:
             await MCPServerManager()._create_mcp_client(server, mcp_auth_header={"Authorization": value})
@@ -14952,8 +16281,11 @@ class TestProtectedCredentialPreparation:
     @pytest.mark.parametrize("source", ["configured", "caller"])
     async def test_basic_requires_a_username_password_separator(self, value: str, source: str) -> None:
         server: Final = MCPServer(
-            server_id="basic-pair", name="basic-pair", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.basic,
+            server_id="basic-pair",
+            name="basic-pair",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.basic,
             authentication_token=value if source == "configured" else None,
         )
         with pytest.raises(HTTPException) as exc:
@@ -14966,8 +16298,12 @@ class TestProtectedCredentialPreparation:
         import base64
 
         server: Final = MCPServer(
-            server_id="basic-valid", name="basic-valid", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=MCPAuth.basic, authentication_token=value,
+            server_id="basic-valid",
+            name="basic-valid",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=MCPAuth.basic,
+            authentication_token=value,
         )
         client: Final = await MCPServerManager()._create_mcp_client(server)
         request: Final = await client.prepare_request_auth()
@@ -14976,17 +16312,27 @@ class TestProtectedCredentialPreparation:
         assert base64.b64decode(encoded) == value.encode()
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,value", [
-        (MCPAuth.bearer_token, "Bearer"), (MCPAuth.bearer_token, "Bearer "), (MCPAuth.bearer_token, "bearer"),
-        (MCPAuth.token, "token"), (MCPAuth.token, "token "), (MCPAuth.token, "TOKEN"),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,value",
+        [
+            (MCPAuth.bearer_token, "Bearer"),
+            (MCPAuth.bearer_token, "Bearer "),
+            (MCPAuth.bearer_token, "bearer"),
+            (MCPAuth.token, "token"),
+            (MCPAuth.token, "token "),
+            (MCPAuth.token, "TOKEN"),
+        ],
+    )
     @pytest.mark.parametrize("source", ["configured", "caller"])
     async def test_static_scheme_only_input_cannot_hide_behind_rendered_prefix(
         self, auth_type: MCPAuthType, value: str, source: str
     ) -> None:
         server: Final = MCPServer(
-            server_id="empty-scheme", name="empty-scheme", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type,
+            server_id="empty-scheme",
+            name="empty-scheme",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
             authentication_token=value if source == "configured" else None,
         )
         with pytest.raises(HTTPException) as exc:
@@ -14994,17 +16340,24 @@ class TestProtectedCredentialPreparation:
         assert exc.value.status_code == 500
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("auth_type,value,expected", [
-        (MCPAuth.bearer_token, "token", "Bearer token"),
-        (MCPAuth.bearer_token, "Bearertoken", "Bearer Bearertoken"),
-        (MCPAuth.token, "tokenish", "token tokenish"),
-    ])
+    @pytest.mark.parametrize(
+        "auth_type,value,expected",
+        [
+            (MCPAuth.bearer_token, "token", "Bearer token"),
+            (MCPAuth.bearer_token, "Bearertoken", "Bearer Bearertoken"),
+            (MCPAuth.token, "tokenish", "token tokenish"),
+        ],
+    )
     async def test_static_credentials_that_resemble_schemes_remain_usable(
         self, auth_type: MCPAuthType, value: str, expected: str
     ) -> None:
         server: Final = MCPServer(
-            server_id="real-token", name="real-token", url="https://upstream.example/mcp",
-            transport=MCPTransport.http, auth_type=auth_type, authentication_token=value,
+            server_id="real-token",
+            name="real-token",
+            url="https://upstream.example/mcp",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            authentication_token=value,
         )
         client: Final = await MCPServerManager()._create_mcp_client(server)
         request: Final = await client.prepare_request_auth()
@@ -15043,16 +16396,31 @@ async def test_request_selected_during_guardrail_runs_concurrently_with_tool(mon
     registry.register_tool("observer-execute", "Execute", {"type": "object"}, upstream)
     monkeypatch.setattr(tool_registry, "global_mcp_tool_registry", registry)
     manager = MCPServerManager()
-    manager.registry = {"observer": MCPServer(
-        server_id="observer", name="observer", server_name="observer", transport="http",
-        url="https://observer.example/mcp", spec_path="observer.json", auth_type="none",
-    )}
+    manager.registry = {
+        "observer": MCPServer(
+            server_id="observer",
+            name="observer",
+            server_name="observer",
+            transport="http",
+            url="https://observer.example/mcp",
+            spec_path="observer.json",
+            auth_type="none",
+        )
+    }
     manager.tool_name_to_mcp_server_name_mapping = {"observer-execute": "observer"}
-    result = await asyncio.wait_for(manager.call_tool(
-        server_name="observer", name="execute", arguments={"text": "hello"},
-        user_api_key_auth=UserAPIKeyAuth(), proxy_logging_obj=ProxyLogging(user_api_key_cache=DualCache()),
-        guardrail_context=MCPRequestContext.resolve_guardrail_context({"metadata": {"guardrails": ["observe"] if selected else []}}),
-    ), timeout=5)
+    result = await asyncio.wait_for(
+        manager.call_tool(
+            server_name="observer",
+            name="execute",
+            arguments={"text": "hello"},
+            user_api_key_auth=UserAPIKeyAuth(),
+            proxy_logging_obj=ProxyLogging(user_api_key_cache=DualCache()),
+            guardrail_context=MCPRequestContext.resolve_guardrail_context(
+                {"metadata": {"guardrails": ["observe"] if selected else []}}
+            ),
+        ),
+        timeout=5,
+    )
     assert tool_started.is_set()
     assert guardrail_started.is_set() is selected
     assert result.is_error is False
@@ -15081,11 +16449,21 @@ async def test_client_sampling_does_not_fill_explicit_context_from_another_ambie
     from litellm.proxy._experimental.mcp_server import server as legacy_server
     from litellm.proxy._experimental.mcp_server.mcp_server_manager import _create_sampling_callback
 
-    upstream = MCPServer(server_id="explicit-empty", name="explicit_empty", url="https://example.invalid/mcp", transport=MCPTransport.http, allow_sampling=True)
+    upstream = MCPServer(
+        server_id="explicit-empty",
+        name="explicit_empty",
+        url="https://example.invalid/mcp",
+        transport=MCPTransport.http,
+        allow_sampling=True,
+    )
     token = auth_context_var.set(None)
     sampling = AsyncMock()
     try:
-        legacy_server.set_auth_context(UserAPIKeyAuth(user_id="unrelated"), raw_headers={"authorization": "unrelated-credential"}, client_ip="192.0.2.99")
+        legacy_server.set_auth_context(
+            UserAPIKeyAuth(user_id="unrelated"),
+            raw_headers={"authorization": "unrelated-credential"},
+            client_ip="192.0.2.99",
+        )
         with (
             patch("litellm.proxy._experimental.mcp_server.upstream.MCPClient") as factory,
             patch("litellm.proxy._experimental.mcp_server.sampling_handler.handle_sampling_create_message", sampling),
@@ -15093,7 +16471,9 @@ async def test_client_sampling_does_not_fill_explicit_context_from_another_ambie
             if legacy_factory:
                 callback = _create_sampling_callback(user_api_key_auth=UserAPIKeyAuth(user_id="explicit"))
             else:
-                await MCPServerManager()._create_mcp_client(upstream, user_api_key_auth=UserAPIKeyAuth(user_id="explicit") if with_caller else None)
+                await MCPServerManager()._create_mcp_client(
+                    upstream, user_api_key_auth=UserAPIKeyAuth(user_id="explicit") if with_caller else None
+                )
                 callback = factory.call_args.kwargs["sampling_callback"]
             await callback(None, None)
         captured = sampling.await_args.kwargs
@@ -15116,16 +16496,28 @@ class TestSharedIdentifierPrefixWarning:
         manager = MCPServerManager()
         rows = [
             LiteLLM_MCPServerTable(
-                server_id="srv-a", server_name="alpha", alias="shared", url="https://a.example.com/mcp",
-                transport=MCPTransport.http, updated_at=datetime.now(),
+                server_id="srv-a",
+                server_name="alpha",
+                alias="shared",
+                url="https://a.example.com/mcp",
+                transport=MCPTransport.http,
+                updated_at=datetime.now(),
             ),
             LiteLLM_MCPServerTable(
-                server_id="srv-b", server_name="beta", alias="Shared", url="https://b.example.com/mcp",
-                transport=MCPTransport.http, updated_at=datetime.now(),
+                server_id="srv-b",
+                server_name="beta",
+                alias="Shared",
+                url="https://b.example.com/mcp",
+                transport=MCPTransport.http,
+                updated_at=datetime.now(),
             ),
             LiteLLM_MCPServerTable(
-                server_id="srv-c", server_name="gamma", alias="lonely", url="https://c.example.com/mcp",
-                transport=MCPTransport.http, updated_at=datetime.now(),
+                server_id="srv-c",
+                server_name="gamma",
+                alias="lonely",
+                url="https://c.example.com/mcp",
+                transport=MCPTransport.http,
+                updated_at=datetime.now(),
             ),
         ]
         raw_rows = [MagicMock(model_dump=lambda row=row: row.model_dump()) for row in rows]
@@ -15217,7 +16609,9 @@ async def test_reload_warns_once_about_a_blocked_stdio_row_that_is_rebuilt_every
 @pytest.mark.parametrize("revision", ["auto", "2024-11-05", "2025-03-26", "2025-06-18", "2025-11-25"])
 async def test_configured_protocol_reaches_the_upstream_client(config_only_mcp_manager_factory, revision):
     manager = config_only_mcp_manager_factory()
-    await manager.load_servers_from_config({"versions": {"url": "http://127.0.0.1:9/mcp", "transport": "http", "protocol_version": revision}})
+    await manager.load_servers_from_config(
+        {"versions": {"url": "http://127.0.0.1:9/mcp", "transport": "http", "protocol_version": revision}}
+    )
     server = next(iter(manager.config_mcp_servers.values()))
     client = await manager._create_mcp_client(server)
     assert server.protocol_version == revision
@@ -15229,11 +16623,15 @@ async def test_configured_protocol_reaches_the_upstream_client(config_only_mcp_m
 def test_runtime_protocol_metadata_preserves_explicit_precedence(
     revision: MCPUpstreamProtocol, explicit: MCPUpstreamProtocol | None
 ) -> None:
-    server: Final = MCPServer.model_validate({
-        "server_id": "preview", "name": "preview", "transport": "http",
-        "mcp_info": {"protocol_version": revision},
-        **({"protocol_version": explicit} if explicit is not None else {}),
-    })
+    server: Final = MCPServer.model_validate(
+        {
+            "server_id": "preview",
+            "name": "preview",
+            "transport": "http",
+            "mcp_info": {"protocol_version": revision},
+            **({"protocol_version": explicit} if explicit is not None else {}),
+        }
+    )
     assert server.protocol_version == (explicit if explicit is not None else revision)
 
