chore(otel/v2): merge litellm_internal_staging and resolve conflicts

Resolve the organization_view.tsx conflict by keeping staging's OrgSettingsForm architecture while preserving the PR's identity-scoped logging-exporter display and org-level editing via the v2 PATCH path.

Fix lint surfaced by staging's tightened gates: drop a stale let in settings.tsx (prefer-const), collapse the key logging-exporters Form.Item to keep key_edit_view.tsx under max-lines, and baseline the three new antd-based logging_credentials components plus settings.tsx max-lines in eslint-suppressions.json alongside the existing grandfathered antd usage.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.circleci/config.yml

@@ -2731,7 +2731,7 @@ jobs:
             - ~/.cache/uv
       - restore_cache:
           keys:
-            - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
       - run:
           name: Install Node dependencies and Playwright
           # The cimg/python:3.12-browsers image already ships the Chromium system
@@ -2742,11 +2742,14 @@ jobs:
           command: |
             cd ui/litellm-dashboard
             npm ci
+            cd ../../tests/e2e/ui
+            npm ci
             npx playwright install chromium
       - save_cache:
-          key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
           paths:
             - ui/litellm-dashboard/node_modules
+            - tests/e2e/ui/node_modules
             - ~/.cache/ms-playwright
       - run:
           name: Build UI from source
@@ -2777,10 +2780,10 @@ jobs:
           name: Seed database
           command: |
             PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \
-              -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql
+              -f tests/e2e/ui/fixtures/seed.sql
       - run:
           name: Start mock LLM server
-          command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py
+          command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py
           background: true
       - run:
           name: Start LiteLLM proxy
@@ -2798,7 +2801,7 @@ jobs:
           command: |
             LITELLM_LICENSE="$LITELLM_LICENSE" \
               uv run --no-sync python -m litellm.proxy.proxy_cli \
-                --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \
+                --config tests/e2e/ui/fixtures/config.yml \
                 --port 4000
           background: true
       - run:
@@ -2819,15 +2822,15 @@ jobs:
           # Forward LITELLM_LICENSE so license.spec.ts can detect that the
           # proxy was launched with a license and assert premium_user=true.
           command: |
-            cd ui/litellm-dashboard
+            cd tests/e2e/ui
             LITELLM_LICENSE="$LITELLM_LICENSE" \
-              npx playwright test --config e2e_tests/playwright.config.ts
+              npx playwright test --config playwright.config.ts
           no_output_timeout: 10m
       - store_artifacts:
-          path: ui/litellm-dashboard/test-results
+          path: tests/e2e/ui/test-results
           destination: e2e-test-results
       - store_artifacts:
-          path: ui/litellm-dashboard/playwright-report
+          path: tests/e2e/ui/playwright-report
           destination: e2e-playwright-report
 
   e2e_ui_testing_server_root_path:
@@ -2870,17 +2873,20 @@ jobs:
             - ~/.cache/uv
       - restore_cache:
           keys:
-            - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
       - run:
           name: Install Node dependencies and Playwright
           command: |
             cd ui/litellm-dashboard
             npm ci
+            cd ../../tests/e2e/ui
+            npm ci
             npx playwright install chromium
       - save_cache:
-          key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
           paths:
             - ui/litellm-dashboard/node_modules
+            - tests/e2e/ui/node_modules
             - ~/.cache/ms-playwright
       - run:
           name: Build UI from source
@@ -2902,10 +2908,10 @@ jobs:
           name: Seed database
           command: |
             PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \
-              -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql
+              -f tests/e2e/ui/fixtures/seed.sql
       - run:
           name: Start mock LLM server
-          command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py
+          command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py
           background: true
       - run:
           name: Start LiteLLM proxy under a server root path
@@ -2918,7 +2924,7 @@ jobs:
           command: |
             LITELLM_LICENSE="$LITELLM_LICENSE" \
               uv run --no-sync python -m litellm.proxy.proxy_cli \
-                --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \
+                --config tests/e2e/ui/fixtures/config.yml \
                 --port 4000
           background: true
       - run:
@@ -2937,15 +2943,15 @@ jobs:
       - run:
           name: Run migration smoke under SERVER_ROOT_PATH
           command: |
-            cd ui/litellm-dashboard
+            cd tests/e2e/ui
             LITELLM_LICENSE="$LITELLM_LICENSE" \
-              npx playwright test --config e2e_tests/migration.serverRootPath.config.ts
+              npx playwright test --config migration.serverRootPath.config.ts
           no_output_timeout: 10m
       - store_artifacts:
-          path: ui/litellm-dashboard/test-results
+          path: tests/e2e/ui/test-results
           destination: e2e-server-root-path-test-results
       - store_artifacts:
-          path: ui/litellm-dashboard/playwright-report
+          path: tests/e2e/ui/playwright-report
           destination: e2e-server-root-path-playwright-report
 
   build_docker_database_image:

.circleci/scripts/classify_changes.sh

@@ -8,7 +8,7 @@ has_backend=false
 while IFS= read -r file || [ -n "$file" ]; do
   [ -n "$file" ] || continue
   case "$file" in
-    ui/*) has_client=true ;;
+    ui/* | tests/e2e/ui/*) has_client=true ;;
     docs/* | *.md | *.mdx) : ;;
     *) has_backend=true ;;
   esac

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -30,7 +30,7 @@ body:
     id: steps-to-reproduce
     attributes:
       label: Steps to Reproduce
-      description: Please provide detailed steps to reproduce this bug(A curl/python code to reproduce the bug)
+      description: Please provide a numbered list of the exact steps to reproduce this bug (include a curl/python snippet to reproduce it). Number each step (1., 2., 3., ...) in the order you performed them.
       placeholder: |
         1. config.yaml file/ .env file/ etc.
         2. Run the following code...

.github/pull_request_template.md

@@ -1,3 +1,18 @@
+## TLDR
+
+<!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max
+     This section must be extremely human parsable, comprehensible, and readable: its target audience is humans, not AI agents -->
+
+Problem this solves:
+
+- <blah>
+- ...
+
+How it solves it:
+
+- <blah>
+- ...
+
 ## Relevant issues
 
 <!-- e.g., "Fixes #000" -->

.github/workflows/_test-unit-base.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Install dependencies
         if: steps.changes.outputs.decision != 'skip'
         run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
 
       - name: Generate Prisma client
         if: steps.changes.outputs.decision != 'skip'

.github/workflows/codspeed.yml

@@ -5,10 +5,24 @@ on:
     branches:
       - main
       - litellm_internal_staging
+    paths:
+      - "litellm/**"
+      - "tests/benchmarks/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/codspeed.yml"
+      - ".github/actions/setup-uv-with-retries/**"
   pull_request:
     branches:
       - main
       - litellm_internal_staging
+    paths:
+      - "litellm/**"
+      - "tests/benchmarks/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/codspeed.yml"
+      - ".github/actions/setup-uv-with-retries/**"
   # Allow CodSpeed to trigger backtest performance analysis
   # in order to generate initial data
   workflow_dispatch:

.github/workflows/image-scan.yml

@@ -9,6 +9,7 @@ on:
       - "litellm_**"
     paths:
       - docker/Dockerfile.non_root
+      - tests/proxy_migration_tests/test_offline_image_migration.py
       - uv.lock
       - ui/litellm-dashboard/package-lock.json
       - .github/workflows/image-scan.yml
@@ -51,6 +52,23 @@ jobs:
       - name: Build runtime image
         run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .
 
+      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
+      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
+      # `docker run` as the default uid with network hides a broken bake because
+      # the migration entrypoint exits 0 even when it applied nothing; asserting
+      # the schema was created is what catches it.
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
+
       # Scans the whole shipped artifact: OS/apk plus every language package
       # baked into the image, including ones no lockfile declares (e.g. prisma's
       # vendored node engine) that osv-scan cannot see. osv-scan stays the fast

.github/workflows/mutation-test.yml

@@ -55,7 +55,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
 
       - name: Generate Prisma client
         env:

.github/workflows/test-code-quality.yml

@@ -115,6 +115,9 @@ jobs:
       - name: check_fastuuid_usage
         run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py
 
+      - name: check_e2e_no_raw_requests
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py
+
       - name: memory_test
         run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py
 

.github/workflows/test-litellm-ui-unit.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   ui-unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-16-cores
     timeout-minutes: 20
     defaults:
       run:
@@ -50,8 +50,8 @@ jobs:
           if [ -n "$BASE_SHA" ]; then
             echo "Pull request: running only tests related to changes since $BASE_SHA"
             npm run test -- --run --changed "$BASE_SHA" --passWithNoTests \
-              --pool forks --poolOptions.forks.maxForks=4
+              --pool forks --poolOptions.forks.maxForks=14
           else
             echo "Push to $GITHUB_REF_NAME: running the full suite"
-            npm run test -- --run --pool forks --poolOptions.forks.maxForks=4
+            npm run test -- --run --pool forks --poolOptions.forks.maxForks=14
           fi

.github/workflows/test-unit-proxy-endpoints.yml

@@ -47,6 +47,7 @@ jobs:
         tests/test_litellm/proxy/rag_endpoints
         tests/test_litellm/proxy/realtime_endpoints
         tests/test_litellm/proxy/ui_crud_endpoints
+        tests/test_litellm/proxy/config_resolvers
         tests/test_litellm/proxy/utils
       workers: 2
       reruns: 2

.github/workflows/test_server_root_path.yml

@@ -106,8 +106,8 @@ jobs:
         with:
           node-version: "20"
 
-      - name: Install UI deps and Chromium
-        working-directory: ui/litellm-dashboard
+      - name: Install e2e deps and Chromium
+        working-directory: tests/e2e/ui
         run: |
           retry() {
             local attempt=1
@@ -131,17 +131,17 @@ jobs:
           retry npx playwright install --with-deps chromium
 
       - name: Run SERVER_ROOT_PATH redirect e2e
-        working-directory: ui/litellm-dashboard
+        working-directory: tests/e2e/ui
         env:
           SERVER_ROOT_PATH: ${{ matrix.root_path }}
-        run: npx playwright test --config=e2e_tests/serverRootPath.config.ts
+        run: npx playwright test --config=serverRootPath.config.ts
 
       - name: Upload Playwright artifacts on failure
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-trace-${{ strategy.job-index }}
-          path: ui/litellm-dashboard/test-results/
+          path: tests/e2e/ui/test-results/
           retention-days: 7
 
       - name: Cleanup

.github/workflows/weekly_load_anomaly.yml

@@ -0,0 +1,81 @@
+name: "Weekly Load Anomaly Check"
+
+on:
+  schedule:
+    - cron: "0 12 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  weekly-load-anomaly:
+    if: github.event_name != 'schedule' || github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    services:
+      postgres:
+        image: postgres:16.6
+        env:
+          POSTGRES_USER: llmproxy
+          POSTGRES_PASSWORD: dbpassword9090
+          POSTGRES_DB: litellm
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U llmproxy"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
+      LITELLM_MASTER_KEY: sk-weekly-anomaly-check
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install dependencies
+        run: |
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Start the proxy
+        run: |
+          nohup uv run --no-sync litellm --config tests/e2e/load/weekly_anomaly_config.yml --port 4000 > proxy.log 2>&1 &
+          for _ in $(seq 1 90); do
+            if curl -fs http://localhost:4000/health/liveliness > /dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "proxy never became live"
+          tail -n 100 proxy.log
+          exit 1
+
+      - name: Run the weekly session anomaly test
+        env:
+          E2E_WEEKLY_ANOMALY: "1"
+        run: |
+          uv run --no-sync pytest tests/e2e/load/test_weekly_session_anomaly_e2e.py -v --tb=short -rA
+
+      - name: Show proxy log on failure
+        if: failure()
+        run: tail -n 300 proxy.log

Dockerfile

@@ -64,6 +64,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr
     --extra proxy-runtime \
     --extra extra_proxy \
     --extra semantic-router \
+    --extra saml \
     --python python3
 
 # Copy full source tree
@@ -84,6 +85,7 @@ RUN uv sync --frozen --no-default-groups --no-editable \
     --extra proxy-runtime \
     --extra extra_proxy \
     --extra semantic-router \
+    --extra saml \
     --python python3
 
 RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \

backend/routes/allowlist.py

@@ -18,6 +18,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
     "/team/",
     "/v2/team/",
     "/organization/",
+    "/v2/organization/",
     "/customer/",
     "/end_user/",
     "/sso/",

docker/Dockerfile.database

@@ -62,6 +62,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr
     --extra proxy-runtime \
     --extra extra_proxy \
     --extra semantic-router \
+    --extra saml \
     --python python3
 
 # Copy full source tree
@@ -82,6 +83,7 @@ RUN uv sync --frozen --no-default-groups --no-editable \
     --extra proxy-runtime \
     --extra extra_proxy \
     --extra semantic-router \
+    --extra saml \
     --python python3
 
 RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \

docker/Dockerfile.non_root

@@ -54,7 +54,6 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
     UV_LINK_MODE=copy \
     PATH="/app/.venv/bin:${PATH}" \
     LITELLM_NON_ROOT=true \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
     XDG_CACHE_HOME=/app/.cache
 
 # Copy dependency metadata first for layer caching
@@ -69,6 +68,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
     --extra proxy-runtime \
     --extra extra_proxy \
     --extra semantic-router \
+    --extra saml \
     --python python3
 
 # Copy full source tree
@@ -95,6 +95,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
         --extra proxy-runtime \
         --extra extra_proxy \
         --extra semantic-router \
+        --extra saml \
         --python python3 \
         --no-sources-package litellm-proxy-extras; \
     else \
@@ -103,10 +104,13 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
         --extra proxy-runtime \
         --extra extra_proxy \
         --extra semantic-router \
+        --extra saml \
         --python python3; \
     fi
 
-RUN prisma generate --schema=./schema.prisma
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma
 
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
     sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
@@ -127,8 +131,6 @@ RUN for i in 1 2 3; do \
 # the rest of the builder's /app is source and build metadata that must not
 # ship (manifest-scanning tools attribute everything in it to this image).
 # entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path.
-# Prisma caches live under /app/.cache here (XDG_CACHE_HOME /
-# PRISMA_BINARY_CACHE_DIR) so the runtime prisma generate finds them.
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=builder /app/docker /app/docker
 COPY --from=builder /app/schema.prisma /app/schema.prisma
@@ -138,21 +140,35 @@ COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/pr
 # enterprise.enterprise_hooks from it)
 COPY --from=builder /app/enterprise /app/enterprise
 COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
-COPY --from=builder /app/.cache /app/.cache
+# Prisma CLI + engines are baked under /opt/prisma, a fixed path every runtime
+# uid can read and that no cache volume mount shadows (unlike /app/.cache or
+# $HOME/.cache under readOnlyRootFilesystem + emptyDir or arbitrary-uid setups).
+# PRISMA_CLI_QUERY_ENGINE_TYPE=binary makes the CLI use the baked binary query
+# engine directly, so `prisma migrate deploy` on a fresh database needs no npm
+# and no network access; without it the CLI looks for the library engine, which
+# prisma stopped baking, and falls back to a download that fails offline or as a
+# non-writable uid (#33650, #24554).
+COPY --from=builder /opt/prisma /opt/prisma
 COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui
 COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
 
+# XDG_CACHE_HOME is intentionally left unset so it falls back to $HOME/.cache
+# (/app/.cache, writable by the runtime uid). The prisma bake at the read-only
+# /opt/prisma is anchored by PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH, so
+# nothing needs XDG to point there; pointing it at the read-only bake would
+# deny any XDG-aware library that writes a cache at runtime.
 ENV PATH="/app/.venv/bin:${PATH}" \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \
+    PRISMA_CLI_QUERY_ENGINE_TYPE=binary \
     HOME=/app \
     LITELLM_NON_ROOT=true \
-    XDG_CACHE_HOME=/app/.cache \
     PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
     PRISMA_HIDE_UPDATE_MESSAGE=1 \
     PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \
     PRISMA_OFFLINE_MODE=true
 
-RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \
+RUN mkdir -p /nonexistent /app/.cache /var/lib/litellm/assets /var/lib/litellm/ui && \
     chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent && \
     PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
     chown -R nobody:nogroup "$PRISMA_PATH" && \
@@ -165,12 +181,14 @@ RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \
     [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \
     chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
     [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \
-    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache
+    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
+    chmod -R a+rX /opt/prisma && \
+    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
+    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
+    ls /opt/prisma/binaries/node_modules/@prisma/engines/query-engine-* >/dev/null 2>&1
 
 USER 65534
 
-RUN prisma generate --schema=./schema.prisma
-
 EXPOSE 4000/tcp
 
 ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]

gateway/Dockerfile

@@ -46,6 +46,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
         --extra proxy-runtime \
         --extra extra_proxy \
         --extra semantic-router \
+        --extra bedrock-realtime \
         --python python3
 
 # Stage 2 — copy source and install the project + workspace members.
@@ -57,6 +58,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
         --extra proxy-runtime \
         --extra extra_proxy \
         --extra semantic-router \
+        --extra bedrock-realtime \
         --python python3
 
 RUN mkdir -p /home/nonroot && \

litellm-rust/crates/ai-gateway/src/messages/common_utils.rs

@@ -50,3 +50,15 @@ pub(super) fn has_header(headers: &[(String, String)], name: &str) -> bool {
         .iter()
         .any(|(key, _)| key.eq_ignore_ascii_case(name))
 }
+
+pub(super) fn has_bearer_auth(headers: &[(String, String)]) -> bool {
+    headers.iter().any(|(name, value)| {
+        if !name.eq_ignore_ascii_case("authorization") {
+            return false;
+        }
+        let value = value.trim();
+        value.len() > 7
+            && value[..7].eq_ignore_ascii_case("bearer ")
+            && !value[7..].trim().is_empty()
+    })
+}

litellm-rust/crates/ai-gateway/src/messages/prepare.rs

@@ -3,7 +3,7 @@ use litellm_core::CoreResult;
 use litellm_core::messages::transformation::MessagesAuthStrategy;
 use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};
 
-use super::common_utils::{has_header, messages_provider_config, string_headers};
+use super::common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers};
 use super::types::{MessagesRequest, ProviderMessagesRequest};
 
 pub(super) fn prepare_messages_call(
@@ -33,7 +33,9 @@ pub(super) fn prepare_messages_call(
     let mut headers = string_headers(request.extra_headers)?;
 
     let auth_strategy = config.auth_strategy();
-    if !has_header(&headers, auth_strategy.header_name()) {
+    let already_authorized = has_header(&headers, auth_strategy.header_name())
+        || (config.accepts_bearer_auth() && has_bearer_auth(&headers));
+    if !already_authorized {
         let api_key = config.resolve_api_key(request.api_key, &env_lookup)?;
         let auth_header = match auth_strategy {
             MessagesAuthStrategy::Bearer => {

litellm-rust/crates/ai-gateway/src/messages/tests.rs

@@ -6,7 +6,7 @@ use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 
 use super::common_utils::{
-    has_header, messages_provider_config, string_headers, truncate_error_body,
+    has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body,
 };
 use super::{MessagesRequest, messages};
 
@@ -85,6 +85,34 @@ fn has_header_is_case_insensitive() {
     assert!(!has_header(&headers, "authorization"));
 }
 
+#[test]
+fn has_bearer_auth_requires_a_nonempty_bearer_token() {
+    assert!(has_bearer_auth(&[(
+        "Authorization".to_string(),
+        "Bearer tok".to_string()
+    )]));
+    assert!(has_bearer_auth(&[(
+        "authorization".to_string(),
+        "bearer tok".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        "Bearer ".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        String::new()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        "Basic abc".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "x-api-key".to_string(),
+        "sk".to_string()
+    )]));
+}
+
 #[tokio::test]
 async fn messages_round_trip_builds_azure_request_and_passes_response_through() {
     let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
@@ -252,6 +280,112 @@ async fn messages_does_not_duplicate_auth_when_x_api_key_supplied() {
     assert!(!head.contains("rust-fallback-key"), "{head}");
 }
 
+#[tokio::test]
+async fn messages_forwards_entra_id_bearer_without_requiring_api_key() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
+    let addr = listener.local_addr().expect("addr");
+
+    let server = tokio::spawn(async move {
+        let (mut socket, _) = listener.accept().await.expect("accepts request");
+        let request = read_http_request(&mut socket).await;
+        let response_body =
+            r#"{"id":"msg_3","type":"message","role":"assistant","content":[],"model":"m"}"#;
+        socket
+            .write_all(write_response(response_body).as_bytes())
+            .await
+            .expect("writes response");
+        request
+    });
+
+    let mut headers = Map::new();
+    headers.insert(
+        "Authorization".to_string(),
+        Value::String("Bearer entra-token".to_string()),
+    );
+
+    messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: None,
+        api_base: Some(&format!("http://{addr}")),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: Some(headers),
+        timeout: Some(Duration::from_secs(5)),
+    })
+    .await
+    .expect("entra id request succeeds without api key");
+
+    let request = server.await.expect("server task completes");
+    let head = request
+        .split_once("\r\n\r\n")
+        .expect("has body")
+        .0
+        .to_ascii_lowercase();
+    assert!(head.contains("authorization: bearer entra-token"), "{head}");
+    assert!(!head.contains("x-api-key"), "{head}");
+}
+
+#[tokio::test]
+async fn messages_requires_auth_when_no_key_and_no_header() {
+    let err = messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: None,
+        api_base: Some("http://127.0.0.1:1"),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: None,
+        timeout: Some(Duration::from_millis(50)),
+    })
+    .await
+    .expect_err("missing auth errors");
+
+    assert!(matches!(err, CoreError::Auth(_)));
+}
+
+#[tokio::test]
+async fn messages_ignores_malformed_authorization_and_uses_api_key() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
+    let addr = listener.local_addr().expect("addr");
+
+    let server = tokio::spawn(async move {
+        let (mut socket, _) = listener.accept().await.expect("accepts request");
+        let request = read_http_request(&mut socket).await;
+        let response_body =
+            r#"{"id":"msg_4","type":"message","role":"assistant","content":[],"model":"m"}"#;
+        socket
+            .write_all(write_response(response_body).as_bytes())
+            .await
+            .expect("writes response");
+        request
+    });
+
+    let mut headers = Map::new();
+    headers.insert(
+        "Authorization".to_string(),
+        Value::String("Bearer ".to_string()),
+    );
+
+    messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: Some("sk-azure"),
+        api_base: Some(&format!("http://{addr}")),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: Some(headers),
+        timeout: Some(Duration::from_secs(5)),
+    })
+    .await
+    .expect("falls back to api key");
+
+    let request = server.await.expect("server task completes");
+    let head = request
+        .split_once("\r\n\r\n")
+        .expect("has body")
+        .0
+        .to_ascii_lowercase();
+    assert!(head.contains("x-api-key: sk-azure"), "{head}");
+}
+
 #[tokio::test]
 async fn messages_maps_provider_error_status_to_http_error() {
     let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");

litellm-rust/crates/core/src/messages/transformation.rs

@@ -35,6 +35,10 @@ pub trait AnthropicMessagesProviderConfig: Sync {
         MessagesAuthStrategy::Header("x-api-key")
     }
 
+    fn accepts_bearer_auth(&self) -> bool {
+        false
+    }
+
     fn default_headers(&self) -> &'static [(&'static str, &'static str)] {
         &[
             ("anthropic-version", "2023-06-01"),

litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs

@@ -163,6 +163,10 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
         self.anthropic.auth_strategy()
     }
 
+    fn accepts_bearer_auth(&self) -> bool {
+        true
+    }
+
     fn default_headers(&self) -> &'static [(&'static str, &'static str)] {
         self.anthropic.default_headers()
     }
@@ -294,6 +298,11 @@ mod tests {
         );
     }
 
+    #[test]
+    fn accepts_bearer_auth_for_entra_id() {
+        assert!(AZURE_ANTHROPIC_MESSAGES_CONFIG.accepts_bearer_auth());
+    }
+
     #[test]
     fn default_headers_match_python() {
         assert_eq!(

litellm/__init__.py

@@ -212,6 +212,9 @@ filter_invalid_headers: Optional[bool] = False
 add_user_information_to_llm_headers: Optional[bool] = (
     None  # adds user_id, team_id, token hash (params from StandardLoggingMetadata) to request headers
 )
+overwrite_user_with_key_hash: bool = (
+    False  # force the outgoing `user` param to the hashed api key, so providers see a stable, tamper-proof id
+)
 store_audit_logs = False  # Enterprise feature, allow users to see audit logs
 skip_system_message_in_guardrail: bool = False
 skip_tool_message_in_guardrail: bool = False
@@ -428,7 +431,9 @@ default_team_settings: Optional[List] = None
 max_user_budget: Optional[float] = None
 default_max_internal_user_budget: Optional[float] = None
 max_internal_user_budget: Optional[float] = None
-max_ui_session_budget: Optional[float] = 0.25  # $0.25 USD budgets for UI Chat sessions
+max_ui_session_budget: Optional[float] = (
+    1.0  # USD budget for each dashboard login session (playground, test connection)
+)
 internal_user_budget_duration: Optional[str] = None
 tag_budget_config: Optional[Dict[str, "BudgetConfig"]] = None
 max_end_user_budget: Optional[float] = None

litellm/constants.py

@@ -264,6 +264,9 @@ MAX_REDIS_BUFFER_DEQUEUE_COUNT = int(os.getenv("MAX_REDIS_BUFFER_DEQUEUE_COUNT",
 # Bounds asyncio.Queue() instances (log queues, spend update queues, etc.) to prevent unbounded memory growth
 LITELLM_ASYNCIO_QUEUE_MAXSIZE = int(os.getenv("LITELLM_ASYNCIO_QUEUE_MAXSIZE", 1000))
 TOOL_POLICY_CACHE_TTL_SECONDS = int(os.getenv("TOOL_POLICY_CACHE_TTL_SECONDS", 60))
+GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS = int(
+    os.getenv("GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS", 24 * 60 * 60)
+)
 # Aggregation threshold: default to 80% of the asyncio queue maxsize so the check can always trigger.
 # Must be < LITELLM_ASYNCIO_QUEUE_MAXSIZE; if set higher the aggregation logic will never fire.
 MAX_SIZE_IN_MEMORY_QUEUE = int(os.getenv("MAX_SIZE_IN_MEMORY_QUEUE", int(LITELLM_ASYNCIO_QUEUE_MAXSIZE * 0.8)))
@@ -1147,6 +1150,7 @@ BEDROCK_CONVERSE_MODELS = [
     "anthropic.claude-sonnet-4-5-20250929-v1:0",
     "anthropic.claude-fable-5",
     "anthropic.claude-sonnet-5",
+    "anthropic.claude-opus-5",
     "anthropic.claude-opus-4-8",
     "anthropic.claude-opus-4-7",
     "anthropic.claude-opus-4-6-v1:0",
@@ -1530,6 +1534,7 @@ LITELLM_SETTINGS_SAFE_DB_OVERRIDES = [
     # test_general_settings_ui_fields_are_db_overridable enforces that pairing.
     "enable_anthropic_prompt_caching",
     "anthropic_prompt_caching_ttl",
+    "max_ui_session_budget",
 ]
 SPECIAL_LITELLM_AUTH_TOKEN = ["ui-token"]
 DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL = int(os.getenv("DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL", 60))

litellm/cost_calculator.py

@@ -2191,6 +2191,13 @@ def batch_cost_calculator(
     return total_prompt_cost, total_completion_cost
 
 
+def _summable_prompt_token_fields(prompt_tokens_details: BaseModel) -> List[str]:
+    field_names = list(type(prompt_tokens_details).model_fields)
+    if getattr(prompt_tokens_details, "cache_write_tokens", None) is None:
+        return field_names
+    return [attr for attr in field_names if attr != "cache_creation_tokens"]
+
+
 class BaseTokenUsageProcessor:
     @staticmethod
     def combine_usage_objects(usage_objects: List[Usage]) -> Usage:
@@ -2225,7 +2232,7 @@ class BaseTokenUsageProcessor:
 
                 # Check what keys exist in the model's prompt_tokens_details
                 # Access model_fields on the class, not the instance, to avoid Pydantic 2.11+ deprecation warnings
-                for attr in type(usage.prompt_tokens_details).model_fields:
+                for attr in _summable_prompt_token_fields(usage.prompt_tokens_details):
                     if (
                         hasattr(usage.prompt_tokens_details, attr)
                         and not attr.startswith("_")

litellm/integrations/custom_guardrail.py

@@ -1,3 +1,5 @@
+import contextvars
+import hashlib
 import os
 import secrets
 from datetime import datetime
@@ -46,7 +48,10 @@ if TYPE_CHECKING:
 dc = DualCache()
 
 
-from litellm.constants import PRE_CALL_EXECUTED_GUARDRAILS_KEY
+from litellm.constants import (
+    GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS,
+    PRE_CALL_EXECUTED_GUARDRAILS_KEY,
+)
 from litellm.exceptions import (
     BlockedPiiEntityError,
     GuardrailRaisedException,
@@ -60,6 +65,10 @@ from litellm.exceptions import (
 # proxy's metadata sanitizer.
 _PRE_CALL_EXECUTED_TOKEN = secrets.token_hex(16)
 
+_guardrail_self_recorded: contextvars.ContextVar[bool] = contextvars.ContextVar(
+    "litellm_guardrail_self_recorded", default=False
+)
+
 
 def _strict_guardrail_modes_enabled() -> bool:
     """Whether guardrail-mode validation raises (default) or logs a warning.
@@ -113,6 +122,8 @@ class CustomGuardrail(CustomLogger):
         on_sensitive_data: Optional[str] = None,
         sensitive_data_route_to_model: Optional[str] = None,
         sticky_session_routing: bool = True,
+        run_in_parallel: bool = False,
+        only_scan_new_messages: bool = False,
         **kwargs,
     ):
         """
@@ -131,6 +142,9 @@ class CustomGuardrail(CustomLogger):
             on_sensitive_data: Action when sensitive data is detected. 'block' (default) or 'route'
             sensitive_data_route_to_model: Model to route to when on_sensitive_data='route'
             sticky_session_routing: When True, all subsequent requests in the session use the same model
+            run_in_parallel: When True, this pre_call or post_call guardrail runs concurrently with
+                other opted-in guardrails of the same hook. Only safe for block-only guardrails that
+                do not mutate the request or response.
         """
         self.guardrail_name = guardrail_name
         self.supported_event_hooks = supported_event_hooks
@@ -145,6 +159,8 @@ class CustomGuardrail(CustomLogger):
         self.on_sensitive_data: Optional[str] = on_sensitive_data
         self.sensitive_data_route_to_model: Optional[str] = sensitive_data_route_to_model
         self.sticky_session_routing: bool = sticky_session_routing
+        self.run_in_parallel: bool = run_in_parallel
+        self.only_scan_new_messages: bool = only_scan_new_messages
 
         if supported_event_hooks:
             ## validate event_hook is in supported_event_hooks
@@ -269,6 +285,100 @@ class CustomGuardrail(CustomLogger):
         """Extract session_id from request data."""
         return get_session_id_from_request_data(request_data)
 
+    @staticmethod
+    def _scanned_text_hash(text: str) -> str:
+        """Stable content hash for a single scannable text segment.
+
+        Hashing the exact text the provider would receive means an edited earlier
+        segment produces a different hash and gets re-scanned, while an unchanged
+        segment repeated on a later turn is skipped.
+        """
+        return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+    def _scanned_texts_cache_key(self, session_id: str) -> str:
+        return f"guardrail_scanned_texts:{self.guardrail_name}:{session_id}"
+
+    async def filter_new_texts_for_session(
+        self,
+        texts: list[str] | None,
+        request_data: dict[str, object],
+        cache: DualCache,
+    ) -> list[str] | None:
+        """Return only the text segments not already scanned earlier in this session.
+
+        Returns ``None`` when incremental scanning is inactive (feature off, no
+        session id, masking enabled, or the cache read failed). ``None`` signals
+        the caller to fall back to a full scan; a returned list (possibly empty)
+        signals the caller to scan only that subset and skip masking write-back.
+        """
+        if not self.only_scan_new_messages or not texts:
+            return None
+
+        if self.mask_request_content or self.mask_response_content:
+            verbose_logger.warning(
+                "Guardrail %s: only_scan_new_messages is not supported with masking; scanning full context.",
+                self.guardrail_name,
+            )
+            return None
+
+        session_id = get_session_id_from_request_data(request_data)
+        if not session_id:
+            verbose_logger.debug(
+                "Guardrail %s: only_scan_new_messages enabled but request has no session id; scanning full context.",
+                self.guardrail_name,
+            )
+            return None
+
+        try:
+            cached: object = await cache.async_get_cache(key=self._scanned_texts_cache_key(session_id))
+        except Exception as e:  # noqa: BLE001  # cache is best-effort; any failure must fall back to a full scan
+            verbose_logger.warning(
+                "Guardrail %s: failed to read scanned-message cache (%s); scanning full context.",
+                self.guardrail_name,
+                e,
+            )
+            return None
+
+        seen: set[str] = {str(h) for h in cached} if isinstance(cached, list) else set()
+        return [text for text in texts if self._scanned_text_hash(text) not in seen]
+
+    async def mark_texts_scanned(
+        self,
+        texts: list[str] | None,
+        request_data: dict[str, object],
+        cache: DualCache,
+    ) -> None:
+        """Record the hashes of all text segments present on a successful (non-blocked) scan.
+
+        Called only after the guardrail allows the request, so a blocked segment is
+        never marked scanned and will be re-checked if the client retries.
+        """
+        if not self.only_scan_new_messages or not texts:
+            return
+        if self.mask_request_content or self.mask_response_content:
+            return
+        session_id = get_session_id_from_request_data(request_data)
+        if not session_id:
+            return
+
+        cache_key = self._scanned_texts_cache_key(session_id)
+        current_hashes = [self._scanned_text_hash(text) for text in texts]
+        try:
+            existing: object = await cache.async_get_cache(key=cache_key)
+            existing_hashes: list[str] = [str(h) for h in existing] if isinstance(existing, list) else []
+            merged: list[str] = list(dict.fromkeys(existing_hashes + current_hashes))
+            await cache.async_set_cache(
+                key=cache_key,
+                value=merged,
+                ttl=GUARDRAIL_SCANNED_MESSAGES_CACHE_TTL_SECONDS,
+            )
+        except Exception as e:  # noqa: BLE001  # cache is best-effort; any failure must not block the request
+            verbose_logger.warning(
+                "Guardrail %s: failed to persist scanned-message cache (%s); next call will re-scan.",
+                self.guardrail_name,
+                e,
+            )
+
     def should_route_on_sensitive_data(self) -> bool:
         """
         Returns True if this guardrail is configured to route requests
@@ -856,6 +966,8 @@ class CustomGuardrail(CustomLogger):
             request_data["metadata"] = {}
             _append_guardrail_info(request_data["metadata"])
 
+        _guardrail_self_recorded.set(True)
+
         # Emit the otel guardrail span here, where every guardrail execution lands,
         # rather than relying on a post-call hook that does not fire on every path
         # (e.g. a pass-through request that passes its guardrails).
@@ -1138,8 +1250,12 @@ def log_guardrail_information(func):
     (structured detections, tracing detail) than this decorator's
     "allow"/"mask"/raw-response default. To avoid double-recording in that
     case (which would emit two spans, two Datadog records, two spend-log
-    entries, etc.), snapshot the entry count before invocation: if the
-    wrapped function already appended its own entry, skip the auto-record.
+    entries, etc.), a context-local flag records whether the wrapped function
+    appended its own entry; if so, the auto-record is skipped. The flag is a
+    ``ContextVar`` rather than a count of entries in the shared ``request_data``
+    so it stays correct when guardrails run concurrently (asyncio copies the
+    context into each gathered task): counting shared entries would let one
+    guardrail's append hide another guardrail's missing record.
     """
     import functools
     import inspect
@@ -1159,16 +1275,6 @@ def log_guardrail_information(func):
             return GuardrailEventHooks.post_call
         return None
 
-    def _count_recorded_guardrail_entries(request_data: dict) -> int:
-        total = 0
-        for container_key in ("metadata", "litellm_metadata"):
-            container = request_data.get(container_key)
-            if isinstance(container, dict):
-                entries = container.get("standard_logging_guardrail_information")
-                if isinstance(entries, list):
-                    total += len(entries)
-        return total
-
     @functools.wraps(func)
     async def async_wrapper(*args, **kwargs):
         start_time = datetime.now()  # Move start_time inside the wrapper
@@ -1182,10 +1288,10 @@ def log_guardrail_information(func):
             original_inputs = kwargs.get("inputs")
 
         logging_obj = kwargs.get("logging_obj")
-        entries_before = _count_recorded_guardrail_entries(request_data)
+        self_recorded_token = _guardrail_self_recorded.set(False)
         try:
             response = await func(*args, **kwargs)
-            if _count_recorded_guardrail_entries(request_data) > entries_before:
+            if _guardrail_self_recorded.get():
                 return response
             return self._process_response(
                 response=response,
@@ -1197,7 +1303,7 @@ def log_guardrail_information(func):
                 original_inputs=original_inputs,
             )
         except Exception as e:
-            if _count_recorded_guardrail_entries(request_data) > entries_before:
+            if _guardrail_self_recorded.get():
                 raise
             return self._process_error(
                 e=e,
@@ -1208,6 +1314,7 @@ def log_guardrail_information(func):
                 event_type=event_type,
             )
         finally:
+            _guardrail_self_recorded.reset(self_recorded_token)
             _sync_guardrail_info_to_logging_obj(request_data, logging_obj)
 
     @functools.wraps(func)
@@ -1223,10 +1330,10 @@ def log_guardrail_information(func):
             original_inputs = kwargs.get("inputs")
 
         logging_obj = kwargs.get("logging_obj")
-        entries_before = _count_recorded_guardrail_entries(request_data)
+        self_recorded_token = _guardrail_self_recorded.set(False)
         try:
             response = func(*args, **kwargs)
-            if _count_recorded_guardrail_entries(request_data) > entries_before:
+            if _guardrail_self_recorded.get():
                 return response
             return self._process_response(
                 response=response,
@@ -1236,7 +1343,7 @@ def log_guardrail_information(func):
                 original_inputs=original_inputs,
             )
         except Exception as e:
-            if _count_recorded_guardrail_entries(request_data) > entries_before:
+            if _guardrail_self_recorded.get():
                 raise
             return self._process_error(
                 e=e,
@@ -1245,6 +1352,7 @@ def log_guardrail_information(func):
                 event_type=event_type,
             )
         finally:
+            _guardrail_self_recorded.reset(self_recorded_token)
             _sync_guardrail_info_to_logging_obj(request_data, logging_obj)
 
     @functools.wraps(func)

litellm/litellm_core_utils/duration_parser.py

@@ -9,9 +9,22 @@ duration_in_seconds is used in diff parts of the code base, example
 import re
 import time as time_module
 from datetime import datetime, time, timedelta, timezone, tzinfo
-from typing import Optional, Tuple
+from typing import Final, Optional, Tuple
 from zoneinfo import ZoneInfo
 
+from litellm._logging import verbose_logger
+
+_BUDGET_DURATION_WORD_ALIASES: Final[dict[str, str]] = {
+    "hourly": "1h",
+    "daily": "24h",
+    "weekly": "7d",
+    "monthly": "30d",
+}
+
+
+def _normalize_duration(duration: str) -> str:
+    return _BUDGET_DURATION_WORD_ALIASES.get(duration.strip().lower(), duration)
+
 
 def _extract_from_regex(duration: str) -> Tuple[int, str]:
     match = re.match(r"(\d+)(mo|[smhdw]?)", duration)
@@ -48,7 +61,7 @@ def duration_in_seconds(duration: str) -> int:
 
     Returns time in seconds till when budget needs to be reset
     """
-    value, unit = _extract_from_regex(duration=duration)
+    value, unit = _extract_from_regex(duration=_normalize_duration(duration))
 
     if unit == "s":
         return value
@@ -124,9 +137,13 @@ def get_next_standardized_reset_time(
     current_time, _ = _setup_timezone(current_time, timezone_str)
 
     # Parse duration
-    value, unit = _parse_duration(duration)
+    value, unit = _parse_duration(_normalize_duration(duration))
     if value is None:
-        # Fall back to default if format is invalid
+        verbose_logger.warning(
+            "Unrecognized budget_duration %r; falling back to a next-midnight reset. "
+            "Use the <int><unit> format (e.g. '1h', '7d', '30d', '1mo').",
+            duration,
+        )
         return current_time.replace(hour=0, minute=0, second=0, microsecond=0) + timedelta(days=1)
 
     # Midnight of the current day in the specified timezone

litellm/litellm_core_utils/litellm_logging.py

@@ -1612,6 +1612,35 @@ class Logging(LiteLLMLoggingBaseClass):
             **kwargs,
         )
 
+    async def dispatch_failure_handlers(
+        self,
+        exception: Exception,
+        traceback_exception: str,
+        prefer_async_handlers: bool = False,
+    ) -> None:
+        """Route failure logging to async and/or sync handlers for this request.
+
+        Mirrors ``dispatch_success_handlers``: the sync ``failure_handler`` never runs
+        concurrently with ``async_failure_handler`` on the shared logging object, so the
+        two paths cannot mutate it at the same time. ``prefer_async_handlers`` only
+        bypasses the sync-SDK-only shortcut (e.g. ``async for`` on a stream from
+        ``completion()``); legacy string callbacks still run via
+        ``executor.submit(failure_handler)`` when configured.
+        """
+        litellm_params = self.model_call_details.get("litellm_params", {}) or {}
+        sync_sdk = self._is_sync_litellm_request(litellm_params)
+        passthrough = self.call_type == CallTypes.pass_through.value
+        if sync_sdk and not prefer_async_handlers and not passthrough:
+            self.failure_handler(exception, traceback_exception)
+            return
+
+        await self.async_failure_handler(exception, traceback_exception)
+
+        if not self._should_run_sync_failure_callbacks_for_async_calls():
+            return
+
+        executor.submit(self.failure_handler, exception, traceback_exception)
+
     def should_run_logging(
         self,
         event_type: Literal["async_success", "sync_success", "async_failure", "sync_failure"],
@@ -3076,6 +3105,24 @@ class Logging(LiteLLMLoggingBaseClass):
         _filtered_success_callbacks = self._remove_internal_litellm_callbacks(_filtered_success_callbacks)
         return len(_filtered_success_callbacks) > 0
 
+    def _should_run_sync_failure_callbacks_for_async_calls(self) -> bool:
+        """
+        Returns:
+            - bool: True if sync failure callbacks should be run for async calls. eg. `langfuse`, `s3`
+
+        Mirrors ``_should_run_sync_callbacks_for_async_calls`` but reads the failure
+        callback lists. Gating the legacy sync ``failure_handler`` on the success lists
+        would drop sync failure callbacks for any caller that configures only failure
+        callbacks, so streaming errors would be logged nowhere.
+        """
+        _combined_sync_callbacks = self.get_combined_callback_list(
+            dynamic_success_callbacks=self.dynamic_failure_callbacks,
+            global_callbacks=litellm.failure_callback,
+        )
+        _filtered_failure_callbacks = self._remove_internal_custom_logger_callbacks(_combined_sync_callbacks)
+        _filtered_failure_callbacks = self._remove_internal_litellm_callbacks(_filtered_failure_callbacks)
+        return len(_filtered_failure_callbacks) > 0
+
     def get_combined_callback_list(self, dynamic_success_callbacks: Optional[List], global_callbacks: List) -> List:
         if dynamic_success_callbacks is None:
             return list(global_callbacks)

litellm/litellm_core_utils/llm_cost_calc/utils.py

@@ -457,7 +457,8 @@ def _parse_prompt_tokens_details(usage: Usage) -> PromptTokensDetailsResult:
     cache_creation_tokens = (
         cast(
             Optional[int],
-            getattr(usage.prompt_tokens_details, "cache_creation_tokens", 0),
+            getattr(usage.prompt_tokens_details, "cache_write_tokens", 0)
+            or getattr(usage.prompt_tokens_details, "cache_creation_tokens", 0),
         )
         or 0
     )
@@ -906,10 +907,6 @@ def get_token_type_cost_breakdown(
         cache_read_tokens = prompt_tokens_details["cache_hit_tokens"]
         cache_creation_tokens = prompt_tokens_details["cache_creation_tokens"]
         cache_creation_token_details = prompt_tokens_details["cache_creation_token_details"]
-        # Some OpenAI-compatible providers (e.g. kimi-k2) report cache-write tokens
-        # under `cache_write_tokens`; mirror the total-cost normalization path.
-        if not cache_creation_tokens:
-            cache_creation_tokens = _coerce_token_count(getattr(usage.prompt_tokens_details, "cache_write_tokens", 0))
     # Fall back to the private top-level counters the Usage constructor mirrors cache
     # tokens onto, so providers/callers that bypass prompt_tokens_details are covered.
     if not cache_read_tokens:

litellm/litellm_core_utils/streaming_handler.py

@@ -2008,12 +2008,9 @@ class CustomStreamWrapper:
             if self.logging_obj is not None:
                 self._record_partial_usage_for_failure()
                 ## LOGGING
-                threading.Thread(
-                    target=self.logging_obj.failure_handler,
-                    args=(e, traceback_exception),
-                ).start()  # log response
-                # Handle any exceptions that might occur during streaming
-                asyncio.create_task(self.logging_obj.async_failure_handler(e, traceback_exception))
+                asyncio.create_task(
+                    self.logging_obj.dispatch_failure_handlers(e, traceback_exception, prefer_async_handlers=True)
+                )
             self._handle_stream_fallback_error(e)
         except (httpx.ReadError, httpx.RemoteProtocolError) as e:
             if self.received_finish_reason is None:
@@ -2122,13 +2119,8 @@ class CustomStreamWrapper:
         if self.logging_obj is not None:
             self._record_partial_usage_for_failure()
             ## LOGGING
-            threading.Thread(
-                target=self.logging_obj.failure_handler,
-                args=(e, traceback_exception),
-            ).start()  # log response
-            # Handle any exceptions that might occur during streaming
             asyncio.create_task(
-                self.logging_obj.async_failure_handler(e, traceback_exception)  # type: ignore
+                self.logging_obj.dispatch_failure_handlers(e, traceback_exception, prefer_async_handlers=True)
             )
         self._handle_stream_fallback_error(e)
 

litellm/litellm_core_utils/url_utils.py

@@ -148,6 +148,15 @@ def _parse_url_destination_allowlist_entry(
     return _normalize_host(parsed.hostname), scheme, port
 
 
+def provider_url_destination_candidates(value: str) -> Tuple[str, ...]:
+    return tuple(
+        candidate
+        for part in value.split(",")
+        for candidate in (part.strip(), part.strip().split("/", 1)[1] if "/" in part.strip() else "")
+        if candidate
+    )
+
+
 def is_url_destination_allowed_by_host(url: str, allowed_hosts: List[str]) -> bool:
     """Return True when a credential-bearing provider URL is admin-allowlisted.
 

litellm/llms/anthropic/chat/transformation.py

@@ -480,10 +480,21 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig):
         """
         Filter out unsupported fields from JSON schema for Anthropic's output_format API.
 
-        Anthropic's output_format doesn't support certain JSON schema properties:
-        - maxItems/minItems: Not supported for array types
-        - minimum/maximum: Not supported for numeric types
-        - minLength/maxLength: Not supported for string types
+        Anthropic's output_format doesn't support certain JSON schema properties.
+        These are constraints that cannot be enforced by the constrained-decoding
+        grammar Anthropic compiles the schema into, so the API rejects them with a
+        400 ``invalid_request_error`` (e.g. "output_format.schema: For 'array' type,
+        property 'uniqueItems' is not supported"):
+        - maxItems/minItems/uniqueItems/contains/minContains/maxContains/prefixItems: array constraints
+        - minimum/maximum/exclusiveMinimum/exclusiveMaximum/multipleOf: numeric constraints
+        - minLength/maxLength: string constraints
+        - minProperties/maxProperties/patternProperties/propertyNames: object constraints
+        - dependentRequired/dependentSchemas/unevaluatedProperties: object constraints
+        - if/then/else/not: conditional and negation keywords
+
+        ``oneOf`` is also rejected ("Schema type 'oneOf' is not supported") and is
+        rewritten to ``anyOf``, matching the Anthropic SDK. Unknown keywords are
+        ignored by the API, so anything not listed here passes through untouched.
 
