From 9be1f264e6b3c30a153da730f5ddc6937f67dca0 Mon Sep 17 00:00:00 2001 From: Tin Chi Lo Date: Wed, 17 Jun 2026 16:27:39 -0700 Subject: [PATCH] refactor(mcp): rename oauth/ to outbound_credentials/ The subdomain resolves every egress credential mode (api_key, none, aws_sigv4, passthrough), not just OAuth grants, so outbound_credentials names it accurately. Pure rename: relative imports are unaffected; the spike import, the absolute test imports, and the path mentions in the module/README docstrings are updated. The RFC 8693 token-type URN is left untouched. --- litellm/proxy/gateway/mcp/README.md | 2 +- litellm/proxy/gateway/mcp/__init__.py | 2 +- litellm/proxy/gateway/mcp/_spike_exhaustiveness.py | 4 ++-- .../mcp/{oauth => outbound_credentials}/__init__.py | 0 .../{oauth => outbound_credentials}/credential_store.py | 0 .../mcp/{oauth => outbound_credentials}/httpx_auth.py | 0 .../gateway/mcp/{oauth => outbound_credentials}/types.py | 0 .../upstream_credentials.py | 0 tests/mcp_tests/gateway/test_upstream_credentials.py | 8 ++++---- 9 files changed, 8 insertions(+), 8 deletions(-) rename litellm/proxy/gateway/mcp/{oauth => outbound_credentials}/__init__.py (100%) rename litellm/proxy/gateway/mcp/{oauth => outbound_credentials}/credential_store.py (100%) rename litellm/proxy/gateway/mcp/{oauth => outbound_credentials}/httpx_auth.py (100%) rename litellm/proxy/gateway/mcp/{oauth => outbound_credentials}/types.py (100%) rename litellm/proxy/gateway/mcp/{oauth => outbound_credentials}/upstream_credentials.py (100%) diff --git a/litellm/proxy/gateway/mcp/README.md b/litellm/proxy/gateway/mcp/README.md index 0a2d09e2e7c..6145e892513 100644 --- a/litellm/proxy/gateway/mcp/README.md +++ b/litellm/proxy/gateway/mcp/README.md @@ -6,7 +6,7 @@ security code is v2-shaped from line one instead of rewritten when the full S0 c Phase 2. It imports nothing from v1; v1 will only ever reach it through a thin adapter built in Phase 1. -Scope is deliberately small: the typed credential seam (`oauth/types.py`), the vendored `Result` +Scope is deliberately small: the typed credential seam (`outbound_credentials/types.py`), the vendored `Result` (`result.py`), and the basedpyright match-exhaustiveness spike (`_spike_exhaustiveness.py`). No transport, registry, CI gate, semgrep rules, import-linter layers, LOC caps, or composition root; those land with the full S0 in Phase 2. diff --git a/litellm/proxy/gateway/mcp/__init__.py b/litellm/proxy/gateway/mcp/__init__.py index b09e8c5e3d8..6993687fce0 100644 --- a/litellm/proxy/gateway/mcp/__init__.py +++ b/litellm/proxy/gateway/mcp/__init__.py @@ -4,7 +4,7 @@ Written v2-native: nothing here imports from v1 (the rest of `litellm.proxy._experimental.mcp_server.*`). v1 only ever reaches v2 through a thin adapter built in Phase 1, never the other way round. -Phase 0 scope = the typed OAuth-credential seam only (`oauth/types.py`), the vendored +Phase 0 scope = the typed OAuth-credential seam only (`outbound_credentials/types.py`), the vendored `Result` (`result.py`), and the basedpyright match-exhaustiveness spike (`_spike_exhaustiveness.py`). No transport, registry, or CI/semgrep/composition-root infrastructure — those land in Phase 2 (S0). diff --git a/litellm/proxy/gateway/mcp/_spike_exhaustiveness.py b/litellm/proxy/gateway/mcp/_spike_exhaustiveness.py index 54bd44e9dbe..1779633ba2d 100644 --- a/litellm/proxy/gateway/mcp/_spike_exhaustiveness.py +++ b/litellm/proxy/gateway/mcp/_spike_exhaustiveness.py @@ -6,7 +6,7 @@ the bet HOLDS, with two non-obvious rules taken from the sibling v2 package `lit Two `match` shapes are exhaustiveness-checked and are the only ones we use: - (A) `match` over a closed `Enum` -> what `resolve()` dispatches on (`oauth/types.py`). + (A) `match` over a closed `Enum` -> what `resolve()` dispatches on (`outbound_credentials/types.py`). (B) `match self.tag` over an Expression `@tagged_union` whose `tag` is a `Literal` -> what `CredError` uses for its `summary`. @@ -25,7 +25,7 @@ from __future__ import annotations from typing_extensions import assert_never -from .oauth.types import AuthSpecKind, CredError +from .outbound_credentials.types import AuthSpecKind, CredError # (A) Enum dispatch — the load-bearing case (`resolve()` uses exactly this shape). diff --git a/litellm/proxy/gateway/mcp/oauth/__init__.py b/litellm/proxy/gateway/mcp/outbound_credentials/__init__.py similarity index 100% rename from litellm/proxy/gateway/mcp/oauth/__init__.py rename to litellm/proxy/gateway/mcp/outbound_credentials/__init__.py diff --git a/litellm/proxy/gateway/mcp/oauth/credential_store.py b/litellm/proxy/gateway/mcp/outbound_credentials/credential_store.py similarity index 100% rename from litellm/proxy/gateway/mcp/oauth/credential_store.py rename to litellm/proxy/gateway/mcp/outbound_credentials/credential_store.py diff --git a/litellm/proxy/gateway/mcp/oauth/httpx_auth.py b/litellm/proxy/gateway/mcp/outbound_credentials/httpx_auth.py similarity index 100% rename from litellm/proxy/gateway/mcp/oauth/httpx_auth.py rename to litellm/proxy/gateway/mcp/outbound_credentials/httpx_auth.py diff --git a/litellm/proxy/gateway/mcp/oauth/types.py b/litellm/proxy/gateway/mcp/outbound_credentials/types.py similarity index 100% rename from litellm/proxy/gateway/mcp/oauth/types.py rename to litellm/proxy/gateway/mcp/outbound_credentials/types.py diff --git a/litellm/proxy/gateway/mcp/oauth/upstream_credentials.py b/litellm/proxy/gateway/mcp/outbound_credentials/upstream_credentials.py similarity index 100% rename from litellm/proxy/gateway/mcp/oauth/upstream_credentials.py rename to litellm/proxy/gateway/mcp/outbound_credentials/upstream_credentials.py diff --git a/tests/mcp_tests/gateway/test_upstream_credentials.py b/tests/mcp_tests/gateway/test_upstream_credentials.py index e1fdbed476e..c4cb74796cc 100644 --- a/tests/mcp_tests/gateway/test_upstream_credentials.py +++ b/tests/mcp_tests/gateway/test_upstream_credentials.py @@ -8,15 +8,15 @@ import httpx import pytest from pydantic import ValidationError -from litellm.proxy.gateway.mcp.oauth.credential_store import ( +from litellm.proxy.gateway.mcp.outbound_credentials.credential_store import ( CredentialKey, InMemoryCredentialStore, ) -from litellm.proxy.gateway.mcp.oauth.httpx_auth import ( +from litellm.proxy.gateway.mcp.outbound_credentials.httpx_auth import ( NoOpAuth, StaticHeaderAuth, ) -from litellm.proxy.gateway.mcp.oauth.types import ( +from litellm.proxy.gateway.mcp.outbound_credentials.types import ( ApiKeyConfig, AuthSpecKind, NoneConfig, @@ -26,7 +26,7 @@ from litellm.proxy.gateway.mcp.oauth.types import ( SharedKey, Subject, ) -from litellm.proxy.gateway.mcp.oauth.upstream_credentials import ( +from litellm.proxy.gateway.mcp.outbound_credentials.upstream_credentials import ( UpstreamCredentialProvider, ) from litellm.proxy.gateway.mcp.result import Error, Ok