 
@@ -15411,9 +16809,7 @@ class TestToolCatalogGuard:
         proxy_logging_obj.pre_call_hook = AsyncMock(side_effect=asyncio.CancelledError)
 
         with pytest.raises(asyncio.CancelledError):
-            await manager._get_tools_from_server(
-                _notes_server(), add_prefix=False, proxy_logging_obj=proxy_logging_obj
-            )
+            await manager._get_tools_from_server(_notes_server(), add_prefix=False, proxy_logging_obj=proxy_logging_obj)
 
         proxy_logging_obj.pre_call_hook.assert_awaited_once()
         proxy_logging_obj.slack_alerting_instance.send_alert.assert_not_awaited()
@@ -15470,7 +16866,10 @@ class TestToolCatalogGuard:
         guardrail, proxy_logging_obj = catalog_guardrail
         monkeypatch.setattr(signer_module, "_mcp_jwt_signer_instance", None)
         signer = signer_module.MCPJWTSigner(
-            guardrail_name="jwt-signer", event_hook="pre_mcp_call", default_on=True, issuer="https://litellm.example.com"
+            guardrail_name="jwt-signer",
+            event_hook="pre_mcp_call",
+            default_on=True,
+            issuer="https://litellm.example.com",
         )
         monkeypatch.setattr(litellm, "callbacks", [signer, guardrail])
         manager = _catalog_manager(LIST_NOTES, POISONED_DELETE)
@@ -15690,7 +17089,10 @@ class TestToolCatalogGuard:
         widened = MCPTool(
             name="read_note",
             description="Read a note",
-            inputSchema={"type": "object", "properties": {"id": {"type": "string"}, "callback_url": {"type": "string"}}},
+            inputSchema={
+                "type": "object",
+                "properties": {"id": {"type": "string"}, "callback_url": {"type": "string"}},
+            },
         )
         manager = _catalog_manager(widened)
 
@@ -15752,8 +17154,12 @@ class TestToolCatalogGuard:
             return "ok"
 
         with patch.dict(global_mcp_tool_registry.tools, {}, clear=True):
-            global_mcp_tool_registry.register_tool("petstore-list_pets", "List pets, newest first", {"type": "object"}, handler)
-            global_mcp_tool_registry.register_tool("petstore-delete_pets", POISONED_DELETE.description, {"type": "object"}, handler)
+            global_mcp_tool_registry.register_tool(
+                "petstore-list_pets", "List pets, newest first", {"type": "object"}, handler
+            )
+            global_mcp_tool_registry.register_tool(
+                "petstore-delete_pets", POISONED_DELETE.description, {"type": "object"}, handler
+            )
             global_mcp_tool_registry.register_tool("petstore-find_pet", "Find a pet", {"type": "object"}, handler)
             served = await manager._get_tools_from_server(
                 server, add_prefix=add_prefix, proxy_logging_obj=proxy_logging_obj
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py
index 4cc7794d4ad..545b2757ffd 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_server_tool_calls_and_headers.py
@@ -9,6 +9,7 @@ from types import SimpleNamespace
 from typing import Final
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import httpx
 import pytest
 from fastapi import HTTPException
 from mcp import ReadResourceResult, Resource
@@ -23,18 +24,20 @@ from mcp.types import (
     TextContent,
     TextResourceContents,
 )
+from mcp.types import Tool as MCPTool
 from mcp_types.version import HANDSHAKE_PROTOCOL_VERSIONS, LATEST_HANDSHAKE_VERSION, MODERN_PROTOCOL_VERSIONS
 from pydantic import TypeAdapter
 from starlette.types import Message, Receive, Scope, Send
 
 from litellm.proxy._experimental.mcp_server.mcp_context import active_mcp_request_ctx_var
+from litellm.proxy._experimental.mcp_server.mcp_server_manager import ListedToolsCaller
 from litellm.proxy._types import (
     LiteLLM_MCPServerTable,
     MCPTransport,
     UserAPIKeyAuth,
 )
 from litellm.types.mcp import MCPAuth
-from litellm.types.mcp_server.mcp_server_manager import MCPOAuthMetadata, MCPServer
+from litellm.types.mcp_server.mcp_server_manager import MCPOAuthMetadata, MCPServer, PinnedMCPTool
 
 
 def test_mcp_available_on_sdk2():
@@ -85,9 +88,6 @@ def cleanup_mcp_global_state():
         yield
 
 
-
-
-
 def _call_tool_params(name, arguments=None):
     from mcp.types import CallToolRequestParams
 
@@ -99,6 +99,7 @@ def _paged_params():
 
     return PaginatedRequestParams()
 
+
 @pytest.mark.asyncio
 async def test_mcp_server_tool_call_body_contains_request_data(_mcp_request_ctx):
     """Test that proxy_server_request body contains name and arguments"""
@@ -295,7 +296,9 @@ async def test_mcp_server_tool_call_relays_upstream_auth_error_as_iserror(_mcp_r
         ):
             with patch("litellm.proxy.proxy_server.proxy_config", MagicMock()):
                 with patch("litellm.proxy._experimental.mcp_server.operations.verbose_logger", mock_logger):
-                    result = await mcp_server_tool_call(_mcp_request_ctx(), _call_tool_params("test_tool", {"param": "value"}))
+                    result = await mcp_server_tool_call(
+                        _mcp_request_ctx(), _call_tool_params("test_tool", {"param": "value"})
+                    )
 
     assert result.is_error is True
     # The dedicated MCPUpstreamAuthError branch (not the generic Exception fallthrough) produces this
@@ -1167,20 +1170,32 @@ async def test_read_resource_preserves_content_metadata(_mcp_request_ctx, kind,
         else BlobResourceContents(uri=uri, blob="aGVsbG8=", mimeType="image/png", meta=metadata)
     )
     with (
-        patch.object(server, "get_or_extract_auth_context", AsyncMock(return_value=(caller, None, ["catalog"], None, None, None, None))),
+        patch.object(
+            server,
+            "get_or_extract_auth_context",
+            AsyncMock(return_value=(caller, None, ["catalog"], None, None, None, None)),
+        ),
         patch.object(operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[upstream_server])),
-        patch.object(operations.global_mcp_server_manager, "read_resource_from_server", AsyncMock(return_value=ReadResourceResult(contents=[content]))),
+        patch.object(
+            operations.global_mcp_server_manager,
+            "read_resource_from_server",
+            AsyncMock(return_value=ReadResourceResult(contents=[content])),
+        ),
     ):
         result: Final = await server.read_resource(_mcp_request_ctx(), ReadResourceRequestParams(uri=uri))
 
     assert result.model_dump(mode="json", by_alias=True, exclude_none=True) == {
-        "cacheScope": "private", "resultType": "complete", "ttlMs": 0,
-        "contents": [{
-            "uri": uri,
-            "mimeType": "text/plain" if kind == "text" else "image/png",
-            "text" if kind == "text" else "blob": "hello world" if kind == "text" else "aGVsbG8=",
-            **({"_meta": metadata} if metadata is not None else {}),
-        }],
+        "cacheScope": "private",
+        "resultType": "complete",
+        "ttlMs": 0,
+        "contents": [
+            {
+                "uri": uri,
+                "mimeType": "text/plain" if kind == "text" else "image/png",
+                "text" if kind == "text" else "blob": "hello world" if kind == "text" else "aGVsbG8=",
+                **({"_meta": metadata} if metadata is not None else {}),
+            }
+        ],
     }
 
 
@@ -1674,7 +1689,9 @@ async def test_handle_list_tools_converts_permission_httpexception_to_mcp_error(
     with (
         patch(  # test-quality-ok: the protocol handler reads auth from module context; no injection seam
             "litellm.proxy._experimental.mcp_server.server.get_or_extract_auth_context",
-            new=AsyncMock(return_value=(None, None, None, None, None, None, None), side_effect=denial if denial_at_auth else None),
+            new=AsyncMock(
+                return_value=(None, None, None, None, None, None, None), side_effect=denial if denial_at_auth else None
+            ),
         ),
         patch(  # test-quality-ok: the listing helper is the handler's only collaborator; the suite's seam
             "litellm.proxy._experimental.mcp_server.operations._list_mcp_tools",
@@ -1913,8 +1930,8 @@ async def test_streamable_http_session_manager_is_stateless():
         ("DELETE", b"", False),
     ),
 )
-async def test_mcp_routing_initialize_to_stateful_no_session_to_stateless(_mcp_request_ctx,
-    debug: bool, method: str, request_body: bytes, stateful: bool
+async def test_mcp_routing_initialize_to_stateful_no_session_to_stateless(
+    _mcp_request_ctx, debug: bool, method: str, request_body: bytes, stateful: bool
 ) -> None:
     from starlette.requests import Request
     from starlette.types import Message, Receive, Scope, Send
@@ -4056,7 +4073,8 @@ async def test_truncated_jsonrpc_response_with_nested_method_skips_lock(
     # parsed, with a nested "method" key in the first bytes to trip a flat
     # substring heuristic.
     response_prefix: Final = (
-        '{"jsonrpc":"2.0","id":99,"' + response_field
+        '{"jsonrpc":"2.0","id":99,"'
+        + response_field
         + '":{"code":-32000,"message":"test","data":{"method":"GET","payload":"'
     ).encode()
     response_body: Final = (
@@ -6564,8 +6582,12 @@ class TestGatewayCreateInitializationOptions:
             yield (None, None)
 
         async def record_request(
-            serving_server: object, read_stream: object, write_stream: object,
-            *, lifespan_state: object, init_options: InitializationOptions,
+            serving_server: object,
+            read_stream: object,
+            write_stream: object,
+            *,
+            lifespan_state: object,
+            init_options: InitializationOptions,
         ) -> None:
             captured["server_name"] = init_options.server_name
 
