Merge e120609f8b into 9ffb82e139

litellm/proxy/_types.py

@@ -3028,6 +3028,10 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
         default=False,
         description="Require aggregate MCP requests to include x-mcp-servers unless a toolset or gateway OAuth session already scopes the server. Off by default.",
     )
+    require_key_mcp_access_defined: bool | None = Field(
+        None,
+        description="When true, a virtual key that grants no MCP servers of its own inherits none from its team, so the team acts as a ceiling rather than a default and the key reaches no MCP servers until it grants some explicitly or through an access group. Keyless subjects admitted through a gateway or the dashboard are unaffected, since team membership is their only access path. Default false: such a key inherits every MCP server its team holds.",
+    )
     mcp_client_id_header: str | None = Field(
         None,
         description="Request header whose value names the calling MCP client application (for example 'x-mcp-client') for callers that did not authenticate with a JWT, used only while mcp_allowed_clients is set. The client picks this value itself, so it is a policy control rather than a security boundary; prefer litellm_jwtauth.mcp_client_id_jwt_field where callers use JWTs.",

tests/unit/proxy/test__types.py

@@ -634,3 +634,14 @@ def test_batch_file_caps_accept_only_positive_limits(setting):
         with pytest.raises(ValidationError):
             ConfigGeneralSettings.model_validate({setting: invalid})
     assert getattr(ConfigGeneralSettings.model_validate({setting: 3}), setting) == 3
+
+
+def test_require_key_mcp_access_defined_is_a_validated_bool_setting():
+    from litellm.proxy._types import ConfigGeneralSettings
+
+    assert ConfigGeneralSettings().require_key_mcp_access_defined is None
+    assert ConfigGeneralSettings.model_validate(
+        {"require_key_mcp_access_defined": True}
+    ).require_key_mcp_access_defined is True
+    with pytest.raises(ValidationError):
+        ConfigGeneralSettings.model_validate({"require_key_mcp_access_defined": "not-a-bool"})