From a806e94246e9b66fe88db61cf2884dfc96a0ddcf Mon Sep 17 00:00:00 2001 From: yucheng Date: Thu, 15 Oct 2026 05:35:25 +0000 Subject: [PATCH] fix(mcp): narrow master_key before the legacy session key derivation Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../_experimental/mcp_server/gateway_dcr_flow.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py index 0e41d05d158..ec9f8d8aff6 100644 --- a/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py +++ b/litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py @@ -1382,7 +1382,9 @@ async def aggregate_token( resource=resource, signing=signing, issue=issue, - legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys), + legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys) + if master_key is not None + else None, ) if grant_type == TOKEN_EXCHANGE_GRANT_TYPE: return await _token_exchange_grant( @@ -1631,7 +1633,10 @@ async def refresh_proxy_credential( if isinstance(signing, Response): return signing opened: Final = _open_presented_refresh_token( - refresh_token, client_id, signing, legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys) + refresh_token, + client_id, + signing, + legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys) if master_key is not None else None, ) if isinstance(opened, Response): return opened @@ -1706,7 +1711,7 @@ async def revoke_session_refresh_token( signing.keys, signing.now, expected_client_id=client_id, - legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys), + legacy_keys=legacy_session_keys_from_master_key(master_key, signing.keys) if master_key is not None else None, ) if isinstance(opened, SessionRefreshOpened): guard: Final = _SingleUseGuard(cache)