@@ -6877,7 +6899,6 @@ async def test_probe_upstream_auth_surfaces_httpx_status_error():
     returning the response. The probe must catch that specifically (before the
     fail-open `except Exception`) so the auth check is not silently defeated.
     """
-    import httpx
 
     from litellm.proxy._experimental.mcp_server.server import _probe_upstream_auth
 
@@ -7412,7 +7433,8 @@ async def test_execute_mcp_tool_rest_server_id_authoritative_for_unprefixed_tool
             return_value=oauth_server,
         ),
         patch.object(
-            mcp_operations, "_handle_managed_mcp_tool",
+            mcp_operations,
+            "_handle_managed_mcp_tool",
             new=fake_handle_managed_mcp_tool,
         ),
         patch.object(
@@ -7658,7 +7680,8 @@ async def test_execute_mcp_tool_strips_a_prefix_that_contains_the_separator():
             return_value=alias_less_server,
         ),
         patch.object(
-            mcp_operations, "_handle_managed_mcp_tool",
+            mcp_operations,
+            "_handle_managed_mcp_tool",
             new=fake_handle_managed_mcp_tool,
         ),
         patch.object(
@@ -7933,7 +7956,8 @@ async def test_execute_mcp_tool_rest_hyphenated_upstream_tool_name_routes_to_req
             return_value=None,
         ),
         patch.object(
-            mcp_operations, "_handle_managed_mcp_tool",
+            mcp_operations,
+            "_handle_managed_mcp_tool",
             new=fake_handle_managed_mcp_tool,
         ),
         patch.object(
@@ -7989,9 +8013,12 @@ async def test_execute_mcp_tool_sets_model_in_model_call_details():
     fake_server.server_name = "openapi-petstore"
     fake_server.alias = None
     fake_server.short_prefix = None
+    fake_server.tool_name_to_description = None
 
     fake_tool = MagicMock()
     fake_tool.name = "list_pets"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
 
     start_time = datetime.now(timezone.utc)
     litellm_logging_obj, _ = function_setup(
@@ -8042,6 +8069,348 @@ async def test_execute_mcp_tool_sets_model_in_model_call_details():
     assert litellm_logging_obj.model == "MCP: list_pets"
 