         This mirrors the transformation done by the Anthropic Python SDK.
         See: https://platform.claude.com/docs/en/build-with-claude/structured-outputs#how-sdk-transformation-works
@@ -504,33 +515,53 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig):
         if not isinstance(schema, dict):
             return schema
 
-        # All numeric/string/array constraints not supported by Anthropic
-        unsupported_fields = {
-            "maxItems",
-            "minItems",  # array constraints
-            "minimum",
-            "maximum",  # numeric constraints
-            "exclusiveMinimum",
-            "exclusiveMaximum",  # numeric constraints
-            "minLength",
-            "maxLength",  # string constraints
-        }
-
-        # Build description additions from removed constraints
-        constraint_descriptions: list = []
         constraint_labels = {
             "minItems": "minimum number of items: {}",
             "maxItems": "maximum number of items: {}",
+            "uniqueItems": "all array items must be unique",
+            "contains": "array must contain an item matching: {}",
+            "minContains": "minimum number of matching items: {}",
+            "maxContains": "maximum number of matching items: {}",
+            "prefixItems": "leading items must match, in order: {}",
             "minimum": "minimum value: {}",
             "maximum": "maximum value: {}",
             "exclusiveMinimum": "exclusive minimum value: {}",
             "exclusiveMaximum": "exclusive maximum value: {}",
+            "multipleOf": "must be a multiple of {}",
             "minLength": "minimum length: {}",
             "maxLength": "maximum length: {}",
+            "minProperties": "minimum number of properties: {}",
+            "maxProperties": "maximum number of properties: {}",
+            "patternProperties": "properties whose names match each pattern must satisfy: {}",
+            "propertyNames": "property names must satisfy: {}",
+            "dependentRequired": "dependent required properties: {}",
+            "dependentSchemas": "dependent schemas: {}",
+            "unevaluatedProperties": "unevaluated properties must satisfy: {}",
+            "if": "conditional (if): {}",
+            "then": "conditional (then): {}",
+            "else": "conditional (else): {}",
+            "not": "must not match: {}",
         }
-        for field in unsupported_fields:
-            if field in schema:
-                constraint_descriptions.append(constraint_labels[field].format(schema[field]))
+        unsupported_fields = set(constraint_labels)
+
+        # Build description additions from removed constraints. Iterating
+        # constraint_labels (not the set) keeps the note order deterministic across
+        # processes, so identical requests serialize identically regardless of
+        # PYTHONHASHSEED and stay cache-friendly.
+        constraint_descriptions: list = []
+        for field, label in constraint_labels.items():
+            if field not in schema:
+                continue
+            value = schema[field]
+            # A falsy boolean constraint (e.g. ``uniqueItems: false``) imposes no
+            # real requirement, so don't add a misleading advisory note for it.
+            if isinstance(value, bool) and not value:
+                continue
+            # Sub-schema constraints (e.g. ``contains``) are serialized as JSON so
+            # the advisory note preserves what the constraint actually required,
+            # instead of just noting that it existed.
+            note_value = json.dumps(value) if isinstance(value, (dict, list)) else value
+            constraint_descriptions.append(label.format(note_value))
 
         result: Dict[str, Any] = {}
 
@@ -557,11 +588,17 @@ class AnthropicConfig(AnthropicModelInfo, BaseConfig):
             elif key == "$defs" and isinstance(value, dict):
                 result[key] = {k: AnthropicConfig.filter_anthropic_output_schema(v) for k, v in value.items()}
             elif key == "anyOf" and isinstance(value, list):
-                result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value]
+                result["anyOf"] = result.get("anyOf", []) + [
+                    AnthropicConfig.filter_anthropic_output_schema(item) for item in value
+                ]
             elif key == "allOf" and isinstance(value, list):
                 result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value]
             elif key == "oneOf" and isinstance(value, list):
-                result[key] = [AnthropicConfig.filter_anthropic_output_schema(item) for item in value]
+                # Anthropic rejects oneOf ("Schema type 'oneOf' is not supported");
+                # the Anthropic SDK rewrites it to anyOf, so do the same.
+                result["anyOf"] = result.get("anyOf", []) + [
+                    AnthropicConfig.filter_anthropic_output_schema(item) for item in value
+                ]
             else:
                 result[key] = value
 

litellm/llms/bedrock/chat/converse_transformation.py

@@ -895,9 +895,8 @@ class AmazonConverseConfig(BaseConfig):
                 if _tool_choice_value is not None:
                     optional_params["tool_choice"] = _tool_choice_value
             if param == "parallel_tool_calls":
-                disable_parallel = not value
                 optional_params["_parallel_tool_use_config"] = {
-                    "tool_choice": {"disable_parallel_tool_use": disable_parallel}
+                    "tool_choice": {"type": "auto", "disable_parallel_tool_use": not value}
                 }
             if param == "thinking":
                 if (
@@ -1208,6 +1207,22 @@ class AmazonConverseConfig(BaseConfig):
 
         return {}
 
+    @staticmethod
+    def _merge_parallel_tool_use_config(additional_request_params: dict, parallel_tool_use_config: dict) -> dict:
+        merged_entries = {
+            key: (
+                {
+                    **value,
+                    **additional_request_params[key],
+                    **{k: v for k, v in value.items() if k != "type"},
+                }
+                if isinstance(additional_request_params.get(key), dict) and isinstance(value, dict)
+                else value
+            )
+            for key, value in parallel_tool_use_config.items()
+        }
+        return {**additional_request_params, **merged_entries}
+
     def _prepare_request_params(
         self, optional_params: dict, model: str, drop_params: bool = False
     ) -> Tuple[dict, dict, dict, Optional[OutputConfigBlock]]:
@@ -1276,15 +1291,9 @@ class AmazonConverseConfig(BaseConfig):
         # Handle parallel_tool_calls configuration
         parallel_tool_use_config = additional_request_params.pop("_parallel_tool_use_config", None)
         if parallel_tool_use_config is not None and bedrock_converse_supports_parallel_tool_use_config(model):
-            for key, value in parallel_tool_use_config.items():
-                if (
-                    key in additional_request_params
-                    and isinstance(additional_request_params[key], dict)
-                    and isinstance(value, dict)
-                ):
-                    additional_request_params[key].update(value)
-                else:
-                    additional_request_params[key] = value
+            additional_request_params = self._merge_parallel_tool_use_config(
+                additional_request_params, parallel_tool_use_config
+            )
 
         additional_request_params.pop("parallel_tool_calls", None)
 

litellm/llms/bedrock/realtime/handler.py

@@ -9,6 +9,8 @@ import contextlib
 import json
 from typing import Any, Optional
 
+from pydantic import TypeAdapter
+
 from litellm._logging import _redact_string, verbose_proxy_logger
 from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLogging
 
@@ -16,6 +18,8 @@ from ..base_aws_llm import BaseAWSLLM
 from ..common_utils import BedrockError
 from .transformation import BedrockRealtimeConfig
 
+_CLIENT_MODALITIES_ADAPTER: TypeAdapter["list[str] | None"] = TypeAdapter(list[str] | None)
+
 
 class BedrockRealtime(BaseAWSLLM):
     """Handler for Bedrock Nova Sonic realtime speech-to-speech API."""
@@ -124,6 +128,9 @@ class BedrockRealtime(BaseAWSLLM):
 
             verbose_proxy_logger.debug("Bedrock Realtime: Bidirectional stream established")
 
+            await websocket.send_text(json.dumps(transformation_config.session_created_event(model, logging_obj)))
+            verbose_proxy_logger.debug("Bedrock Realtime: sent session.created to client on connect")
+
             # Track state for transformation
             session_state = {
                 "current_output_item_id": None,
@@ -143,6 +150,7 @@ class BedrockRealtime(BaseAWSLLM):
                     transformation_config,
                     model,
                     session_state,
+                    logging_obj,
                 )
             )
 
@@ -179,6 +187,7 @@ class BedrockRealtime(BaseAWSLLM):
         transformation_config: BedrockRealtimeConfig,
         model: str,
         session_state: dict,
+        logging_obj: LiteLLMLogging | None = None,
     ):
         """Forward messages from client WebSocket to Bedrock stream."""
         from aws_sdk_bedrock_runtime.models import (
@@ -210,6 +219,23 @@ class BedrockRealtime(BaseAWSLLM):
                 for bedrock_message in transformed_messages:
                     await send_to_bedrock(bedrock_message)
 
+                if logging_obj is not None:
+                    client_message_type: str | None = None
+                    requested_modalities: list[str] | None = None
+                    with contextlib.suppress(Exception):
+                        parsed_client_message = json.loads(message)
+                        client_message_type = parsed_client_message.get("type")
+                        if client_message_type == "session.update":
+                            requested_modalities = _CLIENT_MODALITIES_ADAPTER.validate_python(
+                                parsed_client_message.get("session", {}).get("modalities")
+                            )
+                    if client_message_type == "session.update":
+                        await client_ws.send_text(
+                            json.dumps(
+                                transformation_config.session_updated_event(model, logging_obj, requested_modalities)
+                            )
+                        )
+
         except Exception as e:
             verbose_proxy_logger.debug(f"Client to Bedrock forwarding ended: {e}", exc_info=True)
             for close_message in transformation_config.session_close_messages():

litellm/llms/bedrock/realtime/transformation.py

@@ -623,35 +623,42 @@ class BedrockRealtimeConfig(BaseRealtimeConfig):
             verbose_logger.warning(f"Unknown message type: {message_type}")
             return []
 
-    def transform_session_start_event(
+    def _session_object(
         self,
-        event: dict,
         model: str,
         logging_obj: LiteLLMLoggingObj,
-    ) -> OpenAIRealtimeStreamSessionEvents:
-        """
-        Transform Bedrock sessionStart event to OpenAI session.created.
-
-        Args:
-            event: Bedrock sessionStart event
-            model: Model ID
-            logging_obj: Logging object
-
-        Returns:
-            OpenAI session.created event
-        """
-        verbose_logger.debug("Handling sessionStart")
-
+        modalities: list[str] | None = None,
+    ) -> OpenAIRealtimeStreamSession:
         session = OpenAIRealtimeStreamSession(
             id=logging_obj.litellm_trace_id,
-            modalities=["text", "audio"],
+            modalities=modalities if modalities is not None else ["text", "audio"],
         )
         if model is not None and isinstance(model, str):
             session["model"] = model
+        return session
 
+    def session_created_event(
+        self,
+        model: str,
+        logging_obj: LiteLLMLoggingObj,
+    ) -> OpenAIRealtimeStreamSessionEvents:
+        """Build the OpenAI session.created event for this realtime session."""
         return OpenAIRealtimeStreamSessionEvents(
             type="session.created",
-            session=session,
+            session=self._session_object(model, logging_obj),
+            event_id=str(uuid.uuid4()),
+        )
+
+    def session_updated_event(
+        self,
+        model: str,
+        logging_obj: LiteLLMLoggingObj,
+        modalities: list[str] | None = None,
+    ) -> OpenAIRealtimeStreamSessionEvents:
+        """Build the OpenAI session.updated ack reflecting the client's requested modalities."""
+        return OpenAIRealtimeStreamSessionEvents(
+            type="session.updated",
+            session=self._session_object(model, logging_obj, modalities),
             event_id=str(uuid.uuid4()),
         )
 
@@ -1169,8 +1176,6 @@ class BedrockRealtimeConfig(BaseRealtimeConfig):
 
         # Route to appropriate transformation method
         if "sessionStart" in event:
-            session_created = self.transform_session_start_event(event, model, logging_obj)
-            returned_messages.append(session_created)
             session_configuration_request = json.dumps({"configured": True})
 
         elif "contentStart" in event:

litellm/llms/custom_httpx/llm_http_handler.py

@@ -2107,8 +2107,7 @@ class BaseLLMHTTPHandler:
         rust_messages_response = await self._maybe_rust_anthropic_messages(
             custom_llm_provider=custom_llm_provider,
             litellm_params=litellm_params,
-            stream=stream or False,
-            rust_stream_eligible=bool(stream) and not self._has_agentic_completion_hook(logging_obj),
+            has_agentic_hook=self._has_agentic_completion_hook(logging_obj),
             model=model,
             api_key=api_key,
             api_base=api_base,
@@ -2266,8 +2265,7 @@ class BaseLLMHTTPHandler:
         *,
         custom_llm_provider: str,
         litellm_params: GenericLiteLLMParams,
-        stream: bool,
-        rust_stream_eligible: bool,
+        has_agentic_hook: bool,
         model: str,
         api_key: str | None,
         api_base: str | None,
@@ -2279,7 +2277,7 @@ class BaseLLMHTTPHandler:
             return None
         if litellm_params.get("rust") is not True and not BaseLLMHTTPHandler._rust_env_enabled():
             return None
-        if stream and not rust_stream_eligible:
+        if has_agentic_hook:
             return None
 
         from litellm.rust_bridge import messages as rust_messages_bridge

litellm/llms/huggingface/embedding/handler.py

@@ -322,7 +322,7 @@ class HuggingFaceEmbedding(BaseLLM):
         task = get_hf_task_embedding_for_model(model=model, task_type=task_type, api_base=HF_HUB_URL)
         # print_verbose(f"{model}, {task}")
         embed_url = ""
-        if "https" in model:
+        if model.startswith(("http://", "https://")):
             embed_url = model
         elif api_base:
             embed_url = api_base

litellm/llms/huggingface/embedding/transformation.py

@@ -316,25 +316,6 @@ class HuggingFaceEmbeddingConfig(BaseConfig):
 
         return data
 
-    def get_api_base(self, api_base: Optional[str], model: str) -> str:
-        """
-        Get the API base for the Huggingface API.
-
-        Do not add the chat/embedding/rerank extension here. Let the handler do this.
-        """
-        if "https" in model:
-            completion_url = model
-        elif api_base is not None:
-            completion_url = api_base
-        elif "HF_API_BASE" in os.environ:
-            completion_url = os.getenv("HF_API_BASE", "")
-        elif "HUGGINGFACE_API_BASE" in os.environ:
-            completion_url = os.getenv("HUGGINGFACE_API_BASE", "")
-        else:
-            completion_url = f"https://api-inference.huggingface.co/models/{model}"
-
-        return completion_url
-
     def validate_environment(
         self,
         headers: Dict,

litellm/llms/oobabooga/chat/oobabooga.py

@@ -34,7 +34,7 @@ def completion(
         optional_params=optional_params,
         litellm_params=litellm_params,
     )
-    if "https" in model:
+    if model.startswith(("http://", "https://")):
         completion_url = model
     elif api_base:
         completion_url = api_base
@@ -96,7 +96,7 @@ def embedding(
     encoding=None,
 ):
     # Create completion URL
-    if "https" in model:
+    if model.startswith(("http://", "https://")):
         embeddings_url = model
     elif api_base:
         embeddings_url = f"{api_base}/v1/embeddings"

litellm/llms/sagemaker/chat/transformation.py

@@ -143,7 +143,7 @@ class SagemakerChatConfig(OpenAIGPTConfig, BaseAWSLLM):
             raise SagemakerError(status_code=response.status_code, message=response.text)
 
         custom_stream_decoder = AWSEventStreamDecoder(model="", is_messages_api=True)
-        completion_stream = custom_stream_decoder.iter_bytes(response.iter_bytes(chunk_size=1024))
+        completion_stream = custom_stream_decoder.iter_bytes(response.iter_bytes())
 
         streaming_response = CustomStreamWrapper(
             completion_stream=completion_stream,
@@ -189,7 +189,7 @@ class SagemakerChatConfig(OpenAIGPTConfig, BaseAWSLLM):
             raise SagemakerError(status_code=response.status_code, message=response.text)
 
         custom_stream_decoder = AWSEventStreamDecoder(model="", is_messages_api=True)
-        completion_stream = custom_stream_decoder.aiter_bytes(response.aiter_bytes(chunk_size=1024))
+        completion_stream = custom_stream_decoder.aiter_bytes(response.aiter_bytes())
 
         streaming_response = CustomStreamWrapper(
             completion_stream=completion_stream,

litellm/llms/sagemaker/completion/handler.py

@@ -200,23 +200,12 @@ class SagemakerLLM(BaseAWSLLM):
                     # Add model_id as InferenceComponentName header
                     # boto3 doc: https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_InvokeEndpoint.html
                     prepared_request.headers.update({"X-Amzn-SageMaker-Inference-Component": model_id})
-                sync_handler = _get_httpx_client()
-                sync_response = sync_handler.post(
-                    url=prepared_request.url,
+                completion_stream = self.make_sync_call(
+                    api_base=prepared_request.url,
                     headers=prepared_request.headers,  # type: ignore
-                    data=prepared_request.body,
-                    stream=stream,
+                    data=cast(str, prepared_request.body),  # cast-ok: signed body is a JSON str, mirrors async path
+                    logging_obj=logging_obj,
                 )
-
-                if sync_response.status_code != 200:
-                    raise SagemakerError(
-                        status_code=sync_response.status_code,
-                        message=str(sync_response.read()),
-                    )
-
-                decoder = AWSEventStreamDecoder(model="")
-
-                completion_stream = decoder.iter_bytes(sync_response.iter_bytes(chunk_size=1024))
                 streaming_response = CustomStreamWrapper(
                     completion_stream=completion_stream,
                     model=model,
@@ -334,6 +323,29 @@ class SagemakerLLM(BaseAWSLLM):
             litellm_params=litellm_params,
         )
 
+    def make_sync_call(
+        self,
+        api_base: str,
+        headers: dict,
+        data: str,
+        logging_obj,
+        client=None,
+    ):
+        if client is None:
+            client = _get_httpx_client()
+        sync_response = client.post(
+            api_base,
+            headers=headers,
+            data=data,
+            stream=True,
+        )
+
+        if sync_response.status_code != 200:
+            raise SagemakerError(status_code=sync_response.status_code, message=str(sync_response.read()))
+
+        decoder = AWSEventStreamDecoder(model="")
+        return decoder.iter_bytes(sync_response.iter_bytes())
+
     async def make_async_call(
         self,
         api_base: str,
@@ -358,7 +370,7 @@ class SagemakerLLM(BaseAWSLLM):
                 raise SagemakerError(status_code=response.status_code, message=response.text)
 
             decoder = AWSEventStreamDecoder(model="")
-            completion_stream = decoder.aiter_bytes(response.aiter_bytes(chunk_size=1024))
+            completion_stream = decoder.aiter_bytes(response.aiter_bytes())
 
             return completion_stream
 

litellm/llms/vertex_ai/gemini/vertex_and_google_ai_studio_gemini.py

@@ -3333,27 +3333,37 @@ class ModelResponseIterator:
 
         return self.chunk_parser(chunk=json_chunk)
 
-    def handle_accumulated_json_chunk(self, chunk: str) -> Optional["ModelResponseStream"]:
-        chunk = litellm.CustomStreamWrapper._strip_sse_data_from_chunk(chunk) or ""
-        message = chunk.replace("\n\n", "")
+    def handle_accumulated_json_chunk(self, chunk: str, is_final: bool = False) -> Optional["ModelResponseStream"]:
+        message = litellm.CustomStreamWrapper._strip_sse_data_from_chunk(chunk) or ""
+        self.accumulated_json = (self.accumulated_json + message.replace("\n\n", "")).strip()
 
-        self.accumulated_json += message
-
-        # json.loads on the whole buffer after every fragment is O(n^2) and
-        # holds the GIL, freezing the event loop for seconds on large responses
-        # (https://github.com/BerriAI/litellm/issues/26181). A complete Gemini
-        # chunk is a JSON object/array, so only attempt the parse once the
-        # buffer's last non-whitespace byte can close one.
-        stripped = self.accumulated_json.rstrip()
-        if not stripped or stripped[-1] not in "}]":
+        # Mid-stream, defer parsing until the buffer's last byte can close a value:
+        # attempting a parse after every fragment of one large object is O(n^2) and
+        # holds the GIL, freezing the event loop. At end of stream (is_final) no more
+        # data is coming, so drain whatever complete values remain regardless of the
+        # trailing byte, otherwise a complete leading value sitting behind a truncated
+        # trailing one would be silently dropped.
+        if not is_final and (not self.accumulated_json or self.accumulated_json[-1] not in "}]"):
             return None
 
-        try:
-            _data = json.loads(self.accumulated_json)
-            self.accumulated_json = ""  # reset after successful parsing
-            return self.chunk_parser(chunk=_data)
-        except json.JSONDecodeError:
-            return None
+        # Peel one complete JSON value from the front of the buffer and keep the
+        # unconsumed tail. Running json.loads over the whole buffer would fail
+        # forever once it held more than one concatenated value ("Extra data") while
+        # never resetting the buffer, so the buffer grew without bound and pinned the
+        # core. raw_decode reports where the value ended, so concatenated values drain
+        # one call at a time. A leading non-dict value (never emitted by Gemini in
+        # practice) is consumed and skipped so it cannot block the dict values behind it.
+        decoder = json.JSONDecoder()
+        while self.accumulated_json:
+            try:
+                raw_value = decoder.raw_decode(self.accumulated_json)
+            except json.JSONDecodeError:
+                return None
+            decoded, end_index = cast("tuple[object, int]", raw_value)  # cast-ok: raw_decode -> tuple[Any,int]
+            self.accumulated_json = self.accumulated_json[end_index:].strip()
+            if isinstance(decoded, dict):
+                return self.chunk_parser(chunk=decoded)
+        return None
 
     def _common_chunk_parsing_logic(self, chunk: str) -> Optional["ModelResponseStream"]:
         try:
@@ -3378,7 +3388,9 @@ class ModelResponseIterator:
             chunk = self.response_iterator.__next__()
         except StopIteration:
             if self.chunk_type == "accumulated_json" and self.accumulated_json:
-                return self.handle_accumulated_json_chunk(chunk="")
+                result = self.handle_accumulated_json_chunk(chunk="", is_final=True)
+                if result is not None:
+                    return result
             raise StopIteration
         except ValueError as e:
             raise RuntimeError(f"Error receiving chunk from stream: {e}")
@@ -3400,7 +3412,9 @@ class ModelResponseIterator:
             chunk = await self.async_response_iterator.__anext__()
         except StopAsyncIteration:
             if self.chunk_type == "accumulated_json" and self.accumulated_json:
-                return self.handle_accumulated_json_chunk(chunk="")
+                result = self.handle_accumulated_json_chunk(chunk="", is_final=True)
+                if result is not None:
+                    return result
             raise StopAsyncIteration
         except ValueError as e:
             raise RuntimeError(f"Error receiving chunk from stream: {e}")

litellm/model_prices_and_context_window_backup.json

@@ -1502,6 +1502,222 @@
         "supports_parallel_tool_use_config": true,
         "prompt_cache_min_tokens": 1024
     },
+    "anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "input_cost_per_token": 5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.5e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "global.anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "input_cost_per_token": 5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.5e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "us.anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.875e-06,
+        "cache_creation_input_token_cost_above_1hr": 1.1e-05,
+        "cache_read_input_token_cost": 5.5e-07,
+        "input_cost_per_token": 5.5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.75e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "eu.anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.875e-06,
+        "cache_creation_input_token_cost_above_1hr": 1.1e-05,
+        "cache_read_input_token_cost": 5.5e-07,
+        "input_cost_per_token": 5.5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.75e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "au.anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.875e-06,
+        "cache_creation_input_token_cost_above_1hr": 1.1e-05,
+        "cache_read_input_token_cost": 5.5e-07,
+        "input_cost_per_token": 5.5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.75e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "jp.anthropic.claude-opus-5": {
+        "bedrock_converse_supports_strict_tools": false,
+        "supports_adaptive_thinking": true,
+        "supports_mid_conversation_system": true,
+        "cache_creation_input_token_cost": 6.875e-06,
+        "cache_creation_input_token_cost_above_1hr": 1.1e-05,
+        "cache_read_input_token_cost": 5.5e-07,
+        "input_cost_per_token": 5.5e-06,
+        "litellm_provider": "bedrock_converse",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.75e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_native_structured_output": true,
+        "supports_max_reasoning_effort": true,
+        "supports_output_config": true,
+        "supports_parallel_tool_use_config": true,
+        "prompt_cache_min_tokens": 512
+    },
     "anthropic.claude-opus-4-8": {
         "bedrock_converse_supports_strict_tools": false,
         "supports_adaptive_thinking": true,
@@ -2756,6 +2972,38 @@
         "supports_xhigh_reasoning_effort": true,
         "supports_max_reasoning_effort": true
     },
+    "azure_ai/claude-opus-5": {
+        "supports_mid_conversation_system": true,
+        "supports_adaptive_thinking": true,
+        "input_cost_per_token": 5e-06,
+        "output_cost_per_token": 2.5e-05,
+        "litellm_provider": "azure_ai",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_max_reasoning_effort": true,
+        "prompt_cache_min_tokens": 512
+    },
     "azure_ai/claude-opus-4-8": {
         "supports_mid_conversation_system": true,
         "supports_adaptive_thinking": true,
@@ -11846,6 +12094,44 @@
         "supports_output_config": true,
         "prompt_cache_min_tokens": 512
     },
+    "claude-opus-5": {
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "input_cost_per_token": 5e-06,
+        "litellm_provider": "anthropic",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.5e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_adaptive_thinking": true,
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_native_structured_output": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_max_reasoning_effort": true,
+        "provider_specific_entry": {
+            "us": 1.1,
+            "fast": 2.0
+        },
+        "supports_output_config": true,
+        "supports_speed": true,
+        "prompt_cache_min_tokens": 512
+    },
     "claude-opus-4-8": {
         "cache_creation_input_token_cost": 6.25e-06,
         "cache_creation_input_token_cost_above_1hr": 1e-05,
@@ -36896,6 +37182,70 @@
         "supports_xhigh_reasoning_effort": true,
         "supports_max_reasoning_effort": true
     },
+    "vertex_ai/claude-opus-5": {
+        "supports_mid_conversation_system": true,
+        "supports_adaptive_thinking": true,
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "input_cost_per_token": 5e-06,
+        "litellm_provider": "vertex_ai-anthropic_models",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.5e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_max_reasoning_effort": true,
+        "prompt_cache_min_tokens": 512
+    },
+    "vertex_ai/claude-opus-5@default": {
+        "supports_mid_conversation_system": true,
+        "supports_adaptive_thinking": true,
+        "cache_creation_input_token_cost": 6.25e-06,
+        "cache_creation_input_token_cost_above_1hr": 1e-05,
+        "cache_read_input_token_cost": 5e-07,
+        "input_cost_per_token": 5e-06,
+        "litellm_provider": "vertex_ai-anthropic_models",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "mode": "chat",
+        "output_cost_per_token": 2.5e-05,
+        "search_context_cost_per_query": {
+            "search_context_size_high": 0.01,
+            "search_context_size_low": 0.01,
+            "search_context_size_medium": 0.01
+        },
+        "supports_assistant_prefill": false,
+        "supports_computer_use": true,
+        "supports_function_calling": true,
+        "supports_pdf_input": true,
+        "supports_prompt_caching": true,
+        "supports_reasoning": true,
+        "supports_response_schema": true,
+        "supports_sampling_params": false,
+        "supports_tool_choice": true,
+        "supports_vision": true,
+        "supports_xhigh_reasoning_effort": true,
+        "supports_max_reasoning_effort": true,
+        "prompt_cache_min_tokens": 512
+    },
     "vertex_ai/claude-opus-4-8": {
         "supports_mid_conversation_system": true,
         "supports_adaptive_thinking": true,

litellm/proxy/_experimental/mcp_server/auth/token_exchange.py

@@ -1,192 +0,0 @@
-"""
-OAuth 2.0 Token Exchange (RFC 8693) handler for MCP servers.
-
-Exchanges a user's incoming JWT (subject_token) for a scoped access token
-at an IDP's token exchange endpoint.  The exchanged token is then used to
-authenticate requests to the upstream MCP server.
-
-See: https://datatracker.ietf.org/doc/html/rfc8693
-"""
-
-import asyncio
-import hashlib
-import weakref
-from typing import TYPE_CHECKING, Dict, Tuple
-
-import httpx
-
-from litellm._logging import verbose_logger
-from litellm.caching.in_memory_cache import InMemoryCache
-from litellm.constants import (
-    MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL,
-    MCP_OAUTH2_TOKEN_CACHE_MIN_TTL,
-    MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS,
-    MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE,
-)
-from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
-from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import (
-    build_token_endpoint_client_auth,
-)
-from litellm.types.llms.custom_http import httpxSpecialProvider
-from litellm.types.mcp import DEFAULT_SUBJECT_TOKEN_TYPE
-
-if TYPE_CHECKING:
-    from litellm.types.mcp_server.mcp_server_manager import MCPServer
-
-# RFC 8693 grant type constant
-TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"
-
-
-class TokenExchangeHandler:
-    """Handles OAuth 2.0 Token Exchange (RFC 8693) for MCP servers.
-
-    Caches exchanged tokens keyed by ``hash(subject_token + server_id)`` so
-    repeated calls with the same user token skip the IDP round-trip.
-    """
-
-    def __init__(self) -> None:
-        self._cache = InMemoryCache(
-            max_size_in_memory=MCP_TOKEN_EXCHANGE_CACHE_MAX_SIZE,
-            default_ttl=MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL,
-        )
-        # WeakValueDictionary so locks are GC'd once no coroutine holds a reference,
-        # preventing unbounded growth with many rotating user tokens.
-        self._locks: weakref.WeakValueDictionary[str, asyncio.Lock] = weakref.WeakValueDictionary()
-
-    def _get_lock(self, cache_key: str) -> asyncio.Lock:
-        lock = self._locks.get(cache_key)
-        if lock is None:
-            lock = asyncio.Lock()
-            self._locks[cache_key] = lock
-        return lock
-
-    @staticmethod
-    def _cache_key(subject_token: str, server_id: str) -> str:
-        raw = f"{subject_token}:{server_id}"
-        return hashlib.sha256(raw.encode()).hexdigest()
-
-    async def exchange_token(
-        self,
-        subject_token: str,
-        server: "MCPServer",
-    ) -> str:
-        """Exchange *subject_token* for a scoped access token.
-
-        Returns the exchanged ``access_token`` string (suitable for a
-        ``Bearer`` header).
-
-        Raises ``ValueError`` on configuration or IDP errors.
-        """
-        cache_key = self._cache_key(subject_token, server.server_id)
-
-        # Fast path
-        cached = self._cache.get_cache(cache_key)
-        if cached is not None:
-            return cached
-
-        # Slow path — one exchange at a time per (user, server) pair
-        async with self._get_lock(cache_key):
-            cached = self._cache.get_cache(cache_key)
-            if cached is not None:
-                return cached
-
-            token, ttl = await self._do_exchange(subject_token, server)
-            self._cache.set_cache(cache_key, token, ttl=ttl)
-            return token
-
-    async def _do_exchange(
-        self,
-        subject_token: str,
-        server: "MCPServer",
-    ) -> Tuple[str, int]:
-        """POST to the token exchange endpoint with RFC 8693 parameters.
-
-        Returns ``(access_token, ttl_seconds)``.
-        """
-        endpoint = server.token_exchange_endpoint or server.token_url
-        if not endpoint:
-            raise ValueError(
-                f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange "
-                f"but no token_exchange_endpoint or token_url configured"
-            )
-        if not server.client_id or not server.client_secret:
-            raise ValueError(
-                f"MCP server '{server.server_id}' has auth_type=oauth2_token_exchange "
-                f"but missing client_id or client_secret"
-            )
-
-        client_auth = build_token_endpoint_client_auth(
-            auth_method=server.token_endpoint_auth_method,
-            client_id=server.client_id,
-            client_secret=server.client_secret,
-        )
-        data: Dict[str, str] = {
-            "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
-            "subject_token": subject_token,
-            "subject_token_type": server.subject_token_type or DEFAULT_SUBJECT_TOKEN_TYPE,
-            **client_auth.body,
-        }
-        if server.audience:
-            data["audience"] = server.audience
-        if server.scopes:
-            data["scope"] = " ".join(server.scopes)
-
-        verbose_logger.debug(
-            "Exchanging token for MCP server %s at %s (audience=%s)",
-            server.server_id,
-            endpoint,
-            server.audience,
-        )
-
-        client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP)
-        post_kwargs = {"data": data, **({"headers": client_auth.headers} if client_auth.headers else {})}
-        try:
-            response = await client.post(endpoint, **post_kwargs)
-            response.raise_for_status()
-        except httpx.HTTPStatusError as exc:
-            verbose_logger.debug(
-                "Token exchange IDP error for MCP server %s (status %d)",
-                server.server_id,
-                exc.response.status_code,
-            )
-            raise ValueError(
-                f"Token exchange for MCP server '{server.server_id}' failed with status {exc.response.status_code}"
-            ) from exc
-
-        body = response.json()
-        if not isinstance(body, dict):
-            raise ValueError(
-                f"Token exchange response for MCP server '{server.server_id}' "
-                f"returned non-object JSON (got {type(body).__name__})"
-            )
-
-        access_token = body.get("access_token")
-        if not access_token:
-            raise ValueError(f"Token exchange response for MCP server '{server.server_id}' missing 'access_token'")
-
-        raw_expires_in = body.get("expires_in")
-        try:
-            expires_in = int(raw_expires_in) if raw_expires_in is not None else MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL
-        except (TypeError, ValueError):
-            expires_in = MCP_OAUTH2_TOKEN_CACHE_DEFAULT_TTL
-
-        ttl = max(
-            expires_in - MCP_OAUTH2_TOKEN_EXPIRY_BUFFER_SECONDS,
-            MCP_OAUTH2_TOKEN_CACHE_MIN_TTL,
-        )
-
-        verbose_logger.info(
-            "Token exchange succeeded for MCP server %s (expires in %ds)",
-            server.server_id,
-            expires_in,
-        )
-        return access_token, ttl
-
-    def invalidate(self, subject_token: str, server_id: str) -> None:
-        """Remove a cached exchanged token (e.g. after a 401)."""
-        cache_key = self._cache_key(subject_token, server_id)
-        self._cache.delete_cache(cache_key)
-
-
-# Module-level singleton
-mcp_token_exchange_handler = TokenExchangeHandler()

litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py

@@ -3,6 +3,7 @@ import html as _html
 import json
 import secrets
 import time
+from collections.abc import Mapping
 from datetime import datetime, timezone
 from typing import TYPE_CHECKING, Any, Dict, Literal, Optional, Tuple
 from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
@@ -13,6 +14,7 @@ from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, Resp
 from pydantic import BaseModel, ConfigDict, Field, SecretStr, ValidationError
 
 from litellm._logging import verbose_logger
+from litellm.caching.in_memory_cache import InMemoryCache
 from litellm.llms.custom_httpx.http_handler import (
     get_async_httpx_client,
     httpxSpecialProvider,
@@ -20,7 +22,9 @@ from litellm.llms.custom_httpx.http_handler import (
 from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import (
     TokenEndpointAuthConfigError,
     build_token_endpoint_client_auth,
+    normalize_token_endpoint_auth_method,
 )
+from litellm.types.mcp_server.mcp_server_manager import MCPTokenEndpointAuthMethod
 from litellm.proxy._experimental.mcp_server.bridge_token_flow import (
     _bridge_mint_error_response,
     _BridgeMintReady,
@@ -29,6 +33,7 @@ from litellm.proxy._experimental.mcp_server.bridge_token_flow import (
     _finish_bridge_mint,
     _prepare_bridge_mint,
     _prepare_bridge_refresh,
+    _reload_active_user_by_id,
 )
 from litellm.proxy._experimental.mcp_server.faults import (
     CallerRejected,
@@ -39,6 +44,14 @@ from litellm.proxy._experimental.mcp_server.faults import (
     dcr_fault_detail,
     render_token_fault,
 )
+from litellm.proxy._experimental.mcp_server.gateway_dcr_flow import (
+    aggregate_authorize,
+    aggregate_token,
+    complete_connect_flow,
+    is_gateway_dcr_client_id,
+    register_aggregate_client,
+    relative_request_url,
+)
 from litellm.proxy._experimental.mcp_server.oauth_utils import (
     TOKEN_NO_CACHE_HEADERS,
     get_request_base_url,
@@ -111,6 +124,9 @@ def encode_state_with_base_url(
     client_redirect_uri: Optional[str] = None,
     litellm_user_id: str | None = None,
     mcp_server_id: str | None = None,
+    dcr_client_id: str | None = None,
+    dcr_client_secret: str | None = None,
+    dcr_token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None,
 ) -> str:
     """
     Encode the base_url, original state, and PKCE parameters using encryption.
@@ -124,8 +140,18 @@ def encode_state_with_base_url(
         litellm_user_id: The SSO-authenticated litellm user captured at the bridge authorize
             (interactive dcr_bridge oauth_delegate only); the callback seals it into the gateway
             authorization code so the token mint can bind the envelope to this user
-        mcp_server_id: The bridge server the interactive flow targets, sealed alongside
-            litellm_user_id so the gateway code cannot be replayed against another server
+        mcp_server_id: The server the flow targets, sealed alongside litellm_user_id (bridge) or
+            dcr_client_id (ephemeral mint) so the gateway code cannot be replayed against another
+            server
+        dcr_client_id: The ephemeral DCR client the gateway minted at authorize for a
+            client-forwarded-token server with no caller-supplied client; the callback seals it
+            into the forwarded authorization code so the token exchange can authenticate with it
+            while the gateway stores nothing
+        dcr_client_secret: The minted client's secret, when the upstream issued one
+        dcr_token_endpoint_auth_method: The token-endpoint auth method the upstream's registration
+            response granted the minted client, sealed alongside the credentials so the exchange
+            authenticates the way the upstream expects instead of falling back to the server row's
+            configured method
 
     Returns:
         An encrypted string that encodes all values
@@ -138,6 +164,9 @@ def encode_state_with_base_url(
         "client_redirect_uri": client_redirect_uri,
         "litellm_user_id": litellm_user_id,
         "mcp_server_id": mcp_server_id,
+        "dcr_client_id": dcr_client_id,
+        "dcr_client_secret": dcr_client_secret,
+        "dcr_token_endpoint_auth_method": dcr_token_endpoint_auth_method,
     }
     state_json = json.dumps(state_data, sort_keys=True)
     encrypted_state = encrypt_value_helper(state_json)
@@ -217,14 +246,112 @@ def open_bridge_authorization_code(code: str) -> _BridgeAuthorizationCode | None
         return None
 
 
+_PASSTHROUGH_AUTH_CODE_PREFIX = "llm_ptcode_"
+
+
+class PassthroughAuthorizationCode(BaseModel):
+    """The ephemeral DCR client and upstream code the gateway seals into the authorization code it
+    forwards for a client-forwarded-token server (``true_passthrough`` / ``oauth_delegate``) whose
+    authorize fell through to gateway-side registration. These modes forbid the gateway from storing
+    an OAuth client identity, so the minted client survives only inside this sealed value: the
+    client echoes it back at the token endpoint, where the gateway recovers the client to
+    authenticate the upstream exchange. ``mcp_server_id`` binds the code to the server it was minted
+    for so it cannot be spent at another server's token endpoint."""
+
+    model_config = ConfigDict(frozen=True)
+    upstream_code: str = Field(min_length=1)
+    client_id: str = Field(min_length=1)
+    client_secret: str | None = None
+    token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None
+    mcp_server_id: str = Field(min_length=1)
+
+
+def seal_passthrough_authorization_code(
+    upstream_code: str,
+    client_id: str,
+    client_secret: str | None,
+    mcp_server_id: str,
+    token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None,
+) -> str:
+    """Seal the upstream authorization code together with the ephemeral DCR client that authorized
+    it. Encrypted with the same authenticated symmetric helper as the OAuth state and bridge codes,
+    so the client can neither read the (possibly confidential) client credentials nor forge a
+    code."""
+    payload = json.dumps(
+        {
+            "upstream_code": upstream_code,
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "token_endpoint_auth_method": token_endpoint_auth_method,
+            "mcp_server_id": mcp_server_id,
+        },
+        sort_keys=True,
+    )
+    return _PASSTHROUGH_AUTH_CODE_PREFIX + encrypt_value_helper(payload)
+
+
+def open_passthrough_authorization_code(code: str) -> PassthroughAuthorizationCode | None:
+    """Recover the sealed ephemeral client and upstream code, or ``None`` when ``code`` is not a
+    gateway passthrough code or does not decrypt / validate, so a raw upstream code falls through to
+    the existing caller-supplied-client behavior."""
+    if not code.startswith(_PASSTHROUGH_AUTH_CODE_PREFIX):
+        return None
+    decrypted = decrypt_value_helper(
+        code[len(_PASSTHROUGH_AUTH_CODE_PREFIX) :], "passthrough_authorization_code", return_original_value=False
+    )
+    if not isinstance(decrypted, str):
+        return None
+    try:
+        return PassthroughAuthorizationCode.model_validate_json(decrypted)
+    except ValidationError:
+        return None
+
+
+def redeem_passthrough_authorization_code(
+    code: str | None, mcp_server: MCPServer, code_verifier: str | None
+) -> PassthroughAuthorizationCode | None:
+    """The single redemption gate for sealed passthrough codes: a raw or foreign code returns
+    ``None`` so the caller keeps its existing behavior, while a genuine sealed code must be spent
+    at the server it was minted for and must carry the PKCE verifier of the S256 flow that minted
+    it (the mint refuses downgraded flows, so a verifier-less redemption is an interception
+    attempt, not a legitimate client)."""
+    if not code:
+        return None
+    sealed = open_passthrough_authorization_code(code)
+    if sealed is None:
+        return None
+    if sealed.mcp_server_id != mcp_server.server_id:
+        raise HTTPException(
+            status_code=400,
+            detail="Authorization code was issued for a different MCP server",
+        )
+    if not code_verifier:
+        raise HTTPException(
+            status_code=400,
+            detail="code_verifier is required to redeem this authorization code",
+        )
+    return sealed
+
+
+def _session_cookie_user_id(request: Request) -> str | None:
+    """The signed-in litellm user for a browser request, or ``None``. Thin wrapper so the
+    aggregate DCR flow's verbs receive the identity as a plain value instead of parsing
+    cookies themselves."""
+    from litellm.proxy._experimental.mcp_server.byok_oauth_endpoints import (  # noqa: PLC0415  # circular import at module load
+        _user_id_from_session_cookie,
+    )
+
+    return _user_id_from_session_cookie(request)
+
+
 def _redirect_to_litellm_login(request: Request) -> RedirectResponse:
     """Send an unauthenticated browser through litellm login before the interactive bridge authorize
     can capture its identity. The bridge oauth_delegate flow seals the SSO user into the gateway code,
-    so a session is required; without one there is nothing to bind. After login the user re-initiates
-    the connection, which then finds the session cookie (the seamless return-to round-trip, which is
-    origin-validated against the control-plane URL, is a follow-up)."""
+    so a session is required; without one there is nothing to bind. A same-origin relative
+    ``return_to`` (honored by the SSO callback) brings the browser straight back to this authorize
+    request after login instead of stranding it on the dashboard."""
     base_url = get_request_base_url(request)
-    return RedirectResponse(f"{base_url}/sso/key/generate")
+    return RedirectResponse(f"{base_url}/sso/key/generate?{urlencode({'return_to': relative_request_url(request)})}")
 
 
 # LIT-4197: some upstream authorization servers reject an over-long ``state``
@@ -499,6 +626,35 @@ def _raise_if_not_oauth2(mcp_server: MCPServer) -> None:
     )
 
 
+def _endpoint_not_configured_detail(
+    mcp_server: MCPServer,
+    endpoint_label: str,
+    manual_remedy: str,
+    issuer_remedy: str,
+) -> str:
+    """The 400 detail for an unresolved OAuth endpoint, naming the likely cause for this server's
+    shape (LIT-4658): an anchored issuer whose metadata fell short, a configured (possibly
+    misconfigured) server url whose discovery failed, or no discovery source at all. Kept free of
+    URLs and issuer values because these endpoints are reachable pre-auth."""
+    if mcp_server.issuer_is_anchored:
+        return (
+            f"MCP server {endpoint_label} is not configured. Endpoint discovery anchored on the configured "
+            f"Issuer (RFC 8414) failed or its metadata did not include this endpoint; check the proxy logs "
+            f"for 'MCP OAuth' warnings from server load, verify the Issuer, or {manual_remedy}."
+        )
+    if mcp_server.url:
+        return (
+            f"MCP server {endpoint_label} is not configured. OAuth endpoint discovery against the configured "
+            f"server url did not resolve it; the url may be misconfigured. Check the proxy logs for "
+            f"'MCP OAuth' warnings from server load, verify the server url, or {manual_remedy}, or "
+            f"{issuer_remedy}."
+        )
+    return (
+        f"MCP server {endpoint_label} is not configured. Servers with no url (OpenAPI spec or stdio) run no "
+        f"resource discovery, so {manual_remedy}, or {issuer_remedy}."
+    )
+
+
 def _raise_unless_oauth2_discovery_server(
     mcp_server: Optional[MCPServer],
     mcp_server_name: Optional[str],
@@ -594,15 +750,17 @@ async def authorize_with_server(
     code_challenge_method: Optional[str] = None,
     response_type: Optional[str] = None,
     scope: Optional[str] = None,
+    ephemeral_dcr_client: "EphemeralDcrClient | None" = None,
 ):
     _raise_if_not_oauth2(mcp_server)
     if mcp_server.authorization_url is None:
         raise HTTPException(
             status_code=400,
-            detail=(
-                "MCP server authorization url is not configured. Servers with no url (OpenAPI "
-                "spec or stdio) run no resource discovery, so set Authorization URL and Token URL "
-                "manually, or set Issuer to discover them from the identity provider (RFC 8414)."
+            detail=_endpoint_not_configured_detail(
+                mcp_server,
+                "authorization url",
+                "set Authorization URL and Token URL manually",
+                "set Issuer to discover them from the identity provider (RFC 8414)",
             ),
         )
 
@@ -612,7 +770,10 @@ async def authorize_with_server(
         # calling this for its enforcement side effect, then falls through to the gateway
         # /callback flow below, which reads the original code_challenge names.
         bridge_challenge, bridge_method = _require_s256_pkce(code_challenge, code_challenge_method)
-        if _dcr_bridge_relays_client_registration(mcp_server):
+        # A gateway-minted ephemeral client is registered against {base}/callback, so its
+        # flow must run the short-circuit arm; the relay arm is only for clients that
+        # registered themselves through the front door and hold their own redirect binding.
+        if _dcr_bridge_relays_client_registration(mcp_server) and ephemeral_dcr_client is None:
             return _redirect_to_upstream_authorize(
                 mcp_server=mcp_server,
                 client_id=client_id,
@@ -656,7 +817,12 @@ async def authorize_with_server(
         code_challenge_method=code_challenge_method,
         client_redirect_uri=redirect_uri,
         litellm_user_id=litellm_user_id,
-        mcp_server_id=mcp_server.server_id if litellm_user_id else None,
+        mcp_server_id=mcp_server.server_id if (litellm_user_id or ephemeral_dcr_client) else None,
+        dcr_client_id=ephemeral_dcr_client.client_id if ephemeral_dcr_client else None,
+        dcr_client_secret=ephemeral_dcr_client.client_secret if ephemeral_dcr_client else None,
+        dcr_token_endpoint_auth_method=ephemeral_dcr_client.token_endpoint_auth_method
+        if ephemeral_dcr_client
+        else None,
     )
     relay_state = secrets.token_urlsafe(_OAUTH_STATE_HANDLE_BYTES)
 
@@ -703,6 +869,7 @@ async def exchange_token_with_server(
     code_verifier: Optional[str],
     refresh_token: Optional[str] = None,
     scope: Optional[str] = None,
+    client_token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None,
 ):
     _raise_if_not_oauth2(mcp_server)
     if grant_type not in ("authorization_code", "refresh_token"):
@@ -711,22 +878,32 @@ async def exchange_token_with_server(
     if mcp_server.token_url is None:
         raise HTTPException(
             status_code=400,
-            detail=(
-                "MCP server token url is not configured. Servers with no url (OpenAPI spec or "
-                "stdio) run no resource discovery, so set Token URL manually, or set Issuer to "
-                "discover it from the identity provider (RFC 8414)."
+            detail=_endpoint_not_configured_detail(
+                mcp_server,
+                "token url",
+                "set Token URL manually",
+                "set Issuer to discover it from the identity provider (RFC 8414)",
             ),
         )
 
-    # The id and secret must come from the same source. When the server-side client_id wins,
-    # falling back to the caller's secret pairs the persisted client with a foreign secret; the
-    # register short-circuit hands clients a placeholder secret ("dummy"), so a re-auth against a
-    # persisted public PKCE client (no stored secret) would send that placeholder and the IdP 401s.
+    # The id, secret, and token-endpoint auth method must come from the same source. When the
+    # server-side client_id wins, falling back to the caller's secret pairs the persisted client
+    # with a foreign secret; the register short-circuit hands clients a placeholder secret
+    # ("dummy"), so a re-auth against a persisted public PKCE client (no stored secret) would send
+    # that placeholder and the IdP 401s. Symmetrically, a caller-side client (an ephemeral mint
+    # recovered from a sealed code) must authenticate the way its own registration was granted,
+    # not the way the server row is configured; callers that carry no method keep the row's method
+    # as before.
     resolved_client_id = mcp_server.client_id if mcp_server.client_id else client_id
     resolved_client_secret = mcp_server.client_secret if mcp_server.client_id else client_secret
+    resolved_auth_method = (
+        mcp_server.token_endpoint_auth_method
+        if mcp_server.client_id
+        else (client_token_endpoint_auth_method or mcp_server.token_endpoint_auth_method)
+    )
     try:
         client_auth = build_token_endpoint_client_auth(
-            auth_method=mcp_server.token_endpoint_auth_method,
+            auth_method=resolved_auth_method,
             client_id=resolved_client_id,
             client_secret=resolved_client_secret,
         )
@@ -1229,7 +1406,7 @@ async def _persist_dcr_client_registration(
         return "failed"
 
