fix(helm): enable hosted MCP for the native admin worker

docker-compose.liteadmin.yml

@@ -2,6 +2,7 @@ services:
   litellm:
     image: ${LITELLM_IMAGE:?Set the native-enabled gateway image}
     environment:
+      LITELLM_ENABLE_ADMIN_MCP: "true"
       LITELLM_ADMIN_AGENT_URL: http://liteadmin:10000
       ADMIN_AGENT_SERVICE_TOKEN: ${ADMIN_AGENT_SERVICE_TOKEN:?Set a shared worker token}
       PROXY_BASE_URL: ${LITELLM_PUBLIC_URL:?Set the existing HTTPS gateway URL}

docker/README.md

@@ -141,4 +141,8 @@ export LITEADMIN_IMAGE=litellm-admin-agent:local
 
 When upgrading an existing Slack deployment, change the worker image and replace `--admin-agent` with `litellm-admin-agent --web`. Preserve `CONNECTION_AUTH_MODE=native`, the shared service token, encryption key, and state volume. The gateway's private worker URL and login routes stay the same. The main LiteLLM image no longer contains `/opt/liteadmin`
 
+The native worker requires `LITELLM_ENABLE_ADMIN_MCP=true` and a valid Enterprise license on the process serving `/admin/mcp`. The Compose overlay and enabled Helm worker set the flag automatically. Supply the license through the gateway's existing environment or Secret configuration
+
+For microservices, the backend hosts MCP and account linking, while the gateway handles inference. Configure the worker with one public HTTPS origin that routes management requests to the backend and inference requests to the gateway, as the shared-host component ingress does. Separate component hostnames alone are insufficient because the worker derives authentication and login URLs from its model URL. `ADMIN_MCP_URL` changes only the tool endpoint. Set the flag, license, private worker URL, shared service token, and public base URL on the backend, and deploy the worker separately
+
 For Helm, set `liteadmin.image.repository`, `liteadmin.image.tag`, and optionally `liteadmin.image.pullPolicy`. The worker tag is required when `liteadmin.enabled=true` and is independent of the gateway's `image.tag`. Keep one worker per Slack app

helm/litellm-helm/README.md

@@ -262,8 +262,12 @@ Follow the [Lens Helm connection guide](https://github.com/BerriAI/lens/blob/mai
 
 ### Slack worker
 
-`/admin/mcp` is served inside LiteLLM and does not require `liteadmin.enabled`. That option deploys the separate Slack worker. Set `liteadmin.image.repository` to the worker repository and `liteadmin.image.tag` to an independently published version. A worker tag is required when the worker is enabled. `liteadmin.image.pullPolicy` defaults to `IfNotPresent`
+`/admin/mcp` is served inside LiteLLM. To use MCP without Slack, set `envVars.LITELLM_ENABLE_ADMIN_MCP=true` and supply a valid Enterprise license to the gateway. `liteadmin.enabled` deploys the separate Slack worker and enables the gateway's MCP endpoint automatically. It requires the same gateway license. An explicitly disabled MCP flag fails rendering. Configure this flag through `envVars`, not `extraEnvVars`, when the worker is enabled
+
+Set `liteadmin.image.repository` to the worker repository and `liteadmin.image.tag` to an independently published version. A worker tag is required when the worker is enabled. `liteadmin.image.pullPolicy` defaults to `IfNotPresent`
 
 The `slack-worker.yaml` template runs the `slack-worker` container and labels its resources with `app.kubernetes.io/component: slack-worker`. Existing `liteadmin.*` settings, resource names, selectors, and persistent volume names remain stable for upgrades. Use `kubectl get deployments,pods,services,pvc -l app.kubernetes.io/component=slack-worker` to find the worker resources
 