 
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_hands_openapi_hooks_the_listed_entry_and_nothing_before_a_listing():
+    """A local-registry tools/call with no prior tools/list hands the pre-call hooks name and arguments
+    only, as before this metadata existed, so a pre_mcp_call policy never scans a description the caller was
+    not served. Once the caller has listed, the same call hands the entry that listing served."""
+    from litellm.caching.caching import DualCache
+    from litellm.proxy._experimental.mcp_server import operations as mcp_module
+    from litellm.proxy.utils import ProxyLogging
+
+    petstore = MCPServer(
+        server_id="petstore-id",
+        name="petstore",
+        server_name="petstore",
+        transport=MCPTransport.http,
+        url=None,
+        spec_path="https://example.com/petstore.yaml",
+        tool_name_to_description={"list_pets": "ADMIN DESC"},
+    )
+    schema = {"type": "object", "properties": {"limit": {"type": "integer"}}}
+    mcp_module.global_mcp_tool_registry.register_tool(
+        name="petstore-list_pets", description="List the pets", input_schema=schema, handler=lambda limit: "ok"
+    )
+    manager = mcp_module.global_mcp_server_manager
+    manager._listed_tools_by_server_id.pop(petstore.server_id, None)
+    alice = UserAPIKeyAuth(api_key="sk-user", user_id="alice")
+    proxy_logging = ProxyLogging(user_api_key_cache=DualCache())
+    proxy_logging.pre_call_hook = AsyncMock(return_value={})
+    pre_call_tool_check = AsyncMock(wraps=manager.pre_call_tool_check)
+
+    async def call() -> tuple[MCPTool | None, dict]:
+        await mcp_module.execute_mcp_tool(
+            name="petstore-list_pets",
+            arguments={"limit": 10},
+            allowed_mcp_servers=[petstore],
+            start_time=datetime.now(),
+            user_api_key_auth=alice,
+        )
+        return pre_call_tool_check.call_args.kwargs["tool"], proxy_logging.pre_call_hook.call_args.kwargs["data"]
+
+    try:
+        with (
+            patch.object(manager, "_get_mcp_server_from_tool_name", return_value=petstore),
+            patch.object(manager, "pre_call_tool_check", new=pre_call_tool_check),
+            patch("litellm.proxy.proxy_server.proxy_logging_obj", proxy_logging),
+        ):
+            never_listed_tool, never_listed_data = await call()
+            manager._record_listed_tools(
+                petstore,
+                [MCPTool(name="list_pets", description="ADMIN DESC", inputSchema=schema)],
+                ListedToolsCaller(user_api_key_auth=alice),
+            )
+            listed_tool, listed_data = await call()
+    finally:
+        mcp_module.global_mcp_tool_registry.unregister_tools_with_prefix("petstore-")
+        manager._listed_tools_by_server_id.pop(petstore.server_id, None)
+
+    assert never_listed_tool is None
+    assert (never_listed_data.get("mcp_tool_description"), never_listed_data.get("mcp_input_schema")) == (None, None)
+    assert listed_tool is not None and (listed_tool.description, listed_tool.input_schema) == ("ADMIN DESC", schema)
+    assert (listed_data["mcp_tool_description"], listed_data["mcp_input_schema"]) == ("ADMIN DESC", schema)
+
+
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_hands_openapi_hooks_the_guarded_catalog_entry_clients_saw():
+    """When tools/list pinned the schema and masked the description of an OpenAPI tool, the local-registry
+    call path must hand the pre-call hooks that served entry, not the raw registry one."""
+    from litellm.proxy._experimental.mcp_server import operations as mcp_module
+
+    petstore = MCPServer(
+        server_id="petstore-id",
+        name="petstore",
+        server_name="petstore",
+        transport=MCPTransport.http,
+        url=None,
+        spec_path="https://example.com/petstore.yaml",
+        tool_name_to_description={"getpetbyid": "Find a SECRET pet"},
+    )
+    registry_schema = {"type": "object", "properties": {"petId": {"type": "integer"}, "dump_all": {"type": "boolean"}}}
+    pinned_schema = {"type": "object", "properties": {"petId": {"type": "integer"}}}
+    mcp_module.global_mcp_tool_registry.register_tool(
+        name="petstore-getpetbyid",
+        description="Find pet by ID",
+        input_schema=registry_schema,
+        handler=lambda petId: "ok",
+    )
+    manager = mcp_module.global_mcp_server_manager
+    alice = UserAPIKeyAuth(api_key="sk-user", user_id="alice")
+    manager._record_listed_tools(
+        petstore,
+        [MCPTool(name="getpetbyid", description="Find a [MASKED] pet", inputSchema=pinned_schema)],
+        ListedToolsCaller(user_api_key_auth=alice),
+    )
+    pre_call_tool_check = AsyncMock(return_value={})
+
+    try:
+        with (
+            patch.object(manager, "_get_mcp_server_from_tool_name", return_value=petstore),
+            patch.object(manager, "pre_call_tool_check", new=pre_call_tool_check),
+        ):
+            await mcp_module.execute_mcp_tool(
+                name="petstore-getpetbyid",
+                arguments={"petId": 1},
+                allowed_mcp_servers=[petstore],
+                start_time=datetime.now(),
+                user_api_key_auth=alice,
+            )
+    finally:
+        mcp_module.global_mcp_tool_registry.unregister_tools_with_prefix("petstore-")
+        manager._listed_tools_by_server_id.pop(petstore.server_id, None)
+
+    handed_tool = pre_call_tool_check.call_args.kwargs["tool"]
+    assert (handed_tool.description, handed_tool.input_schema) == ("Find a [MASKED] pet", pinned_schema), (
+        "the pre-call policy must evaluate the entry tools/list served, not the raw registry entry"
+    )
+
+
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_hands_openapi_hooks_each_callers_own_listed_entry():
+    """Two keys can be shown differently guarded OpenAPI catalogs. The call path must evaluate each key
+    against the entry its own tools/list served, not the entry the most recent listing left behind."""
+    from litellm.proxy._experimental.mcp_server import operations as mcp_module
+
+    petstore = MCPServer(
+        server_id="petstore-id",
+        name="petstore",
+        server_name="petstore",
+        transport=MCPTransport.http,
+        url=None,
+        spec_path="https://example.com/petstore.yaml",
+    )
+    schema = {"type": "object", "properties": {"petId": {"type": "integer"}}}
+    mcp_module.global_mcp_tool_registry.register_tool(
+        name="petstore-getpetbyid", description="Find a SECRET pet", input_schema=schema, handler=lambda petId: "ok"
+    )
+    manager = mcp_module.global_mcp_server_manager
+    guarded = UserAPIKeyAuth(api_key="sk-guarded", user_id="alice")
+    opted_out = UserAPIKeyAuth(api_key="sk-opted-out", user_id="bob")
+    manager._record_listed_tools(
+        petstore,
+        [MCPTool(name="getpetbyid", description="Find a [MASKED] pet", inputSchema=schema)],
+        ListedToolsCaller(user_api_key_auth=guarded),
+    )
+    manager._record_listed_tools(
+        petstore,
+        [MCPTool(name="getpetbyid", description="Find a SECRET pet", inputSchema=schema)],
+        ListedToolsCaller(user_api_key_auth=opted_out),
+    )
+    pre_call_tool_check = AsyncMock(return_value={})
+
+    try:
+        with (
+            patch.object(manager, "_get_mcp_server_from_tool_name", return_value=petstore),
+            patch.object(manager, "pre_call_tool_check", new=pre_call_tool_check),
+        ):
+            for caller in (guarded, opted_out):
+                await mcp_module.execute_mcp_tool(
+                    name="petstore-getpetbyid",
+                    arguments={"petId": 1},
+                    allowed_mcp_servers=[petstore],
+                    start_time=datetime.now(),
+                    user_api_key_auth=caller,
+                )
+    finally:
+        mcp_module.global_mcp_tool_registry.unregister_tools_with_prefix("petstore-")
+        manager._listed_tools_by_server_id.pop(petstore.server_id, None)
+
+    handed = [call.kwargs["tool"].description for call in pre_call_tool_check.call_args_list]
+    assert handed == ["Find a [MASKED] pet", "Find a SECRET pet"], (
+        "each key's tools/call must be evaluated against the OpenAPI entry its own listing served"
+    )
+
+
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_runs_the_longer_colliding_operation_and_hands_hooks_no_registry_metadata():
+    """An OpenAPI operation whose name starts with its own server prefix runs instead of the shorter one, and
+    with no prior listing the pre-call hooks get name and arguments only, never either registry entry."""
+    from litellm.proxy._experimental.mcp_server import operations as mcp_module
+
+    petstore = MCPServer(
+        server_id="petstore-id",
+        name="petstore",
+        server_name="petstore",
+        transport=MCPTransport.http,
+        url=None,
+        spec_path="https://example.com/petstore.yaml",
+    )
+    registry = mcp_module.global_mcp_tool_registry
+    registry.register_tool(name="petstore-get_pet", description="short", input_schema={}, handler=lambda: "short")
+    registry.register_tool(
+        name="petstore-petstore-get_pet",
+        description="long",
+        input_schema={"type": "object", "properties": {"petId": {"type": "integer"}}},
+        handler=lambda: "long",
+    )
+    manager = mcp_module.global_mcp_server_manager
+    pre_call_tool_check = AsyncMock(return_value={})
+
+    try:
+        with (
+            patch.object(manager, "_get_mcp_server_from_tool_name", return_value=petstore),
+            patch.object(manager, "pre_call_tool_check", new=pre_call_tool_check),
+        ):
+            result = await mcp_module.execute_mcp_tool(
+                name="petstore-petstore-get_pet",
+                arguments={},
+                allowed_mcp_servers=[petstore],
+                start_time=datetime.now(),
+                user_api_key_auth=UserAPIKeyAuth(api_key="sk-user", user_id="alice"),
+            )
+    finally:
+        registry.unregister_tools_with_prefix("petstore-")
+
+    assert pre_call_tool_check.call_args.kwargs["tool"] is None
+    assert result.content[0].text == "long"
+
+
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_hands_hooks_nothing_for_a_never_listed_operation_named_after_a_listed_one():
+    """After the caller listed ``get_pet``, a call to the never-listed ``petstore-get_pet`` operation hands the
+    pre-call hooks name and arguments only, not the listed sibling's description and schema."""
+    from litellm.proxy._experimental.mcp_server import operations as mcp_module
+
+    petstore = MCPServer(
+        server_id="petstore-id",
+        name="petstore",
+        server_name="petstore",
+        transport=MCPTransport.http,
+        url=None,
+        spec_path="https://example.com/petstore.yaml",
+    )
+    registry = mcp_module.global_mcp_tool_registry
+    registry.register_tool(
+        name="petstore-petstore-get_pet", description="long", input_schema={}, handler=lambda: "long"
+    )
+    manager = mcp_module.global_mcp_server_manager
+    alice = UserAPIKeyAuth(api_key="sk-user", user_id="alice")
+    manager._record_listed_tools(
+        petstore,
+        [MCPTool(name="get_pet", description="Fetches pet records. FLAGWORD", inputSchema={"type": "object"})],
+        ListedToolsCaller(user_api_key_auth=alice),
+    )
+    pre_call_tool_check = AsyncMock(return_value={})
+
+    try:
+        with (
+            patch.object(manager, "_get_mcp_server_from_tool_name", return_value=petstore),
+            patch.object(manager, "pre_call_tool_check", new=pre_call_tool_check),
+        ):
+            result = await mcp_module.execute_mcp_tool(
+                name="petstore-petstore-get_pet",
+                arguments={},
+                allowed_mcp_servers=[petstore],
+                start_time=datetime.now(),
+                user_api_key_auth=alice,
+            )
+    finally:
+        registry.unregister_tools_with_prefix("petstore-")
+        manager._listed_tools_by_server_id.pop(petstore.server_id, None)
+
+    assert pre_call_tool_check.call_args.kwargs["tool"] is None
+    assert result.content[0].text == "long"
+
+
+@pytest.mark.asyncio
+async def test_execute_mcp_tool_implicit_listing_before_the_first_call_hands_hooks_no_description():
+    """The listing tools/call runs on its own when this worker does not yet expose the tool is never served
+    to the caller, so it leaves the caller's listed slot empty and the pre-call hooks still get name and
+    arguments only, as on main."""
+    manager = mcp_operations.global_mcp_server_manager
+    server = _never_listed_passthrough_server()
+    manager.registry[server.server_id] = server
+    manager._listed_tools_by_server_id.pop(server.server_id, None)
+    upstream = AsyncMock()
+    upstream.call_tool.return_value = CallToolResult(content=[TextContent(type="text", text="ok")], isError=False)
+    proxy_logging = _mock_mcp_proxy_logging()
+    proxy_logging._create_mcp_request_object_from_kwargs = MagicMock(return_value={})
+    proxy_logging._convert_mcp_to_llm_format = MagicMock(return_value={})
+    proxy_logging.pre_call_hook = AsyncMock(return_value={})
+    proxy_logging.during_call_hook = AsyncMock(return_value=None)
+    fetch_tools = AsyncMock(
+        return_value=[MCPTool(name="add", description="Adds. FLAGWORD", inputSchema={"type": "object"})]
+    )
+
+    with (
+        patch.object(manager, "_create_mcp_client", new=AsyncMock(return_value=upstream)),
+        patch.object(manager, "_fetch_tools_with_timeout", new=fetch_tools),
+        patch("litellm.proxy.proxy_server.proxy_logging_obj", proxy_logging),
+    ):
+        result = await mcp_operations.execute_mcp_tool(
+            name="lazy_map-add",
+            arguments={"a": 1, "b": 2},
+            allowed_mcp_servers=[server],
+            start_time=datetime.now(),
+            mcp_auth_header="Bearer caller-token",
+            raw_headers={"authorization": "Bearer caller-token"},
+        )
+
+    assert fetch_tools.await_count == 1
+    assert upstream.call_tool.await_count == 1
+    assert result.content[0].text == "ok"
+    hook_kwargs = proxy_logging._create_mcp_request_object_from_kwargs.call_args.args[0]
+    assert (hook_kwargs["tool_description"], hook_kwargs["tool_input_schema"]) == (None, None)
+    assert server.server_id not in manager._listed_tools_by_server_id
+
+
+@pytest.mark.asyncio
+async def test_fetch_pinnable_tool_catalog_records_no_listed_catalog_for_the_admin():
+    """The pin snapshot lists the raw upstream catalog, without the catalog guard or the admin's description
+    overrides, so it must not become what the admin's own later tools/call is evaluated against."""
+    from litellm.caching.caching import DualCache
+    from litellm.proxy._experimental.mcp_server.rest_endpoints import fetch_pinnable_tool_catalog
+    from litellm.proxy.utils import ProxyLogging
+
+    manager = mcp_operations.global_mcp_server_manager
+    server = MCPServer(
+        server_id="pin-srv",
+        name="pin_srv",
+        transport=MCPTransport.http,
+        url="https://up.example.com/mcp",
+        tool_name_to_description={"add": "Admin wording"},
+    )
+    manager._listed_tools_by_server_id.pop(server.server_id, None)
+    admin = UserAPIKeyAuth(api_key="sk-admin", user_id="admin")
+    request = MagicMock()
+    request.client.host = "10.1.2.3"
+    request.headers = {"x-litellm-api-key": "sk-admin"}
+    fetch_tools = AsyncMock(
+        return_value=[MCPTool(name="add", description="Upstream wording", inputSchema={"type": "object"})]
+    )
+
+    with (
+        patch.object(manager, "_create_mcp_client", new=AsyncMock(return_value=MagicMock())),
+        patch.object(manager, "_fetch_tools_with_timeout", new=fetch_tools),
+        patch("litellm.proxy.proxy_server.proxy_logging_obj", ProxyLogging(user_api_key_cache=DualCache())),
+    ):
+        snapshot = await fetch_pinnable_tool_catalog(server, request, admin)
+
+    assert snapshot == {"add": PinnedMCPTool(description="Upstream wording", input_schema={"type": "object"})}
+    assert server.server_id not in manager._listed_tools_by_server_id
+    assert manager.get_listed_tool(server, "add", ListedToolsCaller(user_api_key_auth=admin)) is None
+
+
 @pytest.mark.asyncio
 async def test_execute_mcp_tool_rest_unresolved_prefixed_name_routes_to_requested_server():
     """A prefixed REST name that resolves to no tool must still dispatch to the server_id.
@@ -8098,7 +8467,8 @@ async def test_execute_mcp_tool_rest_unresolved_prefixed_name_routes_to_requeste
             return_value=None,
         ),
         patch.object(
-            mcp_operations, "_handle_managed_mcp_tool",
+            mcp_operations,
+            "_handle_managed_mcp_tool",
             new=fake_handle_managed_mcp_tool,
         ),
         patch.object(
@@ -8597,7 +8967,9 @@ class TestMCPMetaTraceCarrier:
 
         assert _mcp_meta_trace_carrier(None) is None
         assert _mcp_meta_trace_carrier(SimpleNamespace(meta=None)) is None
-        only_progress = CallToolRequestParams.model_validate({"name": "t", "_meta": {"progressToken": "p1"}}, by_name=False).meta
+        only_progress = CallToolRequestParams.model_validate(
+            {"name": "t", "_meta": {"progressToken": "p1"}}, by_name=False
+        ).meta
         assert _mcp_meta_trace_carrier(SimpleNamespace(meta=only_progress)) is None
 
 
@@ -10394,7 +10766,9 @@ async def test_mcp_origin_admission_precedes_authentication(
         patch("litellm.proxy.proxy_server.origins", allowed_origins),
         patch.object(server, "extract_mcp_auth_context", authenticate),
     ):
-        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=server.app), base_url="http://gateway") as client:
+        async with httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=server.app), base_url="http://gateway"
+        ) as client:
             response: Final = await client.request(method, path, headers=(*session_headers, *origin_headers))
 
     assert response.status_code == expected_status
@@ -10477,12 +10851,15 @@ async def test_streamable_http_rejects_modern_protocol_version(
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize("handler_name,field", [
-    ("handle_list_tools", "tools"),
-    ("list_prompts", "prompts"),
-    ("list_resources", "resources"),
-    ("list_resource_templates", "resource_templates"),
-])
+@pytest.mark.parametrize(
+    "handler_name,field",
+    [
+        ("handle_list_tools", "tools"),
+        ("list_prompts", "prompts"),
+        ("list_resources", "resources"),
+        ("list_resource_templates", "resource_templates"),
+    ],
+)
 async def test_native_listing_preserves_empty_result_on_auth_failure(_mcp_request_ctx, handler_name, field):
     from litellm.proxy._experimental.mcp_server import server
 