 
-def _client_supplied_redirect_uris(value: object) -> list[str] | None:
+def client_supplied_redirect_uris(value: object) -> list[str] | None:
     """RFC 7591 redirect_uris must be a non-empty array of URI strings. Any other shape (not a list,
     an empty list, or a list holding a non-string or empty-string element) yields None so every
     register arm falls back to the gateway callback instead of echoing a malformed value back to the
@@ -1241,6 +1418,142 @@ def _client_supplied_redirect_uris(value: object) -> list[str] | None:
     return uris if len(uris) == len(value) else None
 
 
+async def _post_dcr_registration(
+    registration_url: str,
+    register_data: Mapping[str, object],
+    server_id: str,
+) -> httpx.Response:
+    """POST an RFC 7591 registration to the upstream and return its response, relaying a classified
+    upstream rejection instead of a generic 500 and failing loud on an absent response."""
+    headers = {
+        "Content-Type": "application/json",
+        "Accept": "application/json",
+    }
+    async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register)
+    try:
+        response = await async_client.post(
+            registration_url,
+            headers=headers,
+            json=register_data,
+        )
+        if response is not None:
+            response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        status_code, detail = dcr_fault_detail(classify_upstream_dcr_rejection(exc.response, log_context=server_id))
+        raise HTTPException(status_code=status_code, detail=detail) from exc
+    if response is None:
+        raise HTTPException(
+            status_code=502,
+            detail="MCP upstream registration endpoint returned no response",
+        )
+    return response
+
+
+class EphemeralDcrClient(BaseModel):
+    """A DCR client minted for a single authorize round trip and never stored by the gateway."""
+
+    model_config = ConfigDict(frozen=True)
+    client_id: str = Field(min_length=1)
+    client_secret: str | None = None
+    token_endpoint_auth_method: MCPTokenEndpointAuthMethod | None = None
+
+
+_EPHEMERAL_DCR_CLIENT_CACHE = InMemoryCache(default_ttl=_OAUTH_STATE_COOKIE_TTL_SECONDS)
+_EPHEMERAL_DCR_MINT_LOCKS: dict[str, asyncio.Lock] = {}
+
+
+async def mint_ephemeral_dcr_client(request: Request, mcp_server: MCPServer) -> EphemeralDcrClient | None:
+    """Mint a throwaway OAuth client via the upstream's RFC 7591 registration endpoint for a
+    client-forwarded-token server whose authorize arrived with no client_id. Returns ``None`` when
+    the upstream exposes no registration endpoint, so the caller keeps its existing failure path.
+    The minted client is deliberately not persisted anywhere: ``true_passthrough`` /
+    ``oauth_delegate`` require the gateway to hold no OAuth client identity, so it survives only in
+    the encrypted OAuth state and the sealed authorization code the callback forwards.
+
+    Reloading the authorize page or retrying a flow must not register a fresh upstream client every
+    time (an OAuth client identifies the application, not the user, so reuse is semantically
+    correct). A per-process TTL cache bounded to the OAuth state cookie's lifetime dedupes the mint
+    per (server, gateway origin), and a per-server lock single-flights concurrent mints (the
+    ``_OAUTH_METADATA_FETCH_LOCKS`` pattern; keyed by server_id alone so the lock registry stays
+    bounded by the server count even when the request origin varies) so parallel authorize requests
+    cannot each register an upstream client; the cache stamps nothing onto the server record and
+    correctness never depends on it because the sealed state carries the client through the flow."""
+    if mcp_server.registration_url is None:
+        return None
+    request_base_url = get_request_base_url(request)
+    cache_key = f"mcp_ephemeral_dcr_client:{mcp_server.server_id}:{request_base_url}"
+    cached = _EPHEMERAL_DCR_CLIENT_CACHE.get_cache(cache_key)
+    if isinstance(cached, EphemeralDcrClient):
+        return cached
+    lock = _EPHEMERAL_DCR_MINT_LOCKS.setdefault(mcp_server.server_id, asyncio.Lock())
+    async with lock:
+        cached_after_wait = _EPHEMERAL_DCR_CLIENT_CACHE.get_cache(cache_key)
+        if isinstance(cached_after_wait, EphemeralDcrClient):
+            return cached_after_wait
+        register_data: dict[str, object] = {
+            "client_name": mcp_server.server_name or mcp_server.server_id,
+            "redirect_uris": [f"{request_base_url}/callback"],
+            "grant_types": ["authorization_code", "refresh_token"],
+            "response_types": ["code"],
+            "token_endpoint_auth_method": "none",
+        }
+        response = await _post_dcr_registration(
+            registration_url=mcp_server.registration_url,
+            register_data=register_data,
+            server_id=mcp_server.server_id,
+        )
+        try:
+            registration = _DcrClientRegistration.model_validate_json(response.text)
+        except ValidationError as exc:
+            raise HTTPException(
+                status_code=502,
+                detail="MCP upstream registration endpoint returned no usable client_id",
+            ) from exc
+        if not registration.client_id:
+            raise HTTPException(
+                status_code=502,
+                detail="MCP upstream registration endpoint returned no usable client_id",
+            )
+        minted = EphemeralDcrClient(
+            client_id=registration.client_id,
+            client_secret=registration.client_secret,
+            token_endpoint_auth_method=normalize_token_endpoint_auth_method(registration.token_endpoint_auth_method),
+        )
+        _EPHEMERAL_DCR_CLIENT_CACHE.set_cache(cache_key, minted)
+        return minted
+
+
+async def resolve_ephemeral_dcr_client(
+    request: Request,
+    mcp_server: MCPServer,
+    code_challenge: str | None,
+    code_challenge_method: str | None,
+    redirect_uri: str,
+) -> EphemeralDcrClient | None:
+    """The single owner of the gateway-side mint policy for a clientless authorize. Returns
+    ``None`` for servers whose mode does not permit gateway minting and for upstreams without a
+    registration endpoint, so those callers keep their existing failure paths: plain ``oauth2``
+    keeps its persisted-client contract, and the interactive ``oauth_delegate`` dcr_bridge
+    sign-in has its own sealed-identity flow. ``true_passthrough`` mints regardless of the
+    ``dcr_bridge`` flag (the UI creates passthrough servers with the flag on by default): a
+    minted flow runs the bridge short-circuit arm, while the relay front door remains for
+    external clients that registered themselves. Flows that could never succeed fail loud
+    before any upstream registration: a missing ``authorization_url``, a downgraded PKCE pair
+    (without S256 the sealed code would be bearer-redeemable by any authenticated caller who
+    intercepts the redirect), or an untrusted ``redirect_uri`` (a rejected redirect must not be
+    usable to generate orphan IdP clients)."""
+    if not (mcp_server.is_true_passthrough or (mcp_server.is_oauth_delegate and not mcp_server.is_dcr_bridge)):
+        return None
+    if mcp_server.authorization_url is None:
+        raise HTTPException(
+            status_code=400,
+            detail="MCP server authorization url is not set",
+        )
+    _require_s256_pkce(code_challenge, code_challenge_method)
+    validate_trusted_redirect_uri(request, redirect_uri)
+    return await mint_ephemeral_dcr_client(request, mcp_server)
+
+
 async def register_client_with_server(
     request: Request,
     mcp_server: MCPServer,
@@ -1278,10 +1591,11 @@ async def register_client_with_server(
     if mcp_server.authorization_url is None:
         raise HTTPException(
             status_code=400,
-            detail=(
-                "MCP server authorization url is not configured. Servers with no url (OpenAPI "
-                "spec or stdio) run no resource discovery, so set Authorization URL and Token URL "
-                "manually, or set Issuer to discover them from the identity provider (RFC 8414)."
+            detail=_endpoint_not_configured_detail(
+                mcp_server,
+                "authorization url",
+                "set Authorization URL and Token URL manually",
+                "set Issuer to discover them from the identity provider (RFC 8414)",
             ),
         )
 
@@ -1302,30 +1616,11 @@ async def register_client_with_server(
         "response_types": response_types or (["code"] if bridge_relay else []),
         "token_endpoint_auth_method": token_endpoint_auth_method or ("none" if bridge_relay else ""),
     }
-    headers = {
-        "Content-Type": "application/json",
-        "Accept": "application/json",
-    }
-
-    async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.Oauth2Register)
-    try:
-        response = await async_client.post(
-            mcp_server.registration_url,
-            headers=headers,
-            json=register_data,
-        )
-        if response is not None:
-            response.raise_for_status()
-    except httpx.HTTPStatusError as exc:
-        status_code, detail = dcr_fault_detail(
-            classify_upstream_dcr_rejection(exc.response, log_context=mcp_server.server_id)
-        )
-        raise HTTPException(status_code=status_code, detail=detail) from exc
-    if response is None:
-        raise HTTPException(
-            status_code=502,
-            detail="MCP upstream registration endpoint returned no response",
-        )
+    response = await _post_dcr_registration(
+        registration_url=mcp_server.registration_url,
+        register_data=register_data,
+        server_id=mcp_server.server_id,
+    )
 
     token_response = response.json()
 
@@ -1358,6 +1653,18 @@ async def authorize(
         global_mcp_server_manager,
     )
 
+    if mcp_server_name is None and client_id and is_gateway_dcr_client_id(client_id):
+        return aggregate_authorize(
+            request=request,
+            client_id=client_id,
+            redirect_uri=redirect_uri,
+            state=state,
+            code_challenge=code_challenge,
+            code_challenge_method=code_challenge_method,
+            response_type=response_type,
+            session_user_id=_session_cookie_user_id(request),
+        )
+
     lookup_name: Optional[str] = mcp_server_name or client_id
     client_ip = IPAddressUtils.get_mcp_client_ip(request)
     mcp_server = (
@@ -1421,6 +1728,25 @@ async def token_endpoint(
         global_mcp_server_manager,
     )
 
+    if mcp_server_name is None and is_gateway_dcr_client_id(client_id):
+        from litellm.proxy.proxy_server import (  # noqa: PLC0415  # circular import at module load
+            master_key,
+            user_api_key_cache,
+        )
+
+        return await aggregate_token(
+            request=request,
+            grant_type=grant_type,
+            code=code,
+            redirect_uri=redirect_uri,
+            client_id=client_id,
+            code_verifier=code_verifier,
+            refresh_token=refresh_token,
+            master_key=master_key,
+            reload_user=_reload_active_user_by_id,
+            cache=user_api_key_cache,
+        )
+
     lookup_name = mcp_server_name or client_id
     client_ip = IPAddressUtils.get_mcp_client_ip(request)
     mcp_server = global_mcp_server_manager.get_mcp_server_by_name(lookup_name, client_ip=client_ip)
@@ -1442,6 +1768,21 @@ async def token_endpoint(
     )
 
 
+@router.post("/authorize/complete")
+async def authorize_complete(request: Request, flow: str = Form(...)):
+    """Finish an aggregate connect flow: mint the gateway authorization code for the
+    signed-in user and redirect back to the DCR client. POST plus the per-flow HttpOnly
+    cookie set at /authorize; an anonymous or bad-flow request just 400s."""
+    from litellm.proxy.proxy_server import user_api_key_cache  # noqa: PLC0415  # circular import at module load
+
+    return await complete_connect_flow(
+        request=request,
+        flow_handle=flow,
+        session_user_id=_session_cookie_user_id(request),
+        cache=user_api_key_cache,
+    )
+
+
 # Per RFC 6749 §4.1.2.1, an IdP that rejects an OAuth authorization request
 # redirects back to the configured redirect URI with ``error`` /
 # ``error_description`` / ``error_uri`` query params and no ``code``. The MCP
@@ -1563,11 +1904,23 @@ async def callback(
         # envelope to this user. Every other flow forwards the raw code unchanged.
         litellm_user_id = state_data.get("litellm_user_id")
         mcp_server_id = state_data.get("mcp_server_id")
+        dcr_client_id = state_data.get("dcr_client_id")
+        dcr_client_secret = state_data.get("dcr_client_secret")
         forwarded_code = code
         if isinstance(litellm_user_id, str) and litellm_user_id and isinstance(mcp_server_id, str) and mcp_server_id:
             forwarded_code = seal_bridge_authorization_code(
                 upstream_code=code, litellm_user_id=litellm_user_id, mcp_server_id=mcp_server_id
             )
+        elif isinstance(dcr_client_id, str) and dcr_client_id and isinstance(mcp_server_id, str) and mcp_server_id:
+            forwarded_code = seal_passthrough_authorization_code(
+                upstream_code=code,
+                client_id=dcr_client_id,
+                client_secret=dcr_client_secret if isinstance(dcr_client_secret, str) and dcr_client_secret else None,
+                mcp_server_id=mcp_server_id,
+                token_endpoint_auth_method=normalize_token_endpoint_auth_method(
+                    state_data.get("dcr_token_endpoint_auth_method")
+                ),
+            )
 
         params = {"code": forwarded_code, "state": original_state}
         complete_returned_url = _append_query_params(redirect_uri, params)
@@ -2158,7 +2511,7 @@ async def register_client(request: Request, mcp_server_name: Optional[str] = Non
 
     request_data = await _read_request_body(request=request)
     data: dict = {**request_data}
-    client_redirect_uris = _client_supplied_redirect_uris(data.get("redirect_uris"))
+    client_redirect_uris = client_supplied_redirect_uris(data.get("redirect_uris"))
 
     dummy_return = {
         "client_id": mcp_server_name or "dummy_client",
@@ -2167,6 +2520,13 @@ async def register_client(request: Request, mcp_server_name: Optional[str] = Non
     }
     client_ip = IPAddressUtils.get_mcp_client_ip(request)
     if not mcp_server_name:
+        # A real DCR request carries redirect_uris (RFC 7591): route it to the aggregate DCR
+        # endpoint the aggregate authorization-server metadata advertises. A single-server
+        # deployment registers at /{server}/register instead (its bare-origin discovery
+        # advertises that), so this does not affect it. A request without redirect_uris is not
+        # a DCR request, so the legacy single-server-or-dummy fallback is kept for it.
+        if data.get("redirect_uris"):
+            return await register_aggregate_client(request=request, request_body=data)
         resolved = _resolve_oauth2_server_for_root_endpoints(client_ip=client_ip)
         if resolved:
             return await register_client_with_server(

litellm/proxy/_experimental/mcp_server/gateway_dcr_flow.py

@@ -0,0 +1,637 @@
+"""The gateway-level DCR flow for the aggregate ``/mcp`` endpoint (``mcp_gateway_dcr``).
+
+An OAuth-only DCR client (Claude Desktop, Claude Code, MCP Inspector) pointed at the
+aggregate ``/mcp`` endpoint discovers the gateway as its authorization server (PR 1 of
+this track) and then walks the flow implemented here:
+
+1. ``POST /register``: stateless dynamic client registration. The ``client_id`` IS the
+   registration: the client's redirect URIs are sealed into it with the repo's
+   authenticated symmetric helper, so nothing is persisted and a forged or tampered
+   client_id simply fails to open. Clients are always public (``token_endpoint_auth_method
+   "none"``); PKCE S256 is what protects the code.
+2. ``GET /authorize``: validates the client and redirect URI, requires S256 PKCE, and
+   interposes LiteLLM sign-in. Without a session cookie the browser is sent through
+   ``/sso/key/generate`` with a same-origin ``return_to`` so it lands back here after
+   login. With a session, the flow parameters and the SSO user are sealed into a per-flow
+   HttpOnly cookie (the same pattern as the upstream OAuth state relay) and the browser is
+   sent to the connect page, where the user authorizes individual servers (vaulting those
+   tokens server-side) before finishing.
+3. ``POST /authorize/complete``: the deliberate finish step. A POST (not GET) bound to the
+   SameSite=Lax flow cookie, so a cross-site link cannot silently mint a code with the
+   victim's session, and the signed-in user must match the user sealed into the flow.
+   Mints a short-lived, single-use, gateway-sealed authorization code and redirects to the
+   client's registered redirect URI.
+4. ``POST /token``: exchanges the code (PKCE-verified, client- and redirect-bound,
+   single-use) for the identity-only session tokens of
+   :mod:`.outbound_credentials.session_token`, re-validating that the litellm user is
+   still active first; the ``refresh_token`` grant rotates the pair the same way.
+
+Nothing here stores state server-side except the single-use code guard (a TTL cache
+entry). Every sealed value is authenticated encryption over the proxy salt/master key
+family, opened totally (bad input maps to an OAuth error, never a raise), and every
+identity is a stable reference re-validated live at mint, refresh, and (in the admission
+PR) tool-call time. Upstream server credentials never appear anywhere in this flow; they
+are vaulted per user by the existing ``/v1/mcp`` authorize endpoints and resolved at
+egress by user id.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+from base64 import urlsafe_b64encode
+from collections.abc import Mapping
+from datetime import datetime, timezone
+from typing import Awaitable, Callable, Literal, TypeVar
+from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
+
+from fastapi import HTTPException, Request
+from fastapi.responses import JSONResponse, RedirectResponse, Response
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+from typing_extensions import assert_never
+
+from litellm._logging import verbose_logger
+from litellm.caching.caching import DualCache
+from litellm.proxy._experimental.mcp_server.oauth_utils import (
+    TOKEN_NO_CACHE_HEADERS,
+    get_request_base_url,
+    is_loopback_redirect_host,
+    validate_redirect_uri_shape,
+)
+from litellm.proxy._experimental.mcp_server.outbound_credentials.session_credentials import (
+    SessionRefreshOpened,
+    open_session_refresh_bearer,
+    session_keys_from_master_key,
+)
+from litellm.proxy._experimental.mcp_server.outbound_credentials.session_token import (
+    SESSION_REFRESH_TTL_SECONDS,
+    MintedSessionToken,
+    SessionKeys,
+    SessionPrincipal,
+    mint_session_refresh_token,
+    mint_session_token,
+)
+from litellm.proxy.common_utils.encrypt_decrypt_utils import (
+    decrypt_value_helper,
+    encrypt_value_helper,
+)
+
+GATEWAY_DCR_CLIENT_ID_PREFIX = "llm_dcrc_"
+"""Marker prefix on every gateway-issued DCR client_id so the root authorize/token
+endpoints can route an aggregate-flow request without decrypting, and existing per-server
+flows (whose client_ids are upstream-issued) are never captured by the aggregate arm."""
+
+GATEWAY_AUTH_CODE_PREFIX = "llm_gcode_"
+"""Marker prefix on the gateway-sealed authorization code, distinct from the bridge
+``llm_bcode_`` so neither flow can consume the other's codes."""
+
+CONNECT_FLOW_COOKIE_PREFIX = "mcp_connect_flow_"
+"""Per-flow HttpOnly cookie holding the sealed connect flow, keyed by a short random
+handle carried in the connect-page URL (the same handle-plus-cookie pattern as the
+``mcp_oauth_state_`` upstream relay, for the same reasons: replica-safe with no
+server-side session store, and the sealed value never appears in a URL)."""
+
+CONNECT_FLOW_TTL_SECONDS = 600
+GATEWAY_AUTH_CODE_TTL_SECONDS = 120
+_CLAIM_TTL_BUFFER_SECONDS = 60
+_USED_CODE_CACHE_PREFIX = "mcp_gateway_dcr_code_used:"
+_USED_FLOW_CACHE_PREFIX = "mcp_gateway_dcr_flow_used:"
+_USED_REFRESH_CACHE_PREFIX = "mcp_gateway_dcr_refresh_used:"
+
+MAX_REDIRECT_URIS = 3
+MAX_REDIRECT_URI_LENGTH = 256
+MAX_CLIENT_ID_LENGTH = 2048
+"""Registration bounds. They exist to bound the sealed client_id, which rides inside
+every session-token claim set: 3 URIs of 256 bytes seal to roughly 1.2KB, comfortably
+under this cap and under the session token's own 4KB ceiling. Claude Desktop and MCP
+Inspector register one or two redirect URIs."""
+
+MAX_STATE_LENGTH = 1024
+"""Bound on the client ``state`` sealed into the flow cookie and echoed on the auth-code
+redirect. An unbounded ``state`` can push the sealed cookie past the browser's ~4KB cap
+(silently dropped, breaking the flow); spec clients send a short opaque value."""
+
+MIN_CODE_VERIFIER_LENGTH = 43
+MAX_CODE_VERIFIER_LENGTH = 128
+"""RFC 7636 section 4.1 bounds for the PKCE ``code_verifier``. Enforced so an out-of-range
+verifier gets a clean ``invalid_request`` instead of an opaque PKCE-mismatch."""
+
+_UNPREFIXED = ""
+"""Prefix for a sealed value that carries no wire marker because it is never routed by
+prefix (the connect flow lives only in its own per-handle cookie, opened by that one
+handle). Named so the empty-string argument to ``_seal`` / ``_open_sealed`` reads as
+deliberate rather than a typo."""
+
+_CLIENT_RECORD_DEBUG_KEY = "gateway_dcr_client"
+_CONNECT_FLOW_DEBUG_KEY = "gateway_connect_flow"
+_AUTH_CODE_DEBUG_KEY = "gateway_authorization_code"
+
+ReloadUserFailure = Literal["unresolvable", "unavailable", "no_active_key"]
+ReloadUser = Callable[[str], Awaitable[ReloadUserFailure | None]]
+"""Injected live-user revalidation (the token endpoint's mirror of admission):
+``None`` means the user is active; ``unavailable`` is a retryable DB outage; anything
+else fails the grant closed."""
+
+
+class GatewayDcrClient(BaseModel):
+    """The registration record sealed into a gateway DCR ``client_id``.
+
+    ``extra="forbid"`` so a sealed value of another type (an auth code, a connect flow)
+    that happened to decrypt under the shared key can never validate as a client record:
+    cross-type confusion is rejected at the model boundary, not left to differing required
+    fields."""
+
+    model_config = ConfigDict(frozen=True, extra="forbid")
+    redirect_uris: tuple[str, ...] = Field(min_length=1, max_length=MAX_REDIRECT_URIS)
+    iat: int
+
+
+class _ConnectFlow(BaseModel):
+    """One in-flight authorize: the SSO user it belongs to and the client parameters
+    needed to mint the code at the finish step. Sealed into the per-flow cookie. ``jti``
+    makes the flow single-use at complete; ``extra="forbid"`` rejects cross-type
+    confusion."""
+
+    model_config = ConfigDict(frozen=True, extra="forbid")
+    user_id: str = Field(min_length=1)
+    client_id: str = Field(min_length=1)
+    redirect_uri: str = Field(min_length=1)
+    state: str
+    code_challenge: str = Field(min_length=1)
+    jti: str = Field(min_length=1)
+    exp: int
+
+
+class _GatewayAuthCode(BaseModel):
+    """The gateway-sealed authorization code: the user consent it represents and the
+    bindings the token endpoint must verify (client, redirect URI, PKCE challenge),
+    plus a ``jti`` for the single-use guard. ``extra="forbid"`` rejects cross-type
+    confusion."""
+
+    model_config = ConfigDict(frozen=True, extra="forbid")
+    user_id: str = Field(min_length=1)
+    client_id: str = Field(min_length=1)
+    redirect_uri: str = Field(min_length=1)
+    code_challenge: str = Field(min_length=1)
+    jti: str = Field(min_length=1)
+    iat: int
+    exp: int
+
+
+def is_gateway_dcr_client_id(client_id: str | None) -> bool:
+    """Cheap prefix routing test so the root endpoints only enter the aggregate arm for
+    clients this flow registered; every other client_id keeps today's behavior."""
+    return client_id is not None and client_id.startswith(GATEWAY_DCR_CLIENT_ID_PREFIX)
+
+
+def _oauth_error(status_code: int, error: str, description: str) -> JSONResponse:
+    """RFC 6749 section 5.2 / RFC 7591 section 3.2.2 error body. Descriptions carry no
+    token, code, or URL material so they are safe to relay to any client."""
+    return JSONResponse(
+        status_code=status_code,
+        content={"error": error, "error_description": description},
+        headers=TOKEN_NO_CACHE_HEADERS,
+    )
+
+
+def _seal(prefix: str, payload: BaseModel) -> str:
+    return prefix + encrypt_value_helper(payload.model_dump_json())
+
+
+_SealedModelT = TypeVar("_SealedModelT", bound=BaseModel)
+
+
+def _open_sealed(value: str, prefix: str, model: type[_SealedModelT], debug_key: str) -> _SealedModelT | None:
+    """Open a sealed value totally: anything that is not prefix-shaped, does not decrypt,
+    or does not validate returns ``None`` for the caller to map onto an OAuth error."""
+    if not value.startswith(prefix):
+        return None
+    decrypted = decrypt_value_helper(value[len(prefix) :], debug_key, return_original_value=False)
+    if not isinstance(decrypted, str):
+        return None
+    try:
+        return model.model_validate_json(decrypted)
+    except ValidationError:
+        return None
+
+
+def open_gateway_dcr_client(client_id: str) -> GatewayDcrClient | None:
+    return _open_sealed(client_id, GATEWAY_DCR_CLIENT_ID_PREFIX, GatewayDcrClient, _CLIENT_RECORD_DEBUG_KEY)
+
+
+async def register_aggregate_client(request: Request, request_body: Mapping[str, object]) -> Response:
+    """RFC 7591 dynamic registration against the gateway itself, statelessly.
+
+    Only ``redirect_uris`` is authoritative; every client is registered as a public
+    ``token_endpoint_auth_method "none"`` client regardless of what it asked for (RFC
+    7591 lets the server override metadata), because the gateway never issues client
+    secrets: possession of a secret would add nothing over the mandatory S256 PKCE, and a
+    stateless registration has nowhere to keep one. Nothing is persisted, so open
+    registration cannot be used to fill storage.
+
+    Redirect-URI *hygiene* is not decided here: :func:`validate_redirect_uri_shape` is
+    the single owner of that rule across the MCP OAuth surface, so allowlisted native
+    callbacks (``cursor://``) are accepted and fragments, missing hosts, userinfo
+    (``https://claude.ai@attacker.example/cb``) and backslash hosts are rejected exactly
+    as they are on /authorize and /callback.
+
+    What this endpoint does decide is its own trust policy, which is deliberately wider
+    than :func:`validate_trusted_redirect_uri`'s: registration is *public*, so any https
+    client may register (that is what lets a hosted MCP client register at all), and the
+    controls are mandatory S256 PKCE plus the consent screen showing the client origin.
+    http is confined to loopback per RFC 8252 section 7.3.
+    """
+    raw_uris = request_body.get("redirect_uris")
+    if not isinstance(raw_uris, list) or not raw_uris or len(raw_uris) > MAX_REDIRECT_URIS:
+        return _oauth_error(
+            400,
+            "invalid_redirect_uri",
+            f"redirect_uris must be a list of 1 to {MAX_REDIRECT_URIS} URIs",
+        )
+    if not all(isinstance(uri, str) and len(uri) <= MAX_REDIRECT_URI_LENGTH for uri in raw_uris):
+        return _oauth_error(
+            400,
+            "invalid_redirect_uri",
+            f"each redirect URI must be a string of at most {MAX_REDIRECT_URI_LENGTH} characters",
+        )
+    for uri in raw_uris:
+        parsed = urlparse(uri)
+        try:
+            if validate_redirect_uri_shape(parsed):
+                continue  # allowlisted native callback, e.g. cursor://
+        except HTTPException as exc:
+            # The shared validator speaks HTTP; RFC 7591 registration answers with an OAuth
+            # error object, so translate the shape without re-deciding the rule.
+            return _oauth_error(400, "invalid_redirect_uri", str(exc.detail))
+        if parsed.scheme == "https" or (parsed.scheme == "http" and is_loopback_redirect_host(parsed)):
+            continue
+        return _oauth_error(
+            400,
+            "invalid_redirect_uri",
+            "each redirect URI must be https, http on a loopback host, or a registered native callback",
+        )
+    now = datetime.now(timezone.utc)
+    client_id = _seal(
+        GATEWAY_DCR_CLIENT_ID_PREFIX, GatewayDcrClient(redirect_uris=tuple(raw_uris), iat=int(now.timestamp()))
+    )
+    if len(client_id) > MAX_CLIENT_ID_LENGTH:
+        return _oauth_error(400, "invalid_client_metadata", "registered metadata is too large")
+    return JSONResponse(
+        status_code=201,
+        content={
+            "client_id": client_id,
+            "client_id_issued_at": int(now.timestamp()),
+            "redirect_uris": list(raw_uris),
+            "token_endpoint_auth_method": "none",
+            "grant_types": ["authorization_code", "refresh_token"],
+            "response_types": ["code"],
+        },
+    )
+
+
+def _flow_cookie_name(handle: str) -> str:
+    return f"{CONNECT_FLOW_COOKIE_PREFIX}{handle}"
+
+
+def _cookie_path_and_secure(request: Request) -> tuple[str, bool]:
+    parsed = urlparse(get_request_base_url(request))
+    return parsed.path or "/", parsed.scheme == "https"
+
+
+def _append_query_params(url: str, params: dict[str, str]) -> str:
+    parsed = urlparse(url)
+    query = parse_qsl(parsed.query, keep_blank_values=True) + list(params.items())
+    return urlunparse(parsed._replace(query=urlencode(query)))
+
+
+def relative_request_url(request: Request) -> str:
+    """The request's own path and query as a same-origin ``return_to`` target for the
+    login round-trip; relative by construction, so it can never leave the gateway."""
+    path = request.url.path
+    return f"{path}?{request.url.query}" if request.url.query else path
+
+
+def aggregate_authorize(
+    request: Request,
+    client_id: str,
+    redirect_uri: str,
+    state: str,
+    code_challenge: str | None,
+    code_challenge_method: str | None,
+    response_type: str | None,
+    session_user_id: str | None,
+) -> Response:
+    """The aggregate authorize verb: validate the client, require S256 PKCE, interpose
+    LiteLLM sign-in, and hand the browser to the connect page with the flow sealed into a
+    per-flow cookie.
+
+    Validation failures respond directly with 400 and never redirect: per RFC 6749
+    section 4.1.2.1 an unvalidated redirect URI must not receive an error redirect, and
+    once the client is at fault there is no trusted place to send the browser.
+    """
+    client = open_gateway_dcr_client(client_id)
+    if client is None:
+        return _oauth_error(400, "invalid_client", "unknown or malformed client_id")
+    if redirect_uri not in client.redirect_uris:
+        return _oauth_error(400, "invalid_request", "redirect_uri is not registered for this client")
+    if response_type != "code":
+        return _oauth_error(400, "unsupported_response_type", "response_type must be 'code'")
+    if not code_challenge or code_challenge_method != "S256":
+        return _oauth_error(
+            400,
+            "invalid_request",
+            "PKCE is required: send code_challenge with code_challenge_method=S256",
+        )
+    if len(state) > MAX_STATE_LENGTH:
+        return _oauth_error(400, "invalid_request", f"state must be at most {MAX_STATE_LENGTH} characters")
+    base_url = get_request_base_url(request)
+    if session_user_id is None:
+        login_url = f"{base_url}/sso/key/generate?{urlencode({'return_to': relative_request_url(request)})}"
+        return RedirectResponse(login_url, status_code=303)
+    now = datetime.now(timezone.utc)
+    handle = secrets.token_urlsafe(24)
+    flow = _ConnectFlow(
+        user_id=session_user_id,
+        client_id=client_id,
+        redirect_uri=redirect_uri,
+        state=state,
+        code_challenge=code_challenge,
+        jti=secrets.token_urlsafe(24),
+        exp=int(now.timestamp()) + CONNECT_FLOW_TTL_SECONDS,
+    )
+    connect_url = _append_query_params(
+        f"{base_url}/ui/chat/integrations",
+        {"connect_flow": handle, "connect_client": _origin_only(redirect_uri)},
+    )
+    response = RedirectResponse(connect_url, status_code=303)
+    path, secure = _cookie_path_and_secure(request)
+    response.set_cookie(
+        key=_flow_cookie_name(handle),
+        value=_seal(_UNPREFIXED, flow),
+        max_age=CONNECT_FLOW_TTL_SECONDS,
+        path=path,
+        secure=secure,
+        httponly=True,
+        samesite="lax",
+    )
+    return response
+
+
+def _origin_only(url: str) -> str:
+    """Scheme+host for display on the connect page; never the full redirect URI, whose
+    path or query could carry values that do not belong in a page URL or logs."""
+    parsed = urlparse(url)
+    return f"{parsed.scheme}://{parsed.netloc}" if parsed.netloc else ""
+
+
+async def complete_connect_flow(
+    request: Request,
+    flow_handle: str,
+    session_user_id: str | None,
+    cache: DualCache,
+) -> Response:
+    """The deliberate finish step of the connect flow: mint the gateway authorization
+    code and send the browser back to the client.
+
+    Reached by POST so a cross-site GET cannot trigger it, and bound to the HttpOnly
+    per-flow cookie plus an exact match between the signed-in user and the user sealed
+    into the flow: a link crafted by another party dies here with ``access_denied``
+    instead of minting a code for the victim's identity. The flow is single-use (an atomic
+    claim on its ``jti``), so a double-submit cannot mint two codes from one sign-in.
+    """
+    sealed_flow = request.cookies.get(_flow_cookie_name(flow_handle))
+    if sealed_flow is None:
+        return _oauth_error(400, "invalid_request", "unknown or expired connect flow")
+    flow = _open_sealed(sealed_flow, _UNPREFIXED, _ConnectFlow, _CONNECT_FLOW_DEBUG_KEY)
+    if flow is None:
+        return _oauth_error(400, "invalid_request", "unknown or expired connect flow")
+    now = datetime.now(timezone.utc)
+    if now.timestamp() >= flow.exp:
+        return _oauth_error(400, "invalid_request", "the connect flow has expired; restart the connection")
+    if session_user_id is None:
+        return _oauth_error(401, "login_required", "sign in to LiteLLM to finish connecting")
+    if session_user_id != flow.user_id:
+        return _oauth_error(403, "access_denied", "the signed-in user does not match this connect flow")
+    if not await _SingleUseGuard(cache).claim(
+        f"{_USED_FLOW_CACHE_PREFIX}{flow.jti}", CONNECT_FLOW_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS
+    ):
+        return _oauth_error(400, "invalid_request", "this connect flow was already completed; restart the connection")
+    code = _seal(
+        GATEWAY_AUTH_CODE_PREFIX,
+        _GatewayAuthCode(
+            user_id=flow.user_id,
+            client_id=flow.client_id,
+            redirect_uri=flow.redirect_uri,
+            code_challenge=flow.code_challenge,
+            jti=secrets.token_urlsafe(24),
+            iat=int(now.timestamp()),
+            exp=int(now.timestamp()) + GATEWAY_AUTH_CODE_TTL_SECONDS,
+        ),
+    )
+    params = {"code": code, **({"state": flow.state} if flow.state else {})}
+    response = RedirectResponse(_append_query_params(flow.redirect_uri, params), status_code=303)
+    path, secure = _cookie_path_and_secure(request)
+    response.delete_cookie(key=_flow_cookie_name(flow_handle), path=path, secure=secure, httponly=True, samesite="lax")
+    return response
+
+
+def _pkce_verifier_matches(code_verifier: str, code_challenge: str) -> bool:
+    """RFC 7636 S256 verification, total over hostile input. The comparison is over bytes
+    so a non-ASCII ``code_challenge`` (which reaches here unvalidated from the client's
+    authorize request) simply fails to match instead of raising ``TypeError`` the way
+    ``hmac.compare_digest`` does on two ``str`` with non-ASCII content. The verifier is
+    ASCII per spec; a compliant client's challenge is base64url and matches."""
+    digest = hashlib.sha256(code_verifier.encode("ascii", "replace")).digest()
+    computed = urlsafe_b64encode(digest).rstrip(b"=")
+    return hmac.compare_digest(computed, code_challenge.encode("utf-8"))
+
+
+class _SingleUseGuard:
+    """Atomic single-use claim for a one-time id (an auth-code, connect-flow ``jti``, or refresh-token
+    ``jti``) over the injected proxy cache.
+
+    Uses an atomic increment rather than a get-then-set: two concurrent redemptions of the same id
+    cannot both observe "unused", because exactly one increment returns 1. The claim IS the gate, so it
+    fails closed. Crucially, the increment must be recorded in a backend SHARED across replicas, or the
+    single-use property is per-worker only (each replica's in-memory counter returns 1, so a captured
+    id replays through a different worker):
+
+    - When a Redis backend is configured it is the SOLE authority: the claim goes straight to Redis
+      (``INCR`` is atomic across replicas), and any Redis fault fails the claim CLOSED — it never falls
+      back to the per-worker in-memory count (``DualCache.async_increment_cache`` does fall back, which
+      is exactly the replay window this avoids).
+    - With no Redis configured (single-replica) the in-memory increment is authoritative within the one
+      process. A multi-worker deployment must run Redis for the guarantee to hold across workers.
+
+    The id's own TTL is the outer bound. For the auth code, PKCE binding is the primary defense against
+    interception; this makes the RFC 6749 4.1.2 single-use property reliable on top of it."""
+
+    def __init__(self, cache: DualCache) -> None:
+        self._cache = cache
+
+    async def claim(self, key: str, ttl_seconds: int) -> bool:
+        """Atomically claim ``key``. ``True`` iff this caller is the first (increment to 1); ``False``
+        on a replay (>1) or when the claim could not be recorded in the shared backend (fail closed)."""
+        from litellm.proxy.proxy_server import redis_usage_cache  # noqa: PLC0415  # circular import at module load
+
+        # Resolve the shared authority HERE rather than trusting the injected cache: callers pass
+        # user_api_key_cache, which only carries a redis_cache when enable_redis_auth_cache is set
+        # (off by default), so a guard that read its injected cache silently degraded every claim to
+        # a per-worker count on a stock multi-worker deployment. redis_usage_cache is the store the
+        # proxy already treats as cross-worker, so no call site can wire the guarantee away.
+        redis_cache = redis_usage_cache or getattr(self._cache, "redis_cache", None)
+        if redis_cache is not None:
+            # Shared, atomic authority for multi-replica deployments. Claim ONLY against Redis and fail
+            # CLOSED on any Redis fault (async_increment re-raises) rather than fall back to the
+            # per-worker in-memory count, which would let each replica observe count==1 and replay the id.
+            try:
+                count = await redis_cache.async_increment(key, 1, ttl=ttl_seconds)
+            except Exception as e:  # noqa: BLE001  # ANY Redis fault fails the single-use claim closed
+                verbose_logger.warning(
+                    "mcp gateway single-use claim: shared cache backend unavailable, failing closed: %s", e
+                )
+                return False
+            return count == 1
+        # No shared backend configured (single-replica): the in-memory increment is authoritative.
+        count = await self._cache.async_increment_cache(key, 1, ttl=ttl_seconds, local_only=True)
+        return count == 1
+
+
+def _session_token_pair(principal: SessionPrincipal, keys: SessionKeys, now: datetime) -> Response:
+    access = mint_session_token(principal, keys, now)
+    refresh = mint_session_refresh_token(principal, keys, now)
+    if not isinstance(access, MintedSessionToken) or not isinstance(refresh, MintedSessionToken):
+        return _oauth_error(500, "server_error", "failed to mint the session credential")
+    return JSONResponse(
+        status_code=200,
+        content={
+            "access_token": access.token.get_secret_value(),
+            "token_type": "Bearer",
+            "expires_in": int((access.expires_at - now).total_seconds()),
+            "refresh_token": refresh.token.get_secret_value(),
+        },
+        headers=TOKEN_NO_CACHE_HEADERS,
+    )
+
+
+def _reload_failure_response(failure: ReloadUserFailure) -> Response:
+    """Map the live-user revalidation failure onto its OAuth error, exhaustively, so a new
+    ``ReloadUserFailure`` member is a type error here rather than silently 400ing."""
+    match failure:
+        case "unavailable":
+            return _oauth_error(503, "temporarily_unavailable", "the gateway database is unavailable; retry")
+        case "unresolvable":
+            return _oauth_error(500, "server_error", "the gateway is not configured to resolve users")
+        case "no_active_key":
+            return _oauth_error(400, "invalid_grant", "the user for this grant is no longer active")
+        case _:
+            assert_never(failure)
+
+
+async def aggregate_token(
+    request: Request,
+    grant_type: str,
+    code: str | None,
+    redirect_uri: str | None,
+    client_id: str,
+    code_verifier: str | None,
+    refresh_token: str | None,
+    master_key: str | None,
+    reload_user: ReloadUser,
+    cache: DualCache,
+) -> Response:
+    """The aggregate token verb: authorization_code and refresh_token grants for the
+    identity-only session pair. Every path re-validates the litellm user live before
+    minting, so a deactivated user cannot obtain or renew a session."""
+    if master_key is None:
+        verbose_logger.error("mcp_gateway_dcr token grant rejected: no master_key configured")
+        return _oauth_error(500, "server_error", "the gateway has no master key configured")
+    keys = session_keys_from_master_key(master_key)
+    now = datetime.now(timezone.utc)
+    if grant_type == "authorization_code":
+        return await _authorization_code_grant(
+            code=code,
+            redirect_uri=redirect_uri,
+            client_id=client_id,
+            code_verifier=code_verifier,
+            keys=keys,
+            now=now,
+            reload_user=reload_user,
+            guard=_SingleUseGuard(cache),
+        )
+    if grant_type == "refresh_token":
+        return await _refresh_token_grant(
+            refresh_token=refresh_token,
+            client_id=client_id,
+            keys=keys,
+            now=now,
+            reload_user=reload_user,
+            guard=_SingleUseGuard(cache),
+        )
+    return _oauth_error(400, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token")
+
+
+async def _authorization_code_grant(
+    code: str | None,
+    redirect_uri: str | None,
+    client_id: str,
+    code_verifier: str | None,
+    keys: SessionKeys,
+    now: datetime,
+    reload_user: ReloadUser,
+    guard: _SingleUseGuard,
+) -> Response:
+    if not code or not redirect_uri or not code_verifier:
+        return _oauth_error(400, "invalid_request", "code, redirect_uri, and code_verifier are required")
+    if not MIN_CODE_VERIFIER_LENGTH <= len(code_verifier) <= MAX_CODE_VERIFIER_LENGTH:
+        return _oauth_error(400, "invalid_request", "code_verifier must be 43 to 128 characters (RFC 7636)")
+    parsed = _open_sealed(code, GATEWAY_AUTH_CODE_PREFIX, _GatewayAuthCode, _AUTH_CODE_DEBUG_KEY)
+    if parsed is None:
+        return _oauth_error(400, "invalid_grant", "the authorization code is invalid")
+    if now.timestamp() >= parsed.exp:
+        return _oauth_error(400, "invalid_grant", "the authorization code has expired")
+    if client_id != parsed.client_id or redirect_uri != parsed.redirect_uri:
+        return _oauth_error(400, "invalid_grant", "the authorization code was issued to a different client")
+    if not _pkce_verifier_matches(code_verifier, parsed.code_challenge):
+        return _oauth_error(400, "invalid_grant", "PKCE verification failed")
+    # Revalidate the user BEFORE claiming the code, so a transient DB outage (a retryable
+    # 503) does not consume a still-valid code and force the client to restart sign-in.
+    failure = await reload_user(parsed.user_id)
+    if failure is not None:
+        return _reload_failure_response(failure)
+    # Atomic single-use claim is the gate: on a concurrent double-redeem exactly one caller
+    # wins, and a claim that cannot be recorded fails closed.
+    if not await guard.claim(
+        f"{_USED_CODE_CACHE_PREFIX}{parsed.jti}", GATEWAY_AUTH_CODE_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS
+    ):
+        return _oauth_error(400, "invalid_grant", "the authorization code was already used")
+    return _session_token_pair(SessionPrincipal(user_id=parsed.user_id, client_id=client_id), keys, now)
+
+
+async def _refresh_token_grant(
+    refresh_token: str | None,
+    client_id: str,
+    keys: SessionKeys,
+    now: datetime,
+    reload_user: ReloadUser,
+    guard: _SingleUseGuard,
+) -> Response:
+    if not refresh_token:
+        return _oauth_error(400, "invalid_request", "refresh_token is required")
+    opened = open_session_refresh_bearer(refresh_token, keys, now, expected_client_id=client_id)
+    if not isinstance(opened, SessionRefreshOpened):
+        return _oauth_error(400, "invalid_grant", "the refresh token is invalid for this client")
+    failure = await reload_user(opened.principal.user_id)
+    if failure is not None:
+        return _reload_failure_response(failure)
+    # Refresh-token rotation (OAuth 2.0 Security BCP section 4.13): the presented refresh token is
+    # single-use. Claim its jti before issuing the replacement pair, so a captured or replayed
+    # refresh token cannot mint a second pair after the legitimate holder rotated. Claimed AFTER
+    # user revalidation so a transient DB 503 does not burn a still-valid token; a claim that
+    # cannot be recorded fails closed, exactly like the authorization-code path.
+    if not await guard.claim(
+        f"{_USED_REFRESH_CACHE_PREFIX}{opened.jti}", SESSION_REFRESH_TTL_SECONDS + _CLAIM_TTL_BUFFER_SECONDS
+    ):
+        return _oauth_error(400, "invalid_grant", "the refresh token was already used")
+    return _session_token_pair(opened.principal, keys, now)

litellm/proxy/_experimental/mcp_server/mcp_server_manager.py

@@ -13,6 +13,7 @@ import json
 import os
 import re
 import time
+from collections.abc import Sequence
 from contextlib import asynccontextmanager
 from typing import Any, AsyncIterator, Callable, Literal, Optional, Union, cast
 from urllib.parse import urlparse
@@ -49,6 +50,10 @@ from litellm.litellm_core_utils.url_utils import SSRFError, async_safe_get
 from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
 from litellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcp import (
     MCPRequestHandler,
+    _is_mcp_admitted_user_subject,
+)
+from litellm.proxy._experimental.mcp_server.elicitation_handler import (
+    MCP_ELICITATION_AVAILABLE,
 )
 from litellm.proxy._experimental.mcp_server.exceptions import (
     MCPServerListError,
@@ -59,17 +64,14 @@ from litellm.proxy._experimental.mcp_server.faults.list_outcomes import (
     raise_classified_list_failure,
     upstream_auth_challenge,
 )
-from litellm.proxy._experimental.mcp_server.elicitation_handler import (
-    MCP_ELICITATION_AVAILABLE,
-)
-from litellm.proxy._experimental.mcp_server.sampling_handler import (
-    MCP_SAMPLING_AVAILABLE,
-)
 from litellm.proxy._experimental.mcp_server.oauth2_token_cache import (
     MCPPerUserTokenCache,
     mcp_per_user_token_cache,
     resolve_mcp_auth,
 )
+from litellm.proxy._experimental.mcp_server.oauth_utils import (
+    _redact_mcp_resource_url,
+)
 from litellm.proxy._experimental.mcp_server.outbound_credentials import (
     Error,
     Ok,
@@ -100,6 +102,9 @@ from litellm.proxy._experimental.mcp_server.outbound_credentials.types import (
     ServerSpec,
     TokenExchangeConfig,
 )
+from litellm.proxy._experimental.mcp_server.sampling_handler import (
+    MCP_SAMPLING_AVAILABLE,
+)
 from litellm.proxy._experimental.mcp_server.utils import (
     MCP_TOOL_PREFIX_SEPARATOR,
     MCPMissingUserEnvVarsError,
@@ -143,11 +148,9 @@ from litellm.types.mcp_server.mcp_server_manager import (
 from litellm.types.utils import CallTypes
 
 try:
-    from mcp.shared.tool_name_validation import (
-        validate_tool_name,  # pyright: ignore[reportAssignmentType]
-    )
     from mcp.shared.tool_name_validation import (
         SEP_986_URL,
+        validate_tool_name,  # pyright: ignore[reportAssignmentType]
     )
 except ImportError:
     from pydantic import BaseModel
@@ -408,6 +411,88 @@ def _restrict_discovery_to_corroborated_authorization_server(
     return metadata.model_copy(update={"token_url": None, "registration_url": None})
 