 For an existing Slack deployment, publish or build the worker image before upgrading this chart. Preserve `liteadmin.existingSecret`, the encryption key, and the persistent volume. The chart starts the worker with `litellm-admin-agent --web` and `CONNECTION_AUTH_MODE=native`. See the [worker deployment guide](https://github.com/BerriAI/litellm-admin-agent/blob/main/docs/compatibility.md#native-enterprise-deployment)
+
+Keep the worker resources in the existing Helm release during this upgrade. Removing the template or disabling `liteadmin.enabled` removes its Deployment, Service, and PVC from the release. Moving to a separate worker chart requires an explicit state and resource ownership migration first

helm/litellm-helm/templates/deployment.yaml

@@ -59,6 +59,19 @@ spec:
             {{- include "litellm.lensConnectionEnv" . | nindent 12 }}
             {{- include "litellm.proxyEnv" . | nindent 12 }}
             {{- if .Values.liteadmin.enabled }}
+            {{- range .Values.extraEnvVars }}
+            {{- if eq .name "LITELLM_ENABLE_ADMIN_MCP" }}
+            {{- fail "Configure LITELLM_ENABLE_ADMIN_MCP through envVars, not extraEnvVars, when liteadmin.enabled=true" }}
+            {{- end }}
+            {{- end }}
+            {{- if hasKey (default dict .Values.envVars) "LITELLM_ENABLE_ADMIN_MCP" }}
+            {{- if not (has (.Values.envVars.LITELLM_ENABLE_ADMIN_MCP | toString | trim | lower) (list "true" "1" "on" "yes")) }}
+            {{- fail "liteadmin.enabled=true requires envVars.LITELLM_ENABLE_ADMIN_MCP to be enabled" }}
+            {{- end }}
+            {{- else }}
+            - name: LITELLM_ENABLE_ADMIN_MCP
+              value: "true"
+            {{- end }}
             - name: LITELLM_ADMIN_AGENT_URL
               value: {{ printf "http://%s-liteadmin:10000" (include "litellm.fullname" . | trunc 53 | trimSuffix "-") | quote }}
             - name: ADMIN_AGENT_SERVICE_TOKEN

helm/litellm-helm/tests/deployment_tests.yaml

@@ -518,3 +518,64 @@ tests:
       - equal:
           path: spec.template.metadata.annotations["example.com/literal"]
           value: "plain-string-value"
+  - it: leaves admin MCP opt-in when no Slack worker is deployed
+    template: deployment.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_ENABLE_ADMIN_MCP
+          any: true
+  - it: enables the hosted endpoint required by the native Slack worker
+    template: deployment.yaml
+    set:
+      liteadmin.enabled: true
+      liteadmin.existingSecret: worker-secret
+      liteadmin.gatewayUrl: https://gateway.example
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_ENABLE_ADMIN_MCP
+            value: "true"
+          count: 1
+  - it: preserves one explicitly enabled MCP flag with the Slack worker
+    template: deployment.yaml
+    set:
+      liteadmin.enabled: true
+      liteadmin.existingSecret: worker-secret
+      liteadmin.gatewayUrl: https://gateway.example
+      envVars.LITELLM_ENABLE_ADMIN_MCP: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_ENABLE_ADMIN_MCP
+            value: "true"
+          count: 1
+  - it: rejects disabling the endpoint required by the Slack worker
+    template: deployment.yaml
+    set:
+      liteadmin.enabled: true
+      envVars.LITELLM_ENABLE_ADMIN_MCP: false
+    asserts:
+      - failedTemplate:
+          errorMessage: liteadmin.enabled=true requires envVars.LITELLM_ENABLE_ADMIN_MCP to be enabled
+  - it: rejects an invalid MCP flag before starting the Slack worker
+    template: deployment.yaml
+    set:
+      liteadmin.enabled: true
+      envVars.LITELLM_ENABLE_ADMIN_MCP: invalid
+    asserts:
+      - failedTemplate:
+          errorMessage: liteadmin.enabled=true requires envVars.LITELLM_ENABLE_ADMIN_MCP to be enabled
+  - it: prevents a second MCP flag from overriding native worker enablement
+    template: deployment.yaml
+    set:
+      liteadmin.enabled: true
+      extraEnvVars:
+        - name: LITELLM_ENABLE_ADMIN_MCP
+          value: "false"
+    asserts:
+      - failedTemplate:
+          errorMessage: Configure LITELLM_ENABLE_ADMIN_MCP through envVars, not extraEnvVars, when liteadmin.enabled=true