@@ -10500,7 +10877,9 @@ async def test_tool_listing_preserves_permission_denial_when_failure_logging_fai
     auth = UserAPIKeyAuth(user_id="denied-caller")
     denial = HTTPException(status_code=403, detail="scope denied")
     logger = MagicMock()
-    logger.post_call_failure_hook = AsyncMock(side_effect=RuntimeError("log unavailable") if failure_hook_raises else None)
+    logger.post_call_failure_hook = AsyncMock(
+        side_effect=RuntimeError("log unavailable") if failure_hook_raises else None
+    )
     upstream = AsyncMock()
     with (
         patch.object(operations, "_get_allowed_mcp_servers", AsyncMock(side_effect=denial)),
@@ -10509,7 +10888,9 @@ async def test_tool_listing_preserves_permission_denial_when_failure_logging_fai
         patch.object(operations.global_mcp_server_manager, "_get_tools_from_server", upstream),
     ):
         with pytest.raises(HTTPException) as rejected:
-            await operations._get_tools_from_mcp_servers(user_api_key_auth=auth, mcp_auth_header=None, mcp_servers=["catalog"], log_list_tools_to_spendlogs=True)
+            await operations._get_tools_from_mcp_servers(
+                user_api_key_auth=auth, mcp_auth_header=None, mcp_servers=["catalog"], log_list_tools_to_spendlogs=True
+            )
     assert rejected.value is denial
     upstream.assert_not_awaited()
     logger.post_call_failure_hook.assert_awaited_once()
@@ -10521,7 +10902,9 @@ async def test_tool_listing_preserves_permission_denial_when_failure_logging_fai
 @pytest.mark.parametrize("prefix,suffix", (("", ""), ("/gateway", "/")))
 @pytest.mark.parametrize("opening_protocol", (None, *MODERN_PROTOCOL_VERSIONS))
 async def test_legacy_sse_mount_emits_message_endpoint(
-    prefix: str, suffix: str, opening_protocol: str | None,
+    prefix: str,
+    suffix: str,
+    opening_protocol: str | None,
 ) -> None:
     from starlette.applications import Starlette
     from starlette.routing import Mount
@@ -10586,16 +10969,20 @@ async def test_legacy_sse_mount_emits_message_endpoint(
                 return (await messages.get())["status"]
 
             if opening_protocol is not None:
-                discover: Final = json.dumps({
-                    "jsonrpc": "2.0",
-                    "id": 0,
-                    "method": "server/discover",
-                    "params": {"_meta": {
-                        "io.modelcontextprotocol/protocolVersion": opening_protocol,
-                        "io.modelcontextprotocol/clientInfo": {"name": "modern-client", "version": "1"},
-                        "io.modelcontextprotocol/clientCapabilities": {},
-                    }},
-                }).encode()
+                discover: Final = json.dumps(
+                    {
+                        "jsonrpc": "2.0",
+                        "id": 0,
+                        "method": "server/discover",
+                        "params": {
+                            "_meta": {
+                                "io.modelcontextprotocol/protocolVersion": opening_protocol,
+                                "io.modelcontextprotocol/clientInfo": {"name": "modern-client", "version": "1"},
+                                "io.modelcontextprotocol/clientCapabilities": {},
+                            }
+                        },
+                    }
+                ).encode()
                 assert await post(discover) == 202
                 discovered_frame: Final = (await asyncio.wait_for(outgoing.get(), 2))["body"].decode()
                 discovered: Final = json.loads(discovered_frame.split("data: ", 1)[1].splitlines()[0])
@@ -10628,7 +11015,16 @@ async def test_legacy_sse_mount_emits_message_endpoint(
                     patch.object(
                         mcp_server,
                         "extract_mcp_auth_context",
-                        AsyncMock(return_value=(post_auth, None, [marker], {marker: {"Authorization": marker}}, {"Authorization": marker}, {"x-request-marker": marker})),
+                        AsyncMock(
+                            return_value=(
+                                post_auth,
+                                None,
+                                [marker],
+                                {marker: {"Authorization": marker}},
+                                {"Authorization": marker},
+                                {"x-request-marker": marker},
+                            )
+                        ),
                     ),
                     patch.object(mcp_server.operations, "_get_tools_from_mcp_servers", listing),
                 ):
@@ -10677,7 +11073,11 @@ async def test_discovery_adapter_preserves_authenticated_context(_mcp_request_ct
     dispatched = AsyncMock(return_value=expected)
     auth = UserAPIKeyAuth(user_id="discover-caller")
     with (
-        patch.object(server, "get_or_extract_auth_context", AsyncMock(return_value=(auth, None, ["allowed"], None, None, None, None))),
+        patch.object(
+            server,
+            "get_or_extract_auth_context",
+            AsyncMock(return_value=(auth, None, ["allowed"], None, None, None, None)),
+        ),
         patch.object(server.operations.GatewayOperations, "execute", dispatched),
     ):
         result = await server.discover(_mcp_request_ctx(), RequestParams())
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_mcp_tool_search.py b/tests/unit/proxy/_experimental/mcp_server/test_mcp_tool_search.py
index 4575741aa8b..95903b13ba0 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_mcp_tool_search.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_mcp_tool_search.py
@@ -22,6 +22,7 @@ from mcp.types import Tool
 import litellm
 from litellm.models.object_permission import LiteLLM_ObjectPermissionTable
 from litellm.proxy._experimental.mcp_server.faults.list_outcomes import AggregateToolListing
+from litellm.proxy._experimental.mcp_server.mcp_server_manager import ListedToolsCaller
 from litellm.proxy._experimental.mcp_server.tool_search import (
     AGENT_SEARCH_TOOL_NAME,
     MCP_TOOL_CALL_TOOL_NAME,
@@ -31,12 +32,14 @@ from litellm.proxy._experimental.mcp_server.tool_search import (
     ToolSearchResult,
     coerce_top_k,
     get_virtual_tool_definitions,
+    handle_mcp_tool_search,
     search_mcp_tools,
     search_tools,
 )
 from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
 from litellm.proxy.common_utils.semantic_text_index import EmbeddingFailed, SemanticTextIndex, Vector
-from litellm.types.mcp import MCPToolSearchSettings
+from litellm.types.mcp import MCPToolSearchSettings, MCPTransport
+from litellm.types.mcp_server.mcp_server_manager import MCPServer
 
 
 def _make_tools(specs: list[tuple[str, str]]) -> tuple[Tool, ...]:
@@ -1268,3 +1271,33 @@ async def test_handle_mcp_tool_call_scoped_denial_names_the_binding_agent() -> N
     assert exc_info.value.status_code == 403
     assert "MCP server 'github'" in exc_info.value.detail["error"]
     assert "agent 'agent-123'" in exc_info.value.detail["error"]
+
+
+@pytest.mark.asyncio
+async def test_mcp_tool_search_leaves_the_listed_tools_slot_empty(monkeypatch: pytest.MonkeyPatch) -> None:
+    """The search lists the whole catalog but serves only its hits, so the listing must not fill the
+    caller's listed-tools slot: a later call to a tool the search never returned is not a listed tool."""
+    monkeypatch.setattr(litellm, "mcp_tool_search", None)
+    manager = mcp_operations.global_mcp_server_manager
+    server = MCPServer(server_id="search-slot", name="search-slot", transport=MCPTransport.http, url="http://slot")
+    user = UserAPIKeyAuth(api_key="sk-search-slot", user_id="searcher")
+    upstream = [
+        Tool(name="echo", description="Echo text back", inputSchema={"type": "object"}),
+        Tool(name="delete_note", description="Delete a note", inputSchema={"type": "object"}),
+    ]
+    with (
+        patch.dict(manager.tool_name_to_mcp_server_name_mapping),
+        patch.object(mcp_operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[server])),
+        patch.object(manager, "_create_mcp_client", AsyncMock(return_value=object())),
+        patch.object(manager, "_fetch_tools_with_timeout", AsyncMock(return_value=upstream)),
+    ):
+        try:
+            result = await handle_mcp_tool_search(query="echo", top_k=1, user_api_key_dict=user)
+            caller = ListedToolsCaller(user_api_key_auth=user)
+            listed = [manager.get_listed_tool(server, tool.name, caller) for tool in upstream]
+        finally:
+            manager._drop_listed_tools(server.server_id)
+
+    assert result.is_error is False
+    assert [hit["name"] for hit in json.loads(result.content[0].text)] == ["search-slot-echo"]
+    assert listed == [None, None]
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_openapi_tool_auth.py b/tests/unit/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
index a8ec7be55f0..60157193a16 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
@@ -42,9 +42,12 @@ async def test_openapi_local_tool_runs_pre_call_tool_check():
     fake_server.server_name = "openapi-petstore"
     fake_server.alias = None
     fake_server.short_prefix = None
+    fake_server.tool_name_to_description = None
 
     fake_tool = MagicMock()
     fake_tool.name = "list_pets"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
 
     pre_call = AsyncMock(return_value={})
     handle_local = AsyncMock(return_value=CallToolResult(content=[], is_error=False))
@@ -125,9 +128,12 @@ async def test_openapi_local_tool_blocked_when_pre_call_check_raises():
     fake_server.server_name = "openapi-petstore"
     fake_server.alias = None
     fake_server.short_prefix = None
+    fake_server.tool_name_to_description = None
 
     fake_tool = MagicMock()
     fake_tool.name = "delete_pet"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
 
     pre_call = AsyncMock(
         side_effect=HTTPException(status_code=403, detail="not allowed")
@@ -190,6 +196,8 @@ async def test_openapi_local_tool_denied_when_server_not_resolvable():
 
     fake_tool = MagicMock()
     fake_tool.name = "list_pets"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
 
     pre_call = AsyncMock(return_value={})
     handle_local = AsyncMock(return_value=CallToolResult(content=[], is_error=False))
@@ -274,6 +282,8 @@ async def test_openapi_local_tool_injects_resolved_oauth_token():
 
     fake_tool = MagicMock()
     fake_tool.name = "get_values"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
     captured: dict = {}
 
     async def handle_local(_name, _arguments, _wire_compat):
@@ -620,6 +630,8 @@ async def test_per_server_auth_header_reaches_both_openapi_dispatch_arms(dispatc
         if dispatch_arm == "local_registry":
             fake_tool = MagicMock()
             fake_tool.name = "list_reports"
+            fake_tool.description = "test tool"
+            fake_tool.input_schema = {"type": "object"}
             with (
                 patch.object(manager, "_get_mcp_server_from_tool_name", return_value=server),
                 patch.object(mcp_operations.global_mcp_tool_registry, "get_tool", return_value=fake_tool),
@@ -691,6 +703,8 @@ async def test_local_dispatch_reports_the_outcome_instead_of_success(failure: st
 
     fake_tool = MagicMock()
     fake_tool.name = "list_reports"
+    fake_tool.description = "test tool"
+    fake_tool.input_schema = {"type": "object"}
     fake_tool.handler = raising_handler
     server = MCPServer(
         server_id="srv-openapi",
diff --git a/tests/unit/proxy/_experimental/mcp_server/test_operations.py b/tests/unit/proxy/_experimental/mcp_server/test_operations.py
index b16b27ac919..f710bc7f1d7 100644
--- a/tests/unit/proxy/_experimental/mcp_server/test_operations.py
+++ b/tests/unit/proxy/_experimental/mcp_server/test_operations.py
@@ -1,15 +1,101 @@
 import asyncio
+from typing import Final
 from unittest.mock import AsyncMock, patch
 
 import pytest
 from mcp.types import GetPromptRequest, GetPromptRequestParams, GetPromptResult
+from mcp.types import Tool as MCPTool
 