 
+def _redacted_origin_list(urls: Sequence[str]) -> str:
+    return ", ".join(_redact_mcp_resource_url(url) or "<unparseable url>" for url in urls)
+
+
+def _sanitized_error_text(exc: Exception) -> str:
+    return re.sub(r"https?://\S+", "<url>", str(exc))[:200]
+
+
+def _discovery_failure_leaves_needs_unresolved(
+    *,
+    needs_authorization_url: bool,
+    needs_token_url: bool,
+    manual_authorization_url: str | None,
+    manual_token_url: str | None,
+) -> bool:
+    return (needs_authorization_url and not manual_authorization_url) or (needs_token_url and not manual_token_url)
+
+
+def _warn_oauth_endpoints_unresolved(
+    *,
+    server_ref: str,
+    server_url: str | None,
+    discovery_attempted: bool,
+    issuer_anchored: bool,
+    metadata: MCPOAuthMetadata | None,
+    needs_authorization_url: bool,
+    needs_token_url: bool,
+    manual_authorization_url: str | None,
+    manual_token_url: str | None,
+) -> None:
+    """Log one actionable warning when a server that depends on OAuth endpoint discovery finishes a
+    build without the endpoints that its flows need (LIT-4658).
+
+    This is the operator-facing signal for a misconfigured server url: discovery failures themselves
+    are logged where they happen (``_descovery_metadata``), and this names WHICH server is affected,
+    which endpoints stayed unresolved after manual configuration was considered, and the remedies.
+    Scopes never trigger the warning on their own: scope-less metadata is normal for many servers and
+    warning on it every rebuild would be noise. Callers own the per-flow policy of which endpoints
+    are needed (client_credentials never needs authorization_url; OBO needs only token_url); the
+    issuer-anchored arm is excluded here because it has its own RFC 8414 §3.3 warning.
+    """
+    if issuer_anchored:
+        return
+    unresolved = tuple(
+        field
+        for field, needed, value in (
+            (
+                "authorization_url",
+                needs_authorization_url,
+                manual_authorization_url or (metadata.authorization_url if metadata else None),
+            ),
+            (
+                "token_url",
+                needs_token_url,
+                manual_token_url or (metadata.token_url if metadata else None),
+            ),
+        )
+        if needed and not value
+    )
+    if not unresolved:
+        return
+    if discovery_attempted:
+        verbose_logger.warning(
+            "MCP server %s: OAuth endpoint discovery left %s unresolved (server url origin: %s). OAuth flows "
+            "that need them will fail with 'not configured' errors until they resolve. Check the preceding "
+            "'MCP OAuth' log lines for why discovery failed, verify the configured server url, or set the "
+            "unresolved endpoint urls manually, or set issuer to discover them from the identity provider "
+            "(RFC 8414)",
+            server_ref,
+            ", ".join(unresolved),
+            _redact_mcp_resource_url(server_url) or "<no url>",
+        )
+        return
+    verbose_logger.warning(
+        "MCP server %s uses OAuth but has no discovery source (no server url or pinned issuer), and %s not "
+        "set manually. Set the missing endpoint urls on the server, or set issuer to discover them from the "
+        "identity provider (RFC 8414)",
+        server_ref,
+        " and ".join(unresolved) + (" is" if len(unresolved) == 1 else " are"),
+    )
+
+
 def invalidate_user_env_vars_cache(user_id: str, server_id: str) -> None:
     """Drop a cached entry after the user stores or clears their env var values
     so the next request reads the fresh value instead of a stale one."""
@@ -884,10 +969,10 @@ def _create_sampling_callback(user_api_key_auth: Optional[Any] = None):
         return None
 
     async def _sampling_callback(context, params):
+        import litellm
         from litellm.proxy._experimental.mcp_server.sampling_handler import (
             handle_sampling_create_message,
         )
-        import litellm
         from litellm.proxy._experimental.mcp_server.server import (
             get_active_auth_context,
         )
@@ -1284,6 +1369,15 @@ class MCPServerManager:
             should_discover = _has_oauth_discovery_source(server_url, use_issuer_anchor) and (
                 is_discovery_auth_type or obo_needs_discovery
             )
+            config_oauth2_flow = server_config.get("oauth2_flow", None)
+            needs_authorization_url = is_discovery_auth_type and config_oauth2_flow != "client_credentials"
+            needs_token_url = is_discovery_auth_type or obo_needs_discovery
+            warn_on_empty_discovery = _discovery_failure_leaves_needs_unresolved(
+                needs_authorization_url=needs_authorization_url,
+                needs_token_url=needs_token_url,
+                manual_authorization_url=manual_authorization_url,
+                manual_token_url=manual_token_url,
+            )
             if not should_discover:
                 mcp_oauth_metadata = None
             elif use_issuer_anchor and manual_issuer is not None:
@@ -1292,6 +1386,7 @@ class MCPServerManager:
                 mcp_oauth_metadata = await self._descovery_metadata(
                     server_url=server_url,
                     allow_origin_fallback=is_discovery_auth_type,
+                    warn_when_no_metadata=warn_on_empty_discovery,
                 )
 
             if use_issuer_anchor:
@@ -1326,7 +1421,6 @@ class MCPServerManager:
             )
             effective_issuer = manual_issuer or discovered_issuer
 
-            config_oauth2_flow = server_config.get("oauth2_flow", None)
             if auth_type == MCPAuth.oauth2 and config_oauth2_flow not in (
                 "client_credentials",
                 "authorization_code",
@@ -1358,6 +1452,18 @@ class MCPServerManager:
                     "authorization-code flow."
                 )
 
+            _warn_oauth_endpoints_unresolved(
+                server_ref=server_name or server_id,
+                server_url=server_url,
+                discovery_attempted=should_discover,
+                issuer_anchored=use_issuer_anchor,
+                metadata=gated_oauth_metadata,
+                needs_authorization_url=needs_authorization_url,
+                needs_token_url=needs_token_url,
+                manual_authorization_url=manual_authorization_url,
+                manual_token_url=manual_token_url,
+            )
+
             new_server = MCPServer(
                 server_id=server_id,
                 name=name_for_prefix,
@@ -1485,14 +1591,12 @@ class MCPServerManager:
         from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import (
             build_input_schema,
             create_tool_function,
+            load_openapi_spec_async,
+            resolve_operation_params,
         )
         from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import (
             get_base_url as get_openapi_base_url,
         )
-        from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import (
-            load_openapi_spec_async,
-            resolve_operation_params,
-        )
         from litellm.proxy._experimental.mcp_server.tool_registry import (
             global_mcp_tool_registry,
         )
@@ -1681,10 +1785,20 @@ class MCPServerManager:
         scopes: Optional[list[str]],
         token_exchange_endpoint: Optional[str],
     ) -> Optional[MCPOAuthMetadata]:
+        obo_needs_discovery = self._obo_needs_endpoint_discovery(auth_type, token_exchange_endpoint, manual_token_url)
+        needs_authorization_url = (
+            is_discovery_auth_type and getattr(mcp_server, "oauth2_flow", None) != "client_credentials"
+        )
+        needs_token_url = is_discovery_auth_type or obo_needs_discovery
+        warn_on_empty_discovery = _discovery_failure_leaves_needs_unresolved(
+            needs_authorization_url=needs_authorization_url,
+            needs_token_url=needs_token_url,
+            manual_authorization_url=manual_authorization_url,
+            manual_token_url=manual_token_url,
+        )
         has_all_upstream_oauth_fields = bool(manual_authorization_url and manual_token_url and scopes)
         needs_discovery = _has_oauth_discovery_source(server_url, use_issuer_anchor) and (
-            (is_discovery_auth_type and not has_all_upstream_oauth_fields)
-            or self._obo_needs_endpoint_discovery(auth_type, token_exchange_endpoint, manual_token_url)
+            (is_discovery_auth_type and not has_all_upstream_oauth_fields) or obo_needs_discovery
         )
         if not needs_discovery:
             mcp_oauth_metadata: Optional[MCPOAuthMetadata] = None
@@ -1694,24 +1808,32 @@ class MCPServerManager:
             mcp_oauth_metadata = await self._descovery_metadata(
                 server_url=server_url,  # type: ignore[arg-type]
                 allow_origin_fallback=is_discovery_auth_type,
-            )
-        if needs_discovery and not use_issuer_anchor and mcp_oauth_metadata is None:
-            verbose_logger.warning(
-                "MCP OAuth discovery yielded no metadata for server %s (%s); "
-                "OAuth endpoints/scopes stay unresolved until a rebuild succeeds",
-                mcp_server.server_id,
-                server_url,
+                warn_when_no_metadata=warn_on_empty_discovery,
             )
         if use_issuer_anchor:
             return mcp_oauth_metadata
-        if is_discovery_auth_type:
-            return _restrict_discovery_to_corroborated_authorization_server(
+        gated_metadata = (
+            _restrict_discovery_to_corroborated_authorization_server(
                 mcp_oauth_metadata,
                 manual_authorization_url,
                 mcp_server.server_id,
                 bool(getattr(mcp_server, "dcr_bridge", None)),
             )
-        return mcp_oauth_metadata
+            if is_discovery_auth_type
+            else mcp_oauth_metadata
+        )
+        _warn_oauth_endpoints_unresolved(
+            server_ref=mcp_server.alias or mcp_server.server_name or mcp_server.server_id,
+            server_url=server_url,
+            discovery_attempted=needs_discovery,
+            issuer_anchored=False,
+            metadata=gated_metadata,
+            needs_authorization_url=needs_authorization_url,
+            needs_token_url=needs_token_url,
+            manual_authorization_url=manual_authorization_url,
+            manual_token_url=manual_token_url,
+        )
+        return gated_metadata
 
     async def build_mcp_server_from_table(
         self,
@@ -2197,6 +2319,56 @@ class MCPServerManager:
 
         return [server_id for server_id in submitted_server_ids if self.get_mcp_server_by_id(server_id) is not None]
 
+    async def operator_open_server_ids(
+        self,
+        user_api_key_auth: UserAPIKeyAuth | None = None,
+        *,
+        allow_all_server_ids: list[str] | None = None,
+        submitted_server_ids: list[str] | None = None,
+    ) -> set:
+        """Servers reachable through OPEN channels rather than a grant: operator-opened
+        ``allow_all_keys`` servers, plus the caller's own active BYOM submissions when the caller
+        carries no explicit ``mcp_servers`` scope.
+
+        The single owner of that question for BOTH axes. The server union in
+        ``get_allowed_mcp_servers`` adds these ids, and the admitted subject's tool resolution asks
+        the same question to treat an open-channel server as default-open for tools — exactly how a
+        virtual key experiences it. Encoding the channel membership twice is how a server ends up
+        listable but uninvokable.
+
+        Empty inside a toolset scope: toolset_mcp_route / dynamic_mcp_route set
+        ``_mcp_active_toolset_id`` before calling the handler, pinning the request to the toolset's
+        own servers (checking op.mcp_toolsets==[] instead would false-positive on DB-default rows
+        where Postgres initialises the column to ARRAY[]::TEXT[]).
+
+        ``allow_all_server_ids`` / ``submitted_server_ids`` are injectable so the server union,
+        which precomputes both for its fallback path, does not compute them twice."""
+        from litellm.proxy._experimental.mcp_server.mcp_context import (  # noqa: PLC0415
+            _mcp_active_toolset_id,
+        )
+
+        if _mcp_active_toolset_id.get() is not None:
+            return set()
+        if allow_all_server_ids is None:
+            allow_all_server_ids = self.get_allow_all_keys_server_ids()
+        open_ids = set(allow_all_server_ids)
+        key_object_permission = user_api_key_auth.object_permission if user_api_key_auth else None
+        # "Explicitly scoped, so do not widen with BYOM" is a rule about a CREDENTIAL that carries
+        # its own mcp_servers list. It does not describe a keyless admitted subject: its
+        # object_permission is the user's own row, whose mcp_servers column is [] by DB default, so
+        # applying this rule would hide almost every admitted user's OWN submitted servers. Their
+        # submissions are theirs by authorship, and their scope comes from the per-source union.
+        has_explicit_object_permission = (
+            not _is_mcp_admitted_user_subject(user_api_key_auth)
+            and key_object_permission is not None
+            and (key_object_permission.mcp_servers is not None)
+        )
+        if not has_explicit_object_permission:
+            if submitted_server_ids is None:
+                submitted_server_ids = await self._get_active_submitted_mcp_server_ids_for_user(user_api_key_auth)
+            open_ids.update(submitted_server_ids)
+        return open_ids
+
     async def get_allowed_mcp_servers(self, user_api_key_auth: Optional[UserAPIKeyAuth] = None) -> list[str]:
         """
         Get the allowed MCP Servers for the user.
@@ -2210,11 +2382,22 @@ class MCPServerManager:
 
         allow_all_server_ids = self.get_allow_all_keys_server_ids()
 
+        # A keyless admitted subject is resolved per grant source, and channel decisions that are
+        # absolute for a scoped KEY credential are not absolute for it: its own opt-out silences its
+        # own source (handled per source in the resolver), never its teams' grants, and its admin
+        # role does not swallow the grant model — a session bearer is a third-party client
+        # credential, not the dashboard, so an admin signing in through the connect flow gets their
+        # grants like anyone else rather than handing the client the full registry ahead of every
+        # per-team org ceiling.
+        is_admitted_subject = _is_mcp_admitted_user_subject(user_api_key_auth)
+
         # The key explicitly opted out of every MCP server. Return zero before
         # layering on allow_all_keys or submitted servers so the opt-out is absolute.
         key_object_permission = user_api_key_auth.object_permission if user_api_key_auth else None
-        if key_object_permission is not None and (
-            SpecialMCPServerNames.no_mcp_servers.value in (key_object_permission.mcp_servers or [])
+        if (
+            not is_admitted_subject
+            and key_object_permission is not None
+            and (SpecialMCPServerNames.no_mcp_servers.value in (key_object_permission.mcp_servers or []))
         ):
             return []
 
@@ -2234,8 +2417,14 @@ class MCPServerManager:
         )
 
         try:
-            # If admin but NO explicit object permission, get all servers
-            if user_api_key_auth and _user_has_admin_view(user_api_key_auth) and not has_explicit_object_permission:
+            # If admin but NO explicit object permission, get all servers (never for an admitted
+            # subject — see is_admitted_subject above)
+            if (
+                user_api_key_auth
+                and not is_admitted_subject
+                and _user_has_admin_view(user_api_key_auth)
+                and not has_explicit_object_permission
+            ):
                 verbose_logger.debug("Admin user without explicit object_permission - returning all servers")
                 return list(self.get_registry().keys())
 
@@ -2243,20 +2432,14 @@ class MCPServerManager:
             allowed_mcp_servers = await MCPRequestHandler.get_allowed_mcp_servers(user_api_key_auth)
             verbose_logger.debug(f"Allowed MCP Servers for user api key auth: {allowed_mcp_servers}")
             combined_servers = set(allowed_mcp_servers)
-            # Only skip allow_all_keys servers when the request is inside a toolset
-            # scope.  toolset_mcp_route / dynamic_mcp_route set _mcp_active_toolset_id
-            # before calling the handler — that ContextVar is the reliable signal.
-            # Using op.mcp_toolsets==[] would false-positive on DB-default rows where
-            # Postgres initialises the column to ARRAY[]::TEXT[].
-            from litellm.proxy._experimental.mcp_server.mcp_context import (  # noqa: PLC0415
-                _mcp_active_toolset_id,
+            combined_servers.update(
+                await self.operator_open_server_ids(
+                    user_api_key_auth,
+                    allow_all_server_ids=allow_all_server_ids,
+                    submitted_server_ids=submitted_server_ids,
+                )
             )
 
-            in_toolset_scope = _mcp_active_toolset_id.get() is not None
-            if not in_toolset_scope:
-                combined_servers.update(allow_all_server_ids)
-                combined_servers.update(submitted_server_ids)
-
             # For anonymous callers (no user_id, no role), also surface any
             # servers the operator has opted into upstream-delegated auth.
             # These servers handle their own auth at the upstream level, so
@@ -2903,9 +3086,7 @@ class MCPServerManager:
             )
         ):
             spec = None
-        auth_value = (
-            await resolve_mcp_auth(server, mcp_auth_header, subject_token=subject_token) if spec is None else None
-        )
+        auth_value = await resolve_mcp_auth(server, mcp_auth_header) if spec is None else None
 
         # Create sampling and elicitation callbacks for this client
         sampling_cb = _create_sampling_callback(user_api_key_auth=user_api_key_auth) if server.allow_sampling else None
@@ -3430,6 +3611,7 @@ class MCPServerManager:
         server_url: str,
         *,
         allow_origin_fallback: bool = True,
+        warn_when_no_metadata: bool = False,
     ) -> Optional[MCPOAuthMetadata]:
         """Discover OAuth metadata by following RFC 9728 (protected resource metadata discovery).
 
@@ -3438,8 +3620,32 @@ class MCPServerManager:
         it (a human sees the redirect), but token_exchange (OBO) sets it False so the gateway never
         exchanges a subject token against an endpoint it inferred rather than one explicitly configured
         or authoritatively advertised via RFC 9728 / RFC 8414.
-        """
 
+        ``warn_when_no_metadata`` makes an all-empty result log one WARNING with the per-step attempt
+        outcomes (LIT-4658), so a misconfigured server url is diagnosable from default-level logs. The
+        server loaders set it; the issuer-anchored resource-scopes lookup keeps it off because empty
+        scopes are not a fault there.
+        """
+        metadata, attempts = await self._discover_metadata_recording_attempts(
+            server_url, allow_origin_fallback=allow_origin_fallback
+        )
+        if metadata is None and warn_when_no_metadata:
+            verbose_logger.warning(
+                "MCP OAuth endpoint discovery against %s found no authorization server metadata. Attempts: %s. "
+                "The MCP server url may be misconfigured, or the upstream may not support OAuth discovery "
+                "(RFC 9728 / RFC 8414)",
+                _redact_mcp_resource_url(server_url) or "<unparseable url>",
+                "; ".join(attempts) if attempts else "none recorded",
+            )
+        return metadata
+
+    async def _discover_metadata_recording_attempts(
+        self,
+        server_url: str,
+        *,
+        allow_origin_fallback: bool,
+    ) -> tuple[MCPOAuthMetadata | None, tuple[str, ...]]:
+        origin = _redact_mcp_resource_url(server_url) or "<unparseable url>"
         try:
             client = get_async_httpx_client(llm_provider=httpxSpecialProvider.MCP)
             response = await client.get(server_url)
@@ -3452,67 +3658,112 @@ class MCPServerManager:
             if metadata is None and not resource_scopes and authorization_servers and response.status_code == 200:
                 verbose_logger.warning(
                     "MCP OAuth discovery for %s received 200 OK without RFC 9728 challenge and no discoverable authorization metadata.",
-                    server_url,
+                    origin,
                 )
+            attempts = (
+                f"GET {origin}: HTTP {response.status_code} (no RFC 9728 challenge)",
+                *(
+                    ("well-known protected-resource lookup found no authorization servers",)
+                    if not authorization_servers
+                    else ()
+                ),
+                *(
+                    (f"authorization server metadata fetch failed for: {_redacted_origin_list(authorization_servers)}",)
+                    if authorization_servers and metadata is None
+                    else ()
+                ),
+            )
             if metadata is None and resource_scopes:
-                return MCPOAuthMetadata(scopes=resource_scopes)
+                return MCPOAuthMetadata(scopes=resource_scopes), attempts
             if metadata is not None and resource_scopes:
                 metadata.scopes = resource_scopes
-            return metadata
+            return metadata, attempts
         except HTTPStatusError as exc:
-            verbose_logger.debug(
-                "MCP OAuth discovery for %s received status error: %s",
-                server_url,
-                exc,
-            )
-
-            header_value: Optional[str] = None
-            if exc.response is not None:
-                header_value = exc.response.headers.get("WWW-Authenticate") or exc.response.headers.get(
-                    "www-authenticate"
-                )
-
-            resource_metadata_url, scopes = self._parse_www_authenticate_header(header_value)
-
-            authorization_servers = []
-            resource_scopes = None
-            if resource_metadata_url:
-                (
-                    authorization_servers,
-                    resource_scopes,
-                ) = await self._fetch_oauth_metadata_from_resource(resource_metadata_url, server_url)
-            else:
-                (
-                    authorization_servers,
-                    resource_scopes,
-                ) = await self._attempt_well_known_discovery(server_url)
-
-            metadata = None
-            used_origin_fallback = False
-            if allow_origin_fallback and not authorization_servers:
-                try:
-                    parsed_url = urlparse(server_url)
-                    if parsed_url.scheme and parsed_url.netloc:
-                        authorization_servers = [f"{parsed_url.scheme}://{parsed_url.netloc}"]
-                        used_origin_fallback = True
-                except Exception:
-                    authorization_servers = []
-
-            if authorization_servers:
-                metadata = await self._fetch_authorization_server_metadata(authorization_servers, server_url)
-                if metadata is not None and used_origin_fallback:
-                    metadata.from_origin_fallback = True
-
-            preferred_scopes = scopes or resource_scopes
-            if metadata is None and preferred_scopes:
-                metadata = MCPOAuthMetadata(scopes=preferred_scopes)
-            elif metadata is not None and preferred_scopes:
-                metadata.scopes = preferred_scopes
-
-            return metadata
+            return await self._discover_after_status_error(server_url, exc, allow_origin_fallback=allow_origin_fallback)
         except Exception as exc:  # pragma: no cover - network/transient issues
             verbose_logger.debug("MCP OAuth discovery failed for %s: %s", server_url, exc)
-            return None
+            return None, (f"GET {origin}: {type(exc).__name__}: {_sanitized_error_text(exc)}",)
+
+    async def _discover_after_status_error(
+        self,
+        server_url: str,
+        exc: HTTPStatusError,
+        *,
+        allow_origin_fallback: bool,
+    ) -> tuple[MCPOAuthMetadata | None, tuple[str, ...]]:
+        origin = _redact_mcp_resource_url(server_url) or "<unparseable url>"
+        verbose_logger.debug(
+            "MCP OAuth discovery for %s received status error: %s",
+            server_url,
+            exc,
+        )
+
+        header_value: Optional[str] = None
+        if exc.response is not None:
+            header_value = exc.response.headers.get("WWW-Authenticate") or exc.response.headers.get("www-authenticate")
+        status_attempt = (
+            f"GET {origin}: HTTP {exc.response.status_code}"
+            if exc.response is not None
+            else f"GET {origin}: status error"
+        )
+
+        resource_metadata_url, scopes = self._parse_www_authenticate_header(header_value)
+
+        authorization_servers = []
+        resource_scopes = None
+        if resource_metadata_url:
+            (
+                authorization_servers,
+                resource_scopes,
+            ) = await self._fetch_oauth_metadata_from_resource(resource_metadata_url, server_url)
+            lookup_attempt = (
+                None
+                if authorization_servers
+                else "challenge-advertised resource metadata yielded no authorization servers"
+            )
+        else:
+            (
+                authorization_servers,
+                resource_scopes,
+            ) = await self._attempt_well_known_discovery(server_url)
+            lookup_attempt = (
+                None
+                if authorization_servers
+                else "no challenge-advertised resource metadata; well-known protected-resource lookup found no authorization servers"
+            )
+
+        metadata = None
+        used_origin_fallback = False
+        if allow_origin_fallback and not authorization_servers:
+            try:
+                parsed_url = urlparse(server_url)
+                if parsed_url.scheme and parsed_url.netloc:
+                    authorization_servers = [f"{parsed_url.scheme}://{parsed_url.netloc}"]
+                    used_origin_fallback = True
+            except Exception:
+                authorization_servers = []
+
+        fallback_attempt = None
+        if authorization_servers:
+            metadata = await self._fetch_authorization_server_metadata(authorization_servers, server_url)
+            if metadata is not None and used_origin_fallback:
+                metadata.from_origin_fallback = True
+            if metadata is None:
+                fallback_attempt = (
+                    f"origin fallback: no authorization server metadata at {origin}"
+                    if used_origin_fallback
+                    else f"authorization server metadata fetch failed for: {_redacted_origin_list(authorization_servers)}"
+                )
+
+        attempts = tuple(entry for entry in (status_attempt, lookup_attempt, fallback_attempt) if entry)
+
+        preferred_scopes = scopes or resource_scopes
+        if metadata is None and preferred_scopes:
+            return MCPOAuthMetadata(scopes=preferred_scopes), attempts
+        if metadata is not None and preferred_scopes:
+            metadata.scopes = preferred_scopes
+
+        return metadata, attempts
 
     def _parse_www_authenticate_header(self, header_value: Optional[str]) -> tuple[Optional[str], Optional[list[str]]]:
         if not header_value:

litellm/proxy/_experimental/mcp_server/oauth2_token_cache.py

@@ -26,7 +26,6 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import (
     decrypt_value_helper,
     encrypt_value_helper,
 )
-from litellm.proxy._experimental.mcp_server.auth import token_exchange
 from litellm.proxy._experimental.mcp_server.auth.token_endpoint_auth import (
     build_token_endpoint_client_auth,
 )
@@ -58,17 +57,12 @@ class MCPOAuth2TokenCache(InMemoryCache):
     def _has_client_credentials_config(server: "MCPServer") -> bool:
         return bool(server.client_id and server.client_secret and server.token_url)
 
-    async def async_get_token(
-        self,
-        server: "MCPServer",
-        *,
-        require_client_credentials_flow: bool = True,
-    ) -> Optional[str]:
+    async def async_get_token(self, server: "MCPServer") -> Optional[str]:
         """Return a valid access token, fetching or refreshing as needed.
 
         Returns ``None`` when the server lacks client credentials config.
         """
-        if require_client_credentials_flow and not server.has_client_credentials:
+        if not server.has_client_credentials:
             return None
         if not self._has_client_credentials_config(server):
             return None
@@ -278,36 +272,16 @@ mcp_per_user_token_cache = MCPPerUserTokenCache()
 async def resolve_mcp_auth(
     server: "MCPServer",
     mcp_auth_header: Optional[Union[str, Dict[str, str]]] = None,
-    subject_token: Optional[str] = None,
 ) -> Optional[Union[str, Dict[str, str]]]:
     """Resolve the auth value for an MCP server.
 
     Priority:
     1. ``mcp_auth_header`` — per-request/per-user override
-    2. OAuth2 Token Exchange (OBO / RFC 8693) — exchange user token for scoped token
-    3. OAuth2 client_credentials token — auto-fetched and cached
-    4. ``server.authentication_token`` — static token from config/DB
+    2. OAuth2 client_credentials token — auto-fetched and cached
+    3. ``server.authentication_token`` — static token from config/DB
     """
     if mcp_auth_header:
         return mcp_auth_header
-    if server.has_token_exchange_config:
-        if subject_token:
-            return await token_exchange.mcp_token_exchange_handler.exchange_token(subject_token, server)
-        # No subject_token — fall back to client_credentials using the same client
-        # credentials and token_url so M2M scenarios still work.
-        if server.client_id and server.client_secret and server.token_url:
-            return await mcp_oauth2_token_cache.async_get_token(
-                server,
-                require_client_credentials_flow=False,
-            )
-        # OBO configured but no subject_token and missing client credentials — warn
-        # rather than silently proceeding unauthenticated.
-        verbose_logger.warning(
-            "MCP server '%s' is configured for token exchange (OBO) but no subject_token "
-            "was provided and client credentials (client_id/client_secret/token_url) are "
-            "incomplete. The request will proceed without authentication.",
-            server.server_id,
-        )
     if server.has_client_credentials:
         return await mcp_oauth2_token_cache.async_get_token(server)
     return server.authentication_token

litellm/proxy/_experimental/mcp_server/oauth_utils.py

@@ -4,7 +4,7 @@
 import os
 from ipaddress import ip_address
 from typing import Any, Dict, List, NoReturn, Optional
-from urllib.parse import ParseResult, urlparse, urlunparse
+from urllib.parse import ParseResult, urlparse, urlsplit, urlunparse, urlunsplit
 
 from fastapi import HTTPException, Request
 
@@ -70,6 +70,29 @@ def _origin_label(scheme: str, netloc: str) -> str:
     return f"{scheme}://{netloc}" if netloc else f"{scheme}://"
 
 
+def _redact_mcp_resource_url(url: Optional[str]) -> Optional[str]:
+    """Reduce an MCP server URL to its origin (scheme + host + port) for logging.
+
+    Everything else is dropped: userinfo (``user:pass@``), the query string, the
+    fragment, and the path, because hosted MCP servers routinely embed the
+    credential in the path (e.g. ``/mcp/s/<token>``) and this value is persisted
+    in spend-log metadata that a caller who can invoke the tool can read back.
+    Returns None when the URL has no host to identify (nothing safe to log).
+    """
+    if not isinstance(url, str) or not url:
+        return None
+    try:
+        parts = urlsplit(url)
+        hostname = parts.hostname
+        port = parts.port
+    except ValueError:
+        return None
+    if not hostname:
+        return None
+    netloc = f"{hostname}:{port}" if port else hostname
+    return urlunsplit((parts.scheme, netloc, "", "", "")) or None
+
+
 def _resolve_proxy_base_url_env() -> Optional[str]:
     global _warned_invalid_proxy_base_url
     configured = os.environ.get("PROXY_BASE_URL", "").strip()
@@ -343,8 +366,36 @@ def _parse_redirect_uri_for_validation(redirect_uri: str) -> ParseResult:
         )
 
 
-def _validate_trusted_http_redirect_shape(parsed: ParseResult) -> bool:
-    """Return True when ``parsed`` is an allowlisted native callback (caller may return)."""
+def is_loopback_redirect_host(parsed: ParseResult) -> bool:
+    """True when the redirect host is loopback (RFC 8252 section 7.3).
+
+    Shared by every redirect-URI policy in the MCP OAuth surface so that none of them
+    hand-rolls its own host list: a literal ``("localhost", "127.0.0.1", "::1")`` tuple
+    silently misses the rest of 127.0.0.0/8 and IPv6-mapped forms.
+    """
+    host = (parsed.hostname or "").lower()
+    if host == "localhost":
+        return True
+    try:
+        return ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
+def validate_redirect_uri_shape(parsed: ParseResult) -> bool:
+    """Validate redirect-URI *hygiene* and resolve allowlisted native callbacks.
+
+    Returns True when ``parsed`` is an allowlisted native callback (the caller may accept
+    it outright); returns False for http/https, leaving the trust decision to the caller;
+    raises for a URI that no policy should ever accept (bad scheme, fragment, missing
+    host, userinfo, backslash in the host).
+
+    This is deliberately separate from :func:`validate_trusted_redirect_uri`, which adds
+    the *first-party* trust policy (same-origin, loopback, ops allowlist) appropriate to
+    the proxy's own OAuth endpoints. Public dynamic-client registration accepts any https
+    client and relies on PKCE plus the consent screen instead, so it shares this hygiene
+    rule but not that trust policy.
+    """
     if parsed.scheme not in ("http", "https"):
         if _matches_trusted_native_redirect_uri(parsed):
             return True
@@ -396,14 +447,8 @@ def _trusted_redirect_uri_is_allowed(
         ):
             return True
 
-    host = (parsed.hostname or "").lower()
-    if host == "localhost":
+    if is_loopback_redirect_host(parsed):
         return True
-    try:
-        if ip_address(host).is_loopback:
-            return True
-    except ValueError:
-        pass
 
     if parsed.scheme == "https":
         for entry in _parse_trusted_redirect_origins():
@@ -522,7 +567,7 @@ def validate_trusted_redirect_uri(request: Request, redirect_uri: str) -> None:
     :func:`validate_loopback_redirect_uri`.
     """
     parsed = _parse_redirect_uri_for_validation(redirect_uri)
-    if _validate_trusted_http_redirect_shape(parsed):
+    if validate_redirect_uri_shape(parsed):
         return
     redirect_netloc = _strip_default_port(parsed.scheme, parsed.netloc)
     proxy_base = _resolve_proxy_base_for_redirect(request)

litellm/proxy/_experimental/mcp_server/outbound_credentials/session_credentials.py

@@ -149,6 +149,7 @@ class SessionRefreshOpened(BaseModel):
     model_config = ConfigDict(frozen=True)
     tag: Literal["opened"] = "opened"
     principal: SessionPrincipal
+    jti: str
 
 
 class SessionRefreshInvalid(BaseModel):
@@ -187,4 +188,4 @@ def open_session_refresh_bearer(
         return SessionRefreshInvalid()
     if opened.principal.client_id != expected_client_id:
         return SessionRefreshInvalid()
-    return SessionRefreshOpened(principal=opened.principal)
+    return SessionRefreshOpened(principal=opened.principal, jti=opened.jti)

litellm/proxy/_experimental/mcp_server/outbound_credentials/session_token.py

@@ -113,10 +113,12 @@ class MintedSessionToken(BaseModel):
 
 
 class OpenedSessionToken(BaseModel):
-    """A validated session token of either kind: the principal it was minted for."""
+    """A validated session token of either kind: the principal it was minted for, plus the
+    ``jti`` so the token endpoint can enforce single-use rotation on a refresh token."""
 
     model_config = ConfigDict(frozen=True)
     principal: SessionPrincipal
+    jti: str
 
 
 class SessionTokenTooLarge(BaseModel):
@@ -320,7 +322,9 @@ def _open(
         return SessionMalformed()
     if now.timestamp() >= claims.exp:
         return SessionExpired()
-    return OpenedSessionToken(principal=SessionPrincipal(user_id=claims.user_id, client_id=claims.client_id))
+    return OpenedSessionToken(
+        principal=SessionPrincipal(user_id=claims.user_id, client_id=claims.client_id), jti=claims.jti
+    )
 
 
 def _decode_claims(

litellm/proxy/_experimental/mcp_server/rest_endpoints.py

@@ -230,16 +230,33 @@ if MCP_AVAILABLE:
                 return server_auth
         return mcp_auth_header
 
-    def _get_oauth2_server_ids(allowed_server_ids: List[str]) -> Set[str]:
-        """Return the subset of *allowed_server_ids* whose servers use OAuth2 auth.
+    def _is_v1_resolved_oauth2_server(server: Optional[MCPServer]) -> bool:
+        """Whether this server's per-user OAuth2 token is still resolved by v1.
 
-        Used as a cheap pre-flight check to skip bulk credential fetching when no
-        OAuth2 servers are involved in the current request.
+        A server the v2 resolver owns reads its stored token from the resolver at connect
+        time and drops any Authorization built for it here, so the v1 lookup would be a DB
+        round-trip whose result is discarded. Mirrors the same guard on the protocol listing
+        path and in ``_resolve_oauth2_headers_for_tool_call``.
+        """
+        from litellm.proxy._experimental.mcp_server.outbound_credentials.adapter import (
+            to_server_spec,
+        )
+
+        if getattr(server, "auth_type", None) != MCPAuth.oauth2:
+            return False
+        return to_server_spec(server) is None
+
+    def _v1_resolved_oauth2_server_ids(allowed_server_ids: List[str]) -> Set[str]:
+        """Return the subset of *allowed_server_ids* whose per-user OAuth2 token is still
+        resolved by v1.
+
+        Used as a cheap pre-flight check to skip bulk credential fetching when no such
+        server is involved in the current request.
         """
         return {
             sid
             for sid in allowed_server_ids
-            if getattr(global_mcp_server_manager.get_mcp_server_by_id(sid), "auth_type", None) == MCPAuth.oauth2
+            if _is_v1_resolved_oauth2_server(global_mcp_server_manager.get_mcp_server_by_id(sid))
         }
 
     async def _get_user_oauth_extra_headers(
@@ -253,11 +270,13 @@ if MCP_AVAILABLE:
         the MCP server the same way the admin "Add MCP / Authorize and Fetch" flow does.
         Returns None for non-OAuth2 servers or when no credential is stored.
 
+        A server the v2 resolver owns is skipped; see ``_is_v1_resolved_oauth2_server``.
+
         Args:
             prefetched_creds: Optional dict keyed by server_id with credential payloads.
                               When provided, avoids a per-server DB round-trip.
         """
-        if getattr(server, "auth_type", None) != MCPAuth.oauth2:
+        if not _is_v1_resolved_oauth2_server(server):
             return None
         user_id = getattr(user_api_key_dict, "user_id", None)
         server_id = getattr(server, "server_id", None)
@@ -320,38 +339,6 @@ if MCP_AVAILABLE:
             verbose_logger.warning(f"_prefetch_user_oauth_creds: failed to prefetch for user={user_id}: {e}")
             return {}
 
-    async def _get_bulk_user_oauth_headers(
-        user_api_key_dict: UserAPIKeyAuth,
-    ) -> Dict[str, Dict[str, str]]:
-        """
-        Fetch ALL OAuth2 credentials for the current user in a single DB query and
-        return a mapping of server_id → {"Authorization": "Bearer <token>"}.
-
-        This is the batch alternative to calling _get_user_oauth_extra_headers
-        per-server inside a loop (N+1 DB queries).
-        """
-        user_id = getattr(user_api_key_dict, "user_id", None)
-        if not user_id:
-            return {}
-        try:
-            from litellm.proxy._experimental.mcp_server.db import (
-                list_user_oauth_credentials,
-            )
-            from litellm.proxy.utils import get_prisma_client_or_throw
-
-            prisma_client = get_prisma_client_or_throw(
-                "Database not connected. Connect a database to use OAuth2 MCP tools."
-            )
-            creds = await list_user_oauth_credentials(prisma_client, user_id)
-            return {
-                c["server_id"]: {"Authorization": f"Bearer {c['access_token']}"}
-                for c in creds
-                if c.get("access_token") and c.get("server_id")
-            }
-        except Exception:
-            verbose_logger.debug("Failed to bulk-fetch OAuth credentials", exc_info=True)
-            return {}
-
     def _create_tool_response_objects(tools, server: MCPServer):
         """Helper function to create tool response objects.
 
@@ -825,7 +812,7 @@ if MCP_AVAILABLE:
                 # to avoid an unnecessary DB round-trip on requests with no OAuth2 MCP servers.
                 prefetched_oauth_creds = (
                     await _prefetch_user_oauth_creds(user_api_key_dict)
-                    if _get_oauth2_server_ids(allowed_server_ids)
+                    if _v1_resolved_oauth2_server_ids(allowed_server_ids)
                     else {}
                 )
 

litellm/proxy/_experimental/mcp_server/server.py

@@ -27,7 +27,6 @@ from typing import (
     Union,
     cast,
 )
-from urllib.parse import urlsplit, urlunsplit
 
 import httpx
 from fastapi import FastAPI, HTTPException
@@ -59,6 +58,9 @@ from litellm.proxy._experimental.mcp_server.mcp_context import (
     _mcp_gateway_server_name,
 )
 from litellm.proxy._experimental.mcp_server.mcp_debug import MCPDebug
+from litellm.proxy._experimental.mcp_server.oauth_utils import (
+    _redact_mcp_resource_url,
+)
 from litellm.proxy._experimental.mcp_server.utils import (
     LITELLM_MCP_SERVER_DESCRIPTION,
     LITELLM_MCP_SERVER_NAME,
@@ -106,27 +108,6 @@ _MAX_STATEFUL_SESSIONS_PER_OWNER = 100
 _MCP_ROUTING_PEEK_MAX_BYTES = 4096
 
 
-def _redact_mcp_resource_url(url: Optional[str]) -> Optional[str]:
-    """Reduce an MCP server URL to its origin (scheme + host + port) for logging.
-
-    Everything else is dropped: userinfo (``user:pass@``), the query string, the
-    fragment, and the path, because hosted MCP servers routinely embed the
-    credential in the path (e.g. ``/mcp/s/<token>``) and this value is persisted
-    in spend-log metadata that a caller who can invoke the tool can read back.
-    Returns None when the URL has no host to identify (nothing safe to log).
-    """
-    if not isinstance(url, str) or not url:
-        return None
-    try:
-        parts = urlsplit(url)
-    except ValueError:
-        return None
-    if not parts.hostname:
-        return None
-    netloc = f"{parts.hostname}:{parts.port}" if parts.port else parts.hostname
-    return urlunsplit((parts.scheme, netloc, "", "", "")) or None
-
-
 def _invalidate_byok_cred_cache(user_id: str, server_id: str) -> None:
     """Remove a (user_id, server_id) entry from the BYOK credential cache.
 
@@ -977,7 +958,17 @@ if MCP_AVAILABLE:
                     data = await add_litellm_data_to_request(
                         data=body_data,
                         request=request,
-                        user_api_key_dict=user_api_key_auth,
+                        # Bill a team-derived call to the team that granted it. A keyless admitted
+                        # subject carries no team_id, so spend skipped team updates entirely and
+                        # charged the user's PRIMARY org — the granting team's budget never
+                        # accumulated (so it could never begin to block) and, cross-org, the wrong
+                        # organization was charged. This is the ACCOUNTING half; the enforcement
+                        # half (an already-over-budget team stops granting) lives in the source gate.
+                        # Authorization is unaffected: it ran before this, and the union is resolved
+                        # from the untouched auth object passed to call_mcp_tool below.
+                        user_api_key_dict=await MCPRequestHandler.billing_auth_for_tool_call(
+                            user_api_key_auth, tool_name=name
+                        ),
                         proxy_config=proxy_config,
                     )
                 else:

litellm/proxy/_lazy_openapi_snapshot.json

@@ -26762,6 +26762,113 @@
           "title": "ToolPolicyUpdateResponse",
           "type": "object"
         },
+        "ToolSpendDailyEntry": {
+          "description": "Spend attributed to one tool on one UTC day.",
+          "properties": {
+            "call_count": {
+              "default": 0,
+              "title": "Call Count",
+              "type": "integer"
+            },
+            "date": {
+              "title": "Date",
+              "type": "string"
+            },
+            "spend": {
+              "default": 0.0,
+              "title": "Spend",
+              "type": "number"
+            },
+            "tool_name": {
+              "title": "Tool Name",
+              "type": "string"
+            }
+          },
+          "required": [
+            "date",
+            "tool_name"
+          ],
+          "title": "ToolSpendDailyEntry",
+          "type": "object"
+        },
+        "ToolSpendEntry": {
+          "description": "Total spend attributed to one tool over the requested window.",
+          "properties": {
+            "call_count": {
+              "default": 0,
+              "title": "Call Count",
+              "type": "integer"
+            },
+            "spend": {
+              "default": 0.0,
+              "description": "Attributed spend: a request that used several tools counts its full spend toward each of them",
+              "title": "Spend",
+              "type": "number"
+            },
+            "tool_name": {
+              "title": "Tool Name",
+              "type": "string"
+            },
+            "total_tokens": {
+              "default": 0,
+              "title": "Total Tokens",
+              "type": "integer"
+            }
+          },
+          "required": [
+            "tool_name"
+          ],
+          "title": "ToolSpendEntry",
+          "type": "object"
+        },
+        "ToolSpendResponse": {
+          "properties": {
+            "by_tool": {
+              "items": {
+                "$ref": "#/components/schemas/ToolSpendEntry"
+              },
+              "title": "By Tool",
+              "type": "array"
+            },
+            "daily": {
+              "items": {
+                "$ref": "#/components/schemas/ToolSpendDailyEntry"
+              },
+              "title": "Daily",
+              "type": "array"
+            },
+            "end_date": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "End Date"
+            },
+            "start_date": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "title": "Start Date"
+            },
+            "total_spend": {
+              "default": 0.0,
+              "description": "Deduplicated spend of every request that called at least one tool in the window; less than the sum of per-tool attributed spend whenever multi-tool requests exist",
+              "title": "Total Spend",
+              "type": "number"
+            }
+          },
+          "title": "ToolSpendResponse",
+          "type": "object"
+        },
         "ToolUsageLogEntry": {
           "description": "One spend log row for a tool call (for UI \"recent logs\" table).",
           "properties": {
@@ -26858,6 +26965,13 @@
         },
         "ValidationError": {
           "properties": {
+            "ctx": {
+              "title": "Context",
+              "type": "object"
+            },
+            "input": {
+              "title": "Input"
+            },
             "loc": {
               "items": {
                 "anyOf": [
@@ -27301,6 +27415,81 @@
           ]
         }
       },
+      "/v1/tool/spend": {
+        "get": {
+          "description": "Spend attributed to each tool over a date range, for the Cost Optimization dashboard.\n\nJoins ``LiteLLM_SpendLogToolIndex`` (which tool names ran on which request) to\n``LiteLLM_SpendLogs`` (what the request cost). A request that used multiple tools\ncounts its full spend toward each of those tools, so per-tool numbers are\nattributions. ``total_spend`` is the deduplicated spend of every request that\ncalled at least one tool in the window, so it never double counts.",
+          "operationId": "get_tool_spend_v1_tool_spend_get",
+          "parameters": [
+            {
+              "description": "YYYY-MM-DD (defaults to 30 days ago)",
+              "in": "query",
+              "name": "start_date",
+              "required": false,
+              "schema": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "YYYY-MM-DD (defaults to 30 days ago)",
+                "title": "Start Date"
+              }
+            },
+            {
+              "description": "YYYY-MM-DD (defaults to today)",
+              "in": "query",
+              "name": "end_date",
+              "required": false,
+              "schema": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "YYYY-MM-DD (defaults to today)",
+                "title": "End Date"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/ToolSpendResponse"
+                  }
+                }
+              },
+              "description": "Successful Response"
+            },
+            "422": {
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/HTTPValidationError"
+                  }
+                }
+              },
+              "description": "Validation Error"
+            }
+          },
+          "security": [
+            {
+              "APIKeyHeader": []
+            }
+          ],
+          "summary": "Get Tool Spend",
+          "tags": [
+            "tools"
+          ]
+        }
+      },
       "/v1/tool/{tool_name}": {
         "get": {
           "description": "Get details for a single tool.",

litellm/proxy/_types.py

@@ -1868,6 +1868,17 @@ class UpdateTeamRequest(LiteLLMPydanticObjectBase):
     default_team_member_models: Optional[List[str]] = None  # default allowed_models seeded onto new team members
 
 
+class PatchTeamRequest(UpdateTeamRequest):
+    """
+    Body of PATCH /team/{team_id}.
+
+    Identical to UpdateTeamRequest except team_id is optional, because PATCH takes it
+    from the path. A team_id in the body is still accepted when it matches the path.
+    """
+
+    team_id: str | None = None
+
+
 class ResetTeamBudgetRequest(LiteLLMPydanticObjectBase):
     """
     internal type used to reset the budget on a team
@@ -2607,6 +2618,28 @@ class UserAPIKeyAuth(LiteLLM_VerificationTokenView):  # the expected response ob
     user_max_budget: Optional[float] = None
     request_route: Optional[str] = None
     is_session_token: bool = False
+    # Server-only marker set exclusively by the MCP gateway admission path
+    # (_reload_admitted_user) for a keyless user-subject admitted via a gateway DCR session
+    # bearer or bridge envelope. Not a DB column and never populated from caller-controlled key
+    # metadata or JWT claims, so it cannot be forged to gain the team-inherited MCP grant union
+    # or to escape the caller-Authorization egress scrub. exclude=True keeps it out of serialization.
+    mcp_admitted_user_subject: bool = Field(default=False, exclude=True)
+    # team_id -> that team's mcp_rpm_limit map, for a keyless admitted subject that reaches MCP
+    # servers through several teams at once and therefore has no single team_id for the limiter to
+    # key off. Server-only and stripped from validated input for the same reason as the marker
+    # above: a forged entry would let a caller pick which team's rpm bucket it is charged against.
+    mcp_source_team_rpm_limits: dict[str, dict[str, int]] | None = Field(default=None, exclude=True)
+    via_virtual_key: bool = Field(
+        default=False,
+        exclude=True,
+        description=(
+            "Server-only marker set exclusively by the DB virtual-key and master-key auth paths via "
+            "post-construction assignment. Stripped from validated input so custom auth handlers, JWT "
+            "claims, or key metadata cannot forge it. Gates overwrite_user_with_key_hash stamping: only "
+            "a credential the proxy itself validated as a key may be forwarded as the provider-facing "
+            "user id."
+        ),
+    )
     budget_reservation: Optional[Dict[str, Any]] = Field(default=None, exclude=True)
     budget_throttle_pct: Optional[float] = Field(default=None, exclude=True)
     user: Optional[Any] = None  # Expanded user object when expand=user is used
@@ -2627,6 +2660,12 @@ class UserAPIKeyAuth(LiteLLM_VerificationTokenView):  # the expected response ob
         # If values is already an instance (not a dict), return it as-is
         if not isinstance(values, dict):
             return values
+        # mcp_admitted_user_subject is a server-only marker, set ONLY by the MCP gateway admission
+        # path via post-construction assignment. Strip it from any validated input (constructor
+        # kwargs, model_validate, a JWT/key claim splat) so it can never be forged from caller data.
+        values.pop("mcp_admitted_user_subject", None)
+        values.pop("mcp_source_team_rpm_limits", None)
+        values.pop("via_virtual_key", None)
         if values.get("api_key") is not None:
             values.update({"token": cls._safe_hash_litellm_api_key(values.get("api_key"))})
             if isinstance(values.get("api_key"), str):
@@ -2781,6 +2820,31 @@ class LiteLLM_OrganizationTableUpdate(LiteLLM_BudgetTable):
         return values
 
