From 90e256d8055bf6087f3b9299e772d9fa7d4b2ab5 Mon Sep 17 00:00:00 2001
From: Ishaan Jaffer <ishaanjaffer0324@gmail.com>
Date: Tue, 10 Mar 2026 12:38:21 -0700
Subject: [PATCH] fix(mcp): block view-only admin from /register; log settings
 failure; warn on active server reject

---
 .../mcp_management_endpoints.py                  |  5 ++++-
 .../components/mcp_tools/MCPSubmissionsTab.tsx   | 16 +++++++++++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/litellm/proxy/management_endpoints/mcp_management_endpoints.py b/litellm/proxy/management_endpoints/mcp_management_endpoints.py
index 70060a92568..d27d6cdc875 100644
--- a/litellm/proxy/management_endpoints/mcp_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/mcp_management_endpoints.py
@@ -746,7 +746,10 @@ if MCP_AVAILABLE:
         Creates the server with approval_status=pending_review.
         Requires a team-scoped API key.
         """
-        if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN:
+        if user_api_key_dict.user_role in (
+            LitellmUserRoles.PROXY_ADMIN,
+            LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+        ):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail={
diff --git a/ui/litellm-dashboard/src/components/mcp_tools/MCPSubmissionsTab.tsx b/ui/litellm-dashboard/src/components/mcp_tools/MCPSubmissionsTab.tsx
index 4c443a257f1..19a413e65fb 100644
--- a/ui/litellm-dashboard/src/components/mcp_tools/MCPSubmissionsTab.tsx
+++ b/ui/litellm-dashboard/src/components/mcp_tools/MCPSubmissionsTab.tsx
@@ -78,13 +78,17 @@ function StatCard({
 type ConfirmDialogProps = {
   action: "approve" | "reject";
   serverName: string;
+  isCurrentlyActive?: boolean;
   onConfirm: (reviewNotes?: string) => void;
   onCancel: () => void;
 };
 
-function ConfirmDialog({ action, serverName, onConfirm, onCancel }: ConfirmDialogProps) {
+function ConfirmDialog({ action, serverName, isCurrentlyActive, onConfirm, onCancel }: ConfirmDialogProps) {
   const [reviewNotes, setReviewNotes] = useState("");
   const isApprove = action === "approve";
+  const rejectBody = isCurrentlyActive
+    ? "This server is currently live. Rejecting it will immediately remove it from the proxy runtime."
+    : "This will mark the submission as rejected.";
   return (
     <div className="fixed inset-0 bg-black/30 flex items-center justify-center z-50">
       <div className="bg-white rounded-xl shadow-xl p-6 max-w-sm w-full mx-4">
@@ -107,7 +111,7 @@ function ConfirmDialog({ action, serverName, onConfirm, onCancel }: ConfirmDialo
           <span className="font-medium text-gray-700">&quot;{serverName}&quot;</span>?{" "}
           {isApprove
             ? "This will make it active and available for use."
-            : "This will mark it as rejected."}
+            : rejectBody}
         </p>
         {!isApprove && (
           <textarea
@@ -468,6 +472,7 @@ export function MCPSubmissionsTab({ accessToken }: MCPSubmissionsTabProps) {
     serverId: string;
     serverName: string;
     action: "approve" | "reject";
+    isCurrentlyActive?: boolean;
   } | null>(null);
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
@@ -484,7 +489,10 @@ export function MCPSubmissionsTab({ accessToken }: MCPSubmissionsTabProps) {
     try {
       const [res, settings] = await Promise.all([
         fetchMCPSubmissions(accessToken),
-        getGeneralSettingsCall(accessToken).catch(() => null),
+        getGeneralSettingsCall(accessToken).catch((err) => {
+          console.warn("MCPSubmissionsTab: failed to load general settings, compliance rules will be empty:", err);
+          return null;
+        }),
       ]);
       setSummary(res);
       if (settings?.data && Array.isArray(settings.data)) {
@@ -625,6 +633,7 @@ export function MCPSubmissionsTab({ accessToken }: MCPSubmissionsTabProps) {
                   serverId: server.server_id,
                   serverName: server.alias ?? server.server_name ?? server.server_id,
                   action: "reject",
+                  isCurrentlyActive: server.approval_status === "active",
                 })
               }
             />
@@ -635,6 +644,7 @@ export function MCPSubmissionsTab({ accessToken }: MCPSubmissionsTabProps) {
         <ConfirmDialog
           action={confirmAction.action}
           serverName={confirmAction.serverName}
+          isCurrentlyActive={confirmAction.isCurrentlyActive}
           onConfirm={(reviewNotes) =>
             confirmAction.action === "approve"
               ? handleApprove(confirmAction.serverId, confirmAction.serverName)