+import litellm
+from litellm.caching.dual_cache import DualCache
+from litellm.integrations.custom_logger import CustomLogger
+from litellm.proxy._experimental.mcp_server import operations
+from litellm.proxy._experimental.mcp_server import rest_endpoints
+from litellm.proxy._experimental.mcp_server.mcp_server_manager import ListedToolsCaller
 from litellm.proxy._experimental.mcp_server.operations import GatewayOperations, prepare_context
+from litellm.proxy._experimental.mcp_server.tool_registry import global_mcp_tool_registry
 from litellm.proxy._types import UserAPIKeyAuth
+from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
+from litellm.proxy.utils import ProxyLogging
 from litellm.types.mcp import MCPAuth, MCPTransport
 from litellm.types.mcp_server.mcp_server_manager import MCPServer
 
 
+class _CatalogHookCapture(CustomLogger):
+    data: dict[str, object] | None = None
+
+    async def async_pre_call_hook(
+        self, user_api_key_dict: UserAPIKeyAuth, cache: DualCache, data: dict[str, object], call_type: str
+    ) -> None:
+        if call_type == "call_mcp_tool":
+            self.data = data.copy()
+
+
+async def _served_catalog_tool() -> str:
+    return "ok"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("surface", ["mcp", "rest"])
+@pytest.mark.parametrize("restriction", ["key", "server"])
+async def test_listing_records_only_tools_the_caller_received(
+    monkeypatch: pytest.MonkeyPatch, surface: str, restriction: str
+) -> None:
+    manager: Final = operations.global_mcp_server_manager
+    server: Final = MCPServer(
+        server_id="served-catalog", name="served-catalog", transport=MCPTransport.http,
+        spec_path="/catalog.yaml", allow_all_keys=True,
+        allowed_tools=["echo"] if restriction == "server" else None,
+    )
+    auth: Final = UserAPIKeyAuth(
+        api_key="sk-served-catalog", user_id="lister",
+        object_permission={
+            "object_permission_id": "served-permission",
+            "mcp_servers": [server.server_id],
+            "mcp_tool_permissions": {server.server_id: ["echo"]} if restriction == "key" else None,
+        },
+    )
+    monkeypatch.setitem(manager.registry, server.server_id, server)
+    monkeypatch.setitem(manager.tool_name_to_mcp_server_name_mapping, "status", server.server_id)
+    monkeypatch.setitem(manager.tool_name_to_mcp_server_name_mapping, "served-catalog-status", server.server_id)
+    capture: Final = _CatalogHookCapture()
+    monkeypatch.setattr(litellm, "callbacks", [capture])
+    for name in ("echo", "status"):
+        global_mcp_tool_registry.register_tool(
+            name=f"served-catalog-{name}", description=f"{name} description",
+            input_schema={"type": "object"}, handler=_served_catalog_tool,
+        )
+    try:
+        if surface == "mcp":
+            listing: Final = await operations._list_mcp_tools(
+                user_api_key_auth=auth, mcp_servers=[server.server_id], record_listing=True,
+            )
+            assert [tool.name for tool in listing.tools] == ["served-catalog-echo"]
+        else:
+            rest_listing: Final = await rest_endpoints._get_tools_for_single_server(
+                server, None, user_api_key_auth=auth,
+            )
+            assert [tool.name for tool in rest_listing] == ["echo"]
+        granted: Final = auth.model_copy(update={"object_permission": None})
+        caller: Final = ListedToolsCaller(user_api_key_auth=granted)
+        assert manager.get_listed_tool(server, "status", caller) is None
+        served: Final = manager.get_listed_tool(server, "echo", caller)
+        assert served is not None
+        assert (served.description, served.input_schema) == ("echo description", {"type": "object"})
+        server.allowed_tools = None
+        result: Final = await manager.call_tool(
+            server_name=server.server_id, name="status", arguments={}, user_api_key_auth=granted,
+            proxy_logging_obj=ProxyLogging(user_api_key_cache=UserApiKeyCache()),
+        )
+        assert result.is_error is False
+        assert capture.data is not None
+        assert capture.data["messages"] == [{"role": "user", "content": "Tool: status\nArguments: {}"}]
+        assert (capture.data.get("mcp_tool_description"), capture.data.get("mcp_input_schema")) == (None, None)
+    finally:
+        manager._drop_listed_tools(server.server_id)
+        global_mcp_tool_registry.unregister_tools_with_prefix("served-catalog-")
+
+
 @pytest.mark.asyncio
 async def test_oauth_prefetch_failure_does_not_log_caller_or_exception_text(caplog):
     from litellm.proxy._experimental.mcp_server.operations import _prefetch_oauth_creds_for_user
@@ -665,3 +751,30 @@ async def test_tools_listing_preserves_explicit_spend_log_policy(log_enabled):
         )
     assert result.tools == []
     assert listing.await_args.kwargs["log_list_tools_to_spendlogs"] is log_enabled
+    assert listing.await_args.kwargs["record_listing"] is True
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(("listing_kwargs", "recorded"), [({}, False), ({"record_listing": True}, True)])
+async def test_list_mcp_tools_records_the_catalog_only_when_asked(
+    listing_kwargs: dict[str, bool], recorded: bool
+) -> None:
+    """The aggregate listing fills the caller's listed-tools slot only when asked: a listing an internal
+    caller never serves must not hand a later tools/call a description the caller never saw."""
+    manager = operations.global_mcp_server_manager
+    server = MCPServer(server_id="listing-slot", name="listing-slot", transport=MCPTransport.http, url="http://slot")
+    user = UserAPIKeyAuth(api_key="sk-listing-slot", user_id="lister")
+    upstream = [MCPTool(name="echo", description="Echo text back", inputSchema={"type": "object"})]
+    with (
+        patch.object(operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[server])),
+        patch.object(manager, "_create_mcp_client", AsyncMock(return_value=object())),
+        patch.object(manager, "_fetch_tools_with_timeout", AsyncMock(return_value=upstream)),
+        patch.dict(manager.tool_name_to_mcp_server_name_mapping),
+    ):
+        try:
+            listing = await operations._list_mcp_tools(user_api_key_auth=user, **listing_kwargs)
+            listed = manager.get_listed_tool(server, "echo", ListedToolsCaller(user_api_key_auth=user))
+        finally:
+            manager._drop_listed_tools(server.server_id)
+    assert [tool.name for tool in listing.tools] == ["listing-slot-echo"]
+    assert (listed is not None) is recorded
diff --git a/tests/unit/proxy/guardrails/guardrail_hooks/test_agent_365.py b/tests/unit/proxy/guardrails/guardrail_hooks/test_agent_365.py
index 23131321938..e72b716665c 100644
--- a/tests/unit/proxy/guardrails/guardrail_hooks/test_agent_365.py
+++ b/tests/unit/proxy/guardrails/guardrail_hooks/test_agent_365.py
@@ -346,6 +346,29 @@ class TestAllowFlow:
         assert evaluate_call.json["conversationId"] == "sess-123"
         assert evaluate_call.json["agentId"] == "my-agent-key"
 
+    @pytest.mark.asyncio
+    async def test_evaluate_payload_includes_listed_tool_metadata(self):
+        handler: Final = FakeHandler([_token_response(), _allow_response()])
+        guardrail: Final = _make_guardrail(handler)
+        schema: Final = {"type": "object", "properties": {"to": {"type": "string"}}, "required": ["to"]}
+        await _run(guardrail, _mcp_data(mcp_tool_description="Send an email", mcp_input_schema=schema))
+        assert handler.calls[1].json["tool"] == {
+            "name": "send_email",
+            "description": "Send an email",
+            "inputSchema": schema,
+        }
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize(
+        ("description", "schema"),
+        [(None, None), ("", None), (None, ["not", "a", "schema"]), (42, "type: object")],
+    )
+    async def test_evaluate_payload_omits_missing_or_malformed_tool_metadata(self, description, schema):
+        handler: Final = FakeHandler([_token_response(), _allow_response()])
+        guardrail: Final = _make_guardrail(handler)
+        await _run(guardrail, _mcp_data(mcp_tool_description=description, mcp_input_schema=schema))
+        assert handler.calls[1].json["tool"] == {"name": "send_email"}
+
     @pytest.mark.asyncio
     async def test_non_mcp_call_type_skipped(self):
         handler: Final = FakeHandler([])
diff --git a/tests/unit/proxy/hooks/test_parallel_request_limiter_v3.py b/tests/unit/proxy/hooks/test_parallel_request_limiter_v3.py
index 8b9439e25d2..d3a723fe1d3 100644
--- a/tests/unit/proxy/hooks/test_parallel_request_limiter_v3.py
+++ b/tests/unit/proxy/hooks/test_parallel_request_limiter_v3.py
@@ -13,6 +13,7 @@ from typing import Any, Dict, Final, List, Optional
 
 import pytest
 from fastapi import HTTPException
+from pydantic import TypeAdapter
 
