From a3f44c078a45eca4f9c68c064b54aefb28feb1ed Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 13 Feb 2026 11:05:35 -0800 Subject: [PATCH] feat(mcp): add token exchange fields to MCPServer model Adds `token_exchange_endpoint`, `audience`, and `subject_token_type` fields plus `has_token_exchange_config` property to MCPServer for determining when OBO token exchange should be used. Co-Authored-By: Claude Opus 4.6 --- litellm/types/mcp_server/mcp_server_manager.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/litellm/types/mcp_server/mcp_server_manager.py b/litellm/types/mcp_server/mcp_server_manager.py index 8f8673b0a7d..268d064eacc 100644 --- a/litellm/types/mcp_server/mcp_server_manager.py +++ b/litellm/types/mcp_server/mcp_server_manager.py @@ -57,6 +57,10 @@ class MCPServer(BaseModel): aws_service_name: Optional[str] = None # defaults to "bedrock-agentcore" aws_role_name: Optional[str] = None # IAM role ARN for STS AssumeRole aws_session_name: Optional[str] = None # session name for CloudTrail auditing + # Token Exchange (OBO) fields — RFC 8693 + token_exchange_endpoint: Optional[str] = None + audience: Optional[str] = None + subject_token_type: str = "urn:ietf:params:oauth:token-type:access_token" # Stdio-specific fields command: Optional[str] = None args: Optional[List[str]] = None @@ -127,3 +131,12 @@ class MCPServer(BaseModel): return any(h.lower() in auth_header_names for h in self.extra_headers) return False + + @property + def has_token_exchange_config(self) -> bool: + """True if this server is configured for OAuth2 token exchange (OBO / RFC 8693).""" + return ( + self.auth_type == MCPAuth.oauth2_token_exchange + and bool(self.client_id and self.client_secret) + and bool(self.token_exchange_endpoint or self.token_url) + )