 
+class OrganizationUpdateRequestV2(LiteLLMPydanticObjectBase):
+    """
+    Typed PATCH body for ``/v2/organization/{organization_id}`` (RFC 7396 merge-patch).
+
+    Presence is read from ``model_fields_set``, so a sent field is written and an omitted one is
+    left untouched. ``extra="forbid"`` makes an unknown key a 422 rather than a silent no-op, since
+    the contract hinges on which keys are present. See the endpoint for the per-field clear tokens.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    organization_alias: str | None = None
+    models: list[str] | None = None
+    metadata: dict | None = None
+    tpm_limit: int | None = None
+    rpm_limit: int | None = None
+    max_budget: float | None = None
+    soft_budget: float | None = None
+    max_parallel_requests: int | None = None
+    model_max_budget: dict | None = None
+    budget_duration: str | None = None
+    logging_exporters: list[str] | None = None
+    object_permission: LiteLLM_ObjectPermissionBase | None = None
+
+
 from litellm.models.organization import (  # noqa: E402
     LiteLLM_OrganizationTable as LiteLLM_OrganizationTable,
 )

litellm/proxy/auth/auth_checks.py

@@ -2661,6 +2661,15 @@ async def get_managed_vector_store_rows_by_uuids(
     return result
 
 
+class OrganizationNotFoundError(Exception):
+    """The organization row is CONFIRMED absent, as opposed to a lookup that failed.
+
+    Subclasses Exception so every existing except Exception caller keeps its current
+    behavior; it exists so a caller that wants to treat "no such org" as "no restriction" can do
+    that WITHOUT also swallowing an outage and silently dropping a real org ceiling.
+    """
+
+
 @log_db_metrics
 async def get_org_object(
     org_id: str,
@@ -2707,25 +2716,30 @@ async def get_org_object(
             query_kwargs["include"] = {"litellm_budget_table": True}
 
         response = await OrganizationRepository(prisma_client).table.find_unique(**query_kwargs)
-
-        if response is None:
-            raise Exception
-
-        _org_obj = LiteLLM_OrganizationTable(**response.model_dump())
-        # Cache the result
-        await user_api_key_cache.async_set_cache(
-            key=cache_key,
-            value=_org_obj,
-            model_type=LiteLLM_OrganizationTable,
-            ttl=DEFAULT_IN_MEMORY_TTL,
-        )
-
-        return _org_obj
     except Exception:
-        raise Exception(
+        # An operational failure (DB down, timeout, cache fault) is NOT the same fact as a confirmed
+        # missing row, and relabelling it as "doesn't exist" made every caller unable to tell them
+        # apart — a caller that treats absence as "this org places no restriction" then drops a real
+        # org ceiling during an outage. Propagate the real error; callers that already catch
+        # Exception are unaffected.
+        raise
+
+    if response is None:
+        raise OrganizationNotFoundError(
             f"Organization doesn't exist in db. Organization={org_id}. Create organization via `/organization/new` call."
         )
 
+    _org_obj = LiteLLM_OrganizationTable(**response.model_dump())
+    # Cache the result
+    await user_api_key_cache.async_set_cache(
+        key=cache_key,
+        value=_org_obj,
+        model_type=LiteLLM_OrganizationTable,
+        ttl=DEFAULT_IN_MEMORY_TTL,
+    )
+
+    return _org_obj
+
 
 async def _get_resources_from_access_groups(
     access_group_ids: List[str],

litellm/proxy/auth/auth_utils.py

@@ -3,7 +3,7 @@ import re
 import sys
 from functools import lru_cache
 from logging import Logger
-from typing import Any, Dict, FrozenSet, List, Mapping, Optional, Tuple, Union
+from typing import Any, Dict, FrozenSet, Iterator, List, Mapping, Optional, Tuple, Union
 
 from fastapi import HTTPException, Request, status
 
@@ -12,7 +12,12 @@ from litellm import Router, provider_list
 from litellm._logging import verbose_proxy_logger
 from litellm.constants import MINIMUM_CUSTOM_KEY_LENGTH, STANDARD_CUSTOMER_ID_HEADERS
 from litellm.litellm_core_utils.safe_json_loads import safe_json_loads
-from litellm.litellm_core_utils.url_utils import SSRFError, validate_url
+from litellm.litellm_core_utils.url_utils import (
+    SSRFError,
+    is_url_destination_allowed_by_host,
+    provider_url_destination_candidates,
+    validate_url,
+)
 from litellm.proxy._types import *
 from litellm.types.passthrough_endpoints.pass_through_endpoints import (
     LITELLM_PASS_THROUGH_ENDPOINT_MARKER,
@@ -290,6 +295,7 @@ _BANNED_REQUEST_BODY_PARAMS: Tuple[str, ...] = (
     "use_ssl",
     # SDK-only field; also rejected outright in is_request_body_safe.
     "model_list",
+    "vertex_ai_credentials",
     # Observability credentials, hosts, and project identifiers: derived
     # from the canonical ``_supported_callback_params`` allowlist so new
     # integrations are covered automatically. Sorted for stable iteration
@@ -342,6 +348,60 @@ def _check_banned_params(
         )
 
 
+_FALLBACK_FIELDS: tuple[str, ...] = (
+    "fallbacks",
+    "context_window_fallbacks",
+    "content_policy_fallbacks",
+)
+
+
+def _iter_fallback_field_values(request_body: Mapping[str, object]) -> Iterator[object]:
+    override = request_body.get("router_settings_override")
+    for source in (request_body, override):
+        if isinstance(source, Mapping):
+            for field in _FALLBACK_FIELDS:
+                yield source.get(field)
+
+
+def _iter_fallback_targets(value: object, depth: int) -> Iterator[str | Mapping[str, object]]:
+    if depth > 2 * litellm.ROUTER_MAX_FALLBACKS:
+        raise ValueError("Rejected Request: fallback nesting exceeds the allowed validation depth.")
+    if not isinstance(value, list):
+        return
+    for item in value:
+        if isinstance(item, str):
+            yield item
+        elif isinstance(item, Mapping):
+            values = tuple(item.values())
+            if not (values and all(isinstance(v, list) for v in values)):
+                yield item
+            if isinstance(item.get("model"), str):
+                for field in _FALLBACK_FIELDS:
+                    yield from _iter_fallback_targets(item.get(field), depth + 1)
+            else:
+                for target_list in values:
+                    yield from _iter_fallback_targets(target_list, depth + 1)
+
+
+def iter_request_fallback_targets(request_body: Mapping[str, object]) -> Iterator[str | Mapping[str, object]]:
+    for value in _iter_fallback_field_values(request_body):
+        yield from _iter_fallback_targets(value, 0)
+
+
+def _reject_url_valued_fallback_target(value: str) -> None:
+    allowed_hosts = getattr(litellm, "provider_url_destination_allowed_hosts", []) or []
+    for candidate in provider_url_destination_candidates(value):
+        if not candidate.lower().startswith(("http://", "https://")):
+            continue
+        if is_url_destination_allowed_by_host(candidate, allowed_hosts):
+            continue
+        raise ValueError(
+            f"Rejected Request: URL-valued fallback destination '{value}' is not allowed. "
+            "Configure custom endpoints with api_base instead, or add the destination host to "
+            "`provider_url_destination_allowed_hosts` in litellm_settings."
+        )
+
+
 def is_request_body_safe(request_body: dict, general_settings: dict, llm_router: Optional[Router], model: str) -> bool:
     """
     Check if the request body is safe.
@@ -379,6 +439,14 @@ def is_request_body_safe(request_body: dict, general_settings: dict, llm_router:
         metadata = _coerce_metadata_to_dict(request_body.get(metadata_key))
         if metadata is not None:
             _check_banned_params(metadata, general_settings, llm_router, model)
+    for target in iter_request_fallback_targets(request_body):
+        if isinstance(target, dict):
+            _check_banned_params(target, general_settings, llm_router, model)
+            target_model = target.get("model")
+            if isinstance(target_model, str):
+                _reject_url_valued_fallback_target(target_model)
+        elif isinstance(target, str):
+            _reject_url_valued_fallback_target(target)
     litellm_params = _coerce_metadata_to_dict(request_body.get("litellm_params"))
     if litellm_params is not None:
         litellm_params_metadata = _coerce_metadata_to_dict(litellm_params.get("metadata"))

litellm/proxy/auth/login_utils.py

@@ -7,12 +7,15 @@ login endpoints (e.g., /login and /v2/login).
 
 import os
 import secrets
+from datetime import datetime, timedelta, timezone
 from typing import Literal, Optional, cast
 
+import jwt
 from fastapi import HTTPException
 
 import litellm
 from litellm.constants import LITELLM_PROXY_ADMIN_NAME, LITELLM_UI_SESSION_DURATION
+from litellm.litellm_core_utils.duration_parser import duration_in_seconds
 from litellm.proxy._types import (
     LiteLLM_UserTable,
     LitellmUserRoles,
@@ -313,6 +316,29 @@ async def authenticate_user(
         )
 
 
+def _ui_session_exp_timestamp() -> int:
+    """The ``exp`` claim (unix seconds) for a UI session cookie, ``LITELLM_UI_SESSION_DURATION``
+    from now. The virtual key sealed inside the cookie already expires after this same
+    duration; stamping the JWT itself gives the cookie the bounded lifetime the dashboard's
+    client-side expiry check and the server-side session-cookie readers both assume, instead
+    of a token that stays signature-valid until the master key rotates."""
+    ttl_seconds = duration_in_seconds(LITELLM_UI_SESSION_DURATION)
+    return int((datetime.now(timezone.utc) + timedelta(seconds=ttl_seconds)).timestamp())
+
+
+def encode_ui_session_jwt(returned_ui_token_object: ReturnedUITokenObject, master_key: str) -> str:
+    """Encode a UI session cookie JWT with a bounded ``exp``.
+
+    The single choke point every UI login path (SSO and username/password /login, /v2,
+    /v3) uses to mint the ``token`` cookie, so the cookie's lifetime is set in exactly one
+    place and cannot drift between paths. Without the ``exp`` the cookie is valid until the
+    master key rotates, and the session-cookie readers that require a bounded lifetime
+    (the MCP interactive sign-in) reject it.
+    """
+    claims = {**cast(dict, returned_ui_token_object), "exp": _ui_session_exp_timestamp()}
+    return jwt.encode(claims, master_key, algorithm="HS256")
+
+
 def create_ui_token_object(
     login_result: LoginResult,
     general_settings: dict,

litellm/proxy/auth/user_api_key_auth.py

@@ -14,7 +14,7 @@ import secrets
 
 import orjson
 from datetime import datetime, timezone
-from typing import Any, Dict, Iterator, NamedTuple, List, Optional, Protocol, Tuple, Union, cast
+from typing import Any, Dict, NamedTuple, List, Optional, Protocol, Tuple, Union, cast
 
 import fastapi
 from fastapi import HTTPException, Request, WebSocket, status
@@ -58,6 +58,7 @@ from litellm.proxy.auth.auth_utils import (
     get_model_from_request,
     get_request_route,
     get_request_route_template,
+    iter_request_fallback_targets,
     normalize_request_route,
     pre_db_read_auth_checks,
     route_in_additonal_public_routes,
@@ -1538,6 +1539,13 @@ async def _user_api_key_auth_builder(
                             check_cache_only=True,
                         ).resolve(hashed_token=hash_token(api_key))
                     )
+                # Key-cache entries are written only after the proxy validated a
+                # virtual key or the master key, but via_virtual_key is exclude=True
+                # so serialization drops it; restore it at this trusted boundary.
+                # The UI-login JWT fallback below constructs its token from a
+                # decrypted blob, not this cache, and stays unmarked.
+                if isinstance(valid_token, UserAPIKeyAuth):
+                    valid_token.via_virtual_key = True
             except Exception:
                 verbose_logger.debug("api key not found in cache.")
                 valid_token = None
@@ -1655,6 +1663,7 @@ async def _user_api_key_auth_builder(
             _user_api_key_obj = update_valid_token_with_end_user_params(
                 valid_token=_user_api_key_obj, end_user_params=end_user_params
             )
+            _user_api_key_obj.via_virtual_key = True
 
             return _user_api_key_obj
 
@@ -2064,7 +2073,7 @@ async def _user_api_key_auth_builder(
             # No token was found when looking up in the DB
             raise Exception("Invalid proxy server token passed")
         if valid_token_dict is not None:
-            return await _return_user_api_key_auth_obj(
+            virtual_key_auth_obj = await _return_user_api_key_auth_obj(
                 user_obj=user_obj,
                 api_key=api_key,
                 parent_otel_span=parent_otel_span,
@@ -2072,6 +2081,8 @@ async def _user_api_key_auth_builder(
                 route=route,
                 start_time=start_time,
             )
+            virtual_key_auth_obj.via_virtual_key = True
+            return virtual_key_auth_obj
     except Exception as e:
         return await UserAPIKeyAuthExceptionHandler._handle_authentication_error(
             e=e,
@@ -2485,6 +2496,7 @@ async def _reserve_budget_after_common_checks(
         end_user_id=end_user_id,
         end_user_object=end_user_object,
         skip_user_budget_on_team_key=general_settings.get("skip_user_budget_on_team_key") is True,
+        fail_closed_budget_enforcement=general_settings.get("fail_closed_budget_enforcement") is True,
     )
 
 
@@ -2854,19 +2866,11 @@ async def _enforce_key_and_fallback_model_access(
                 llm_router=llm_router,
             )
 
-        # Validate every fallback model name reachable by this request.
-        # All three fields (``fallbacks``, ``context_window_fallbacks``,
-        # ``content_policy_fallbacks``) are forwarded to the router as
-        # per-request kwargs whether they appear at the top level of
-        # ``request_data`` or nested under ``router_settings_override``.
-        # Both surfaces must be validated against the API key's model
-        # allowlist or a caller can smuggle a restricted model. VERIA-44.
-        fallback_names: List[str] = []
-        override_settings = request_data.get("router_settings_override")
-        for _fb_key in ROUTER_FALLBACK_FIELDS:
-            fallback_names.extend(iter_router_fallback_model_names(request_data.get(_fb_key)))
-            if isinstance(override_settings, dict):
-                fallback_names.extend(iter_router_fallback_model_names(override_settings.get(_fb_key)))
+        fallback_names = tuple(
+            name
+            for target in iter_request_fallback_targets(request_data)
+            if (name := _fallback_target_model_name(target)) is not None
+        )
 
         for _name in dict.fromkeys(fallback_names):  # dedupe, preserve order
             await can_key_call_model(
@@ -2882,36 +2886,14 @@ async def _enforce_key_and_fallback_model_access(
             )
 
 
-ROUTER_FALLBACK_FIELDS: Tuple[str, ...] = (
-    "fallbacks",
-    "context_window_fallbacks",
-    "content_policy_fallbacks",
-)
-
-
-def iter_router_fallback_model_names(fallbacks: Any) -> Iterator[str]:
-    """Yield leaf model names from any of the supported fallbacks shapes.
-
-    Handles the simple top-level shape (``str`` or ``{"model": str}``) and
-    the nested router-config shape (``[{primary: [fallback_list]}]``).
-    """
-    if not isinstance(fallbacks, list):
-        return
-    for entry in fallbacks:
-        if isinstance(entry, str):
-            yield entry
-        elif isinstance(entry, dict):
-            if isinstance(entry.get("model"), str):
-                yield entry["model"]
-                continue
-            for fallback_list in entry.values():
-                if not isinstance(fallback_list, list):
-                    continue
-                for m in fallback_list:
-                    if isinstance(m, str):
-                        yield m
-                    elif isinstance(m, dict) and isinstance(m.get("model"), str):
-                        yield m["model"]
+def _fallback_target_model_name(target: object) -> str | None:
+    if isinstance(target, str):
+        return target
+    if isinstance(target, dict):
+        model = target.get("model")
+        if isinstance(model, str):
+            return model
+    return None
 
