From e120609f8b6dddd87644ede2ddd3813577fc891e Mon Sep 17 00:00:00 2001 From: BinYi LIU Date: Thu, 29 Oct 2026 10:38:56 -0700 Subject: [PATCH] feat(proxy): declare require_key_mcp_access_defined in general_settings --- litellm/proxy/_types.py | 4 ++++ tests/unit/proxy/test__types.py | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index 4047fa3f0ad..7be592f6a82 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -2969,6 +2969,10 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase): default=False, description="Require aggregate MCP requests to include x-mcp-servers unless a toolset or gateway OAuth session already scopes the server. Off by default.", ) + require_key_mcp_access_defined: bool | None = Field( + None, + description="When true, a virtual key that grants no MCP servers of its own inherits none from its team, so the team acts as a ceiling rather than a default and the key reaches no MCP servers until it grants some explicitly or through an access group. Keyless subjects admitted through a gateway or the dashboard are unaffected, since team membership is their only access path. Default false: such a key inherits every MCP server its team holds.", + ) mcp_client_id_header: str | None = Field( None, description="Request header whose value names the calling MCP client application (for example 'x-mcp-client') for callers that did not authenticate with a JWT, used only while mcp_allowed_clients is set. The client picks this value itself, so it is a policy control rather than a security boundary; prefer litellm_jwtauth.mcp_client_id_jwt_field where callers use JWTs.", diff --git a/tests/unit/proxy/test__types.py b/tests/unit/proxy/test__types.py index 76ca49362b4..6f915e73163 100644 --- a/tests/unit/proxy/test__types.py +++ b/tests/unit/proxy/test__types.py @@ -601,3 +601,14 @@ def test_batch_file_caps_accept_only_positive_limits(setting): with pytest.raises(ValidationError): ConfigGeneralSettings.model_validate({setting: invalid}) assert getattr(ConfigGeneralSettings.model_validate({setting: 3}), setting) == 3 + + +def test_require_key_mcp_access_defined_is_a_validated_bool_setting(): + from litellm.proxy._types import ConfigGeneralSettings + + assert ConfigGeneralSettings().require_key_mcp_access_defined is None + assert ConfigGeneralSettings.model_validate( + {"require_key_mcp_access_defined": True} + ).require_key_mcp_access_defined is True + with pytest.raises(ValidationError): + ConfigGeneralSettings.model_validate({"require_key_mcp_access_defined": "not-a-bool"})