 import litellm
 from litellm import Router
@@ -21,6 +22,7 @@ from litellm.caching.in_memory_cache import InMemoryCache
 from litellm.constants import INTERNAL_CALL_ORIGIN_METADATA_KEY
 from litellm.proxy._types import UserAPIKeyAuth
 from litellm.proxy.common_utils.proxy_rate_limit_error import ProxyRateLimitError
+from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
 from litellm.proxy.hooks.parallel_request_limiter_v3 import (
     PARALLEL_REQUEST_SLOT_TTL_SECONDS,
     ParallelSlotAcquisition,
@@ -39,6 +41,7 @@ from litellm.proxy.hooks.parallel_request_limiter_v3 import (
 from litellm.proxy.utils import InternalUsageCache, ProxyLogging, hash_token
 from litellm.types.caching import RedisPipelineIncrementOperation
 from litellm.types.llms.openai import ResponsesAPIResponse
+from litellm.types.mcp import MCPPreCallRequestObject
 from litellm.types.utils import (
     EmbeddingResponse,
     ModelResponse,
@@ -108,6 +111,159 @@ def test_api_key_descriptor_applies_budget_throttle(
     assert api_key_descriptor["rate_limit"]["tokens_per_unit"] == expected_tpm
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "description", [None, "Gateway metadata, not caller input. " * 100], ids=["unlisted", "listed"]
+)
+@pytest.mark.parametrize("arguments_rewritten", [False, True])
+async def test_mcp_description_does_not_change_admission_or_reserved_tokens(
+    description: str | None, arguments_rewritten: bool, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    cache: Final = DualCache()
+    handler: Final = _PROXY_MaxParallelRequestsHandler(internal_usage_cache=InternalUsageCache(cache))
+    logger: Final = ProxyLogging(user_api_key_cache=UserApiKeyCache())
+    schema: Final = {"type": "object", "properties": {"q": {"type": "string", "description": "Schema text " * 100}}}
+    request: Final = MCPPreCallRequestObject(
+        tool_name="echo", arguments={"q": "hello"}, tool_description=description, tool_input_schema=schema
+    )
+    data: Final = TypeAdapter(dict[str, object]).validate_python(logger._convert_mcp_to_llm_format(request, {}))
+    messages: Final = data["messages"]
+    caller: Final = UserAPIKeyAuth(api_key=hash_token("sk-mcp-description-reservation"), tpm_limit=64)
+
+    if arguments_rewritten:
+        data["mcp_arguments"] = {"q": "Transformed arguments " * 100}
+    monkeypatch.setattr(litellm, "callbacks", [handler])
+    await logger.pre_call_hook(user_api_key_dict=caller, data=data, call_type="call_mcp_tool")
+
+    stash: Final = get_request_stash()
+    assert stash is not None
+    assert stash.reserved_tokens == 25
+    assert (
+        await cache.async_get_cache(
+            key=handler.create_rate_limit_keys("api_key", caller.api_key, "tokens"), local_only=True
+        )
+        == 25
+    )
+    assert data["messages"] is messages
+    assert data.get("mcp_tool_description") == description
+    assert data["mcp_input_schema"] == schema
+    assert messages == [
+        {
+            "role": "user",
+            "content": "Tool: echo\nArguments: {'q': 'hello'}",
+        }
+    ]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "description", [None, "Gateway metadata, not caller input. " * 100], ids=["unlisted", "listed"]
+)
+@pytest.mark.parametrize("itpm_limit,otpm_limit", [(64, 4096), (4096, 64), (4096, 4096)])
+@pytest.mark.parametrize("arguments_rewritten", [False, True])
+async def test_mcp_description_preserves_project_input_and_output_reservations(
+    description: str | None, itpm_limit: int, otpm_limit: int,
+    arguments_rewritten: bool, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    cache: Final = DualCache()
+    handler: Final = _PROXY_MaxParallelRequestsHandler(internal_usage_cache=InternalUsageCache(cache))
+    logger: Final = ProxyLogging(user_api_key_cache=UserApiKeyCache())
+    schema: Final = {"type": "object", "properties": {"q": {"type": "string", "description": "Schema text " * 100}}}
+    request: Final = MCPPreCallRequestObject(
+        tool_name="echo", arguments={"q": "hello"}, tool_description=description, tool_input_schema=schema
+    )
+    data: Final = TypeAdapter(dict[str, object]).validate_python(logger._convert_mcp_to_llm_format(request, {}))
+    messages: Final = data["messages"]
+    base_data: Final[dict[str, object]] = {
+        "messages": [{"role": "user", "content": "Tool: echo\nArguments: {'q': 'hello'}"}]
+    }
+    expected_input: Final = handler._estimate_precise_input_tokens(base_data, "mcp-tool-call", "call_mcp_tool")
+    expected_output: Final = handler.no_max_tokens_output_floor(otpm_limit)
+    expected_combined: Final = handler._estimate_tokens_for_request(
+        base_data, min_configured_tpm_limit=4096, call_type="call_mcp_tool"
+    )
+    caller: Final = UserAPIKeyAuth(
+        api_key=hash_token("sk-mcp-project-reservation"),
+        tpm_limit=4096,
+        project_id="mcp-project-reservation",
+        project_metadata={
+            "model_itpm_limit": {"mcp-tool-call": itpm_limit},
+            "model_otpm_limit": {"mcp-tool-call": otpm_limit},
+        },
+    )
+
+    if arguments_rewritten:
+        data["mcp_arguments"] = {"q": "Transformed arguments " * 100}
+    monkeypatch.setattr(litellm, "callbacks", [handler])
+    await logger.pre_call_hook(user_api_key_dict=caller, data=data, call_type="call_mcp_tool")
+
+    stash: Final = get_request_stash()
+    assert stash is not None
+    assert (stash.reserved_tokens, stash.itpm_reserved_tokens, stash.otpm_reserved_tokens) == (
+        expected_combined,
+        expected_input,
+        expected_output,
+    )
+    assert (
+        await cache.async_get_cache(
+            key=handler.create_rate_limit_keys(
+                "model_per_project_itpm", f"{caller.project_id}:mcp-tool-call", "tokens"
+            ),
+            local_only=True,
+        )
+        == expected_input
+    )
+    assert (
+        await cache.async_get_cache(
+            key=handler.create_rate_limit_keys(
+                "model_per_project_otpm", f"{caller.project_id}:mcp-tool-call", "tokens"
+            ),
+            local_only=True,
+        )
+        == expected_output
+    )
+    assert data["messages"] is messages
+    assert data.get("mcp_tool_description") == description
+    assert data["mcp_input_schema"] == schema
+    assert messages == [
+        {
+            "role": "user",
+            "content": "Tool: echo\nArguments: {'q': 'hello'}",
+        }
+    ]
+
+
+def test_llm_tpm_estimation_still_counts_messages_with_mcp_metadata() -> None:
+    handler: Final = _PROXY_MaxParallelRequestsHandler(internal_usage_cache=InternalUsageCache(DualCache()))
+    data: Final[dict[str, object]] = {
+        "messages": [{"role": "user", "content": "x" * 400}],
+        "max_tokens": 1,
+        "mcp_tool_name": "echo",
+        "mcp_arguments": {},
+    }
+    assert handler._estimate_tokens_for_request(data, call_type="acompletion") == 101
+
+
+@pytest.mark.asyncio
+async def test_unconverted_mcp_request_keeps_its_reservation() -> None:
+    cache: Final = DualCache()
+    handler: Final = _PROXY_MaxParallelRequestsHandler(internal_usage_cache=InternalUsageCache(cache))
+    caller: Final = UserAPIKeyAuth(api_key=hash_token("sk-raw-mcp-request"), tpm_limit=64)
+    data: Final[dict[str, object]] = {"name": "echo", "arguments": {"q": "hello"}, "server_id": "fixture"}
+
+    await handler.async_pre_call_hook(user_api_key_dict=caller, cache=cache, data=data, call_type="call_mcp_tool")
+
+    stash: Final = get_request_stash()
+    assert stash is not None
+    assert stash.reserved_tokens == 16
+    assert (
+        await cache.async_get_cache(
+            key=handler.create_rate_limit_keys("api_key", caller.api_key, "tokens"), local_only=True
+        )
+        == 16
+    )
+
+
 @pytest.mark.flaky(reruns=3)
 @pytest.mark.asyncio
 async def test_sliding_window_rate_limit_v3(monkeypatch, time_controller):
diff --git a/tests/unit/proxy/utils/proxy_logging/test_mcp_bridging.py b/tests/unit/proxy/utils/proxy_logging/test_mcp_bridging.py
index c5bd89645b4..25be3b5de6b 100644
--- a/tests/unit/proxy/utils/proxy_logging/test_mcp_bridging.py
+++ b/tests/unit/proxy/utils/proxy_logging/test_mcp_bridging.py
@@ -403,6 +403,26 @@ def test_create_mcp_request_object_from_kwargs_full(proxy_logging, make_user_api
     assert snapshot == {"tool_name": "calc", "arguments": {"x": 1}, "server_name": "math", "auth_user_id": "u-1"}
 
 
+def test_mcp_tool_metadata_flows_from_kwargs_to_synthetic_data(proxy_logging):
+    schema = {"type": "object", "properties": {"x": {"type": "integer"}}}
+    obj = proxy_logging._create_mcp_request_object_from_kwargs(
+        kwargs={
+            "name": "calc",
+            "arguments": {"x": 1},
+            "tool_description": "Adds numbers",
+            "tool_input_schema": schema,
+        }
+    )
+    out = proxy_logging._convert_mcp_to_llm_format(request_obj=obj, kwargs={})
+    assert (out["mcp_tool_description"], out["mcp_input_schema"]) == ("Adds numbers", schema)
+
+
+def test_mcp_tool_metadata_absent_when_tool_was_never_listed(proxy_logging):
+    obj = proxy_logging._create_mcp_request_object_from_kwargs(kwargs={"name": "calc", "arguments": {}})
+    out = proxy_logging._convert_mcp_to_llm_format(request_obj=obj, kwargs={})
+    assert "mcp_tool_description" not in out and "mcp_input_schema" not in out
+
+
 def test_create_mcp_request_object_from_kwargs_empty(proxy_logging):
     obj = proxy_logging._create_mcp_request_object_from_kwargs(kwargs={})
     snapshot = {
diff --git a/tests/unit/responses/mcp/test_litellm_proxy_mcp_handler.py b/tests/unit/responses/mcp/test_litellm_proxy_mcp_handler.py
index 2699f9445c9..73bee304fc2 100644
--- a/tests/unit/responses/mcp/test_litellm_proxy_mcp_handler.py
+++ b/tests/unit/responses/mcp/test_litellm_proxy_mcp_handler.py
@@ -1,10 +1,11 @@
+import asyncio
 import importlib
 import subprocess
 import sys
 import textwrap
 import types
-from typing import Any, Final, cast
-from unittest.mock import AsyncMock, MagicMock
+from typing import Any, Final, Literal, cast
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 from fastapi import HTTPException
@@ -12,15 +13,26 @@ from mcp.types import CallToolResult, TextContent
 from mcp.types import Tool as MCPTool
 from openai.types.responses.tool_param import Mcp
 
