From e50bfa572784c532d6695a4a5d165e88e45cc11e Mon Sep 17 00:00:00 2001
From: awais qureshi <awais.qureshi@arbisoft.com>
Date: Tue, 10 Mar 2026 17:24:05 +0500
Subject: [PATCH] fix(mcp): prevent auto-discovered token_url from triggering
 2LO client_credentials grant.

---
 .../_experimental/mcp_server/mcp_server_manager.py   | 12 ++++++++----
 litellm/types/mcp_server/mcp_server_manager.py       |  1 -
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
index ac593476cc2..240501e5085 100644
--- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
+++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
@@ -298,9 +298,14 @@ class MCPServerManager:
             resolved_authorization_url = server_config.get("authorization_url") or (
                 mcp_oauth_metadata.authorization_url if mcp_oauth_metadata else None
             )
-            token_url_from_config = bool(server_config.get("token_url"))
-            resolved_token_url = server_config.get("token_url") or (
-                mcp_oauth_metadata.token_url if mcp_oauth_metadata else None
+            _explicit_token_url = server_config.get("token_url")
+            _has_pkce_creds = bool(
+                server_config.get("client_id") and server_config.get("client_secret")
+            )
+            resolved_token_url = _explicit_token_url or (
+                (mcp_oauth_metadata.token_url if mcp_oauth_metadata else None)
+                if not _has_pkce_creds
+                else None
             )
             resolved_registration_url = server_config.get("registration_url") or (
                 mcp_oauth_metadata.registration_url if mcp_oauth_metadata else None
@@ -323,7 +328,6 @@ class MCPServerManager:
                 scopes=resolved_scopes,
                 authorization_url=resolved_authorization_url,
                 token_url=resolved_token_url,
-                token_url_from_config=token_url_from_config,
                 registration_url=resolved_registration_url,
                 # TODO: utility fn the default values
                 transport=server_config.get("transport", MCPTransport.http),
diff --git a/litellm/types/mcp_server/mcp_server_manager.py b/litellm/types/mcp_server/mcp_server_manager.py
index 18df7a6ef21..ed391f0af68 100644
--- a/litellm/types/mcp_server/mcp_server_manager.py
+++ b/litellm/types/mcp_server/mcp_server_manager.py
@@ -47,7 +47,6 @@ class MCPServer(BaseModel):
     scopes: Optional[List[str]] = None
     authorization_url: Optional[str] = None
     token_url: Optional[str] = None
-    token_url_from_config: bool = False  # True only when token_url was explicitly set in user config (not auto-discovered)
     registration_url: Optional[str] = None
     # AWS SigV4 fields
     aws_access_key_id: Optional[str] = None