 
 async def _run_post_custom_auth_checks(

litellm/proxy/client/cli/README.md

@@ -523,7 +523,7 @@ export LITELLM_PROXY_API_KEY=sk-...
 lite model-groups list [--format table|json]
 ```
 
-Lists the model groups your key can reach on the proxy, via `/model_group/info`, along with each group's mode (`chat`, `embedding`, etc.) and per-token pricing. This is also what `lite autoroute configure` uses internally to discover what it can offer you.
+Lists the model groups your key can reach on the proxy, via `/model_group/info`, along with each group's mode (`chat`, `embedding`, etc.) and per-token pricing. Note this route needs management access; `lite autoroute configure` instead discovers models through `/v1/models`, so it works with a key scoped to just the AI API routes
 
 #### Configure the Auto-Router
 

litellm/proxy/client/cli/commands/autoroute/config.py

@@ -15,41 +15,25 @@ class DiscoveredModel(BaseModel):
 
     name: str
     mode: str = "chat"
-    input_cost_per_token: float | None = None
-    output_cost_per_token: float | None = None
 
 
-class _RawModelGroup(BaseModel):
+class _RawModelListing(BaseModel):
     model_config = ConfigDict(extra="ignore")
 
-    model_group: str
-    # Optional: some real deployments return an explicit `"mode": null` for models that
-    # were registered without a mode (seen for embedding models like voyage-4-large).
-    # ModelGroupInfo's own "chat" default (litellm/types/router.py) only applies when the
-    # key is missing entirely, not when it's present as null, so this must tolerate None.
-    mode: str | None = "chat"
-    input_cost_per_token: float | None = None
-    output_cost_per_token: float | None = None
+    id: str
+    # /v1/models attaches "mode" (sourced from the cost map) only for models it can resolve;
+    # a model whose mode is unknown arrives without the field, so default it to chat rather
+    # than dropping it, which keeps it selectable as a routing target in the wizard.
+    mode: str = "chat"
 
 
-_RAW_MODEL_GROUPS_ADAPTER = TypeAdapter(list[_RawModelGroup])
+_RAW_MODEL_LISTING_ADAPTER = TypeAdapter(list[_RawModelListing])
 
 
 def parse_discovered_models(raw: list[JsonValue]) -> tuple[DiscoveredModel, ...]:
-    """Validate a raw `/model_group/info` response into typed models."""
-    parsed = _RAW_MODEL_GROUPS_ADAPTER.validate_python(raw)
-    return tuple(
-        DiscoveredModel(
-            name=group.model_group,
-            # A null mode means the server genuinely doesn't know what this model does;
-            # "unknown" (rather than guessing "chat") keeps it out of both chat_models()
-            # and embedding_models() instead of risking a wrong-mode deployment.
-            mode=group.mode or "unknown",
-            input_cost_per_token=group.input_cost_per_token,
-            output_cost_per_token=group.output_cost_per_token,
-        )
-        for group in parsed
-    )
+    """Validate a raw `/v1/models` response into typed models."""
+    parsed = _RAW_MODEL_LISTING_ADAPTER.validate_python(raw)
+    return tuple(DiscoveredModel(name=item.id, mode=item.mode) for item in parsed)
 
 
 def chat_models(models: tuple[DiscoveredModel, ...]) -> tuple[DiscoveredModel, ...]:

litellm/proxy/client/cli/commands/autoroute/wizard.py

@@ -111,12 +111,12 @@ def run_configure_wizard(ctx: click.Context) -> Path:
     api_key = ctx.obj["api_key"]
     client = Client(base_url=base_url, api_key=api_key)
 
-    raw_groups = client.model_groups.info()
-    if not isinstance(raw_groups, list):
+    raw_models = client.models.list()
+    if not isinstance(raw_models, list):
         raise click.ClickException(
-            f"Unexpected response from /model_group/info: expected a list, got {type(raw_groups).__name__}"
+            f"Unexpected response from /v1/models: expected a list, got {type(raw_models).__name__}"
         )
-    discovered = parse_discovered_models(raw_groups)
+    discovered = parse_discovered_models(raw_models)
     chat_pool = chat_models(discovered)
     embedding_pool = embedding_models(discovered)
 

litellm/proxy/common_utils/callback_utils.py

@@ -1,4 +1,5 @@
 import copy
+import os
 from typing import TYPE_CHECKING, Any, Callable, Dict, Iterable, List, Literal, Optional
 
 import litellm
@@ -564,11 +565,8 @@ def process_callback(_callback: str, callback_type: str, environment_variables:
 
     env_vars_dict: dict[str, str | None] = {}
     for _var in env_vars:
-        env_variable = environment_variables.get(_var, None)
-        if env_variable is None:
-            env_vars_dict[_var] = None
-        else:
-            env_vars_dict[_var] = env_variable
+        stored_value = environment_variables.get(_var, None)
+        env_vars_dict[_var] = stored_value if stored_value is not None else os.getenv(_var)
 
     return {"name": _callback, "variables": env_vars_dict, "type": callback_type}
 

litellm/proxy/config_resolvers/__init__.py

@@ -0,0 +1,9 @@
+"""Typed, provenance-aware resolution of proxy settings from DB then env."""
+
+from litellm.proxy.config_resolvers._descriptors import (
+    FieldDescriptor,
+    FieldSource,
+    resolve_fields,
+)
+
+__all__ = ["FieldDescriptor", "FieldSource", "resolve_fields"]

litellm/proxy/config_resolvers/_descriptors.py

@@ -0,0 +1,73 @@
+"""Shared primitive for resolving a settings value from its sources.
+
+A ``FieldDescriptor`` names, for one setting, where it lives in the stored DB
+row (``db_key``), which process env var carries it (``env_var``), whether it is
+a secret, and its effective default. ``resolve_fields`` reconciles a set of
+descriptors against a decrypted DB row and the process environment with a fixed
+precedence, returning the resolved values plus per-field provenance so a caller
+can tell whether a value came from the database, the environment, a default, or
+is unset.
+"""
+
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import Literal
+
+FieldSource = Literal["db", "env", "default", "unset"]
+
+
+@dataclass(frozen=True, slots=True)
+class FieldDescriptor:
+    field_name: str
+    db_key: str
+    env_var: str
+    is_secret: bool = False
+    default: str | None = None
+
+
+def _db_is_set(db_value: object, empty_db_is_set: bool) -> bool:
+    if empty_db_is_set:
+        # A stored key that is present, even as "", is an explicit admin choice
+        # (e.g. clearing an alerting webhook) and must win over a stale env var.
+        return db_value is not None
+    # A blank stored value is treated as absent, so it falls through to env. This
+    # fits settings whose clear path also unsets the env var (e.g. SSO).
+    return isinstance(db_value, str) and bool(db_value.strip())
+
+
+def _resolve_one(
+    descriptor: FieldDescriptor,
+    db_values: Mapping[str, object],
+    env: Mapping[str, str],
+    empty_db_is_set: bool,
+) -> tuple[str, str | None, FieldSource]:
+    db_value = db_values.get(descriptor.db_key)
+    if _db_is_set(db_value, empty_db_is_set):
+        return descriptor.field_name, db_value if isinstance(db_value, str) else str(db_value), "db"
+    env_value = env.get(descriptor.env_var)
+    if isinstance(env_value, str) and env_value.strip():
+        return descriptor.field_name, env_value, "env"
+    if descriptor.default is not None:
+        return descriptor.field_name, descriptor.default, "default"
+    return descriptor.field_name, None, "unset"
+
+
+def resolve_fields(
+    descriptors: Sequence[FieldDescriptor],
+    db_values: Mapping[str, object],
+    env: Mapping[str, str],
+    empty_db_is_set: bool = False,
+) -> tuple[dict[str, str | None], dict[str, FieldSource]]:
+    """Resolve every descriptor to (values, provenance).
+
+    Precedence per field: a set stored value wins, else a non-blank process env
+    var, else the descriptor default, else unset. ``empty_db_is_set`` selects
+    how a present-but-empty stored value is read: ``False`` treats it as absent
+    so it falls back to env (SSO, whose clear path also unsets the env var);
+    ``True`` treats it as an explicit clear that wins over env (alerting, whose
+    clear path stores "" without unsetting the env var).
+    """
+    resolved = tuple(_resolve_one(descriptor, db_values, env, empty_db_is_set) for descriptor in descriptors)
+    values = {field_name: value for field_name, value, _ in resolved}
+    provenance = {field_name: source for field_name, _, source in resolved}
+    return values, provenance

litellm/proxy/config_resolvers/alerting.py

@@ -0,0 +1,25 @@
+"""Descriptor tables for the alerting settings surfaced by /get/config/callbacks.
+
+These reconcile the stored ``environment_variables`` blob (keyed by the
+uppercase env-var names) with the process environment. SMTP_PORT and SMTP_TLS
+carry the same effective defaults the mail-send path applies, so the settings
+page shows the config that mail would actually use rather than a blank.
+"""
+
+from litellm.proxy.config_resolvers._descriptors import FieldDescriptor
+
+EMAIL_DESCRIPTORS: tuple[FieldDescriptor, ...] = (
+    FieldDescriptor("SMTP_HOST", "SMTP_HOST", "SMTP_HOST"),
+    FieldDescriptor("SMTP_PORT", "SMTP_PORT", "SMTP_PORT", default="587"),
+    FieldDescriptor("SMTP_TLS", "SMTP_TLS", "SMTP_TLS", default="True"),
+    FieldDescriptor("SMTP_USERNAME", "SMTP_USERNAME", "SMTP_USERNAME", is_secret=True),
+    FieldDescriptor("SMTP_PASSWORD", "SMTP_PASSWORD", "SMTP_PASSWORD", is_secret=True),
+    FieldDescriptor("SMTP_SENDER_EMAIL", "SMTP_SENDER_EMAIL", "SMTP_SENDER_EMAIL"),
+    FieldDescriptor("TEST_EMAIL_ADDRESS", "TEST_EMAIL_ADDRESS", "TEST_EMAIL_ADDRESS"),
+    FieldDescriptor("EMAIL_LOGO_URL", "EMAIL_LOGO_URL", "EMAIL_LOGO_URL"),
+    FieldDescriptor("EMAIL_SUPPORT_CONTACT", "EMAIL_SUPPORT_CONTACT", "EMAIL_SUPPORT_CONTACT"),
+)
+
+SLACK_DESCRIPTORS: tuple[FieldDescriptor, ...] = (
+    FieldDescriptor("SLACK_WEBHOOK_URL", "SLACK_WEBHOOK_URL", "SLACK_WEBHOOK_URL", is_secret=True),
+)

litellm/proxy/config_resolvers/sso.py

@@ -0,0 +1,98 @@
+"""Resolved SSO config object.
+
+Reconciles the dedicated ``sso_config`` DB row (lowercase, per-value encrypted
+keys) with the process environment (uppercase env vars) into a typed
+``SSOConfig`` plus per-field provenance. This is the single source of truth for
+the SSO field -> env-var mapping, used by both the read-back endpoint and the
+save endpoint so the two can never drift.
+"""
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+from litellm.proxy.common_utils.encrypt_decrypt_utils import decrypt_value_helper
+from litellm.proxy.config_resolvers._descriptors import (
+    FieldDescriptor,
+    FieldSource,
+    resolve_fields,
+)
+from litellm.types.proxy.management_endpoints.ui_sso import (
+    RoleMappings,
+    SSOConfig,
+    TeamMappings,
+)
+
+SSO_DESCRIPTORS: tuple[FieldDescriptor, ...] = (
+    FieldDescriptor("google_client_id", "google_client_id", "GOOGLE_CLIENT_ID"),
+    FieldDescriptor("google_client_secret", "google_client_secret", "GOOGLE_CLIENT_SECRET", is_secret=True),
+    FieldDescriptor("microsoft_client_id", "microsoft_client_id", "MICROSOFT_CLIENT_ID"),
+    FieldDescriptor("microsoft_client_secret", "microsoft_client_secret", "MICROSOFT_CLIENT_SECRET", is_secret=True),
+    FieldDescriptor("microsoft_tenant", "microsoft_tenant", "MICROSOFT_TENANT"),
+    FieldDescriptor("generic_client_id", "generic_client_id", "GENERIC_CLIENT_ID"),
+    FieldDescriptor("generic_client_secret", "generic_client_secret", "GENERIC_CLIENT_SECRET", is_secret=True),
+    FieldDescriptor(
+        "generic_authorization_endpoint", "generic_authorization_endpoint", "GENERIC_AUTHORIZATION_ENDPOINT"
+    ),
+    FieldDescriptor("generic_token_endpoint", "generic_token_endpoint", "GENERIC_TOKEN_ENDPOINT"),
+    FieldDescriptor("generic_userinfo_endpoint", "generic_userinfo_endpoint", "GENERIC_USERINFO_ENDPOINT"),
+    FieldDescriptor("generic_scope", "generic_scope", "GENERIC_SCOPE", default="openid email profile"),
+    FieldDescriptor("saml_idp_metadata_url", "saml_idp_metadata_url", "SAML_IDP_METADATA_URL"),
+    FieldDescriptor("saml_idp_metadata_xml", "saml_idp_metadata_xml", "SAML_IDP_METADATA_XML"),
+    FieldDescriptor("saml_sp_entity_id", "saml_sp_entity_id", "SAML_SP_ENTITY_ID"),
+    FieldDescriptor("saml_allow_unsolicited", "saml_allow_unsolicited", "SAML_ALLOW_UNSOLICITED"),
+    FieldDescriptor("proxy_base_url", "proxy_base_url", "PROXY_BASE_URL"),
+)
+
+# Derived from the descriptor table so read (masking) and the field->env mapping
+# never diverge from the resolver.
+SSO_SECRET_FIELDS: frozenset[str] = frozenset(d.field_name for d in SSO_DESCRIPTORS if d.is_secret)
+SSO_FIELD_ENV_VARS: dict[str, str] = {d.field_name: d.env_var for d in SSO_DESCRIPTORS}
+
+# Structured sub-objects stored on the SSO row that are not simple env-backed
+# scalars; handled outside the descriptor resolution.
+_STRUCTURED_KEYS = ("role_mappings", "team_mappings")
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedSSOConfig:
+    config: SSOConfig
+    provenance: dict[str, FieldSource]
+
+
+def _decrypt(raw: Mapping[str, object]) -> dict[str, object]:
+    return {
+        key: (
+            decrypt_value_helper(value=value, key=key, return_original_value=True) if isinstance(value, str) else value
+        )
+        for key, value in raw.items()
+    }
+
+
+def _parse_role_mappings(data: object) -> RoleMappings | None:
+    # The stored row is JSON, so mappings arrive as a dict (or are absent).
+    return RoleMappings(**data) if isinstance(data, dict) else None
+
+
+def _parse_team_mappings(data: object) -> TeamMappings | None:
+    return TeamMappings(**data) if isinstance(data, dict) else None
+
+
+def resolve_sso_config(sso_db_settings: Mapping[str, object] | None, env: Mapping[str, str]) -> ResolvedSSOConfig:
+    """Resolve the effective SSO config: stored row first, then process env.
+
+    Decryption happens here, once, via the pure ``decrypt_value_helper``; this
+    function never writes ``os.environ`` (unlike the legacy read path). Values
+    are returned unmasked so the login path could consume them; the read-back
+    endpoint is responsible for masking secrets before responding to the UI.
+    """
+    raw = dict(sso_db_settings) if sso_db_settings else {}
+    decrypted = _decrypt({key: value for key, value in raw.items() if key not in _STRUCTURED_KEYS})
+    values, provenance = resolve_fields(SSO_DESCRIPTORS, decrypted, env)
+    structured = {
+        "user_email": decrypted.get("user_email"),
+        "ui_access_mode": decrypted.get("ui_access_mode"),
+        "role_mappings": _parse_role_mappings(raw.get("role_mappings")),
+        "team_mappings": _parse_team_mappings(raw.get("team_mappings")),
+    }
+    config = SSOConfig(**{**values, **structured})
+    return ResolvedSSOConfig(config=config, provenance=provenance)

litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py

@@ -2046,6 +2046,90 @@ class BedrockGuardrail(CustomGuardrail, BaseAWSLLM):
                         masking_index += 1
                         verbose_proxy_logger.debug("Applied masking to choice text content")
 
+    @staticmethod
+    def _incremental_scan_cache() -> DualCache:
+        """Resolve the cache used to remember which segments a session already scanned.
+
+        Prefers the proxy's shared cache (``internal_usage_cache.dual_cache``), which is
+        backed by Redis when the deployment configures it, so incremental state is shared
+        across proxy instances. Falls back to a process-local ``DualCache`` singleton when
+        the proxy is not running (e.g. unit tests), where sharing does not apply.
+        """
+        from litellm.integrations.custom_guardrail import dc as fallback_cache
+
+        try:
+            from litellm.proxy.proxy_server import proxy_logging_obj as _proxy_logging
+        except Exception:  # noqa: BLE001  # proxy not importable outside the server; use local fallback
+            return fallback_cache
+        if _proxy_logging is not None:
+            return _proxy_logging.internal_usage_cache.dual_cache
+        return fallback_cache
+
+    def _bedrock_response_has_masked_output(self, response: BedrockGuardrailResponse) -> bool:
+        """Return True if the guardrail rewrote (masked/anonymized) any scanned text.
+
+        Bedrock returns non-empty ``output``/``outputs`` text only when it changed the
+        content; an ``action == "NONE"`` response leaves both empty.
+        """
+        for field in ("output", "outputs"):
+            items = response.get(field) or []
+            if any(isinstance(item, dict) and item.get("text") for item in items):
+                return True
+        return False
+
+    async def _apply_incremental_request_scan(
+        self,
+        texts: list[str],
+        inputs: "GenericGuardrailAPIInputs",
+        request_data: dict,
+    ) -> Optional["GenericGuardrailAPIInputs"]:
+        """Scan only the text segments not already seen earlier in this session.
+
+        Returns ``None`` when incremental scanning is inactive (feature off, no
+        session id, masking enabled, or cache unavailable) or when the guardrail
+        turns out to mask content, telling the caller to run the normal full scan.
+        Otherwise scans only the new segments and skips the Bedrock call entirely
+        when nothing is new. Incremental mode is for blocking/detection guardrails
+        only: if the guardrail returns masked output it cannot be applied to the
+        skipped context, so the scan falls back to the full path and no session
+        state is recorded.
+        """
+        cache = self._incremental_scan_cache()
+
+        new_texts = await self.filter_new_texts_for_session(
+            texts=texts,
+            request_data=request_data,
+            cache=cache,
+        )
+        if new_texts is None:
+            return None
+
+        if not new_texts:
+            verbose_proxy_logger.debug("Bedrock Guardrail: no new messages to scan for this session, skipping API call")
+            return inputs
+
+        bedrock_response = await self.make_bedrock_api_request(
+            source="INPUT",
+            messages=[ChatCompletionUserMessage(role="user", content=text) for text in new_texts],
+            request_data=request_data,
+            logging_event_type=GuardrailEventHooks.pre_call,
+        )
+
+        if self._bedrock_response_has_masked_output(bedrock_response):
+            verbose_proxy_logger.warning(
+                "Bedrock Guardrail %s: guardrail returned masked/anonymized content; "
+                "only_scan_new_messages cannot apply masking to skipped context, falling back to a full-context scan",
+                self.guardrail_name,
+            )
+            return None
+
+        await self.mark_texts_scanned(
+            texts=texts,
+            request_data=request_data,
+            cache=cache,
+        )
+        return inputs
+
     async def apply_guardrail(
         self,
         inputs: "GenericGuardrailAPIInputs",
@@ -2077,6 +2161,15 @@ class BedrockGuardrail(CustomGuardrail, BaseAWSLLM):
         try:
             verbose_proxy_logger.debug(f"Bedrock Guardrail: Applying guardrail to {len(texts)} text(s)")
 
+            if input_type == "request":
+                incremental_result = await self._apply_incremental_request_scan(
+                    texts=texts,
+                    inputs=inputs,
+                    request_data=request_data,
+                )
+                if incremental_result is not None:
+                    return incremental_result
+
             masked_texts = []
 
             selection = self._select_messages_for_apply_guardrail(

litellm/proxy/guardrails/guardrail_hooks/model_armor/model_armor.py

@@ -432,7 +432,7 @@ class ModelArmorGuardrail(CustomGuardrail, VertexBase):
         Override to store only the Model Armor API response, not the entire data dict.
         This prevents circular references in logging.
         """
-        metadata = request_data.get("metadata", {}) if isinstance(request_data, dict) else {}
+        metadata = (request_data.get("metadata") or {}) if isinstance(request_data, dict) else {}
         guardrail_response = metadata.get("_model_armor_response", {})
 
         # Determine status – default to "success" but prefer the explicit value if present.

litellm/proxy/guardrails/guardrail_initializers.py

@@ -35,6 +35,7 @@ def initialize_bedrock(litellm_params: LitellmParams, guardrail: Guardrail):
         aws_sts_endpoint=litellm_params.aws_sts_endpoint,
         aws_bedrock_runtime_endpoint=litellm_params.aws_bedrock_runtime_endpoint,
         experimental_use_latest_role_message_only=litellm_params.experimental_use_latest_role_message_only,
+        only_scan_new_messages=litellm_params.only_scan_new_messages or False,
     )
     litellm.logging_callback_manager.add_litellm_callback(_bedrock_callback)
     return _bedrock_callback

litellm/proxy/guardrails/guardrail_registry.py

@@ -489,6 +489,9 @@ class InMemoryGuardrailHandler:
                 "skip_tool_message_in_guardrail",
                 getattr(litellm_params, "skip_tool_message_in_guardrail", None),
             )
+            configured_run_in_parallel = getattr(litellm_params, "run_in_parallel", None)
+            if configured_run_in_parallel is not None:
+                custom_guardrail_callback.run_in_parallel = bool(configured_run_in_parallel)
 
         parsed_guardrail = Guardrail(
             guardrail_id=guardrail.get("guardrail_id"),

litellm/proxy/hooks/parallel_request_limiter_v3.py

@@ -1781,28 +1781,38 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         """
         from litellm.proxy.auth.auth_utils import get_team_mcp_rpm_limit
 
-        if not mcp_server_name or not user_api_key_dict.team_id:
+        if not mcp_server_name:
             return
 
-        mcp_rpm_limit = get_team_mcp_rpm_limit(user_api_key_dict)
-        if not mcp_rpm_limit:
-            return
+        # Which teams' buckets does this call charge? A key is pinned to exactly one team. A keyless
+        # MCP-admitted subject reaches servers through SEVERAL teams at once and has no team_id, so
+        # without the second source below its calls charged no team bucket at all and it outran every
+        # team's mcp_rpm_limit. Every applicable team is charged rather than one being picked: the
+        # limiter enforces all descriptors, so each team's own ceiling binds on a call made through
+        # its grant, and there is no arbitrary attribution when several teams grant the same server.
+        team_limits: list[tuple[str | None, dict[str, int] | None]] = []
+        if user_api_key_dict.team_id:
+            team_limits.append((user_api_key_dict.team_id, get_team_mcp_rpm_limit(user_api_key_dict)))
+        for source_team_id, source_limit in (user_api_key_dict.mcp_source_team_rpm_limits or {}).items():
+            team_limits.append((source_team_id, source_limit))
 
-        server_rpm_limit = mcp_rpm_limit.get(mcp_server_name)
-        if server_rpm_limit is None:
-            return
-
-        descriptors.append(
-            RateLimitDescriptor(
-                key="mcp_per_team",
-                value=f"{user_api_key_dict.team_id}:{mcp_server_name}",
-                rate_limit={
-                    "requests_per_unit": server_rpm_limit,
-                    "tokens_per_unit": None,
-                    "window_size": self.window_size,
-                },
+        for team_id, mcp_rpm_limit in team_limits:
+            if not team_id or not mcp_rpm_limit:
+                continue
+            server_rpm_limit = mcp_rpm_limit.get(mcp_server_name)
+            if server_rpm_limit is None:
+                continue
+            descriptors.append(
+                RateLimitDescriptor(
+                    key="mcp_per_team",
+                    value=f"{team_id}:{mcp_server_name}",
+                    rate_limit={
+                        "requests_per_unit": server_rpm_limit,
+                        "tokens_per_unit": None,
+                        "window_size": self.window_size,
+                    },
+                )
             )
-        )
 
     def _should_enforce_rate_limit(
         self,

litellm/proxy/litellm_pre_call_utils.py

@@ -13,13 +13,16 @@ from starlette.datastructures import Headers
 import litellm
 from litellm._logging import verbose_logger, verbose_proxy_logger
 from litellm._service_logger import ServiceLogging
-from litellm.constants import PRE_CALL_EXECUTED_GUARDRAILS_KEY
+from litellm.constants import LITELLM_PROXY_MASTER_KEY_ALIAS, PRE_CALL_EXECUTED_GUARDRAILS_KEY
 from litellm.litellm_core_utils.credential_accessor import CredentialAccessor
 from litellm.litellm_core_utils.initialize_dynamic_callback_params import (
     iter_client_callback_metadata_dicts,
 )
 from litellm.litellm_core_utils.safe_json_loads import safe_json_loads
-from litellm.litellm_core_utils.url_utils import is_url_destination_allowed_by_host
+from litellm.litellm_core_utils.url_utils import (
+    is_url_destination_allowed_by_host,
+    provider_url_destination_candidates,
+)
 from litellm.proxy._types import (
     AddTeamCallback,
     CommonProxyErrors,
@@ -45,6 +48,24 @@ _EXPLICIT_SESSION_HEADERS = frozenset({"x-litellm-trace-id", "x-litellm-session-
 # Session-id values must be non-empty strings of alphanumerics, hyphens, or underscores
 # (covers UUIDs and most common session-id formats).
 _SESSION_ID_VALUE_RE = re.compile(r"^[a-zA-Z0-9_\-]{8,}$")
+
+_SHA256_HEX_RE = re.compile(r"^[0-9a-f]{64}$")
+
+
+def _stampable_key_hash(user_api_key_dict: UserAPIKeyAuth) -> str | None:
+    """Only proxy-validated keys are stamped, proven by the unforgeable
+    via_virtual_key marker AND a known non-secret shape: the sha256 hex digest
+    UserAPIKeyAuth stores virtual keys in, or the master key's stable alias.
+    Custom-auth credentials arrive raw (never forward auth material) and hashed
+    JWTs rotate on re-issue (useless as a stable ban id), so both are skipped."""
+    api_key = user_api_key_dict.api_key
+    if not user_api_key_dict.via_virtual_key or api_key is None:
+        return None
+    if api_key == LITELLM_PROXY_MASTER_KEY_ALIAS or _SHA256_HEX_RE.fullmatch(api_key):
+        return api_key
+    return None
+
+
 _ANTHROPIC_SESSION_ID_VALUE_RE = re.compile(r"^[a-zA-Z0-9_\-]+$")
 
 
@@ -229,23 +250,26 @@ def _reject_url_valued_destinations(data: Dict[str, Any]) -> None:
     allowed_hosts = getattr(litellm, "provider_url_destination_allowed_hosts", []) or []
     for field in _URL_DESTINATION_REQUEST_FIELDS:
         value = data.get(field)
-        if not isinstance(value, str) or not value.startswith(("http://", "https://")):
+        if not isinstance(value, str):
             continue
-        if is_url_destination_allowed_by_host(value, allowed_hosts):
-            continue
-        raise HTTPException(
-            status_code=400,
-            detail={
-                "error": "invalid_request",
-                "param": field,
-                "message": (
-                    f"URL-valued '{field}' is not allowed. Configure custom "
-                    "endpoints with api_base instead, or add the destination "
-                    "host to `provider_url_destination_allowed_hosts` in "
-                    "litellm_settings."
-                ),
-            },
-        )
+        for candidate in provider_url_destination_candidates(value):
+            if not candidate.lower().startswith(("http://", "https://")):
+                continue
+            if is_url_destination_allowed_by_host(candidate, allowed_hosts):
+                continue
+            raise HTTPException(
+                status_code=400,
+                detail={
+                    "error": "invalid_request",
+                    "param": field,
+                    "message": (
+                        f"URL-valued '{field}' is not allowed. Configure custom "
+                        "endpoints with api_base instead, or add the destination "
+                        "host to `provider_url_destination_allowed_hosts` in "
+                        "litellm_settings."
+                    ),
+                },
+            )
 
 
 def _strip_untrusted_request_header_controls(
@@ -1693,6 +1717,11 @@ async def add_litellm_data_to_request(
         if "user" not in data:
             data["user"] = user
 
+    if litellm.overwrite_user_with_key_hash is True:
+        stampable_hash = _stampable_key_hash(user_api_key_dict)
+        if stampable_hash is not None:
+            data["user"] = stampable_hash
+
     data["secret_fields"] = SecretFields(raw_headers=_raw_headers)
 
     ## Dynamic api version (Azure OpenAI endpoints) ##

litellm/proxy/management_endpoints/cache_settings_endpoints.py

@@ -18,8 +18,9 @@ from pydantic import BaseModel, Field
 
 import litellm
 from litellm._logging import verbose_proxy_logger
+from litellm._redis import _redis_kwargs_from_environment
 from litellm._uuid import uuid
-from litellm.litellm_core_utils.sensitive_data_masker import mask_sensitive_keys
+from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
 from litellm.proxy._types import (
     AUDIT_ACTIONS,
     LiteLLM_AuditLogs,
@@ -43,6 +44,17 @@ router = APIRouter()
 # (e.g. redis://:secret@host:6379/1).
 _CACHE_SENSITIVE_FIELDS: set = {"password", "sentinel_password", "url"}
 
+# The env fallback resolves the full set of redis.Redis kwargs, which includes
+# credential-bearing params (azure_client_secret, ssl_password, ...) that are
+# not cache UI fields. Only overlay fields the settings page actually renders,
+# so the read never surfaces a credential the UI does not manage.
+_CACHE_SETTINGS_FIELD_NAMES: frozenset = frozenset(field.field_name for field in CACHE_SETTINGS_FIELDS)
+
+# Classifier used, alongside _CACHE_SENSITIVE_FIELDS, to redact any
+# credential-bearing key before it leaves the server (`url` is kept in the
+# explicit set because its name carries no sensitive segment).
+_CREDENTIAL_CLASSIFIER = SensitiveDataMasker()
+
 
 _REDACTED_VALUE = "***REDACTED***"
 
@@ -67,6 +79,165 @@ def _resolve_cache_url_precedence(settings: Mapping[str, Any]) -> dict[str, Any]
     return {k: v for k, v in settings.items() if k not in _URL_OVERRIDDEN_CONNECTION_FIELDS}
 
 
+def _parse_stored_settings(cache_settings_value: object) -> dict[str, Any]:
+    """Normalize a stored cache_settings blob to a dict.
+
+    The prisma column comes back as either a JSON string or an already-parsed
+    dict depending on the client, so callers that json.loads unconditionally
+    silently drop the whole (still-encrypted) row on the dict path.
+    """
+    parsed = json.loads(cache_settings_value) if isinstance(cache_settings_value, str) else cache_settings_value
+    return parsed if isinstance(parsed, dict) else {}
+
+
+def _overlay_environment(stored: Mapping[str, Any]) -> dict[str, Any]:
+    """Fill connection fields from the REDIS_* environment the cache actually reads.
+
+    A response cache pointed at Redis resolves host/port/password/etc. from the
+    REDIS_* env vars when the stored config leaves them unset, so a cache
+    configured purely through the environment works while its settings page,
+    which reads only the database row, shows blank. Overlaying the same env
+    kwargs the runtime uses makes the page reflect the effective connection.
+    Stored values win; the environment only fills what the stored config omits.
+    """
+    env_kwargs = {
+        key: value for key, value in _redis_kwargs_from_environment().items() if key in _CACHE_SETTINGS_FIELD_NAMES
+    }
+    if not env_kwargs:
+        return dict(stored)
+    effective = {**env_kwargs, **stored}
+    # the env fallback is a Redis connection, so name the type when the stored
+    # config did not, letting the UI render the Redis fields it just populated
+    effective.setdefault("type", "redis")
+    return effective
+
+
+def _redact_credentials(settings: Mapping[str, Any]) -> dict[str, Any]:
+    """Replace credential-bearing values with a fixed marker, keeping the rest.
+
+    The marker is unambiguous on the way back in: an admin who edits an
+    unrelated field and re-submits sends the marker for the untouched secret,
+    which the update path maps back to the stored value rather than persisting
+    the marker over a working password.
+    """
+    return {
+        key: (_REDACTED_VALUE if value is not None and _is_credential_field(key) else value)
+        for key, value in settings.items()
+    }
+
+
+def _is_credential_field(key: str) -> bool:
+    """Whether a cache setting carries a credential and must be redacted on read."""
+    return key in _CACHE_SENSITIVE_FIELDS or _CREDENTIAL_CLASSIFIER.is_sensitive_key(key)
+
+
+def _has_connection_target(value: object) -> bool:
+    """Whether a payload value names a live discrete connection target."""
+    if isinstance(value, str):
+        return value.strip() != "" and value != _REDACTED_VALUE
+    return value not in (None, [], {})
+
+
+# Every field that identifies which Redis a credential belongs to, across node
+# (host/port/url), cluster (redis_startup_nodes), and sentinel
+# (sentinel_nodes/service_name) modes. A stored secret is bound to these.
+_CONNECTION_TARGET_FIELDS: tuple = (
+    "host",
+    "port",
+    "url",
+    "redis_startup_nodes",
+    "sentinel_nodes",
+    "service_name",
+)
+
+
+def _target_repr(value: object) -> str:
+    """Canonical string form of a connection-target value for equality checks.
+
+    The client may serialize the same target differently from storage (a port as
+    "6379" vs 6379, node lists round-tripped through JSON), so compare normalized
+    forms rather than raw values to avoid treating an unchanged target as a change.
+    """
+    if isinstance(value, (list, dict)):
+        return json.dumps(value, sort_keys=True, default=str)
+    return str(value)
+
+
+def _saved_secret_is_reusable(incoming: Mapping[str, Any], saved: Mapping[str, Any]) -> bool:
+    """Whether a stored credential may be restored for this request.
+
+    A stored secret belongs to the stored connection target, so it is reused only
+    when the request describes that same target on every dimension the stored
+    config pins (host/port, url, cluster nodes, sentinel nodes/service). This
+    prevents credential replay: a caller cannot omit the credential, point at a
+    different (or incomplete) target, and have the proxy send the stored secret
+    to a Redis of their choosing.
+
+    Non-secret target fields (host/port/nodes/service) must be supplied and match
+    in normalized form, so equivalent representations (port "6379" vs 6379) are
+    not seen as a change while an omitted or different value is. ``url`` is the
+    exception: it is itself the secret and the form never re-prefills it, so a
+    redacted or omitted url means "keep the stored url" (same target) and only a
+    different supplied url blocks reuse.
+    """
+    for field in _CONNECTION_TARGET_FIELDS:
+        saved_value = saved.get(field)
+        if saved_value in (None, "", [], {}):
+            continue  # the stored config does not pin this dimension
+        incoming_value = incoming.get(field)
+        if field == "url":
+            if incoming_value in (None, "", _REDACTED_VALUE):
+                continue  # url kept as-is (same target)
+            if _target_repr(incoming_value) != _target_repr(saved_value):
+                return False
+            continue
+        if _target_repr(incoming_value) != _target_repr(saved_value):
+            return False  # a pinned target field is missing or different
+    return True
+
+
+def _merge_over_saved(incoming: Mapping[str, Any], saved: Mapping[str, Any]) -> dict[str, Any]:
+    """Keep the stored secret behind any credential the caller echoed back redacted or omitted.
+
+    GET returns credentials as the marker and the form never re-prefills a
+    secret, so a save that does not touch a credential arrives with the marker
+    or with the field absent. Either way the real secret must survive: it is
+    restored from the stored row, or dropped when there is no stored row (the
+    value is env-sourced and the marker must never be persisted). Non-secret
+    fields are taken from the incoming payload as-is, so clearing one still works.
+
+    ``url`` is the exception: it is credential-bearing (redacted) yet also a
+    connection-mode selector that url-precedence resolves against host/port. If
+    the caller supplies a discrete target (host, cluster, or sentinel nodes), a
+    stored url is a stale mode the caller is leaving, so it is dropped rather
+    than restored, otherwise url-precedence would resurrect it and discard the
+    submitted host/port.
+    """
+    switching_to_discrete_target = (
+        _has_connection_target(incoming.get("host"))
+        or _has_connection_target(incoming.get("redis_startup_nodes"))
+        or _has_connection_target(incoming.get("sentinel_nodes"))
+    )
+    reuse_saved_secret = _saved_secret_is_reusable(incoming, saved)
+    merged = dict(incoming)
+    for field in _CACHE_SENSITIVE_FIELDS:
+        # A value the caller explicitly supplied is honored verbatim: a new
+        # secret, or an empty string / null to clear the stored one. Only an
+        # omitted field or the echoed-back marker triggers preserve-or-drop.
+        if field in incoming and incoming[field] != _REDACTED_VALUE:
+            continue
+        if field == "url" and switching_to_discrete_target:
+            merged.pop(field, None)
+            continue
+        if field in saved and reuse_saved_secret:
+            merged[field] = saved[field]
+        else:
+            # nothing stored to reuse, or the caller is pointing at a different
+            # target: never persist/replay the marker or the stored secret
+            merged.pop(field, None)
+    return merged
+
+
 def _redact_settings(settings: Optional[Mapping[str, Any]]) -> Dict[str, Any]:
     """Replace every value in a settings map with a fixed marker.
 
@@ -270,34 +441,34 @@ async def get_cache_settings(
         # Get cache settings fields from types file
         cache_fields = [field.model_copy(deep=True) for field in CACHE_SETTINGS_FIELDS]
 
-        # Try to get cache settings from database
-        current_values = {}
+        # Read the stored settings (decrypted); an env-only cache has none.
+        stored: dict[str, Any] = {}
         if prisma_client is not None:
             cache_config = await CacheConfigRepository(prisma_client).table.find_unique(where={"id": "cache_config"})
             if cache_config is not None and cache_config.cache_settings:
-                # Decrypt cache settings
-                cache_settings_json = cache_config.cache_settings
-                if isinstance(cache_settings_json, str):
-                    cache_settings_dict = json.loads(cache_settings_json)
-                else:
-                    cache_settings_dict = cache_settings_json
+                stored = proxy_config._decrypt_db_variables(
+                    variables_dict=_parse_stored_settings(cache_config.cache_settings)
+                )
 
-                # Decrypt environment variables
-                decrypted_settings = proxy_config._decrypt_db_variables(variables_dict=cache_settings_dict)
+        # Fill connection fields from the REDIS_* environment the cache resolves
+        # from when the stored config leaves them unset, then apply url precedence
+        # so a url-mode config does not surface conflicting discrete fields (which
+        # would otherwise let a no-op save silently switch it to host/port).
+        effective = _resolve_cache_url_precedence(_overlay_environment(stored))
 
-                # Derive redis_type for UI based on settings
-                # UI uses redis_type to show/hide fields, backend only stores 'type'
-                if decrypted_settings.get("type") == "redis":
-                    if decrypted_settings.get("redis_startup_nodes"):
-                        decrypted_settings["redis_type"] = "cluster"
-                    elif decrypted_settings.get("sentinel_nodes"):
-                        decrypted_settings["redis_type"] = "sentinel"
-                    else:
-                        decrypted_settings["redis_type"] = "node"
+        # Derive redis_type for UI based on settings
+        # UI uses redis_type to show/hide fields, backend only stores 'type'
+        if effective.get("type") == "redis":
+            if effective.get("redis_startup_nodes"):
+                effective["redis_type"] = "cluster"
+            elif effective.get("sentinel_nodes"):
+                effective["redis_type"] = "sentinel"
+            else:
+                effective["redis_type"] = "node"
 
-                # Mask credential fields so the GET response never carries
-                # plaintext Redis / Sentinel passwords off the server.
-                current_values = mask_sensitive_keys(decrypted_settings, _CACHE_SENSITIVE_FIELDS)
+        # Redact credential fields so the GET response never carries a plaintext
+        # Redis / Sentinel password off the server.
+        current_values = _redact_credentials(effective)
 
         # Update field values with current values
         for field in cache_fields:
@@ -331,10 +502,27 @@ async def test_cache_connection(
     to verify the credentials work without affecting global state.
     """
     from litellm import Cache
+    from litellm.proxy.proxy_server import prisma_client, proxy_config
 
     try:
-        cache_settings = _resolve_cache_url_precedence(request.cache_settings)
-        verbose_proxy_logger.debug("Testing cache connection with settings: %s", cache_settings)
+        # A credential the form left untouched arrives redacted; resolve it back
+        # to the stored secret so the test connects with the real password. A
+        # lookup failure must not block the test, so fall back to no stored row.
+        saved_settings: dict[str, Any] = {}
+        if prisma_client is not None:
+            try:
+                existing_row = await CacheConfigRepository(prisma_client).table.find_unique(
+                    where={"id": "cache_config"}
+                )
+                if existing_row is not None and existing_row.cache_settings:
+                    saved_settings = proxy_config._decrypt_db_variables(
+                        variables_dict=_parse_stored_settings(existing_row.cache_settings)
+                    )
+            except Exception:  # noqa: BLE001 - a saved-settings lookup failure must not block a connection test
+                saved_settings = {}
+        cache_settings = _resolve_cache_url_precedence(_merge_over_saved(request.cache_settings, saved_settings))
+        # cache_settings now carries the resolved plaintext credential; never log it raw
+        verbose_proxy_logger.debug("Testing cache connection with settings: %s", _redact_credentials(cache_settings))
 
         # Only support Redis for now
         if cache_settings.get("type") != "redis":
@@ -400,19 +588,20 @@ async def update_cache_settings(
         )
 
     try:
-        cache_settings = _resolve_cache_url_precedence(request.cache_settings)
-
-        # Snapshot the prior settings (key set only — values get redacted in
-        # the audit row) so the audit-log entry shows which fields changed.
+        # Read the stored row first: its decrypted values back any credential the
+        # caller echoed back redacted, and its key set drives the audit diff.
         existing_row = await CacheConfigRepository(prisma_client).table.find_unique(where={"id": "cache_config"})
         before_settings: Optional[Dict[str, Any]] = None
+        saved_settings: dict[str, Any] = {}
         if existing_row is not None and existing_row.cache_settings:
-            try:
-                before_settings = json.loads(existing_row.cache_settings)
-            except (TypeError, ValueError):
-                before_settings = None
+            before_settings = _parse_stored_settings(existing_row.cache_settings)
+            saved_settings = proxy_config._decrypt_db_variables(variables_dict=before_settings)
         action: AUDIT_ACTIONS = "updated" if existing_row is not None else "created"
 
+        # Preserve stored secrets behind any redacted or omitted credential, then
+        # resolve the url-vs-discrete-fields precedence.
+        cache_settings = _resolve_cache_url_precedence(_merge_over_saved(request.cache_settings, saved_settings))
+
         # Encrypt sensitive fields (keep redis_type for storage)
         encrypted_settings = proxy_config._encrypt_env_variables(environment_variables=cache_settings)
 
@@ -461,7 +650,7 @@ async def update_cache_settings(
         return {
             "message": "Cache settings updated successfully",
             "status": "success",
-            "settings": cache_settings,
+            "settings": _redact_credentials(cache_settings),
         }
     except Exception as e:
         verbose_proxy_logger.error(f"Error updating cache settings: {str(e)}")

litellm/proxy/management_endpoints/mcp_management_endpoints.py

@@ -136,9 +136,12 @@ if MCP_AVAILABLE:
     from litellm.proxy._experimental.mcp_server.discoverable_endpoints import (
         _raise_if_not_oauth2,
         authorize_with_server,
+        client_supplied_redirect_uris,
         exchange_token_with_server,
         get_request_base_url,
+        redeem_passthrough_authorization_code,
         register_client_with_server,
+        resolve_ephemeral_dcr_client,
     )
     from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
         global_mcp_server_manager,
@@ -1661,7 +1664,21 @@ if MCP_AVAILABLE:
         mcp_server = await _get_cached_temporary_mcp_server_or_404(server_id, user_api_key_dict, request=request)
         _raise_if_not_oauth2(mcp_server)
         # Use the server's stored client_id when the caller doesn't supply one
-        resolved_client_id = mcp_server.client_id or client_id or ""
+        stored_or_supplied_client_id = mcp_server.client_id or client_id or ""
+        ephemeral_dcr_client = (
+            await resolve_ephemeral_dcr_client(
+                request=request,
+                mcp_server=mcp_server,
+                code_challenge=code_challenge,
+                code_challenge_method=code_challenge_method,
+                redirect_uri=redirect_uri,
+            )
+            if not stored_or_supplied_client_id
+            else None
+        )
+        resolved_client_id = stored_or_supplied_client_id or (
+            ephemeral_dcr_client.client_id if ephemeral_dcr_client else ""
+        )
         if not resolved_client_id:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
@@ -1683,6 +1700,7 @@ if MCP_AVAILABLE:
             code_challenge_method=code_challenge_method,
             response_type=response_type,
             scope=scope,
+            ephemeral_dcr_client=ephemeral_dcr_client,
         )
 
     @router.post(
@@ -1705,7 +1723,21 @@ if MCP_AVAILABLE:
     ):
         mcp_server = await _get_cached_temporary_mcp_server_or_404(server_id, user_api_key_dict, request=request)
         _raise_if_not_oauth2(mcp_server)
-        resolved_client_id = mcp_server.client_id or client_id or ""
+        # Sealed passthrough codes exist only for the authorization_code grant. A refresh_token
+        # grant must never open one: the minted client is unrecoverable after the single flow by
+        # contract, so an expired browser-held token re-runs authorize instead.
+        sealed_code = (
+            redeem_passthrough_authorization_code(code=code, mcp_server=mcp_server, code_verifier=code_verifier)
+            if grant_type == "authorization_code"
+            else None
+        )
+        resolved_code = sealed_code.upstream_code if sealed_code else code
+        # A sealed flow ran the gateway /callback as its upstream redirect (bridge short-circuit
+        # or plain flow alike), so the exchange must present that binding, not the browser page.
+        resolved_redirect_uri = f"{get_request_base_url(request)}/callback" if sealed_code else redirect_uri
+        caller_client_id = sealed_code.client_id if sealed_code else client_id
+        caller_client_secret = sealed_code.client_secret if sealed_code else client_secret
+        resolved_client_id = mcp_server.client_id or caller_client_id or ""
         if not resolved_client_id:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
@@ -1721,13 +1753,14 @@ if MCP_AVAILABLE:
             request=request,
             mcp_server=mcp_server,
             grant_type=grant_type,
-            code=code,
-            redirect_uri=redirect_uri,
+            code=resolved_code,
+            redirect_uri=resolved_redirect_uri,
             client_id=resolved_client_id,
-            client_secret=client_secret,
+            client_secret=caller_client_secret,
             code_verifier=code_verifier,
             refresh_token=refresh_token,
             scope=scope,
+            client_token_endpoint_auth_method=sealed_code.token_endpoint_auth_method if sealed_code else None,
         )
 
     @router.post(
@@ -1743,6 +1776,7 @@ if MCP_AVAILABLE:
         mcp_server = await _get_cached_temporary_mcp_server_or_404(server_id, user_api_key_dict, request=request)
         request_data = await _read_request_body(request=request)
         data: dict = {**request_data}
+        client_redirect_uris = client_supplied_redirect_uris(data.get("redirect_uris"))
 
         return await register_client_with_server(
             request=request,
@@ -1753,6 +1787,7 @@ if MCP_AVAILABLE:
             token_endpoint_auth_method=data.get("token_endpoint_auth_method", ""),
             fallback_client_id=server_id,
             persist_credentials=_user_is_full_admin(user_api_key_dict),
+            client_redirect_uris=client_redirect_uris,
         )
 
     @router.delete(

litellm/proxy/management_endpoints/organization_endpoints.py

@@ -13,16 +13,18 @@ Endpoints for /organization operations
 
 #### ORGANIZATION MANAGEMENT ####
 
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Annotated, Any, Dict, List, Mapping, Optional, Tuple
 
 import fastapi
 from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import TypeAdapter
 
 from litellm._logging import verbose_proxy_logger
 from litellm._uuid import uuid
 from litellm.proxy._types import *
 from litellm.proxy.auth.auth_checks import can_user_call_model, get_user_object
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+from litellm.proxy.common_utils.timezone_utils import get_budget_reset_time
 from litellm.proxy.management_endpoints.budget_management_endpoints import (
     new_budget,
     update_budget,
@@ -34,6 +36,7 @@ from litellm.proxy.management_endpoints.common_utils import (
 )
 from litellm.proxy.management_helpers.object_permission_utils import (
     handle_update_object_permission_common,
+    prepare_object_permission_upsert,
 )
 from litellm.proxy.management_helpers.utils import (
     get_new_internal_user_defaults,
@@ -101,6 +104,30 @@ async def _verify_org_access(
     )
 
 
+_STR_OBJECT_DICT_ADAPTER = TypeAdapter(dict[str, object])
+_BUDGET_SETTABLE_FIELDS = frozenset(LiteLLM_BudgetTable.model_fields.keys()) - {"budget_id"}
+_ORG_COLUMN_FIELDS = frozenset({"organization_alias", "models"})
+
+
+def build_budget_write_data(budget_updates: Mapping[str, object], updated_by: str) -> Mapping[str, object]:
+    """
+    Budget-row columns to write. ``budget_reset_at`` tracks any sent ``budget_duration``:
+    recomputed for a new duration, cleared alongside a ``None`` duration so no stale reset
+    timestamp survives. Other sent fields (including a ``None`` clear) are written as-is.
+    """
+    budget_duration = budget_updates.get("budget_duration")
+    recomputed_reset_at: Mapping[str, object] = (
+        {
+            "budget_reset_at": (
+                get_budget_reset_time(budget_duration=budget_duration) if isinstance(budget_duration, str) else None
+            )
+        }
+        if "budget_duration" in budget_updates
+        else {}
+    )
+    return {**budget_updates, **recomputed_reset_at, "updated_by": updated_by}
+
+
 def handle_nested_budget_structure_in_organization_update_request(
     raw_data: dict,
 ) -> dict:
@@ -568,6 +595,155 @@ async def handle_update_object_permission(
     return data_json
 
 
+@router.patch(
+    "/v2/organization/{organization_id}",
+    tags=["organization management"],
+    dependencies=[Depends(user_api_key_auth)],
+    response_model=LiteLLM_OrganizationTableWithMembers,
+    include_in_schema=False,
+)
+async def update_organization_v2(
+    organization_id: str,
+    data: OrganizationUpdateRequestV2,
+    user_api_key_dict: Annotated[UserAPIKeyAuth, Depends(user_api_key_auth)],
+):
+    """
+    Partial update of an organization (RESTful PATCH, RFC 7396 merge-patch semantics).
+
+    A sent field is written and an omitted one is left untouched (presence is read from
+    ``model_fields_set``). Clear tokens are per field: budget limits and ``metadata`` clear with
+    ``null``, ``models`` with ``[]``, and ``object_permission`` with ``null`` (it merges when sent,
+    so an empty ``{}`` is rejected). ``organization_alias`` is required and cannot be cleared.
+    Validation failures return 422; the object-permission upsert, budget-row write, and
+    org-row write are one transaction.
+    """
+    from litellm.proxy.proxy_server import prisma_client
+
+    if prisma_client is None:
+        raise HTTPException(
+            status_code=500,
+            detail={"error": CommonProxyErrors.db_not_connected_error.value},
+        )
+
+    if user_api_key_dict.user_id is None:
+        raise HTTPException(
+            status_code=400,
+            detail={
+                "error": "Cannot associate a user_id to this action. Check `/key/info` to validate if 'user_id' is set."
+            },
+        )
+
+    if data.max_budget is not None and (not math.isfinite(data.max_budget) or data.max_budget < 0):
+        raise HTTPException(
+            status_code=422,
+            detail={"error": f"max_budget must be a non-negative finite number. Received: {data.max_budget}"},
+        )
+    if data.soft_budget is not None and (not math.isfinite(data.soft_budget) or data.soft_budget < 0):
+        raise HTTPException(
+            status_code=422,
+            detail={"error": f"soft_budget must be a non-negative finite number. Received: {data.soft_budget}"},
+        )
+    if data.model_max_budget:
+        from litellm.proxy.management_endpoints.key_management_endpoints import (
+            validate_model_max_budget,
+        )
+
+        try:
+            validate_model_max_budget(data.model_max_budget)
+        except ValueError as e:
+            raise HTTPException(status_code=422, detail={"error": str(e)})
+
+    if "organization_alias" in data.model_fields_set and data.organization_alias is None:
+        raise HTTPException(
+            status_code=422,
+            detail={"error": "organization_alias cannot be cleared; it is required"},
+        )
+    if "models" in data.model_fields_set and data.models is None:
+        raise HTTPException(
+            status_code=422,
+            detail={"error": "models cannot be set to null; send [] to clear it"},
+        )
+    if data.object_permission is not None and not data.object_permission.model_dump(exclude_none=True):
+        raise HTTPException(
+            status_code=422,
+            detail={
+                "error": "object_permission cannot be an empty object; send null to clear it, or a non-empty object to set grants"
+            },
+        )
+
+    await _verify_org_access(
+        organization_id=organization_id,
+        user_api_key_dict=user_api_key_dict,
+        prisma_client=prisma_client,
+    )
+
+    existing_organization_row = await OrganizationRepository(prisma_client).table.find_unique(
+        where={"organization_id": organization_id},
+    )
+    if existing_organization_row is None:
+        raise HTTPException(
+            status_code=404,
+            detail={"error": f"Organization not found for organization_id={organization_id}"},
+        )
+
+    field_values = _STR_OBJECT_DICT_ADAPTER.validate_python(data.model_dump())
+    present_fields = data.model_fields_set
+    budget_updates = {field: field_values[field] for field in present_fields if field in _BUDGET_SETTABLE_FIELDS}
+    org_column_updates: Mapping[str, object] = {
+        **{field: field_values[field] for field in present_fields if field in _ORG_COLUMN_FIELDS},
+        **({"metadata": data.metadata or {}} if "metadata" in present_fields else {}),
+        **({"logging_exporters": data.logging_exporters or []} if "logging_exporters" in present_fields else {}),
+    }
+
+    object_permission_cleared = "object_permission" in present_fields and data.object_permission is None
+    object_permission_upsert = (
+        await prepare_object_permission_upsert(
+            new_object_permission=data.object_permission.model_dump(exclude_none=True),
+            existing_object_permission_id=existing_organization_row.object_permission_id,
+            prisma_client=prisma_client,
+        )
+        if data.object_permission is not None
+        else None
+    )
+    object_permission_write: Mapping[str, object] = (
+        {"object_permission_id": object_permission_upsert.object_permission_id}
+        if object_permission_upsert is not None
+        else ({"object_permission_id": None} if object_permission_cleared else {})
+    )
+
+    organization_write_data = prisma_client.jsonify_object(
+        {
+            **org_column_updates,
+            **object_permission_write,
+            "updated_by": user_api_key_dict.user_id,
+        }
+    )
+
+    async with prisma_client.db.tx() as tx:
+        if object_permission_upsert is not None:
+            await tx.litellm_objectpermissiontable.upsert(
+                where={"object_permission_id": object_permission_upsert.object_permission_id},
+                data={
+                    "create": object_permission_upsert.record,
+                    "update": object_permission_upsert.record,
+                },
+            )
+        if budget_updates:
+            await tx.litellm_budgettable.update(
+                where={"budget_id": existing_organization_row.budget_id},
+                data=prisma_client.jsonify_object(
+                    dict(build_budget_write_data(budget_updates, user_api_key_dict.user_id))
+                ),
+            )
+        response = await tx.litellm_organizationtable.update(
+            where={"organization_id": organization_id},
+            data=organization_write_data,
+            include={"members": True, "teams": True, "litellm_budget_table": True},
+        )
+
+    return response
+
+
 @router.delete(
     "/organization/delete",
     tags=["organization management"],

litellm/proxy/management_endpoints/scim/scim_v2.py

@@ -98,14 +98,27 @@ class UserProvisionerHelpers:
         if not existing_user:
             return None
 
-        # Update the user
+        new_teams = list(dict.fromkeys(new_user_request.teams or []))
+
+        if new_user_request.user_id != existing_user.user_id:
+            await UserRepository(prisma_client).table.update(
+                where={"user_id": existing_user.user_id},
+                data={"user_id": new_user_request.user_id},
+            )
+
+        await _handle_team_membership_changes(
+            user_id=new_user_request.user_id,
+            existing_teams=existing_user.teams or [],
+            new_teams=new_teams,
+            raise_on_error=True,
+        )
+
         updated_user = await UserRepository(prisma_client).table.update(
-            where={"user_id": existing_user.user_id},
+            where={"user_id": new_user_request.user_id},
             data={
-                "user_id": new_user_request.user_id,
                 "user_email": new_user_request.user_email,
                 "user_alias": new_user_request.user_alias,
-                "teams": new_user_request.teams,
+                "teams": new_teams,
                 "metadata": safe_dumps(new_user_request.metadata),
                 **({"user_role": new_user_request.user_role} if admin_group is not None else {}),
             },
@@ -440,7 +453,12 @@ async def _get_team_members_display(member_ids: List[str]) -> List[SCIMMember]:
     return members
 
 
-async def _handle_team_membership_changes(user_id: str, existing_teams: List[str], new_teams: List[str]) -> None:
+async def _handle_team_membership_changes(
+    user_id: str,
+    existing_teams: List[str],
+    new_teams: List[str],
+    raise_on_error: bool = False,
+) -> None:
     """Handle adding/removing user from teams based on changes."""
     existing_teams_set = set(existing_teams)
     new_teams_set = set(new_teams)
@@ -453,6 +471,7 @@ async def _handle_team_membership_changes(user_id: str, existing_teams: List[str
             user_id=user_id,
             teams_ids_to_add_user_to=list(teams_to_add),
             teams_ids_to_remove_user_from=list(teams_to_remove),
+            raise_on_error=raise_on_error,
         )
 
 
@@ -1298,6 +1317,13 @@ async def delete_user(
                     where={"team_id": team.team_id}, data={"members": new_members}
                 )
 
+            team_row = LiteLLM_TeamTable(**team.model_dump())
+            if any(member.user_id == user_id for member in team_row.members_with_roles or []):
+                await team_member_delete(
+                    data=TeamMemberDeleteRequest(team_id=team_row.team_id, user_id=user_id),
+                    user_api_key_dict=UserAPIKeyAuth(user_role=LitellmUserRoles.PROXY_ADMIN),
+                )
+
         await _set_user_keys_blocked(user_id=user_id, blocked=True)
 
         await _delete_rows_referencing_user(prisma_client, user_id=user_id)
@@ -1327,6 +1353,31 @@ def _extract_group_values(value: Any) -> List[str]:
     return group_values
 
 
+def _extract_ids_from_path_filter(path: str | None, attribute: str) -> List[str]:
+    """Return ids from a SCIM filtered path like ``members[value eq "id"]``.
+
+    Okta commonly sends membership removals as a filtered path and omits the
+    request body ``value``, so the id lives only inside the ``[value eq "..."]``
+    filter. The ``eq`` operator is matched case-insensitively per the SCIM
+    spec; the id keeps its original case. Per the SCIM filter grammar the
+    compared value must be quoted (single or double), so malformed unquoted
