From a2b010b2a5ea6b2e6dbb0c8d8af96419a0c7f05f Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 13 Feb 2026 11:05:53 -0800 Subject: [PATCH] feat(mcp): integrate token exchange into resolve_mcp_auth Updates resolve_mcp_auth() to accept a subject_token parameter and route through TokenExchangeHandler when the server is configured for oauth2_token_exchange. Co-Authored-By: Claude Opus 4.6 --- .../_experimental/mcp_server/oauth2_token_cache.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py index 0de381ee1df..512fda5d497 100644 --- a/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py +++ b/litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py @@ -148,16 +148,24 @@ mcp_oauth2_token_cache = MCPOAuth2TokenCache() async def resolve_mcp_auth( server: "MCPServer", mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None, + subject_token: Optional[str] = None, ) -> Optional[Union[str, Dict[str, str]]]: """Resolve the auth value for an MCP server. Priority: 1. ``mcp_auth_header`` — per-request/per-user override - 2. OAuth2 client_credentials token — auto-fetched and cached - 3. ``server.authentication_token`` — static token from config/DB + 2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token + 3. OAuth2 client_credentials token — auto-fetched and cached + 4. ``server.authentication_token`` — static token from config/DB """ if mcp_auth_header: return mcp_auth_header + if server.has_token_exchange_config and subject_token: + from litellm.proxy._experimental.mcp_server.auth.token_exchange import ( + mcp_token_exchange_handler, + ) + + return await mcp_token_exchange_handler.exchange_token(subject_token, server) if server.has_client_credentials: return await mcp_oauth2_token_cache.async_get_token(server) return server.authentication_token