+import litellm
+from litellm.caching.caching import DualCache
+from litellm.integrations.custom_guardrail import CustomGuardrail
+from litellm.litellm_core_utils.litellm_logging import Logging
+from litellm.proxy._experimental.mcp_server import operations as mcp_operations
 from litellm.proxy._experimental.mcp_server.faults.list_outcomes import AggregateToolListing
+from litellm.proxy._experimental.mcp_server.mcp_server_manager import ListedToolsCaller, MCPServerManager
+from litellm.proxy._types import UserAPIKeyAuth
+from litellm.proxy.utils import ProxyLogging
 from litellm.responses import main as responses_main
 from litellm.responses.mcp import litellm_proxy_mcp_handler as mcp_handler_module
 from litellm.responses.mcp.litellm_proxy_mcp_handler import (
     LiteLLM_Proxy_MCP_Handler,
 )
+from litellm.types.guardrails import GuardrailEventHooks
 from litellm.types.llms.openai import ResponsesAPIResponse
+from litellm.types.mcp import MCPTransport
+from litellm.types.mcp_server.mcp_server_manager import MCPServer
 from litellm.types.responses.main import OutputFunctionToolCall
-from litellm.types.utils import ModelResponse
+from litellm.types.utils import GenericGuardrailAPIInputs, ModelResponse
 
 
 class _DummyMCPResult:
@@ -1310,6 +1322,167 @@ async def test_responses_discovery_logs_sanitized_caller_headers(monkeypatch: py
     assert headers["x-mcp-deepwiki-authorization"] == "upstream-sentinel"
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("real_listing", [False, True])
+@pytest.mark.parametrize(
+    ("allowed_tools", "expected_names"),
+    [
+        ([], ["responses_slot-echo", "responses_slot-status"]),
+        (["echo"], ["responses_slot-echo"]),
+        (["responses_slot-echo"], ["responses_slot-echo"]),
+        (["absent"], []),
+    ],
+)
+async def test_bridge_listing_leaves_the_callers_catalog_unchanged(
+    monkeypatch: pytest.MonkeyPatch, allowed_tools: list[str], expected_names: list[str], real_listing: bool
+) -> None:
+    manager: Final = mcp_operations.global_mcp_server_manager
+    server: Final = MCPServer(
+        server_id="responses-slot", name="responses_slot", alias="responses_slot", transport=MCPTransport.http
+    )
+    user: Final = UserAPIKeyAuth(api_key="sk-responses-slot", user_id="responder")
+    upstream: Final = [
+        MCPTool(name="echo", description="Echo text back", inputSchema={"type": "object"}),
+        MCPTool(name="status", description="Report status", inputSchema={"type": "object"}),
+        MCPTool(name="echo", description="Duplicate echo", inputSchema={"type": "object", "properties": {}}),
+    ]
+    fake_manager: Final = types.SimpleNamespace(
+        get_registry=MagicMock(return_value={}),
+        get_allowed_mcp_servers=AsyncMock(return_value=[]),
+        get_mcp_servers_from_ids=MagicMock(return_value=[]),
+        get_mcp_server_by_name=MagicMock(return_value=None),
+    )
+    monkeypatch.setattr(
+        "litellm.proxy._experimental.mcp_server.mcp_server_manager.global_mcp_server_manager",
+        fake_manager,
+    )
+    with (
+        patch.dict(manager.tool_name_to_mcp_server_name_mapping),
+        patch.object(mcp_operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[server])),
+        patch.object(manager, "_create_mcp_client", AsyncMock(return_value=object())),
+        patch.object(manager, "_fetch_tools_with_timeout", AsyncMock(return_value=upstream)),
+    ):
+        try:
+            if real_listing:
+                await manager._get_tools_from_server(server, user_api_key_auth=user, record_listing=True)
+            caller: Final = ListedToolsCaller(user_api_key_auth=user)
+            before: Final = {
+                tool.name: (listed.description, listed.input_schema)
+                for tool in upstream
+                if (listed := manager.get_listed_tool(server, tool.name, caller)) is not None
+            }
+            assert bool(before) is real_listing
+            tools, _server_names = await LiteLLM_Proxy_MCP_Handler._process_mcp_tools_without_openai_transform(
+                user_api_key_auth=user,
+                mcp_tools_with_litellm_proxy=[
+                    {
+                        "type": "mcp",
+                        "server_url": "litellm_proxy/mcp/responses-slot",
+                        "allowed_tools": allowed_tools,
+                    }
+                ],
+            )
+            recorded: Final = {
+                tool.name: (listed.description, listed.input_schema)
+                for tool in upstream
+                if (listed := manager.get_listed_tool(server, tool.name, caller)) is not None
+            }
+            assert recorded == before
+            assert (
+                manager.get_listed_tool(
+                    server, "echo", ListedToolsCaller(user_api_key_auth=UserAPIKeyAuth(api_key="sk-other-caller"))
+                )
+                is None
+            )
+        finally:
+            manager._drop_listed_tools(server.server_id)
+
+    assert [tool.name for tool in tools] == expected_names
+
+
+class _BridgeMetadataGuardrail(CustomGuardrail):
+    def __init__(self) -> None:
+        super().__init__(guardrail_name="bridge-metadata", event_hook=GuardrailEventHooks.pre_mcp_call, default_on=True)
+        self.calls: tuple[tuple[object, object], ...] = ()
+
+    async def apply_guardrail(
+        self,
+        inputs: GenericGuardrailAPIInputs,
+        request_data: dict[str, object],
+        input_type: Literal["request", "response"],
+        logging_obj: Logging | None = None,
+    ) -> GenericGuardrailAPIInputs:
+        if request_data.get("mcp_arguments") == {"probe": "bridge"}:
+            self.calls += ((request_data.get("mcp_tool_description"), request_data.get("mcp_input_schema")),)
+        return inputs
+
+
+@pytest.mark.asyncio
+async def test_concurrent_bridge_calls_use_their_own_served_metadata(monkeypatch: pytest.MonkeyPatch) -> None:
+    manager: Final = MCPServerManager()
+    server: Final = MCPServer(server_id="bridge", name="bridge", transport=MCPTransport.http, url="http://upstream")
+    manager.registry = {server.server_id: server}
+    user: Final = UserAPIKeyAuth(api_key="sk-bridge", user_id="bridge-user")
+    upstream: Final = [
+        MCPTool(
+            name="echo",
+            description="Echo text",
+            inputSchema={"type": "object", "properties": {"text": {"type": "string"}}},
+        ),
+        MCPTool(name="status", description="Read status", inputSchema={"type": "object"}),
+    ]
+    client: Final = AsyncMock()
+    client.call_tool.return_value = CallToolResult(content=[TextContent(type="text", text="ok")])
+    manager._create_mcp_client = AsyncMock(return_value=client)
+    manager._fetch_tools_with_timeout = AsyncMock(return_value=upstream)
+    guardrail: Final = _BridgeMetadataGuardrail()
+    logger: Final = ProxyLogging(user_api_key_cache=DualCache())
+    monkeypatch.setattr(litellm, "callbacks", [guardrail])
+    monkeypatch.setattr("litellm.proxy.proxy_server.proxy_logging_obj", logger)
+    monkeypatch.setattr(mcp_operations, "global_mcp_server_manager", manager)
+    monkeypatch.setattr(mcp_operations, "_get_allowed_mcp_servers", AsyncMock(return_value=[server]))
+    monkeypatch.setattr("litellm.proxy._experimental.mcp_server.mcp_server_manager.global_mcp_server_manager", manager)
+    first_listed: Final = asyncio.Event()
+    second_listed: Final = asyncio.Event()
+
+    async def bridge(name: str, first: bool) -> None:
+        if not first:
+            await first_listed.wait()
+        tools, server_map = await LiteLLM_Proxy_MCP_Handler._process_mcp_tools_without_openai_transform(
+            user_api_key_auth=user,
+            mcp_tools_with_litellm_proxy=[
+                {"type": "mcp", "server_url": "litellm_proxy/mcp/bridge", "allowed_tools": [name]}
+            ],
+        )
+        (first_listed if first else second_listed).set()
+        await second_listed.wait()
+        result: Final = await LiteLLM_Proxy_MCP_Handler._execute_tool_calls(
+            tool_server_map=server_map,
+            tool_calls=[
+                {"type": "function_call", "name": f"bridge-{name}", "arguments": '{"probe":"bridge"}', "call_id": name}
+            ],
+            user_api_key_auth=user,
+            served_tools=tools,
+        )
+        assert [entry["result"] for entry in result] == ["ok"]
+
+    try:
+        await asyncio.gather(bridge("echo", True), bridge("status", False))
+        assert sorted(guardrail.calls, key=str) == sorted(
+            ((tool.description, tool.input_schema) for tool in upstream), key=str
+        )
+        await manager.call_tool("bridge", "echo", {"probe": "bridge"}, user_api_key_auth=user, proxy_logging_obj=logger)
+        assert guardrail.calls[-1] == (None, None)
+        await manager._get_tools_from_server(
+            server, user_api_key_auth=user, proxy_logging_obj=logger, record_listing=True
+        )
+        await manager.call_tool("bridge", "echo", {"probe": "bridge"}, user_api_key_auth=user, proxy_logging_obj=logger)
+        assert guardrail.calls[-1] == (upstream[0].description, upstream[0].input_schema)
+    finally:
+        manager._drop_listed_tools(server.server_id)
+        ProxyLogging._callback_capabilities_cache.clear()
+
+
 def _toolset_gateway_manager(toolset_id: str, server_id: str) -> types.SimpleNamespace:
     return types.SimpleNamespace(
         get_registry=MagicMock(return_value={}),