+    filters yield no id. A quoted id may contain escaped quotes and
+    backslashes (``\\"`` and ``\\\\``), which are unescaped before use.
+    ``path`` must be the raw, case-preserving path from the patch op.
+    """
+    if not path:
+        return []
+    match = re.match(
+        rf"""\s*{re.escape(attribute)}\s*\[\s*value\s+eq\s+(['"])((?:\\.|[^\\])*?)\1\s*\]\s*$""",
+        path,
+        flags=re.IGNORECASE,
+    )
+    if not match:
+        return []
+    extracted = re.sub(r"\\(.)", r"\1", match.group(2))
+    return [extracted] if extracted else []
+
+
 def _handle_displayname_update(op_type: str, value: Any, update_data: Dict[str, Any]) -> None:
     """Handle displayname updates."""
     if op_type == "remove":
@@ -1370,9 +1421,11 @@ def _handle_name_update(path: str, op_type: str, value: Any, scim_metadata: Dict
             scim_metadata["familyName"] = str(value)
 
 
-def _handle_group_operations(op_type: str, value: Any, teams_set: Set[str]) -> Optional[Set[str]]:
+def _handle_group_operations(op_type: str, value: Any, teams_set: Set[str], path: str | None) -> Set[str] | None:
     """Handle group/team membership operations."""
     group_values = _extract_group_values(value)
+    if not group_values and value is None:
+        group_values = _extract_ids_from_path_filter(path, "groups")
     if op_type == "replace":
         return set(group_values)
     elif op_type == "add":
@@ -1485,7 +1538,7 @@ def _apply_patch_ops(
         elif _multi_valued_attribute_base(path) in SCIM_MULTI_VALUED_ATTRIBUTE_METADATA_KEYS:
             _handle_multi_valued_attribute_update(path, op_type, value, metadata)
         elif path.startswith("groups"):
-            new_replace_set = _handle_group_operations(op_type, value, teams_set)
+            new_replace_set = _handle_group_operations(op_type, value, teams_set, op.path)
             if new_replace_set is not None:
                 replace_team_set = new_replace_set
         else:
@@ -1497,16 +1550,29 @@ def _apply_patch_ops(
     return update_data, final_team_set
 
 
+def _is_user_not_in_team_error(exc: HTTPException) -> bool:
+    """True when team_member_delete reports the user was already absent from the
+    team, which is the idempotent no-op case for a removal."""
+    detail = exc.detail
+    return isinstance(detail, dict) and detail.get("error") == "User not found in team"
+
+
 async def patch_team_membership(
     user_id: str,
     teams_ids_to_add_user_to: List[str],
     teams_ids_to_remove_user_from: List[str],
+    raise_on_error: bool = False,
 ) -> bool:
     """
     Add or remove user from teams
 
     Handles duplicate membership gracefully (idempotent operation).
-    If a user is already in a team, that's fine - we don't treat it as an error.
+    A user already being in a team (on add) or already absent from it (on
+    remove) is treated as a no-op, not an error.
+
+    When ``raise_on_error`` is True a genuine add or remove failure (anything
+    other than those idempotent no-ops) propagates instead of being swallowed,
+    so a caller can avoid persisting a teams array the roster never received.
     """
     for _team_id in teams_ids_to_add_user_to:
         try:
@@ -1521,9 +1587,13 @@ async def patch_team_membership(
             # Handle duplicate membership gracefully - this is idempotent
             if e.type == ProxyErrorTypes.team_member_already_in_team:
                 verbose_proxy_logger.debug(f"User {user_id} is already in team {_team_id}, skipping add")
+            elif raise_on_error:
+                raise
             else:
                 verbose_proxy_logger.exception(f"Error adding user to team {_team_id}: {e}")
         except Exception as e:
+            if raise_on_error:
+                raise
             verbose_proxy_logger.exception(f"Error adding user to team {_team_id}: {e}")
 
     for _team_id in teams_ids_to_remove_user_from:
@@ -1532,7 +1602,16 @@ async def patch_team_membership(
                 data=TeamMemberDeleteRequest(team_id=_team_id, user_id=user_id),
                 user_api_key_dict=UserAPIKeyAuth(user_role=LitellmUserRoles.PROXY_ADMIN),
             )
+        except HTTPException as e:
+            if _is_user_not_in_team_error(e):
+                verbose_proxy_logger.debug(f"User {user_id} is not in team {_team_id}, skipping remove")
+            elif raise_on_error:
+                raise
+            else:
+                verbose_proxy_logger.exception(f"Error removing user from team {_team_id}: {e}")
         except Exception as e:
+            if raise_on_error:
+                raise
             verbose_proxy_logger.exception(f"Error removing user from team {_team_id}: {e}")
 
     return True
@@ -1654,8 +1733,11 @@ async def get_groups(
         # Convert to SCIM format
         scim_groups = []
         for team in teams:
-            # Get team members with display names
-            members = await _get_team_members_display(team.members or [])
+            # Get team members with display names. members_with_roles is the
+            # source of truth; the legacy `members` column is not populated by
+            # team creation, so reading it here would report an empty member
+            # list to the IdP and trigger repeated re-provisioning.
+            members = await _get_team_members_display(await _get_team_member_user_ids_from_team(team))
             verbose_proxy_logger.debug(f"SCIM GET GROUPS members: {members}")
             team_alias = getattr(team, "team_alias", team.team_id)
             team_created_at = team.created_at.isoformat() if team.created_at else None
@@ -1877,16 +1959,28 @@ async def delete_group(
 
 async def _process_group_patch_operations(
     patch_ops: SCIMPatchOp, existing_team, prisma_client
-) -> Tuple[Dict[str, Any], Set[str]]:
-    """Process patch operations for a group and return update data and final members."""
+) -> Tuple[Dict[str, Any], Set[str], Set[str] | None]:
+    """Process patch operations for a group and return update data, final members
+    and, when the request contained a member ``replace`` op, the absolute target
+    roster it declared (``None`` otherwise).
+
+    ``add``/``remove`` are deltas relative to the current roster, but ``replace``
+    is absolute: it declares the roster is exactly this set, so the caller must
+    reconcile against it as a set-to-target rather than rebasing it onto a
+    concurrently-mutated roster.
+    """
     update_data: Dict[str, Any] = {}
 
     # Create a fresh copy of existing metadata to avoid Prisma issues
     existing_metadata = existing_team.metadata or {}
     metadata = dict(existing_metadata) if existing_metadata else {}
 
-    # Track member changes
-    current_members = set(existing_team.members or [])
+    # Track member changes. members_with_roles is the source of truth for team
+    # membership; the legacy `members` column is not populated by team creation
+    # or the real team endpoints, so seeding from it would make an `add`/`remove`
+    # operation recompute the member set from an empty base and silently drop
+    # everyone already in the team.
+    current_members = set(await _get_team_member_user_ids_from_team(existing_team))
     final_members = current_members.copy()
 
     # Process each patch operation
@@ -1908,6 +2002,8 @@ async def _process_group_patch_operations(
         elif path.startswith("members"):
             # Handle member operations
             member_values = _extract_group_values(value)
+            if not member_values and value is None:
+                member_values = _extract_ids_from_path_filter(op.path, "members")
             # Check the feature flag
             scim_upsert_user = await _get_scim_upsert_user_setting()
             # Validate all users exist or create them based on feature flag
@@ -1960,27 +2056,32 @@ async def _process_group_patch_operations(
     if metadata:
         update_data["metadata"] = metadata
 
-    return update_data, final_members
+    member_replace_present = any(
+        op.op == "replace" and (op.path or "").lower().startswith("members") for op in patch_ops.Operations
+    )
+    replace_target = set(final_members) if member_replace_present else None
+
+    return update_data, final_members, replace_target
 
 
-async def _apply_group_patch_updates(
-    group_id: str, update_data: Dict[str, Any], final_members: Set[str], prisma_client
-):
-    """Apply patch updates to the group in the database."""
-    # Serialize metadata if present
+async def _apply_group_patch_updates(group_id: str, update_data: Dict[str, Any], prisma_client):
+    """Apply the group's metadata/displayName patch updates to the database.
+
+    Membership itself is not written here; it is reconciled onto the source of
+    truth (members_with_roles and each member's user.teams) by
+    _handle_group_membership_changes via team_member_add/team_member_delete.
+    Writing the legacy `members` column here too would create a second, unread
+    copy of membership that could drift from the source of truth.
+    """
     if "metadata" in update_data and isinstance(update_data["metadata"], dict):
         update_data["metadata"] = safe_dumps(update_data["metadata"])
 
-    # Update members list
-    update_data["members"] = list(final_members)
-
-    # Update team in database
-    updated_team = await TeamRepository(prisma_client).table.update(
-        where={"team_id": group_id},
-        data=update_data,
-    )
-
-    return updated_team
+    if update_data:
+        return await TeamRepository(prisma_client).table.update(
+            where={"team_id": group_id},
+            data=update_data,
+        )
+    return await TeamRepository(prisma_client).table.find_unique(where={"team_id": group_id})
 
 
 async def _handle_group_membership_changes(group_id: str, current_members: Set[str], final_members: Set[str]):
@@ -2031,27 +2132,29 @@ async def patch_group(
         existing_team = await _check_team_exists(group_id)
 
         # Process patch operations
-        update_data, final_members = await _process_group_patch_operations(patch_ops, existing_team, prisma_client)
+        update_data, final_members, replace_target = await _process_group_patch_operations(
+            patch_ops, existing_team, prisma_client
+        )
 
-        # Track current members BEFORE update for comparison
-        current_members = set(await _get_team_member_user_ids_from_team(existing_team))
+        snapshot_members = set(await _get_team_member_user_ids_from_team(existing_team))
+        intended_add = final_members - snapshot_members
+        intended_remove = snapshot_members - final_members
 
-        # Apply updates to the database
-        updated_team = await _apply_group_patch_updates(group_id, update_data, final_members, prisma_client)
+        # Apply the metadata/displayName updates to the database
+        updated_team = await _apply_group_patch_updates(group_id, update_data, prisma_client)
 
-        # Refresh team data from database to get the latest state after concurrent updates
-        # This prevents race conditions when multiple PATCH requests come in simultaneously
         refreshed_team = await TeamRepository(prisma_client).table.find_unique(where={"team_id": group_id})
-        if refreshed_team:
-            # Re-read current members from refreshed team to account for concurrent updates
-            refreshed_current_members = set(
-                await _get_team_member_user_ids_from_team(LiteLLM_TeamTable(**refreshed_team.model_dump()))
-            )
-            # Use the refreshed members for comparison
-            current_members = refreshed_current_members
+        refreshed_current = (
+            set(await _get_team_member_user_ids_from_team(LiteLLM_TeamTable(**refreshed_team.model_dump())))
+            if refreshed_team
+            else snapshot_members
+        )
 
-        # Handle user-team relationship changes
-        await _handle_group_membership_changes(group_id, current_members, final_members)
+        effective_final = (
+            replace_target if replace_target is not None else (refreshed_current | intended_add) - intended_remove
+        )
+
+        await _handle_group_membership_changes(group_id, refreshed_current, effective_final)
 
         # A rename can flip whether this group matches scim_admin_group by display
         # name, so retained members must be re-resolved too, not just the ones whose
@@ -2060,7 +2163,7 @@ async def patch_group(
         alias_changed = new_alias != existing_team.team_alias
         await _recompute_scim_member_roles(
             prisma_client,
-            (current_members | final_members if alias_changed else current_members ^ final_members),
+            (refreshed_current | effective_final if alias_changed else refreshed_current ^ effective_final),
         )
 
         # Refresh team one more time to get final state after membership changes

litellm/proxy/management_endpoints/sso/saml_sso.py

@@ -0,0 +1,493 @@
+"""
+SAML 2.0 SSO for the LiteLLM proxy admin UI.
+
+Supports both SP-initiated and IdP-initiated login via the HTTP-POST binding,
+using the OneLogin python3-saml toolkit for signature, audience and time
+validation. The IdP is configured from its metadata (``SAML_IDP_METADATA_URL``
+or inline ``SAML_IDP_METADATA_XML``); a successful login is mapped to a
+``CustomOpenID`` and handed to the shared post-login path used by every other
+SSO provider.
+
+python3-saml pulls in the native ``xmlsec``/``libxml2`` libraries, so it is an
+optional dependency. When it is not installed the SAML routes return a clear
+error instead of breaking proxy startup.
+"""
+
+# python3-saml ships no type stubs, so the type checker sees every onelogin call
+# as Unknown and the guarded optional import as possibly-unbound. Values crossing
+# that boundary are cast() to concrete types at each use site; these directives
+# silence only the unavoidable noise from the untyped dependency in this module.
+# pyright: reportUnknownMemberType=false, reportUnknownVariableType=false
+# pyright: reportUnknownArgumentType=false, reportUnknownParameterType=false
+# pyright: reportMissingTypeStubs=false, reportPossiblyUnboundVariable=false
+# pyright: reportConstantRedefinition=false
+
+import asyncio
+import hashlib
+import os
+import secrets
+import time
+from typing import cast
+from urllib.parse import parse_qsl
+
+from fastapi import HTTPException, Request, status
+from fastapi.responses import RedirectResponse
+from pydantic import ValidationError
+
+from litellm._logging import verbose_proxy_logger
+from litellm.caching.dual_cache import DualCache
+from litellm.proxy.management_endpoints.types import CustomOpenID, get_litellm_user_role
+from litellm.proxy.utils import get_custom_url
+
+try:
+    from onelogin.saml2.auth import OneLogin_Saml2_Auth
+    from onelogin.saml2.idp_metadata_parser import OneLogin_Saml2_IdPMetadataParser
+    from onelogin.saml2.settings import OneLogin_Saml2_Settings
+    from onelogin.saml2.xml_utils import OneLogin_Saml2_XML
+
+    SAML_AVAILABLE = True
+except ImportError:
+    SAML_AVAILABLE = False
+
+SAML_LOGIN_ROUTE = "sso/saml/login"
+SAML_CALLBACK_ROUTE = "sso/saml/callback"
+SAML_METADATA_ROUTE = "sso/saml/metadata"
+
+_SAML_AUTHN_STATE_COOKIE = "litellm_saml_authn"
+_SAML_IDP_SETTINGS_CACHE_PREFIX = "saml_idp_settings"
+_SAML_AUTHN_REQUEST_CACHE_PREFIX = "saml_authn_request"
+_SAML_CONSUMED_ASSERTION_CACHE_PREFIX = "saml_consumed_assertion"
+_SAML_AUTHN_REQUEST_TTL_SECONDS = 600
+_SAML_IDP_METADATA_TTL_SECONDS = 3600
+_SAML_METADATA_FETCH_TIMEOUT_SECONDS = 10
+_SAML_MAX_POST_BYTES = 5 * 1024 * 1024
+# The replay guard tracks each assertion's NotOnOrAfter so it spans the full
+# validity window; the floor covers IdPs that issue hour-long assertions or omit
+# the timestamp, and the cap bounds cache growth.
+_SAML_REPLAY_GUARD_DEFAULT_TTL_SECONDS = 3600
+_SAML_REPLAY_GUARD_MAX_TTL_SECONDS = 86400
+
+_EMAIL_ATTRIBUTE_CANDIDATES = (
+    "urn:oid:0.9.2342.19200300.100.1.3",
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+    "email",
+    "emailAddress",
+    "mail",
+    "Email",
+)
+_FIRST_NAME_ATTRIBUTE_CANDIDATES = (
+    "urn:oid:2.5.4.42",
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+    "givenName",
+    "first_name",
+    "firstName",
+)
+_LAST_NAME_ATTRIBUTE_CANDIDATES = (
+    "urn:oid:2.5.4.4",
+    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
+    "sn",
+    "surname",
+    "last_name",
+    "lastName",
+)
+_ROLE_ATTRIBUTE_CANDIDATES = ("role", "roles", "litellm_role")
+_TEAM_IDS_ATTRIBUTE_CANDIDATES = ("teams", "team_ids", "groups")
+
+
+def _saml_unavailable_error() -> HTTPException:
+    return HTTPException(
+        status_code=status.HTTP_501_NOT_IMPLEMENTED,
+        detail=(
+            "SAML SSO requires the optional 'python3-saml' dependency, which is "
+            "not installed. Re-install litellm with the saml extra: "
+            "'pip install litellm[saml]'. The saml extra bundles the native "
+            "xmlsec/libxml2 libraries, so no system packages are required."
+        ),
+    )
+
+
+class SAMLAuthHandler:
+    """SP- and IdP-initiated SAML 2.0 login for the admin UI."""
+
+    @staticmethod
+    def _env(name: str, default: str | None = None) -> str | None:
+        return os.getenv(name, default)
+
+    @staticmethod
+    def is_saml_configured() -> bool:
+        return bool(SAMLAuthHandler._env("SAML_IDP_METADATA_URL") or SAMLAuthHandler._env("SAML_IDP_METADATA_XML"))
+
+    @staticmethod
+    def _bool_env(name: str, default: bool) -> bool:
+        raw = SAMLAuthHandler._env(name)
+        if raw is None:
+            return default
+        return raw.strip().lower() in ("true", "1", "yes", "on")
+
+    @staticmethod
+    def _base_url(request: Request) -> str:
+        base = get_custom_url(request_base_url=str(request.base_url))
+        return base if base.endswith("/") else base + "/"
+
+    @staticmethod
+    def _is_https(request: Request) -> bool:
+        return SAMLAuthHandler._base_url(request).startswith("https")
+
+    @staticmethod
+    def _acs_url(request: Request) -> str:
+        return SAMLAuthHandler._base_url(request) + SAML_CALLBACK_ROUTE
+
+    @staticmethod
+    def _metadata_url(request: Request) -> str:
+        return SAMLAuthHandler._base_url(request) + SAML_METADATA_ROUTE
+
+    @staticmethod
+    def _sp_entity_id(request: Request) -> str:
+        return SAMLAuthHandler._env("SAML_SP_ENTITY_ID") or SAMLAuthHandler._metadata_url(request)
+
+    @staticmethod
+    async def _load_idp_settings(cache: DualCache) -> dict[str, object]:
+        metadata_url = SAMLAuthHandler._env("SAML_IDP_METADATA_URL")
+        metadata_xml = SAMLAuthHandler._env("SAML_IDP_METADATA_XML")
+        source = metadata_url or metadata_xml
+        if source is None:
+            raise HTTPException(
+                status_code=status.HTTP_501_NOT_IMPLEMENTED,
+                detail="SAML SSO is not configured. Set SAML_IDP_METADATA_URL or SAML_IDP_METADATA_XML.",
+            )
+
+        cache_key = f"{_SAML_IDP_SETTINGS_CACHE_PREFIX}:{hashlib.sha256(source.encode()).hexdigest()}"
+        cached = cache.get_cache(key=cache_key)
+        if isinstance(cached, dict):
+            return cast(dict[str, object], cached)  # cast-ok: untyped python3-saml
+
+        if metadata_url is not None:
+            parsed = await asyncio.to_thread(
+                OneLogin_Saml2_IdPMetadataParser.parse_remote,
+                metadata_url,
+                validate_cert=SAMLAuthHandler._bool_env("SAML_IDP_METADATA_VALIDATE_CERT", True),
+                timeout=_SAML_METADATA_FETCH_TIMEOUT_SECONDS,
+            )
+        else:
+            parsed = OneLogin_Saml2_IdPMetadataParser.parse(cast(str, metadata_xml))  # cast-ok: untyped python3-saml
+
+        idp_settings = cast(dict[str, object], parsed)  # cast-ok: untyped python3-saml
+        if not idp_settings.get("idp"):
+            raise HTTPException(
+                status_code=status.HTTP_502_BAD_GATEWAY,
+                detail="Could not parse an IdP entityID/SSO URL/certificate from the SAML metadata.",
+            )
+        cache.set_cache(key=cache_key, value=idp_settings, ttl=_SAML_IDP_METADATA_TTL_SECONDS)
+        return idp_settings
+
+    @staticmethod
+    def _build_settings(request: Request, idp_settings: dict[str, object]) -> dict[str, object]:
+        sp_settings: dict[str, object] = {
+            "strict": SAMLAuthHandler._bool_env("SAML_STRICT", True),
+            "debug": False,
+            "sp": {
+                "entityId": SAMLAuthHandler._sp_entity_id(request),
+                "assertionConsumerService": {
+                    "url": SAMLAuthHandler._acs_url(request),
+                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                },
+                "NameIDFormat": SAMLAuthHandler._env(
+                    "SAML_SP_NAME_ID_FORMAT",
+                    "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+                ),
+            },
+            "security": {
+                "wantAssertionsSigned": SAMLAuthHandler._bool_env("SAML_WANT_ASSERTIONS_SIGNED", True),
+                "wantMessagesSigned": SAMLAuthHandler._bool_env("SAML_WANT_MESSAGES_SIGNED", False),
+                "authnRequestsSigned": SAMLAuthHandler._bool_env("SAML_AUTHN_REQUESTS_SIGNED", False),
+                "wantNameId": True,
+                "requestedAuthnContext": False,
+                "rejectUnsolicitedResponsesWithInResponseTo": False,
+            },
+        }
+        return OneLogin_Saml2_IdPMetadataParser.merge_settings(sp_settings, idp_settings)
+
+    @staticmethod
+    def _prepare_request_data(request: Request, post_data: dict[str, str] | None = None) -> dict[str, object]:
+        base = SAMLAuthHandler._base_url(request)
+        scheme, _, host_part = base.partition("://")
+        host = host_part.split("/", 1)[0]
+        return {
+            "https": "on" if scheme == "https" else "off",
+            "http_host": host,
+            "script_name": "/" + SAML_CALLBACK_ROUTE,
+            "get_data": dict(request.query_params),
+            "post_data": post_data or {},
+        }
+
+    @staticmethod
+    async def _build_auth(
+        request: Request,
+        cache: DualCache,
+        post_data: dict[str, str] | None = None,
+    ) -> "OneLogin_Saml2_Auth":
+        if not SAML_AVAILABLE:
+            raise _saml_unavailable_error()
+        idp_settings = await SAMLAuthHandler._load_idp_settings(cache)
+        settings = SAMLAuthHandler._build_settings(request, idp_settings)
+        request_data = SAMLAuthHandler._prepare_request_data(request, post_data)
+        try:
+            return OneLogin_Saml2_Auth(request_data, old_settings=settings)
+        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Invalid SAML configuration: {e}",
+            )
+
+    @staticmethod
+    async def build_login_redirect(
+        request: Request, cache: DualCache, relay_state: str | None = None
+    ) -> RedirectResponse:
+        auth = await SAMLAuthHandler._build_auth(request, cache)
+        redirect_url = cast(str, auth.login(return_to=relay_state))  # cast-ok: untyped python3-saml
+        response = RedirectResponse(url=redirect_url, status_code=303)
+        request_id = cast(str | None, auth.get_last_request_id())  # cast-ok: untyped python3-saml
+        if request_id is not None:
+            cache.set_cache(
+                key=f"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{request_id}",
+                value="1",
+                ttl=_SAML_AUTHN_REQUEST_TTL_SECONDS,
+            )
+            secure = SAMLAuthHandler._is_https(request)
+            response.set_cookie(
+                key=_SAML_AUTHN_STATE_COOKIE,
+                value=request_id,
+                max_age=_SAML_AUTHN_REQUEST_TTL_SECONDS,
+                httponly=True,
+                secure=secure,
+                samesite="none" if secure else "lax",
+            )
+        return response
+
+    @staticmethod
+    async def build_sp_metadata(request: Request, cache: DualCache) -> str:
+        if not SAML_AVAILABLE:
+            raise _saml_unavailable_error()
+        idp_settings = await SAMLAuthHandler._load_idp_settings(cache)
+        settings = SAMLAuthHandler._build_settings(request, idp_settings)
+        saml_settings = OneLogin_Saml2_Settings(settings, sp_validation_only=True)
+        metadata = cast(str, saml_settings.get_sp_metadata())  # cast-ok: untyped python3-saml
+        errors = cast(list[str], saml_settings.validate_metadata(metadata))  # cast-ok: untyped python3-saml
+        if errors:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Invalid SP metadata: {', '.join(errors)}",
+            )
+        return metadata
+
+    @staticmethod
+    async def read_acs_post_data(request: Request) -> dict[str, str]:
+        """Read the ACS POST form under a hard size cap before any base64/XML decoding.
+
+        Bounds both Content-Length-declared and chunked requests so an unauthenticated
+        caller cannot force unbounded buffering while decoding the SAMLResponse."""
+        declared = request.headers.get("content-length")
+        if declared is not None and declared.isdigit() and int(declared) > _SAML_MAX_POST_BYTES:
+            raise HTTPException(
+                status_code=status.HTTP_413_CONTENT_TOO_LARGE,
+                detail="SAML response exceeds the maximum allowed size.",
+            )
+
+        body = bytearray()
+        async for chunk in request.stream():
+            body += chunk
+            if len(body) > _SAML_MAX_POST_BYTES:
+                raise HTTPException(
+                    status_code=status.HTTP_413_CONTENT_TOO_LARGE,
+                    detail="SAML response exceeds the maximum allowed size.",
+                )
+
+        return dict(parse_qsl(body.decode("utf-8", "replace")))
+
+    @staticmethod
+    async def handle_acs(request: Request, cache: DualCache, post_data: dict[str, str]) -> CustomOpenID:
+        auth = await SAMLAuthHandler._build_auth(request, cache, post_data=post_data)
+        browser_request_id = request.cookies.get(_SAML_AUTHN_STATE_COOKIE)
+        try:
+            auth.process_response(request_id=browser_request_id)
+        except Exception as e:  # noqa: BLE001 - toolkit exposes no common exception base; fail closed
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"Could not process SAML response: {e}",
+            )
+
+        errors = cast(list[str], auth.get_errors())  # cast-ok: untyped python3-saml
+        if errors or not auth.is_authenticated():
+            reason = auth.get_last_error_reason()
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"SAML authentication failed: {reason or ', '.join(errors)}",
+            )
+
+        await SAMLAuthHandler._enforce_response_binding(auth, cache, browser_request_id)
+        return SAMLAuthHandler._result_from_auth(auth)
+
+    @staticmethod
+    def _replay_guard_ttl(auth: "OneLogin_Saml2_Auth") -> int:
+        not_on_or_after = auth.get_last_assertion_not_on_or_after()
+        if not isinstance(not_on_or_after, int):
+            return _SAML_REPLAY_GUARD_DEFAULT_TTL_SECONDS
+        remaining = not_on_or_after - int(time.time())
+        return min(
+            max(remaining, _SAML_REPLAY_GUARD_DEFAULT_TTL_SECONDS),
+            _SAML_REPLAY_GUARD_MAX_TTL_SECONDS,
+        )
+
+    @staticmethod
+    def _response_in_response_to(auth: "OneLogin_Saml2_Auth") -> str | None:
+        """The request id this response answers, read from the Response element or, when the
+        IdP only stamps it on the bearer SubjectConfirmationData, from there. A non-None value
+        marks the response as solicited (SP-initiated) and so requiring browser binding."""
+        value = cast(str | None, auth.get_last_response_in_response_to())  # cast-ok: untyped python3-saml
+        if value:
+            return value
+        xml = cast(bytes | None, auth.get_last_response_xml())  # cast-ok: untyped python3-saml
+        if not xml:
+            return None
+        root = OneLogin_Saml2_XML.to_etree(xml)
+        for node in OneLogin_Saml2_XML.query(root, "//saml:SubjectConfirmationData[@InResponseTo]"):
+            irt = cast(str | None, node.get("InResponseTo"))  # cast-ok: untyped python3-saml
+            if irt:
+                return irt
+        return None
+
+    @staticmethod
+    async def _enforce_response_binding(
+        auth: "OneLogin_Saml2_Auth",
+        cache: DualCache,
+        browser_request_id: str | None,
+    ) -> None:
+        in_response_to = SAMLAuthHandler._response_in_response_to(auth)
+
+        if in_response_to is not None:
+            authn_key = f"{_SAML_AUTHN_REQUEST_CACHE_PREFIX}:{in_response_to}"
+            if cache.get_cache(key=authn_key) is None:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="SAML response references an unknown or already-used login request.",
+                )
+            if browser_request_id is None or not secrets.compare_digest(browser_request_id, in_response_to):
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="SAML response is not bound to this browser's login request.",
+                )
+        elif browser_request_id is not None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="SAML response is not bound to this browser's login request.",
+            )
+        elif not SAMLAuthHandler._bool_env("SAML_ALLOW_UNSOLICITED", False):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Unsolicited (IdP-initiated) SAML responses are disabled.",
+            )
+        elif cache.redis_cache is None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=(
+                    "Unsolicited (IdP-initiated) SAML responses require a shared Redis cache "
+                    "so the replay guard is enforced across every worker."
+                ),
+            )
+
+        assertion_id = cast(str | None, auth.get_last_assertion_id())  # cast-ok: untyped python3-saml
+        if assertion_id is None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="SAML assertion is missing the required ID attribute.",
+            )
+        consumed_key = f"{_SAML_CONSUMED_ASSERTION_CACHE_PREFIX}:{assertion_id}"
+        consumed_count = await cache.async_increment_cache(
+            key=consumed_key, value=1, ttl=SAMLAuthHandler._replay_guard_ttl(auth)
+        )
+        if consumed_count is not None and consumed_count > 1:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="SAML assertion has already been used (replay detected).",
+            )
+
+    @staticmethod
+    def _result_from_auth(auth: "OneLogin_Saml2_Auth") -> CustomOpenID:
+        attributes = cast(dict[str, list[str]], auth.get_attributes())  # cast-ok: untyped python3-saml
+        name_id = cast(str | None, auth.get_nameid())  # cast-ok: untyped python3-saml
+
+        email = SAMLAuthHandler._attribute_value(attributes, "SAML_ATTRIBUTE_EMAIL", _EMAIL_ATTRIBUTE_CANDIDATES)
+        if email is None and name_id is not None and "@" in name_id:
+            email = name_id
+
+        if email is None and SAMLAuthHandler._env("ALLOWED_EMAIL_DOMAINS") is not None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=(
+                    "SAML assertion did not contain an email address, but ALLOWED_EMAIL_DOMAINS "
+                    "restricts sign-in by email domain."
+                ),
+            )
+
+        user_id = SAMLAuthHandler._attribute_value(attributes, "SAML_ATTRIBUTE_USER_ID", ()) or name_id or email
+        if user_id is None:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="SAML assertion did not contain a usable subject (NameID) or email.",
+            )
+
+        first_name = SAMLAuthHandler._attribute_value(
+            attributes, "SAML_ATTRIBUTE_FIRST_NAME", _FIRST_NAME_ATTRIBUTE_CANDIDATES
+        )
+        last_name = SAMLAuthHandler._attribute_value(
+            attributes, "SAML_ATTRIBUTE_LAST_NAME", _LAST_NAME_ATTRIBUTE_CANDIDATES
+        )
+        role_value = SAMLAuthHandler._attribute_value(attributes, "SAML_ATTRIBUTE_ROLE", _ROLE_ATTRIBUTE_CANDIDATES)
+        team_ids = SAMLAuthHandler._attribute_values(
+            attributes, "SAML_ATTRIBUTE_TEAM_IDS", _TEAM_IDS_ATTRIBUTE_CANDIDATES
+        )
+
+        display_name = " ".join(part for part in (first_name, last_name) if part) or email
+
+        verbose_proxy_logger.info(f"SAML login: subject={user_id}, email={email}, attributes={list(attributes.keys())}")
+
+        try:
+            return CustomOpenID(
+                id=user_id,
+                email=email,
+                first_name=first_name,
+                last_name=last_name,
+                display_name=display_name,
+                picture=None,
+                provider="saml",
+                team_ids=team_ids,
+                user_role=get_litellm_user_role(role_value) if role_value else None,
+            )
+        except ValidationError as e:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail=f"SAML assertion contained an invalid subject or email: {e}",
+            )
+
+    @staticmethod
+    def _attribute_value(
+        attributes: dict[str, list[str]],
+        env_override: str,
+        candidates: tuple[str, ...],
+    ) -> str | None:
+        values = SAMLAuthHandler._attribute_values(attributes, env_override, candidates)
+        return values[0] if values else None
+
+    @staticmethod
+    def _attribute_values(
+        attributes: dict[str, list[str]],
+        env_override: str,
+        candidates: tuple[str, ...],
+    ) -> list[str]:
+        override = SAMLAuthHandler._env(env_override)
+        keys = (override, *candidates) if override else candidates
+        for key in keys:
+            values = attributes.get(key)
+            if values:
+                return [v for v in values if v]
+        return []

litellm/proxy/management_endpoints/team_endpoints.py

@@ -47,6 +47,7 @@ from litellm.proxy._types import (
     Member,
     NewTeamRequest,
     OrgMember,
+    PatchTeamRequest,
     ProxyErrorTypes,
     ProxyException,
     SpecialManagementEndpointEnums,
@@ -2005,6 +2006,7 @@ async def update_team(
 )
 async def patch_team(
     team_id: str,
+    data: PatchTeamRequest,
     http_request: Request,
     user_api_key_dict: Annotated[UserAPIKeyAuth, Depends(user_api_key_auth)],
     litellm_changed_by: Annotated[
@@ -2017,11 +2019,12 @@ async def patch_team(
     """
     Partially update a team using RFC 7386 JSON Merge Patch semantics.
 
-    `team_id` is taken from the path. `metadata` is merged with the team's stored
-    metadata rather than replacing it: an omitted key is preserved, `key: null`
-    deletes it, and any other value overwrites (recursing into nested objects).
-    Every other field behaves exactly like `POST /team/update` (omitted preserves,
-    a value overwrites). Returns the full updated team.
+    `team_id` is taken from the path; a `team_id` in the body is accepted only when it
+    matches. `metadata` is merged with the team's stored metadata rather than replacing
+    it: an omitted key is preserved, `key: null` deletes it, and any other value
+    overwrites (recursing into nested objects). Every other field behaves exactly like
+    `POST /team/update` (omitted preserves, a value overwrites). Returns the full
+    updated team.
 
     ```
     curl --location --request PATCH 'http://0.0.0.0:4000/team/8d916b1c-510d-4894-a334-1c16a93344f5' \
@@ -2041,21 +2044,15 @@ async def patch_team(
                 detail={"error": CommonProxyErrors.db_not_connected_error.value},
             )
 
-        try:
-            body = await http_request.json()
-        except (json.JSONDecodeError, ValueError):
-            raise HTTPException(status_code=400, detail={"error": "Request body must be a JSON object"})
-        if not isinstance(body, dict):
-            raise HTTPException(status_code=400, detail={"error": "Request body must be a JSON object"})
-
-        body_team_id = body.pop("team_id", None)
-        if body_team_id is not None and body_team_id != team_id:
+        if data.team_id is not None and data.team_id != team_id:
             raise HTTPException(
                 status_code=400,
-                detail={"error": f"team_id in body ({body_team_id}) does not match team_id in path ({team_id})"},
+                detail={"error": f"team_id in body ({data.team_id}) does not match team_id in path ({team_id})"},
             )
 
-        if "metadata" in body:
+        patch_fields = data.model_dump(exclude_unset=True, exclude={"team_id"})
+
+        if "metadata" in patch_fields:
             existing_team_row = await TeamRepository(prisma_client).table.find_unique(where={"team_id": team_id})
             if existing_team_row is None:
                 raise HTTPException(
@@ -2063,9 +2060,9 @@ async def patch_team(
                     detail={"error": f"Team not found, passed team_id={team_id}"},
                 )
             existing_metadata = existing_team_row.metadata if isinstance(existing_team_row.metadata, dict) else {}
-            body["metadata"] = apply_json_merge_patch(existing_metadata, body["metadata"])
+            patch_fields["metadata"] = apply_json_merge_patch(existing_metadata, patch_fields["metadata"])
 
-        update_request = UpdateTeamRequest(team_id=team_id, **body)
+        update_request = UpdateTeamRequest(team_id=team_id, **patch_fields)
 
         result = await update_team(
             data=update_request,
@@ -2424,7 +2421,15 @@ async def _add_team_members_to_team(
     user_api_key_dict: UserAPIKeyAuth,
     litellm_proxy_admin_name: str,
 ) -> Tuple[LiteLLM_TeamTable, List[LiteLLM_UserTable], List[LiteLLM_TeamMembership]]:
-    """Add team members to the team."""
+    """Add team members to the team.
+
+    The members_with_roles reconciliation runs inside a transaction that locks
+    the team row with ``SELECT ... FOR UPDATE`` before reading the current
+    membership. Concurrent /team/member_add calls for the same team therefore
+    serialize on the row lock and each appends onto the other's committed
+    result, instead of both rewriting the whole JSON array from a stale
+    snapshot (which silently drops one member on the losing write).
+    """
     # Process and add new members
     updated_users, updated_team_memberships = await _process_team_members(
         data=data,
@@ -2434,19 +2439,22 @@ async def _add_team_members_to_team(
         litellm_proxy_admin_name=litellm_proxy_admin_name,
     )
 
-    # Update team members list
-    await _update_team_members_list(
-        data=data,
-        complete_team_data=complete_team_data,
-        updated_users=updated_users,
-    )
+    async with prisma_client.tx() as tx:
+        complete_team_data.members_with_roles = await TeamRepository(prisma_client).get_members_with_roles_locked(
+            tx, data.team_id
+        )
 
-    # ADD MEMBER TO TEAM
-    _db_team_members = [m.model_dump() for m in complete_team_data.members_with_roles]
-    updated_team = await TeamRepository(prisma_client).table.update(
-        where={"team_id": data.team_id},
-        data={"members_with_roles": json.dumps(_db_team_members)},  # type: ignore
-    )
+        await _update_team_members_list(
+            data=data,
+            complete_team_data=complete_team_data,
+            updated_users=updated_users,
+        )
+
+        _db_team_members = [m.model_dump() for m in complete_team_data.members_with_roles]
+        updated_team = await tx.litellm_teamtable.update(
+            where={"team_id": data.team_id},
+            data={"members_with_roles": json.dumps(_db_team_members)},
+        )
 
     return updated_team, updated_users, updated_team_memberships
 

litellm/proxy/management_endpoints/tool_management_endpoints.py

@@ -10,16 +10,18 @@ POST /v1/tool/policy            - Update the input_policy / output_policy for a
 """
 
 import uuid
-from datetime import datetime, timezone
-from typing import TYPE_CHECKING, Any, List, Optional
+from datetime import datetime, timedelta, timezone
+from itertools import groupby
+from typing import TYPE_CHECKING, Annotated, Any, List, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel, TypeAdapter
 
 if TYPE_CHECKING:
     from litellm.proxy.utils import PrismaClient
 
 from litellm._logging import verbose_proxy_logger
-from litellm.proxy._types import CommonProxyErrors, UserAPIKeyAuth
+from litellm.proxy._types import CommonProxyErrors, LitellmUserRoles, UserAPIKeyAuth
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
 from litellm.repositories.object_permission_repository import ObjectPermissionRepository
 from litellm.repositories.table_repositories import (
@@ -39,6 +41,9 @@ from litellm.types.tool_management import (
     ToolPolicyOptionsResponse,
     ToolPolicyUpdateRequest,
     ToolPolicyUpdateResponse,
+    ToolSpendDailyEntry,
+    ToolSpendEntry,
+    ToolSpendResponse,
     ToolUsageLogEntry,
     ToolUsageLogsResponse,
 )
@@ -124,6 +129,147 @@ async def list_tools(
         raise HTTPException(status_code=500, detail=str(e))
 
 
+def _parse_day_start(value: str | None) -> datetime | None:
+    if not value:
+        return None
+    try:
+        return datetime.strptime(value.strip(), "%Y-%m-%d").replace(tzinfo=timezone.utc)
+    except ValueError:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Invalid date format: {value}. Expected: 'YYYY-MM-DD'",
+        )
+
+
+class _ToolSpendRow(BaseModel):
+    date: str
+    tool_name: str
+    call_count: int
+    spend: float
+    total_tokens: int
+
+
+class _RequestTotalRow(BaseModel):
+    total_spend: float
+
+
+_TOOL_SPEND_ROWS = TypeAdapter(list[_ToolSpendRow])
+_REQUEST_TOTAL_ROWS = TypeAdapter(list[_RequestTotalRow])
+
+
+def _summarize_tool(name: str, grp: tuple[_ToolSpendRow, ...]) -> ToolSpendEntry:
+    return ToolSpendEntry(
+        tool_name=name,
+        spend=sum(r.spend for r in grp),
+        call_count=sum(r.call_count for r in grp),
+        total_tokens=sum(r.total_tokens for r in grp),
+    )
+
+
+def _build_tool_spend_response(
+    rows: list[_ToolSpendRow],
+    total_spend: float,
+    start_date: str,
+    end_date: str,
+) -> ToolSpendResponse:
+    daily = [
+        ToolSpendDailyEntry(date=r.date, tool_name=r.tool_name, spend=r.spend, call_count=r.call_count) for r in rows
+    ]
+    grouped = groupby(sorted(rows, key=lambda r: r.tool_name), key=lambda r: r.tool_name)
+    by_tool = sorted(
+        (_summarize_tool(name, tuple(grp)) for name, grp in grouped),
+        key=lambda e: e.spend,
+        reverse=True,
+    )
+    return ToolSpendResponse(
+        by_tool=by_tool,
+        daily=daily,
+        total_spend=total_spend,
+        start_date=start_date,
+        end_date=end_date,
+    )
+
+
+@router.get(
+    "/v1/tool/spend",
+    tags=["tool management"],
+    dependencies=[Depends(user_api_key_auth)],
+    response_model=ToolSpendResponse,
+)
+async def get_tool_spend(
+    user_api_key_dict: Annotated[UserAPIKeyAuth, Depends(user_api_key_auth)],
+    start_date: Annotated[str | None, Query(description="YYYY-MM-DD (defaults to 30 days ago)")] = None,
+    end_date: Annotated[str | None, Query(description="YYYY-MM-DD (defaults to today)")] = None,
+):
+    """
+    Spend attributed to each tool over a date range, for the Cost Optimization dashboard.
+
+    Joins ``LiteLLM_SpendLogToolIndex`` (which tool names ran on which request) to
+    ``LiteLLM_SpendLogs`` (what the request cost). A request that used multiple tools
+    counts its full spend toward each of those tools, so per-tool numbers are
+    attributions. ``total_spend`` is the deduplicated spend of every request that
+    called at least one tool in the window, so it never double counts.
+    """
+    from litellm.proxy.proxy_server import prisma_client
+
+    if user_api_key_dict.user_role not in (
+        LitellmUserRoles.PROXY_ADMIN,
+        LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+    ):
+        raise HTTPException(
+            status_code=403,
+            detail="Only proxy admin roles can view tool spend across the deployment",
+        )
+
+    if prisma_client is None:
+        raise HTTPException(status_code=500, detail=CommonProxyErrors.db_not_connected_error.value)
+
+    now = datetime.now(timezone.utc)
+    end_day = _parse_day_start(end_date)
+    start_dt = _parse_day_start(start_date) or ((end_day or now) - timedelta(days=30))
+    end_exclusive = (end_day + timedelta(days=1)) if end_day else now
+
+    rows = await prisma_client.db.query_raw(
+        """
+        SELECT to_char(ti.start_time, 'YYYY-MM-DD') AS date,
+               ti.tool_name AS tool_name,
+               COUNT(*)::int AS call_count,
+               COALESCE(SUM(sl.spend), 0)::double precision AS spend,
+               COALESCE(SUM(sl.total_tokens), 0)::bigint AS total_tokens
+        FROM "LiteLLM_SpendLogToolIndex" ti
+        JOIN "LiteLLM_SpendLogs" sl ON sl.request_id = ti.request_id
+        WHERE ti.start_time >= ($1::timestamptz AT TIME ZONE 'UTC')
+          AND ti.start_time < ($2::timestamptz AT TIME ZONE 'UTC')
+        GROUP BY date, ti.tool_name
+        ORDER BY date ASC, spend DESC
+        """,
+        start_dt.isoformat(),
+        end_exclusive.isoformat(),
+    )
+    totals = await prisma_client.db.query_raw(
+        """
+        SELECT COALESCE(SUM(sl.spend), 0)::double precision AS total_spend
+        FROM "LiteLLM_SpendLogs" sl
+        WHERE EXISTS (
+            SELECT 1
+            FROM "LiteLLM_SpendLogToolIndex" ti
+            WHERE ti.request_id = sl.request_id
+              AND ti.start_time >= ($1::timestamptz AT TIME ZONE 'UTC')
+              AND ti.start_time < ($2::timestamptz AT TIME ZONE 'UTC')
+        )
+        """,
+        start_dt.isoformat(),
+        end_exclusive.isoformat(),
+    )
+    total_rows = _REQUEST_TOTAL_ROWS.validate_python(totals or [])
+    return _build_tool_spend_response(
+        rows=_TOOL_SPEND_ROWS.validate_python(rows or []),
+        total_spend=total_rows[0].total_spend if total_rows else 0.0,
+        start_date=start_dt.strftime("%Y-%m-%d"),
+        end_date=(end_day or now).strftime("%Y-%m-%d"),
+    )
+
+
 @router.get(
     "/v1/tool/{tool_name:path}/detail",
     tags=["tool management"],

litellm/proxy/management_endpoints/ui_sso.py

@@ -12,6 +12,7 @@ import asyncio
 import base64
 import hashlib
 import inspect
+import json
 import os
 import re
 import secrets
@@ -35,7 +36,7 @@ if TYPE_CHECKING:
     import httpx
 
 import jwt
-from fastapi import APIRouter, Depends, Header, HTTPException, Request, status
+from fastapi import APIRouter, Depends, Header, HTTPException, Request, Response, status
 from fastapi.responses import RedirectResponse
 
 import litellm
@@ -99,6 +100,7 @@ from litellm.proxy.common_utils.html_forms.ui_login import build_ui_login_form
 from litellm.proxy.common_utils.user_api_key_cache import UserApiKeyCache
 from litellm.proxy.management_endpoints.internal_user_endpoints import new_user
 from litellm.proxy.management_endpoints.sso import CustomMicrosoftSSO
+from litellm.proxy.management_endpoints.sso.saml_sso import SAMLAuthHandler
 from litellm.proxy.management_endpoints.sso_helper_utils import (
     check_is_admin_only_access,
     has_admin_ui_access,
@@ -258,11 +260,20 @@ def _get_cli_sso_flow_or_raise(login_id: Optional[str], cache: DualCache) -> dic
         raise HTTPException(status_code=400, detail="Invalid CLI login session id")
 
     cache_key = _get_cli_sso_flow_cache_key(cast(str, login_id))
-    flow = cache.get_cache(key=cache_key)
+    redis_cache = cache.redis_cache
+    if redis_cache is not None:
+        flow = redis_cache.get_cache(key=cache_key)
+    else:
+        flow = cache.get_cache(key=cache_key)
+    if isinstance(flow, str):
+        try:
+            flow = json.loads(flow)
+        except ValueError:
+            flow = None
     if not isinstance(flow, dict) or "poll_secret_hash" not in flow:
         verbose_proxy_logger.warning(
             "CLI SSO login session not found in cache for login_id=%s. If the proxy runs multiple replicas, "
-            "a shared Redis cache (enable_redis_auth_cache: true) is required for CLI login to work.",
+            "a shared Redis cache is required for CLI login to work.",
             login_id,
         )
         raise HTTPException(
@@ -270,7 +281,7 @@ def _get_cli_sso_flow_or_raise(login_id: Optional[str], cache: DualCache) -> dic
             detail=(
                 "CLI login session not found or expired. Run `litellm-proxy login` again. "
                 "If this happens immediately after starting a login, the proxy is likely running multiple "
-                "replicas without a shared cache; configure Redis with `enable_redis_auth_cache: true` "
+                "replicas without a shared cache; configure a Redis cache "
                 "so every replica can see the login session."
             ),
         )
@@ -278,11 +289,12 @@ def _get_cli_sso_flow_or_raise(login_id: Optional[str], cache: DualCache) -> dic
 
 
 def _set_cli_sso_flow(login_id: str, cache: DualCache, flow: dict) -> None:
-    cache.set_cache(
-        key=_get_cli_sso_flow_cache_key(login_id),
-        value=flow,
-        ttl=CLI_SSO_SESSION_TTL_SECONDS,
-    )
+    cache_key = _get_cli_sso_flow_cache_key(login_id)
+    redis_cache = cache.redis_cache
+    if redis_cache is not None:
+        redis_cache.set_cache(key=cache_key, value=json.dumps(flow), ttl=CLI_SSO_SESSION_TTL_SECONDS)
+    else:
+        cache.set_cache(key=cache_key, value=flow, ttl=CLI_SSO_SESSION_TTL_SECONDS)
 
 
 def _verify_cli_sso_poll_secret(flow: dict, poll_secret: Optional[str]) -> bool:
@@ -593,11 +605,11 @@ def _render_cli_sso_verification_page(
 
 @router.post("/sso/cli/start", tags=["experimental"], include_in_schema=False)
 async def cli_sso_start(request: Request):
-    from litellm.proxy.proxy_server import general_settings, user_api_key_cache
+    from litellm.proxy.proxy_server import cli_sso_session_cache, general_settings
 
     _check_cli_sso_start_rate_limit(
         request=request,
-        cache=user_api_key_cache,
+        cache=cli_sso_session_cache,
         use_x_forwarded_for=bool((general_settings or {}).get("use_x_forwarded_for", False)),
     )
 
@@ -612,7 +624,7 @@ async def cli_sso_start(request: Request):
         "user_code_verified": False,
         "session_data": None,
     }
-    _set_cli_sso_flow(login_id=login_id, cache=user_api_key_cache, flow=flow)
+    _set_cli_sso_flow(login_id=login_id, cache=cli_sso_session_cache, flow=flow)
 
     verification_uri_complete: str | None = (
         (
@@ -644,9 +656,9 @@ async def cli_sso_complete(request: Request, login_id: str):
     from litellm.proxy.common_utils.html_forms.cli_sso_success import (
         render_cli_sso_success_page,
     )
-    from litellm.proxy.proxy_server import user_api_key_cache
+    from litellm.proxy.proxy_server import cli_sso_session_cache
 
-    flow = _get_cli_sso_flow_or_raise(login_id=login_id, cache=user_api_key_cache)
+    flow = _get_cli_sso_flow_or_raise(login_id=login_id, cache=cli_sso_session_cache)
     if not flow.get("sso_complete") or not flow.get("session_data"):
         raise HTTPException(status_code=400, detail="CLI login is not ready")
 
@@ -670,7 +682,7 @@ async def cli_sso_complete(request: Request, login_id: str):
         raise HTTPException(status_code=400, detail="Invalid verification code")
 
     flow["user_code_verified"] = True
-    _set_cli_sso_flow(login_id=login_id, cache=user_api_key_cache, flow=flow)
+    _set_cli_sso_flow(login_id=login_id, cache=cli_sso_session_cache, flow=flow)
 
     html_content = render_cli_sso_success_page()
     return HTMLResponse(content=html_content, status_code=200)
@@ -846,6 +858,27 @@ def process_sso_jwt_access_token(
     return None
 
 
+async def _raise_if_sso_exceeds_free_user_limit(premium_user: bool, prisma_client: PrismaClient | None) -> None:
+    """Free tier allows SSO for up to 5 billable users; beyond that requires an Enterprise license."""
+    if premium_user is True:
+        return
+    if prisma_client is None:
+        raise ProxyException(
+            message=CommonProxyErrors.db_not_connected_error.value,
+            type=ProxyErrorTypes.auth_error,
+            param="premium_user",
+            code=status.HTTP_403_FORBIDDEN,
+        )
+    billable_users = await UserRepository(prisma_client).count_billable_users()
+    if billable_users and billable_users > 5:
+        raise ProxyException(
+            message="You must be a LiteLLM Enterprise user to use SSO for more than 5 users. If you have a license please set `LITELLM_LICENSE` in your env. If you want to obtain a license meet with us here: https://enterprise.litellm.ai/demo You are seeing this error message because You configured SSO (one of `MICROSOFT_CLIENT_ID`, `GOOGLE_CLIENT_ID`, `GENERIC_CLIENT_ID`, or SAML) in your env. Please unset it",
+            type=ProxyErrorTypes.auth_error,
+            param="premium_user",
+            code=status.HTTP_403_FORBIDDEN,
+        )
+
+
 @router.get("/sso/key/generate", tags=["experimental"], include_in_schema=False)
 async def google_login(
     request: Request,
@@ -861,6 +894,7 @@ async def google_login(
     Example:
     """
     from litellm.proxy.proxy_server import (
+        cli_sso_session_cache,
         general_settings,
         premium_user,
         prisma_client,
@@ -880,25 +914,13 @@ async def google_login(
             return admin_ui_disabled()
 
     ####### Check if user is a Enterprise / Premium User #######
-    if microsoft_client_id is not None or google_client_id is not None or generic_client_id is not None:
-        if premium_user is not True:
-            # Check if under 'free SSO user' limit
-            if prisma_client is not None:
-                billable_users = await UserRepository(prisma_client).count_billable_users()
-                if billable_users and billable_users > 5:
-                    raise ProxyException(
-                        message="You must be a LiteLLM Enterprise user to use SSO for more than 5 users. If you have a license please set `LITELLM_LICENSE` in your env. If you want to obtain a license meet with us here: https://enterprise.litellm.ai/demo You are seeing this error message because You set one of `MICROSOFT_CLIENT_ID`, `GOOGLE_CLIENT_ID`, or `GENERIC_CLIENT_ID` in your env. Please unset this",
-                        type=ProxyErrorTypes.auth_error,
-                        param="premium_user",
-                        code=status.HTTP_403_FORBIDDEN,
-                    )
-            else:
-                raise ProxyException(
-                    message=CommonProxyErrors.db_not_connected_error.value,
-                    type=ProxyErrorTypes.auth_error,
-                    param="premium_user",
-                    code=status.HTTP_403_FORBIDDEN,
-                )
+    if (
+        microsoft_client_id is not None
+        or google_client_id is not None
+        or generic_client_id is not None
+        or SAMLAuthHandler.is_saml_configured()
+    ):
+        await _raise_if_sso_exceeds_free_user_limit(premium_user, prisma_client)
 
     ####### Detect DB + MASTER KEY in .env #######
     missing_env_vars = show_missing_vars_in_env()
@@ -912,7 +934,7 @@ async def google_login(
     )
 
     if source == LITELLM_CLI_SOURCE_IDENTIFIER:
-        _get_cli_sso_flow_or_raise(login_id=key, cache=user_api_key_cache)
+        _get_cli_sso_flow_or_raise(login_id=key, cache=cli_sso_session_cache)
 
     # Store CLI login handle in state for OAuth flow
     cli_state: Optional[str] = SSOAuthenticationHandler._get_cli_state(
@@ -936,6 +958,19 @@ async def google_login(
                 "Enterprise features are not available. Custom UI SSO sign-in requires LiteLLM Enterprise."
             )
 
+    if (
+        microsoft_client_id is None
+        and google_client_id is None
+        and generic_client_id is None
+        and SAMLAuthHandler.is_saml_configured()
+    ):
+        verbose_proxy_logger.info("Redirecting to SAML SSO login")
+        return await SAMLAuthHandler.build_login_redirect(
+            request=request,
+            cache=user_api_key_cache,
+            relay_state=return_to,
+        )
+
     # Check if we should use SSO handler
     if (
         SSOAuthenticationHandler.should_use_sso_handler(
@@ -954,15 +989,8 @@ async def google_login(
             state=cli_state,
             request=request,
         )
-        if return_to is not None and sso_redirect is not None:
-            if SSOAuthenticationHandler._validate_return_to(return_to):
-                sso_redirect.set_cookie(
-                    key="litellm_cp_return_to",
-                    value=return_to,
-                    max_age=600,
-                    httponly=True,
-                    samesite="lax",
-                )
+        if sso_redirect is not None:
+            _persist_return_to_cookie(sso_redirect, return_to)
         return sso_redirect
 
     from fastapi.responses import HTMLResponse
@@ -971,13 +999,19 @@ async def google_login(
         os.getenv("LITELLM_HIDE_DEFAULT_CREDENTIALS_HINT", "false").lower() == "true"
         or general_settings.get("hide_default_credentials_hint", False) is True
     )
-    return HTMLResponse(
+    form_response = HTMLResponse(
         content=build_ui_login_form(
             show_deprecation_banner=True,
             hide_default_credentials_hint=hide_default_credentials_hint,
         ),
         status_code=200,
     )
+    # Preserve return_to across the username/password sign-in too, via the SAME shared, never-raising
+    # helper the SSO branch uses, so /login can resume the connect flow instead of dead-ending at the
+    # dashboard. One implementation → the two sign-in branches cannot diverge (and the login form always
+    # renders, since the helper never raises on a bad return_to).
+    _persist_return_to_cookie(form_response, return_to)
+    return form_response
 
 
 def generic_response_convertor(
@@ -1903,6 +1937,81 @@ async def auth_callback(request: Request, state: Optional[str] = None):
     )
 
 
+@router.get("/sso/saml/login", tags=["experimental"], include_in_schema=False)
+async def saml_login(request: Request, return_to: str | None = None):
+    """SP-initiated SAML login. Redirects the user to the configured IdP."""
+    from litellm.proxy.proxy_server import user_api_key_cache
+
+    _disable_ui_flag = os.getenv("DISABLE_ADMIN_UI")
+    if _disable_ui_flag is not None and str_to_bool(value=_disable_ui_flag):
+        return admin_ui_disabled()
+
+    return await SAMLAuthHandler.build_login_redirect(request=request, cache=user_api_key_cache, relay_state=return_to)
+
+
+@router.get("/sso/saml/metadata", tags=["experimental"], include_in_schema=False)
+async def saml_metadata(request: Request):
+    """Service Provider metadata XML, for registering this proxy at the IdP."""
+    from litellm.proxy.proxy_server import user_api_key_cache
+
+    metadata = await SAMLAuthHandler.build_sp_metadata(request=request, cache=user_api_key_cache)
+    return Response(content=metadata, media_type="application/xml")
+
+
+@router.post("/sso/saml/callback", tags=["experimental"], include_in_schema=False)
+async def saml_callback(request: Request):
+    """Assertion Consumer Service. Validates the IdP assertion and issues a UI session."""
+    from litellm.proxy.proxy_server import (
+        general_settings,
+        jwt_handler,
+        master_key,
+        premium_user,
+        prisma_client,
+        user_api_key_cache,
+    )
+
+    _disable_ui_flag = os.getenv("DISABLE_ADMIN_UI")
+    if _disable_ui_flag is not None and str_to_bool(value=_disable_ui_flag):
+        return admin_ui_disabled()
+
+    if prisma_client is None:
+        raise HTTPException(status_code=500, detail=CommonProxyErrors.db_not_connected_error.value)
+    if master_key is None:
+        raise ProxyException(
+            message="Master Key not set for Proxy. Set `LITELLM_MASTER_KEY` in .env or general_settings:master_key in config.yaml.",
+            type=ProxyErrorTypes.auth_error,
+            param="master_key",
+            code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+    post_data = await SAMLAuthHandler.read_acs_post_data(request)
+    if "SAMLResponse" not in post_data:
+        raise HTTPException(status_code=400, detail="Missing SAMLResponse in callback request.")
+
+    result = await SAMLAuthHandler.handle_acs(request=request, cache=user_api_key_cache, post_data=post_data)
+
+    await _raise_if_sso_exceeds_free_user_limit(premium_user, prisma_client)
+
+    ui_access_mode = general_settings.get("ui_access_mode", None)
+    relay_state = post_data.get("RelayState")
+    cp_return_to: str | None = (
+        relay_state
+        if isinstance(relay_state, str) and SSOAuthenticationHandler._validate_return_to(relay_state)
+        else None
+    )
+
+    return await SSOAuthenticationHandler.get_redirect_response_from_openid(
+        result=result,
+        request=request,
+        received_response=None,
+        generic_client_id=None,
+        ui_access_mode=ui_access_mode,
+        access_token_payload=None,
+        jwt_handler=jwt_handler,
+        return_to=cp_return_to,
+    )
+
+
 async def _build_cli_sso_user_defined_values(
     result: Union[OpenID, dict],
     parsed_openid_result: ParsedOpenIDResult,
@@ -1957,6 +2066,7 @@ async def _complete_cli_sso_callback_session(
     user_defined_values: Optional[SSOUserDefinedValues],
     prisma_client: PrismaClient,
     user_api_key_cache: UserApiKeyCache,
+    cli_sso_session_cache: DualCache,
     proxy_logging_obj: ProxyLogging,
     prefill_user_code: str | None = None,
     sso_assertion: SSOIdentityAssertion | None = None,
@@ -2006,7 +2116,7 @@ async def _complete_cli_sso_callback_session(
     flow["sso_complete"] = True
     browser_complete_token = secrets.token_urlsafe(32)
     flow["browser_complete_token_hash"] = _hash_cli_sso_secret(browser_complete_token)
-    _set_cli_sso_flow(login_id=key, cache=user_api_key_cache, flow=flow)
+    _set_cli_sso_flow(login_id=key, cache=cli_sso_session_cache, flow=flow)
 
     verbose_proxy_logger.info(
         f"Stored CLI SSO session for user: {user_info.user_id}, teams: {teams}, num_teams: {len(teams)}"
@@ -2037,13 +2147,14 @@ async def cli_sso_callback(
     verbose_proxy_logger.info("CLI SSO callback")
 
     from litellm.proxy.proxy_server import (
+        cli_sso_session_cache,
         general_settings,
         prisma_client,
         proxy_logging_obj,
         user_api_key_cache,
     )
 
-    flow = _get_cli_sso_flow_or_raise(login_id=key, cache=user_api_key_cache)
+    flow = _get_cli_sso_flow_or_raise(login_id=key, cache=cli_sso_session_cache)
 
     if prisma_client is None:
         raise HTTPException(status_code=500, detail=CommonProxyErrors.db_not_connected_error.value)
@@ -2083,6 +2194,7 @@ async def cli_sso_callback(
             user_defined_values=user_defined_values,
             prisma_client=prisma_client,
             user_api_key_cache=user_api_key_cache,
+            cli_sso_session_cache=cli_sso_session_cache,
             proxy_logging_obj=proxy_logging_obj,
             prefill_user_code=prefill_user_code,
             sso_assertion=sso_assertion,
@@ -2114,10 +2226,10 @@ async def cli_poll_key(
         team_id: Optional team ID to assign to the JWT. If provided, must be one of user's teams.
     """
     from litellm.proxy.auth.auth_checks import ExperimentalUIJWTToken
-    from litellm.proxy.proxy_server import user_api_key_cache
+    from litellm.proxy.proxy_server import cli_sso_session_cache
 
     try:
-        flow = _get_cli_sso_flow_or_raise(login_id=key_id, cache=user_api_key_cache)
+        flow = _get_cli_sso_flow_or_raise(login_id=key_id, cache=cli_sso_session_cache)
         if not _verify_cli_sso_poll_secret(flow=flow, poll_secret=x_litellm_cli_poll_secret):
             raise HTTPException(status_code=403, detail="Invalid CLI polling secret")
 
@@ -2192,7 +2304,7 @@ async def cli_poll_key(
             )
 
             # Delete cache entry (single-use)
-            user_api_key_cache.delete_cache(key=_get_cli_sso_flow_cache_key(key_id))
+            cli_sso_session_cache.delete_cache(key=_get_cli_sso_flow_cache_key(key_id))
 
             verbose_proxy_logger.info(f"CLI JWT generated for user: {user_id}, team: {team_id}")
             poll_response = {
@@ -2404,6 +2516,92 @@ async def sso_readiness():
     )
 
 
+def _is_same_origin_return_path(return_to: str) -> bool:
+    """True for a strictly relative return path that stays on the gateway's own origin by
+    construction, and is therefore safe to honor without a configured ``control_plane_url``.
+    Used by the MCP gateway DCR authorize round-trip so a browser sent through login lands
+    back on the authorize request.
+
+    Requires a single leading ``/`` (not protocol-relative ``//``), no backslash (browsers
+    fold ``\\`` to ``/``, so ``/\\evil.com`` would escape the origin), and no control or
+    whitespace characters. Rejecting control chars keeps a ``\\r\\n``/tab-bearing value out
+    of the redirect ``Location`` and the ``litellm_cp_return_to`` cookie entirely, rather
+    than relying on downstream header encoding to neutralize it."""
+    if not return_to.startswith("/") or return_to.startswith("//") or "\\" in return_to:
+        return False
+    return not any(ord(ch) < 0x20 or ch in (" ", "\x7f") for ch in return_to)
+
+
+async def _sso_return_to_redirect(
+    return_to: str | None,
+    jwt_token: str,
+    redis_usage_cache,
+    user_api_key_cache,
+) -> RedirectResponse | None:
+    """Resolve the post-SSO redirect for a ``return_to``, or None to fall through to the dashboard.
+
+    Two arms, both clearing the one-shot ``litellm_cp_return_to`` cookie:
+    - **Same-origin relative path** (the MCP gateway DCR authorize round-trip): set the session cookie
+      exactly like the dashboard path, then send the browser back where it came from.
+    - **Control-plane cross-origin** (``control_plane_url``): stash the JWT behind a single-use opaque
+      code (60s TTL) so the token never lands in browser history/logs; the control plane redeems it via
+      ``POST /v3/login/exchange``.
+
+    Extracted from ``get_redirect_response_from_openid`` to keep that method inside the complexity
+    budget; behavior is identical to the inline arms it replaces (including letting
+    ``_validate_return_to`` raise for a mismatched absolute return_to, as before)."""
+    if return_to is None:
+        return None
+
+    if _is_same_origin_return_path(return_to):
+        redirect_response = RedirectResponse(url=return_to, status_code=303)
+        redirect_response.set_cookie(key="token", value=jwt_token)
+        redirect_response.delete_cookie("litellm_cp_return_to")
+        return redirect_response
+
+    if SSOAuthenticationHandler._validate_return_to(return_to):
+        code = secrets.token_urlsafe(32)
+        cache_key = f"login_code:{code}"
+        cache_value = {"token": jwt_token, "redirect_url": return_to}
+        if redis_usage_cache is not None:
+            await redis_usage_cache.async_set_cache(key=cache_key, value=cache_value, ttl=60)
+        else:
+            await user_api_key_cache.async_set_cache(key=cache_key, value=cache_value, ttl=60)
+
+        separator = "&" if "?" in return_to else "?"
+        redirect_url = return_to + separator + urlencode({"login": "success", "code": code})
+        verbose_proxy_logger.info("Cross-origin SSO: redirecting to control plane with login code")
+        redirect_response = RedirectResponse(url=redirect_url, status_code=303)
+        redirect_response.delete_cookie("litellm_cp_return_to")
+        return redirect_response
+
+    return None
+
+
+def _persist_return_to_cookie(response: Response, return_to: str | None) -> None:
+    """Best-effort: persist a SAFE ``return_to`` on ``response`` as the one-shot ``litellm_cp_return_to``
+    cookie so ANY sign-in path — SSO / Okta / generic OR the username/password form — can resume there
+    afterwards. THIS is the single source of truth, called by every sign-in branch so they cannot
+    diverge (a per-branch reimplementation is exactly how the two drifted before). Honors a strictly
+    relative same-origin path, and (when ``control_plane_url`` is configured) a return_to matching that
+    origin. It NEVER raises: a mismatched or invalid ``return_to`` is simply not stored, so it can never
+    block sign-in — the login entrypoint must always render."""
+    if return_to is None:
+        return
+    try:
+        safe = _is_same_origin_return_path(return_to) or SSOAuthenticationHandler._validate_return_to(return_to)
+    except HTTPException:
+        return  # a non-matching absolute return_to is ignored, never blocks sign-in
+    if safe:
+        response.set_cookie(
+            key="litellm_cp_return_to",
+            value=return_to,
+            max_age=600,
+            httponly=True,
+            samesite="lax",
+        )
+
+
 class SSOAuthenticationHandler:
     """
     Handler for SSO Authentication across all SSO providers
@@ -3041,7 +3239,6 @@ class SSOAuthenticationHandler:
         return_to: Optional[str] = None,
         sso_assertion: SSOIdentityAssertion | None = None,
     ) -> RedirectResponse:
-        import jwt
 
         from litellm.proxy.proxy_server import (
             general_settings,
@@ -3205,30 +3402,21 @@ class SSOAuthenticationHandler:
             server_root_path=get_server_root_path(),
         )
 
-        jwt_token = jwt.encode(
-            cast(dict, returned_ui_token_object),
-            master_key or "",
-            algorithm="HS256",
+        from litellm.proxy.auth.login_utils import encode_ui_session_jwt
+
+        jwt_token = encode_ui_session_jwt(returned_ui_token_object, master_key or "")
+
+        # Post-SSO return_to handling (the same-origin DCR round-trip and the control-plane
+        # cross-origin code exchange) lives in one shared helper so this method stays inside the
+        # complexity budget. None falls through to the dashboard redirect below.
+        return_to_redirect = await _sso_return_to_redirect(
+            return_to=return_to,
+            jwt_token=jwt_token,
+            redis_usage_cache=redis_usage_cache,
+            user_api_key_cache=user_api_key_cache,
         )
-
-        # Control-plane cross-origin: store JWT behind a single-use opaque
-        # code (60s TTL) so the token never appears in browser history / logs.
-        # The control plane redeems it via POST /v3/login/exchange.
-        if return_to is not None and SSOAuthenticationHandler._validate_return_to(return_to):
-            code = secrets.token_urlsafe(32)
-            cache_key = f"login_code:{code}"
-            cache_value = {"token": jwt_token, "redirect_url": return_to}
-            if redis_usage_cache is not None:
-                await redis_usage_cache.async_set_cache(key=cache_key, value=cache_value, ttl=60)
-            else:
-                await user_api_key_cache.async_set_cache(key=cache_key, value=cache_value, ttl=60)
-
-            separator = "&" if "?" in return_to else "?"
-            redirect_url = return_to + separator + urlencode({"login": "success", "code": code})
-            verbose_proxy_logger.info("Cross-origin SSO: redirecting to control plane with login code")
-            redirect_response = RedirectResponse(url=redirect_url, status_code=303)
-            redirect_response.delete_cookie("litellm_cp_return_to")
-            return redirect_response
+        if return_to_redirect is not None:
+            return return_to_redirect
 
         if user_id is not None and isinstance(user_id, str):
             litellm_dashboard_ui += "?login=success"

litellm/proxy/management_helpers/object_permission_utils.py

@@ -4,7 +4,8 @@ organizations, teams, and keys.
 """
 
 import json
-from typing import TYPE_CHECKING, Any, Dict, List, Optional, Set, Union
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any, Dict, List, Mapping, Optional, Set, Union
 
 from fastapi import HTTPException, status
 
@@ -64,6 +65,57 @@ async def attach_object_permission_to_dict(
     return data_dict
 
 
+@dataclass(frozen=True, slots=True)
+class ObjectPermissionUpsert:
+    object_permission_id: str
+    record: dict[str, object]
+
+
+async def prepare_object_permission_upsert(
+    new_object_permission: Mapping[str, object],
+    existing_object_permission_id: str | None,
+    prisma_client: PrismaClient,
+) -> ObjectPermissionUpsert:
+    """
+    Read-and-merge half of an object permission upsert; performs no writes.
+
+    Merges the sent grants over the existing row (looked up by
+    ``existing_object_permission_id``, or a fresh uuid when the entity has none) and
+    returns the id plus the full record to upsert. The id is pinned inside the record
+    because the column has ``@default(uuid())``, so a create without it would mint a
+    different id than the one the caller links. ``mcp_tool_permissions`` is serialized
+    to a JSON string to avoid GraphQL parsing issues (e.g. server IDs starting with
+    "3e64" being interpreted as floats).
+
+    Keeping this separate from the write lets callers run the upsert inside the same
+    transaction as the row that links ``object_permission_id``, so a rolled-back
+    update cannot leave permission changes live.
+    """
+    object_permission_id = existing_object_permission_id or str(uuid.uuid4())
+    existing_object_permission = await ObjectPermissionRepository(prisma_client).table.find_unique(
+        where={"object_permission_id": object_permission_id},
+    )
+    existing_fields: dict[str, object] = (
+        existing_object_permission.model_dump(exclude_unset=True, exclude_none=True)
+        if existing_object_permission is not None
+        else {}
+    )
+    merged: dict[str, object] = {
+        **existing_fields,
+        **new_object_permission,
+        "object_permission_id": object_permission_id,
+    }
+    record: dict[str, object] = {
+        **merged,
+        **(
+            {"mcp_tool_permissions": safe_dumps(merged["mcp_tool_permissions"])}
+            if "mcp_tool_permissions" in merged
+            else {}
+        ),
+    }
+    return ObjectPermissionUpsert(object_permission_id=object_permission_id, record=record)
+
+
 async def handle_update_object_permission_common(
     data_json: Dict,
     existing_object_permission_id: Optional[str],
@@ -93,50 +145,23 @@ async def handle_update_object_permission_common(
     if prisma_client is None:
         raise ValueError("Prisma client not found")
 
-    #########################################################
-    # Ensure `object_permission` is not added to the data_json
-    # We need to update the entity at the object_permission_id level in the LiteLLM_ObjectPermissionTable
-    #########################################################
-    new_object_permission: Union[dict, str] = data_json.pop("object_permission", None)
+    new_object_permission: Union[dict, str, None] = data_json.pop("object_permission", None)
     if new_object_permission is None:
         return None
 
-    # Lookup existing object permission ID and update that entry
-    object_permission_id_to_use: str = existing_object_permission_id or str(uuid.uuid4())
-    existing_object_permissions_dict: Dict = {}
-
-    existing_object_permission = await ObjectPermissionRepository(prisma_client).table.find_unique(
-        where={"object_permission_id": object_permission_id_to_use},
-    )
-
-    # Update the object permission
-    if existing_object_permission is not None:
-        existing_object_permissions_dict = existing_object_permission.model_dump(exclude_unset=True, exclude_none=True)
-
-    # Handle string JSON object permission
     if isinstance(new_object_permission, str):
         new_object_permission = json.loads(new_object_permission)
 
-    if isinstance(new_object_permission, dict):
-        existing_object_permissions_dict.update(new_object_permission)
-
-    #########################################################
-    # Serialize mcp_tool_permissions JSON field to avoid GraphQL parsing issues
-    # (e.g., server IDs starting with "3e64" being interpreted as floats)
-    #########################################################
-    if "mcp_tool_permissions" in existing_object_permissions_dict:
-        existing_object_permissions_dict["mcp_tool_permissions"] = safe_dumps(
-            existing_object_permissions_dict["mcp_tool_permissions"]
-        )
-
-    #########################################################
-    # Commit the update to the LiteLLM_ObjectPermissionTable
-    #########################################################
+    upsert = await prepare_object_permission_upsert(
+        new_object_permission=new_object_permission if isinstance(new_object_permission, dict) else {},
+        existing_object_permission_id=existing_object_permission_id,
+        prisma_client=prisma_client,
+    )
     created_object_permission_row = await ObjectPermissionRepository(prisma_client).table.upsert(
-        where={"object_permission_id": object_permission_id_to_use},
+        where={"object_permission_id": upsert.object_permission_id},
         data={
-            "create": existing_object_permissions_dict,
-            "update": existing_object_permissions_dict,
+            "create": upsert.record,
+            "update": upsert.record,
         },
     )
 

litellm/proxy/management_helpers/utils.py

@@ -252,6 +252,21 @@ async def _resolve_member_budget_id(
     return response.budget_id
 
 
+async def _append_team_id_if_absent(prisma_client: PrismaClient, user_id: str, team_id: str) -> None:
+    """Append team_id to a user's teams array, only if it is not already present.
+
+    The row-level filter makes the append a no-op once the team is present, so
+    repeated or concurrent adds of the same team cannot accumulate duplicate
+    team ids in user.teams (a duplicate also breaks auth logic that keys off the
+    number of teams a user belongs to). Teams added concurrently for a different
+    team id are unaffected, since each update filters on its own team id.
+    """
+    await UserRepository(prisma_client).table.update_many(
+        where={"user_id": user_id, "NOT": {"teams": {"has": team_id}}},
+        data={"teams": {"push": [team_id]}},
+    )
+
+
 async def add_new_member(
     new_member: Member,
     max_budget_in_team: Optional[float],
@@ -276,13 +291,22 @@ async def add_new_member(
     ## ADD TEAM ID, to USER TABLE IF NEW ##
     if new_member.user_id is not None:
         new_user_defaults = get_new_internal_user_defaults(user_id=new_member.user_id)
+        # Upsert ensures the user row exists atomically (no create race when the
+        # same new user is provisioned concurrently), seeding teams on create.
+        # The teams append lives in the filtered update below rather than the
+        # upsert's update branch so an already-existing user does not get a
+        # duplicate team id. The update branch still has to write something:
+        # Prisma only compiles an upsert down to INSERT ... ON CONFLICT when it
+        # is non-empty, and falls back to a racy SELECT-then-INSERT when it is
+        # not, so this re-states user_id as a no-op rather than being empty.
         _returned_user = await UserRepository(prisma_client).table.upsert(
             where={"user_id": new_member.user_id},
             data={
-                "update": {"teams": {"push": [team_id]}},
-                "create": {"teams": [team_id], **new_user_defaults},  # type: ignore
+                "create": {"teams": [team_id], **new_user_defaults},
+                "update": {"user_id": new_member.user_id},
             },
         )
+        await _append_team_id_if_absent(prisma_client, new_member.user_id, team_id)
         if _returned_user is not None:
             returned_user = LiteLLM_UserTable(**_returned_user.model_dump())
     elif new_member.user_email is not None:
@@ -302,12 +326,8 @@ async def add_new_member(
                 returned_user = LiteLLM_UserTable(**_returned_user.model_dump())
         elif len(existing_user_row) == 1:
             user_info = existing_user_row[0]
-            _returned_user = await UserRepository(prisma_client).table.update(
-                where={"user_id": user_info.user_id},  # type: ignore
-                data={"teams": {"push": [team_id]}},
-            )
-            if _returned_user is not None:
-                returned_user = LiteLLM_UserTable(**_returned_user.model_dump())
+            await _append_team_id_if_absent(prisma_client, user_info.user_id, team_id)
+            returned_user = LiteLLM_UserTable(**user_info.model_dump())
         elif len(existing_user_row) > 1:
             raise HTTPException(
                 status_code=400,

litellm/proxy/mcp_registry.json

@@ -198,13 +198,9 @@
       "icon_url": "https://cdn.simpleicons.org/googledrive",
       "category": "Productivity",
       "registry_url": null,
-      "transport": "stdio",
-      "command": "npx",
-      "args": ["-y", "@modelcontextprotocol/server-gdrive"],
-      "env_vars": [
-        {"name": "GOOGLE_CLIENT_ID", "description": "Google OAuth Client ID", "secret": false},
-        {"name": "GOOGLE_CLIENT_SECRET", "description": "Google OAuth Client Secret", "secret": true}
-      ]
+      "transport": "http",
+      "url": "https://drivemcp.googleapis.com/mcp/v1",
+      "env_vars": []
     },
     {
       "name": "google_calendar",

litellm/proxy/proxy_server.py

@@ -226,6 +226,7 @@ from litellm.constants import (
     APSCHEDULER_MAX_INSTANCES,
     APSCHEDULER_MISFIRE_GRACE_TIME,
     APSCHEDULER_REPLACE_EXISTING,
+    CLI_SSO_SESSION_TTL_SECONDS,
     DAYS_IN_A_MONTH,
     DEFAULT_HEALTH_CHECK_INTERVAL,
     DEFAULT_MODEL_CREATED_AT_TIME,
@@ -303,6 +304,11 @@ from litellm.proxy.common_utils.encrypt_decrypt_utils import (
     encrypt_value_helper,
 )
 from litellm.proxy.common_utils.html_forms.ui_login import build_ui_login_form
+from litellm.proxy.config_resolvers import resolve_fields
+from litellm.proxy.config_resolvers.alerting import (
+    EMAIL_DESCRIPTORS,
+    SLACK_DESCRIPTORS,
+)
 from litellm.proxy.common_utils.http_parsing_utils import (
     _read_request_body,
     _safe_get_request_headers,
@@ -1158,9 +1164,9 @@ _OPENAPI_HTTP_METHODS = {
 # Credentials surfaced by `/get/config/callbacks` in the alerting block: the
 # full Slack incoming-webhook URL is itself a credential, and the SMTP
 # password is a service password. Masked on read so plaintext never reaches
-# the UI. Kept here at module scope to match the analogous
-# `_SSO_SENSITIVE_FIELDS` / `_CACHE_SENSITIVE_FIELDS` constants in the SSO
-# and cache endpoint files.
+# the UI. Kept here at module scope to match the analogous descriptor
+# `is_secret` flags in litellm.proxy.config_resolvers and the
+# `_CACHE_SENSITIVE_FIELDS` constant in the cache endpoint file.
 _ALERTING_SENSITIVE_VARS: Set[str] = {"SLACK_WEBHOOK_URL", "SMTP_PASSWORD"}
 
 
@@ -1970,6 +1976,7 @@ user_api_key_cache: UserApiKeyCache = UserApiKeyCache(
     default_in_memory_ttl=UserAPIKeyCacheTTLEnum.in_memory_cache_ttl.value
 )
 spend_counter_cache = DualCache(default_in_memory_ttl=UserAPIKeyCacheTTLEnum.in_memory_cache_ttl.value)
+cli_sso_session_cache = DualCache(default_in_memory_ttl=CLI_SSO_SESSION_TTL_SECONDS)
 model_max_budget_limiter = _PROXY_VirtualKeyModelMaxBudgetLimiter(dual_cache=user_api_key_cache)
 litellm.logging_callback_manager.add_litellm_callback(model_max_budget_limiter)
 redis_usage_cache: Optional[RedisCache] = None  # redis cache used for tracking spend, tpm/rpm limits
@@ -3696,13 +3703,22 @@ def _build_redis_usage_cache_from_environment() -> RedisCache | None:
 def _attach_redis_usage_cache(redis_cache: RedisCache, enable_redis_auth_cache: bool) -> None:
     """
     Wires an established coordination Redis into the proxy-level caches that
-    consume it directly: the spend counter cache, the cluster-wide config
-    cache, and (only when opted in) the virtual-key auth cache.
+    consume it directly: the spend counter cache, the CLI SSO login-session
+    cache, the cluster-wide config cache, and (only when opted in) the
+    virtual-key auth cache.
+
+    The CLI SSO login-session cache is always backed by Redis when available so
+    that the browser SSO flow behind `lite login` survives landing on different
+    workers; it must not be gated behind enable_redis_auth_cache.
     """
     spend_counter_cache.attach_redis_cache(
         redis_cache,
         default_redis_ttl=litellm.default_redis_ttl,
     )
+    cli_sso_session_cache.attach_redis_cache(
+        redis_cache,
+        default_redis_ttl=CLI_SSO_SESSION_TTL_SECONDS,
+    )
     if enable_redis_auth_cache is True:
         user_api_key_cache.attach_redis_cache(
             redis_cache,
@@ -4618,6 +4634,11 @@ class ProxyConfig:
                     verbose_proxy_logger.debug(
                         f"{blue_color_code} Initialized polling via cache: enabled={polling_via_cache_enabled}, native_background_mode={native_background_mode}, ttl={polling_cache_ttl}{reset_color_code}"
                     )
+                elif key == "max_ui_session_budget":
+                    litellm.max_ui_session_budget = float(value) if value is not None else None
+                    verbose_proxy_logger.debug(
+                        f"{blue_color_code} setting litellm.max_ui_session_budget={litellm.max_ui_session_budget}{reset_color_code}"
+                    )
                 elif key == "default_team_settings":
                     for idx, team_setting in enumerate(value):  # run through pydantic validation
                         try:
@@ -13451,7 +13472,7 @@ async def fallback_login(request: Request):
 @router.post("/login", include_in_schema=False)  # hidden since this is a helper for UI sso login
 async def login(request: Request):
     global premium_user, general_settings, master_key
-    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object
+    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object, encode_ui_session_jwt
     from litellm.proxy.utils import get_custom_url
 
     form = await request.form()
@@ -13474,13 +13495,7 @@ async def login(request: Request):
     )
 
     # Generate JWT token
-    import jwt
-
-    jwt_token = jwt.encode(
-        cast(dict, returned_ui_token_object),
-        cast(str, master_key),
-        algorithm="HS256",
-    )
+    jwt_token = encode_ui_session_jwt(returned_ui_token_object, cast(str, master_key))
 
     # Build redirect URL
     litellm_dashboard_ui = get_custom_url(str(request.base_url))
@@ -13490,16 +13505,51 @@ async def login(request: Request):
         litellm_dashboard_ui += "/ui/"
     litellm_dashboard_ui += "?login=success"
 
+    # Honor a same-origin return_to preserved by the sign-in page (e.g. the aggregate DCR connect flow's
+    # authorize round-trip), mirroring the SSO callback; otherwise land on the dashboard. Gated by
+    # _is_same_origin_return_path (strictly relative path) so it can never be an open redirect, and the
+    # one-shot cookie is cleared after use.
+    from litellm.proxy.management_endpoints.ui_sso import _sso_return_to_redirect
+
+    # Resume through the SAME resumer the SSO callback uses, rather than a second, narrower arm.
+    # _persist_return_to_cookie stores both shapes it accepts (a relative same-origin path AND a
+    # control_plane_url-matching absolute URL); honoring only the relative one here silently dropped
+    # the control-plane case, landing the user on the dashboard. One function decides how a stored
+    # return_to is honored for EVERY sign-in branch, so the write and read sets cannot diverge: it
+    # sets the token cookie on the same-origin arm and hands off via a one-time login code on the
+    # cross-origin arm, and clears the one-shot cookie in both.
+    cp_return_to = request.cookies.get("litellm_cp_return_to")
+    if cp_return_to:
+        try:
+            resumed = await _sso_return_to_redirect(
+                return_to=cp_return_to,
+                jwt_token=jwt_token,
+                redis_usage_cache=redis_usage_cache,
+                user_api_key_cache=user_api_key_cache,
+            )
+        except Exception:  # noqa: BLE001  # resuming must NEVER block a completed sign-in
+            # The symmetric half of _persist_return_to_cookie's "never raises" contract. The resumer
+            # rejects a return_to that no longer matches control_plane_url (a config change between
+            # the cookie's write and this read), and the user has ALREADY authenticated here —
+            # failing their login over a stale one-shot cookie is the worst possible outcome. Land
+            # on the dashboard instead; the cookie is cleared below either way.
+            verbose_proxy_logger.info("Ignoring stale litellm_cp_return_to cookie; landing on dashboard")
+            resumed = None
+        if resumed is not None:
+            return resumed
+
     # Create redirect response with cookie
     redirect_response = RedirectResponse(url=litellm_dashboard_ui, status_code=303)
     redirect_response.set_cookie(key="token", value=jwt_token)
+    if cp_return_to:
+        redirect_response.delete_cookie(key="litellm_cp_return_to")
     return redirect_response
 
 
 @router.post("/v2/login", include_in_schema=False)  # hidden helper for UI logins via API
 async def login_v2(request: Request):
     global premium_user, general_settings, master_key
-    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object
+    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object, encode_ui_session_jwt
     from litellm.proxy.utils import get_custom_url
 
     try:
@@ -13520,13 +13570,7 @@ async def login_v2(request: Request):
             premium_user=premium_user,
         )
 
-        import jwt
-
-        jwt_token = jwt.encode(
-            cast(dict, returned_ui_token_object),
-            cast(str, master_key),
-            algorithm="HS256",
-        )
+        jwt_token = encode_ui_session_jwt(returned_ui_token_object, cast(str, master_key))
 
         litellm_dashboard_ui = get_custom_url(str(request.base_url))
         if litellm_dashboard_ui.endswith("/"):
@@ -13570,7 +13614,7 @@ async def login_v2(request: Request):
 )  # control-plane login — always returns token in body for cross-origin use
 async def login_v3(request: Request):
     global premium_user, general_settings, master_key
-    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object
+    from litellm.proxy.auth.login_utils import authenticate_user, create_ui_token_object, encode_ui_session_jwt
     from litellm.proxy.utils import get_custom_url
 
     try:
@@ -13599,13 +13643,7 @@ async def login_v3(request: Request):
             premium_user=premium_user,
         )
 
-        import jwt
-
-        jwt_token = jwt.encode(
-            cast(dict, returned_ui_token_object),
-            cast(str, master_key),
-            algorithm="HS256",
-        )
+        jwt_token = encode_ui_session_jwt(returned_ui_token_object, cast(str, master_key))
 
         litellm_dashboard_ui = get_custom_url(str(request.base_url))
         if litellm_dashboard_ui.endswith("/"):
@@ -14914,10 +14952,11 @@ GeneralSettingsUILiteLLMValue = Union[float, bool, str, None]
 
 
 class GeneralSettingsUILiteLLMFieldSpec(TypedDict):
-    type: Literal["Float", "Boolean", "Select"]
+    type: Literal["Float", "Dollar", "Boolean", "Select"]
     description: str
     options: NotRequired[tuple[str, ...]]
     tab: NotRequired[str]  # Admin UI sub-tab this field renders under; None groups it with the rest
+    default: NotRequired[float]  # reset/clear restores this instead of None; fields whose None means fail-open set it
 
 
 _GENERAL_SETTINGS_UI_LITELLM_FIELDS: dict[str, GeneralSettingsUILiteLLMFieldSpec] = {
@@ -14943,21 +14982,32 @@ _GENERAL_SETTINGS_UI_LITELLM_FIELDS: dict[str, GeneralSettingsUILiteLLMFieldSpec
         "tab": "prompt_caching",
         "description": "Empty uses Anthropic's 5m default. 1h suits long sessions but doubles the cache write cost.",
     },
+    "max_ui_session_budget": {
+        "type": "Dollar",
+        "default": 1.0,
+        "description": (
+            "USD spend cap for each dashboard login session; covers LLM calls made from the dashboard "
+            "such as the playground and auto router Test Connection. Each login starts a fresh session "
+            "with this budget. Clearing restores the $1 default."
+        ),
+    },
 }
 
 
 def _general_settings_ui_litellm_default(
-    field_type: Literal["Float", "Boolean", "Select"],
+    spec: GeneralSettingsUILiteLLMFieldSpec,
 ) -> GeneralSettingsUILiteLLMValue:
     """The value a field falls back to when it is cleared or reset."""
-    return False if field_type == "Boolean" else None
+    if "default" in spec:
+        return spec["default"]
+    return False if spec["type"] == "Boolean" else None
 
 
 def _validate_general_settings_ui_litellm_value(field_name: str, value: Any) -> GeneralSettingsUILiteLLMValue:
     spec = _GENERAL_SETTINGS_UI_LITELLM_FIELDS[field_name]
     field_type = spec["type"]
     if value is None or value == "":
-        return _general_settings_ui_litellm_default(field_type)
+        return _general_settings_ui_litellm_default(spec)
     match field_type:
         case "Boolean":
             if not isinstance(value, bool):
@@ -14981,6 +15031,13 @@ def _validate_general_settings_ui_litellm_value(field_name: str, value: Any) ->
                     detail={"error": f"{field_name} must be a number in (0, 1] or empty"},
                 )
             return float(value)
+        case "Dollar":
+            if isinstance(value, bool) or not isinstance(value, (int, float)) or float(value) <= 0:
+                raise HTTPException(
+                    status_code=400,
+                    detail={"error": f"{field_name} must be a positive dollar amount or empty"},
+                )
+            return float(value)
         case _:
             assert_never(field_type)
 
@@ -15003,7 +15060,7 @@ async def _persist_general_settings_ui_litellm_field(
 async def _reset_general_settings_ui_litellm_field(field_name: str, user_api_key_dict: UserAPIKeyAuth) -> dict:
     config = await proxy_config.get_config()
     before_value = config.get("litellm_settings", {}).get(field_name)
-    default_value = _general_settings_ui_litellm_default(_GENERAL_SETTINGS_UI_LITELLM_FIELDS[field_name]["type"])
+    default_value = _general_settings_ui_litellm_default(_GENERAL_SETTINGS_UI_LITELLM_FIELDS[field_name])
     setattr(litellm, field_name, default_value)
     if "litellm_settings" in config:
         config["litellm_settings"].pop(field_name, None)
@@ -15178,7 +15235,7 @@ async def get_config_list(
     )
     for litellm_field_name, spec in _GENERAL_SETTINGS_UI_LITELLM_FIELDS.items():
         current_value: GeneralSettingsUILiteLLMValue = getattr(litellm, litellm_field_name, None)
-        default_value = _general_settings_ui_litellm_default(spec["type"])
+        default_value = _general_settings_ui_litellm_default(spec)
         stored_in_db_litellm: Optional[bool]
         if litellm_field_name in db_litellm_settings:
             stored_in_db_litellm = True
@@ -15456,14 +15513,10 @@ async def get_config(
         _alerting = _general_settings.get("alerting", [])
         alerting_data = []
         if "slack" in _alerting:
-            _slack_vars = [
-                "SLACK_WEBHOOK_URL",
-            ]
-            _slack_env_vars = {
-                _var: (value if (value := environment_variables.get(_var)) is not None else os.getenv(_var))
-                for _var in _slack_vars
-            }
-            _slack_env_vars = _apply_alerting_env_role_gate(_slack_env_vars, is_full_admin)
+            _slack_values, _ = resolve_fields(
+                SLACK_DESCRIPTORS, environment_variables, os.environ, empty_db_is_set=True
+            )
+            _slack_env_vars = _apply_alerting_env_role_gate(_slack_values, is_full_admin)
 
             _alerting_types = proxy_logging_obj.slack_alerting_instance.alert_types
             _all_alert_types = proxy_logging_obj.slack_alerting_instance._all_possible_alert_types()
@@ -15479,19 +15532,8 @@ async def get_config(
                 }
             )
         # pass email alerting vars
-        _email_vars = [
-            "SMTP_HOST",
-            "SMTP_PORT",
-            "SMTP_USERNAME",
-            "SMTP_PASSWORD",
-            "SMTP_SENDER_EMAIL",
-            "TEST_EMAIL_ADDRESS",
-            "EMAIL_LOGO_URL",
-            "EMAIL_SUPPORT_CONTACT",
-        ]
-        _email_env_vars = _apply_alerting_env_role_gate(
-            {_var: environment_variables.get(_var) for _var in _email_vars}, is_full_admin
-        )
+        _email_values, _ = resolve_fields(EMAIL_DESCRIPTORS, environment_variables, os.environ, empty_db_is_set=True)
+        _email_env_vars = _apply_alerting_env_role_gate(_email_values, is_full_admin)
 
         alerting_data.append(
             {

litellm/proxy/spend_tracking/budget_reservation.py

@@ -4,7 +4,9 @@ import asyncio
 import json
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
-from typing import Any, Dict, List, Mapping, Optional, Sequence, cast
+from typing import Any, Dict, List, Mapping, NoReturn, Optional, Sequence, cast
+
+from fastapi import HTTPException, status
 
 import litellm
 from litellm._logging import verbose_proxy_logger
@@ -59,6 +61,22 @@ class _CounterReservationUnavailable(Exception):
         super().__init__("Counter reservation unavailable")
 
 
+def _raise_reservation_unavailable(counter_key: str) -> NoReturn:
+    verbose_proxy_logger.warning(
+        "fail_closed_budget_enforcement: rejecting request — budget reservation for %s could not be written",
+        counter_key,
+    )
+    raise HTTPException(
+        status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+        detail=(
+            "Budget enforcement unavailable: the budget reservation could not "
+            "be written to the spend counter backend, and "
+            "fail_closed_budget_enforcement is enabled, so the request was "
+            "rejected to avoid exceeding the configured budget. Retry shortly."
+        ),
+    )
+
+
 def get_reserved_counter_keys(budget_reservation: Optional[dict]) -> set:
     if not budget_reservation:
         return set()
@@ -138,6 +156,7 @@ async def reserve_budget_for_request(
     end_user_id: Optional[str] = None,
     end_user_object: Optional[Any] = None,
     skip_user_budget_on_team_key: bool = False,
+    fail_closed_budget_enforcement: bool = False,
 ) -> Optional[dict]:
     if valid_token is None or not RouteChecks.is_llm_api_route(route=route):
         return None
@@ -193,6 +212,8 @@ async def reserve_budget_for_request(
                         default_reserved_cost=reservation_cost,
                     )
                 applied_entries.remove(entry)
+                if fail_closed_budget_enforcement:
+                    _raise_reservation_unavailable(counter_key=counter.counter_key)
                 continue
 
             if reserved_value is not None:

litellm/proxy/spend_tracking/spend_management_endpoints.py

@@ -1695,13 +1695,10 @@ async def ui_view_spend_logs(
             code=status.HTTP_401_UNAUTHORIZED,
         )
 
-    if start_date is None or end_date is None:
-        raise ProxyException(
-            message="Start date and end date are required",
-            type="bad_request",
-            param="None",
-            code=status.HTTP_400_BAD_REQUEST,
-        )
+    # Inline import — auth_utils participates in a proxy import cycle.
+    from litellm.proxy.auth.auth_utils import get_request_route  # noqa: PLC0415
+
+    is_v2 = "/spend/logs/v2" in get_request_route(request)
 
     # Validate sort_by and sort_order
     valid_sort_fields = {
@@ -1729,36 +1726,50 @@ async def ui_view_spend_logs(
         )
 
     try:
-        # Inline import — auth_utils participates in a proxy import cycle.
-        from litellm.proxy.auth.auth_utils import get_request_route  # noqa: PLC0415
+        is_admin_view = _is_admin_view_safe(user_api_key_dict=user_api_key_dict)
+        is_request_id_lookup = request_id is not None and not is_v2
 
-        is_v2 = "/spend/logs/v2" in get_request_route(request)
-        formats = ["%Y-%m-%d %H:%M:%S", "%Y-%m-%d"] if is_v2 else ["%Y-%m-%d %H:%M:%S"]
+        if is_request_id_lookup:
+            # request_id is the @id primary key: it identifies a single row, so a
+            # time window is meaningless. The dashboard always sends a default 24h
+            # window, which hid ids copied from an older page (LIT-3981). Drop the
+            # window for the id lookup so it resolves across all time; every other
+            # query, including the public v2 route, still requires one (below).
+            start_date_obj: datetime | None = None
+            end_date_obj: datetime | None = None
+        else:
+            if start_date is None or end_date is None:
+                raise ProxyException(
+                    message="Start date and end date are required",
+                    type="bad_request",
+                    param="None",
+                    code=status.HTTP_400_BAD_REQUEST,
+                )
+            formats = ["%Y-%m-%d %H:%M:%S", "%Y-%m-%d"] if is_v2 else ["%Y-%m-%d %H:%M:%S"]
 
-        def parse_date(date_str: str) -> datetime:
-            date_str = date_str.strip()
-            for fmt in formats:
-                try:
-                    return datetime.strptime(date_str, fmt).replace(tzinfo=timezone.utc)
-                except ValueError:
-                    continue
-            expected = "'YYYY-MM-DD' or 'YYYY-MM-DD HH:MM:SS'" if is_v2 else "'YYYY-MM-DD HH:MM:SS'"
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"Invalid date format: {date_str}. Expected: {expected}",
-            )
+            def parse_date(date_str: str) -> datetime:
+                date_str = date_str.strip()
+                for fmt in formats:
+                    try:
+                        return datetime.strptime(date_str, fmt).replace(tzinfo=timezone.utc)
+                    except ValueError:
+                        continue
+                expected = "'YYYY-MM-DD' or 'YYYY-MM-DD HH:MM:SS'" if is_v2 else "'YYYY-MM-DD HH:MM:SS'"
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f"Invalid date format: {date_str}. Expected: {expected}",
+                )
 
-        start_date_obj = parse_date(start_date)
-        end_date_obj = parse_date(end_date)
-
-        # Convert to ISO format strings for Prisma
-        start_date_iso = start_date_obj.isoformat()  # Already in UTC, no need to add Z
-        end_date_iso = end_date_obj.isoformat()  # Already in UTC, no need to add Z
+            start_date_obj = parse_date(start_date)
+            end_date_obj = parse_date(end_date)
 
         # Build where conditions
-        where_conditions: dict[str, Any] = {
-            "startTime": {"gte": start_date_iso, "lte": end_date_iso},
-        }
+        where_conditions: dict[str, Any] = {}
+        if start_date_obj is not None and end_date_obj is not None:
+            where_conditions["startTime"] = {
+                "gte": start_date_obj.isoformat(),  # Already in UTC, no need to add Z
+                "lte": end_date_obj.isoformat(),
+            }
 
         if team_id is not None:
             where_conditions["team_id"] = team_id
@@ -1827,9 +1838,19 @@ async def ui_view_spend_logs(
                 where_conditions["spend"]["gte"] = min_spend
             if max_spend is not None:
                 where_conditions["spend"]["lte"] = max_spend
-        is_admin_view = _is_admin_view_safe(user_api_key_dict=user_api_key_dict)
+        # A request_id lookup drops the date window, so a non-admin could otherwise
+        # reach any single row by id; require they own it, mirroring the detail
+        # endpoint. That ownership check fully authorizes the one row, so the
+        # general scoping below is skipped for id lookups. Scoped to the UI route
+        # so the public v2 contract is unchanged.
+        if request_id is not None and not is_v2 and not is_admin_view:
+            await _assert_user_can_view_request_id(
+                prisma_client=prisma_client,
+                user_api_key_dict=user_api_key_dict,
+                request_id=request_id,
+            )
         permitted_team_ids: List[str] | None = None
-        if not is_admin_view:
+        if not is_request_id_lookup and not is_admin_view:
             if team_id is not None:
                 can_view_team = await _can_team_member_view_log(
                     prisma_client=prisma_client,
@@ -1875,15 +1896,16 @@ async def ui_view_spend_logs(
         sql_params: List[Any] = []
         p = 1  # parameter index counter
 
-        # Date range (always present). Wrap the param side with
-        # `AT TIME ZONE 'UTC'` so comparison against the plain `timestamp`
-        # column does not depend on the DB session timezone (see #22529).
-        sql_conditions.append(f"\"startTime\" >= (${p}::timestamptz AT TIME ZONE 'UTC')")
-        sql_params.append(start_date_obj)
-        p += 1
-        sql_conditions.append(f"\"startTime\" <= (${p}::timestamptz AT TIME ZONE 'UTC')")
-        sql_params.append(end_date_obj)
-        p += 1
+        # Date range. Wrap the param side with `AT TIME ZONE 'UTC'` so comparison
+        # against the plain `timestamp` column does not depend on the DB session
+        # timezone (see #22529). Absent for a request_id-only lookup (see above).
+        if start_date_obj is not None and end_date_obj is not None:
+            sql_conditions.append(f"\"startTime\" >= (${p}::timestamptz AT TIME ZONE 'UTC')")
+            sql_params.append(start_date_obj)
+            p += 1
+            sql_conditions.append(f"\"startTime\" <= (${p}::timestamptz AT TIME ZONE 'UTC')")
+            sql_params.append(end_date_obj)
+            p += 1
 
         # Equality filters - read effective values from where_conditions (post-authorization)
         for sql_col, wc_key in [

litellm/proxy/spend_tracking/spend_tracking_utils.py

@@ -374,12 +374,22 @@ def get_logging_payload(kwargs, response_obj, start_time, end_time) -> SpendLogs
             if isinstance(v, BaseModel):
                 v = v.model_dump()
             additional_usage_values.update({k: v})
-    if "cache_read_input_tokens" not in additional_usage_values:
-        prompt_tokens_details = additional_usage_values.get("prompt_tokens_details")
-        if isinstance(prompt_tokens_details, dict):
+    prompt_tokens_details = additional_usage_values.get("prompt_tokens_details")
+    if not isinstance(prompt_tokens_details, dict):
+        usage_object = clean_metadata.get("usage_object")
+        if isinstance(usage_object, dict):
+            prompt_tokens_details = usage_object.get("prompt_tokens_details")
+    if isinstance(prompt_tokens_details, dict):
+        if "cache_read_input_tokens" not in additional_usage_values:
             cached_tokens = prompt_tokens_details.get("cached_tokens")
             if isinstance(cached_tokens, int) and cached_tokens > 0:
                 additional_usage_values["cache_read_input_tokens"] = cached_tokens
+        if "cache_creation_input_tokens" not in additional_usage_values:
+            cache_write_tokens = prompt_tokens_details.get("cache_write_tokens") or prompt_tokens_details.get(
+                "cache_creation_tokens"
+            )
+            if isinstance(cache_write_tokens, int) and cache_write_tokens > 0:
+                additional_usage_values["cache_creation_input_tokens"] = cache_write_tokens
     clean_metadata["additional_usage_values"] = additional_usage_values
 
     if litellm.cache is not None:

litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py

@@ -1,6 +1,8 @@
 #### CRUD ENDPOINTS for UI Settings #####
 import asyncio
 import json
+import os
+from collections.abc import Mapping
 from typing import Any, Dict, List, Optional, Set, Tuple, Type, Union
 from urllib.parse import urlparse
 
@@ -13,6 +15,11 @@ from litellm._logging import verbose_proxy_logger
 from litellm.litellm_core_utils.sensitive_data_masker import mask_sensitive_keys
 from litellm.proxy._types import *
 from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
+from litellm.proxy.config_resolvers.sso import (
+    SSO_FIELD_ENV_VARS,
+    SSO_SECRET_FIELDS,
+    resolve_sso_config,
+)
 from litellm.repositories.config_repository import ConfigRepository
 from litellm.repositories.table_repositories import (
     SSOConfigRepository,
@@ -25,17 +32,45 @@ from litellm.types.proxy.management_endpoints.ui_sso import (
 
 router = APIRouter()
 
-# SSO secret fields returned by /get/sso_settings. These are masked on read so
-# the UI can show "(set)" without ever transporting the plaintext OAuth secret
-# off the server, matching the write-once + masked-on-read contract used for
-# the HashiCorp Vault config override.
-_SSO_SENSITIVE_FIELDS: Set[str] = {
-    "google_client_secret",
-    "microsoft_client_secret",
-    "generic_client_secret",
+# Maps each UIThemeConfig field to the env var the UI branding path reads it
+# from. /update/ui_theme_settings writes both the stored ui_theme_config and
+# these env vars, so /get/ui_theme_settings resolves the same env vars to
+# reflect a deployment branded purely through process env.
+_UI_THEME_FIELD_ENV_VARS: dict[str, str] = {
+    "logo_url": "UI_LOGO_PATH",
+    "favicon_url": "LITELLM_FAVICON_URL",
 }
 
 
+def _is_public_http_url(value: str | None) -> bool:
+    """Whether a value is a plain http(s) URL with a host, safe to disclose publicly."""
+    if not isinstance(value, str) or not value.strip():
+        return False
+    parsed = urlparse(value.strip())
+    return parsed.scheme in ("http", "https") and bool(parsed.netloc)
+
+
+def _resolve_ui_theme_field(stored_values: Mapping[str, Any], field_name: str) -> str | None:
+    """Resolve one UI theme field to the value the branding path actually uses.
+
+    The stored ui_theme_config wins; a field absent or blank there falls back to
+    the process environment. The branding path reads the env var, and stored
+    settings reach it by being pushed into the environment on save, so a value
+    supplied only as a process env var is live even though no stored entry exists.
+
+    This endpoint is unauthenticated, so the env fallback only surfaces a public
+    http(s) URL: an operator can point UI_LOGO_PATH at a local filesystem path
+    (the branding path serves it server-side), and that path must not be
+    disclosed to anonymous callers. A stored value is already validated as a
+    public URL on write, so it passes through.
+    """
+    stored = stored_values.get(field_name)
+    if isinstance(stored, str) and stored.strip():
+        return stored
+    env_value = os.environ.get(_UI_THEME_FIELD_ENV_VARS[field_name])
+    return env_value if _is_public_http_url(env_value) else None
+
+
 class IPAddress(BaseModel):
     ip: str
 
@@ -69,7 +104,8 @@ class SettingsResponse(BaseModel):
 class SSOSettingsResponse(SettingsResponse):
     """Response model for SSO settings"""
 
-    pass
+    provenance: Dict[str, str] = Field(default_factory=dict)
+    """Per-field source of each value: 'db', 'env', 'default', or 'unset'."""
 
 
 class InternalUserSettingsResponse(SettingsResponse):
@@ -717,7 +753,7 @@ async def get_sso_settings():
     Returns a structured object with values and descriptions for UI display.
     """
 
-    from litellm.proxy.proxy_server import prisma_client, proxy_config
+    from litellm.proxy.proxy_server import prisma_client
 
     if prisma_client is None:
         raise HTTPException(
@@ -725,59 +761,12 @@ async def get_sso_settings():
             detail={"error": "Database not connected. Please connect a database."},
         )
 
-    # Get SSO config from dedicated table
+    # Resolve the effective SSO config: the stored row wins, else the process
+    # environment, else each field's default. Unlike the legacy read path this
+    # does not write os.environ; a GET has no business mutating the environment.
     sso_db_record = await SSOConfigRepository(prisma_client).table.find_unique(where={"id": "sso_config"})
-
-    # Initialize with defaults
-    sso_settings_dict = {}
-
-    if sso_db_record and sso_db_record.sso_settings:
-        # Load settings from database
-        sso_settings_dict = dict(sso_db_record.sso_settings)
-
-    role_mappings_data = sso_settings_dict.pop("role_mappings", None)
-    role_mappings = None
-    if role_mappings_data:
-        from litellm.types.proxy.management_endpoints.ui_sso import RoleMappings
-
-        if isinstance(role_mappings_data, dict):
-            role_mappings = RoleMappings(**role_mappings_data)
-        elif isinstance(role_mappings_data, RoleMappings):
-            role_mappings = role_mappings_data
-
-    team_mappings_data = sso_settings_dict.pop("team_mappings", None)
-    team_mappings = None
-    if team_mappings_data:
-        from litellm.types.proxy.management_endpoints.ui_sso import TeamMappings
-
-        if isinstance(team_mappings_data, dict):
-            team_mappings = TeamMappings(**team_mappings_data)
-        elif isinstance(team_mappings_data, TeamMappings):
-            team_mappings = team_mappings_data
-
-    decrypted_sso_settings_dict = proxy_config._decrypt_and_set_db_env_variables(
-        environment_variables=sso_settings_dict
-    )
-
-    # Build SSO config with database values or environment fallback
-
-    sso_config = SSOConfig(
-        google_client_id=decrypted_sso_settings_dict.get("google_client_id", None),
-        google_client_secret=decrypted_sso_settings_dict.get("google_client_secret", None),
-        microsoft_client_id=decrypted_sso_settings_dict.get("microsoft_client_id", None),
-        microsoft_client_secret=decrypted_sso_settings_dict.get("microsoft_client_secret", None),
-        microsoft_tenant=decrypted_sso_settings_dict.get("microsoft_tenant", None),
-        generic_client_id=decrypted_sso_settings_dict.get("generic_client_id", None),
-        generic_client_secret=decrypted_sso_settings_dict.get("generic_client_secret", None),
-        generic_authorization_endpoint=decrypted_sso_settings_dict.get("generic_authorization_endpoint", None),
-        generic_token_endpoint=decrypted_sso_settings_dict.get("generic_token_endpoint", None),
-        generic_userinfo_endpoint=decrypted_sso_settings_dict.get("generic_userinfo_endpoint", None),
-        proxy_base_url=decrypted_sso_settings_dict.get("proxy_base_url", None),
-        user_email=decrypted_sso_settings_dict.get("user_email"),
-        ui_access_mode=decrypted_sso_settings_dict.get("ui_access_mode"),
-        role_mappings=role_mappings,
-        team_mappings=team_mappings,
-    )
+    sso_db_settings = dict(sso_db_record.sso_settings) if sso_db_record and sso_db_record.sso_settings else None
+    resolved = resolve_sso_config(sso_db_settings, os.environ)
 
     # Get the schema for UI display
     from pydantic import TypeAdapter
@@ -786,11 +775,12 @@ async def get_sso_settings():
 
     # Convert to dict for response, masking OAuth client secrets so plaintext
     # is never sent to the UI.
-    sso_dict = mask_sensitive_keys(sso_config.model_dump(), _SSO_SENSITIVE_FIELDS)
+    sso_dict = mask_sensitive_keys(resolved.config.model_dump(), set(SSO_SECRET_FIELDS))
 
     # Add descriptions to the response
     result = {
         "values": sso_dict,
+        "provenance": resolved.provenance,
         "field_schema": {
             "description": schema.get("description", ""),
             "properties": {},
@@ -841,21 +831,6 @@ async def update_sso_settings(
             detail={"error": "Set `'STORE_MODEL_IN_DB='True'` in your env to enable this feature."},
         )
 
-    # Update environment variables
-    env_var_mapping = {
-        "google_client_id": "GOOGLE_CLIENT_ID",
-        "google_client_secret": "GOOGLE_CLIENT_SECRET",
-        "microsoft_client_id": "MICROSOFT_CLIENT_ID",
-        "microsoft_client_secret": "MICROSOFT_CLIENT_SECRET",
-        "microsoft_tenant": "MICROSOFT_TENANT",
-        "generic_client_id": "GENERIC_CLIENT_ID",
-        "generic_client_secret": "GENERIC_CLIENT_SECRET",
-        "generic_authorization_endpoint": "GENERIC_AUTHORIZATION_ENDPOINT",
-        "generic_token_endpoint": "GENERIC_TOKEN_ENDPOINT",
-        "generic_userinfo_endpoint": "GENERIC_USERINFO_ENDPOINT",
-        "proxy_base_url": "PROXY_BASE_URL",
-    }
-
     # Read the existing SSO row first so the audit log captures a real
     # before/after diff. Stored values are encrypted; decrypt them so the
     # before-snapshot has the same shape as after_value, and rely on
@@ -884,8 +859,8 @@ async def update_sso_settings(
     # Update environment variables in config and in memory
     sso_data = sso_config.model_dump()
     for field_name, value in sso_data.items():
-        if field_name in env_var_mapping:
-            env_var_name = env_var_mapping[field_name]
+        if field_name in SSO_FIELD_ENV_VARS:
+            env_var_name = SSO_FIELD_ENV_VARS[field_name]
             if value:
                 os.environ[env_var_name] = value
             else:
@@ -935,7 +910,7 @@ async def update_sso_settings(
             else:
                 environment_variables = {}
 
-            env_vars_to_remove = set(env_var_mapping.values())
+            env_vars_to_remove = set(SSO_FIELD_ENV_VARS.values())
             filtered_env_vars = {
                 key: value for key, value in environment_variables.items() if key not in env_vars_to_remove
             }
@@ -977,12 +952,19 @@ async def get_ui_theme_settings():
     # Load existing config
     config = await proxy_config.get_config()
 
-    return await _get_settings_with_schema(
+    result = await _get_settings_with_schema(
         settings_key="ui_theme_config",
         settings_class=UIThemeConfig,
         config=config,
     )
 
+    stored_values = result.get("values", {})
+    result["values"] = {
+        **stored_values,
+        **{field: _resolve_ui_theme_field(stored_values, field) for field in _UI_THEME_FIELD_ENV_VARS},
+    }
+    return result
+
 
 def _validate_public_image_url(value: Optional[str], field_name: str) -> None:
     """

litellm/proxy/utils.py

@@ -172,6 +172,7 @@ from litellm.types.utils import LLMResponseTypes, LoggedLiteLLMParams
 
 if TYPE_CHECKING:
     from opentelemetry.trace import Span as _Span
+    from prisma.client import TransactionManager
 
     from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
 
@@ -1399,6 +1400,14 @@ class ProxyLogging:
                     self._process_guardrail_metadata(data)
                 return data
 
+            parallel_guardrails: tuple[CustomGuardrail, ...] = tuple(
+                cb
+                for cb in caps.resolved_callbacks
+                if isinstance(cb, CustomGuardrail)
+                and getattr(cb, "run_in_parallel", False)
+                and not (cb.guardrail_name and cb.guardrail_name in pipeline_managed)
+            )
+
             deferred_route_exc: Optional[SensitiveDataRouteException] = None
             for _callback in caps.resolved_callbacks:
                 start_time = time.time()
@@ -1408,6 +1417,9 @@ class ProxyLogging:
                         if _callback.guardrail_name and _callback.guardrail_name in pipeline_managed:
                             continue
 
+                        if getattr(_callback, "run_in_parallel", False):
+                            continue
+
                         result = await self._process_guardrail_callback(
                             callback=_callback,
                             data=data,  # type: ignore
@@ -1464,6 +1476,14 @@ class ProxyLogging:
             if deferred_route_exc is not None and data is not None:
                 data = await self._handle_sensitive_data_route_exception(deferred_route_exc, data, user_api_key_dict)
 
+            if parallel_guardrails and data is not None:
+                await self._run_parallel_pre_call_guardrails(
+                    guardrails=parallel_guardrails,
+                    data=data,
+                    user_api_key_dict=user_api_key_dict,
+                    call_type=call_type,
+                )
+
             if data is not None:
                 self._process_guardrail_metadata(data)
 
@@ -1476,6 +1496,47 @@ class ProxyLogging:
         except Exception as e:
             raise e
 
+    async def _run_parallel_pre_call_guardrails(
+        self,
+        guardrails: tuple[CustomGuardrail, ...],
+        data: dict,
+        user_api_key_dict: UserAPIKeyAuth,
+        call_type: CallTypesLiteral,
+    ) -> None:
+        """
+        Run opted-in pre_call guardrails concurrently against one shared payload
+        snapshot. These guardrails are declared block-only, so any modified data
+        they return is discarded; they run for their blocking side effect (raising
+        to reject the request before it reaches the LLM). Every guardrail is
+        awaited to completion (``return_exceptions=True``) so a raise by one never
+        leaves the others running as unobserved background tasks. A guardrail that
+        blocks (any exception other than a reroute or passthrough) takes precedence
+        over one that only changes the request flow, so a fast reroute can never
+        let a slower block be bypassed; the request is rejected before it reaches
+        the LLM, preserving the pre-call barrier that ``during_call`` guardrails
+        cannot provide. Per-guardrail latency is recorded by
+        ``_process_guardrail_callback``'s own metrics.
+        """
+        results = await asyncio.gather(
+            *(
+                self._process_guardrail_callback(
+                    callback=callback,
+                    data=data,
+                    user_api_key_dict=user_api_key_dict,
+                    call_type=call_type,
+                    event_type=GuardrailEventHooks.pre_call,
+                )
+                for callback in guardrails
+            ),
+            return_exceptions=True,
+        )
+        raised = tuple(result for result in results if isinstance(result, BaseException))
+        blocking = next((exc for exc in raised if not _exception_changes_request_flow(exc)), None)
+        if blocking is not None:
+            raise blocking
+        if raised:
+            raise raised[0]
+
     async def _handle_sensitive_data_route_exception(
         self,
         exc: SensitiveDataRouteException,
@@ -2276,9 +2337,16 @@ class ProxyLogging:
             # Merge model-level guardrails before checking which guardrails to run
             guardrail_data = _check_and_merge_model_level_guardrails(data=data, llm_router=llm_router)
 
+            parallel_guardrails: tuple[CustomGuardrail, ...] = tuple(
+                callback for callback in guardrail_callbacks if getattr(callback, "run_in_parallel", False)
+            )
+
             for callback in guardrail_callbacks:
                 # Main - V2 Guardrails implementation
 
+                if getattr(callback, "run_in_parallel", False):
+                    continue
+
                 if (
                     callback.should_run_guardrail(
                         data=guardrail_data,
@@ -2315,6 +2383,15 @@ class ProxyLogging:
                 if guardrail_response is not None:
                     response = guardrail_response
 
+            if parallel_guardrails:
+                await self._run_parallel_post_call_guardrails(
+                    guardrails=parallel_guardrails,
+                    data=data,
+                    guardrail_data=guardrail_data,
+                    response=response,
+                    user_api_key_dict=user_api_key_dict,
+                )
+
             ############ Handle CustomLogger ###############################
             #################################################################
 
@@ -2328,6 +2405,65 @@ class ProxyLogging:
             raise e
         return response
 
+    async def _run_parallel_post_call_guardrails(
+        self,
+        guardrails: tuple[CustomGuardrail, ...],
+        data: dict,
+        guardrail_data: dict,
+        response: LLMResponseTypes,
+        user_api_key_dict: UserAPIKeyAuth,
+    ) -> None:
+        """
+        Run opted-in post_call guardrails concurrently against the response
+        produced by the sequential guardrails. These guardrails are declared
+        block-only, so any modified response they return is discarded; they run
+        for their blocking side effect (raising to reject the response before it
+        reaches the client). Every guardrail is awaited to completion
+        (``return_exceptions=True``) so a raise by one never leaves the others
+        running as unobserved background tasks. A guardrail that blocks (any
+        exception other than a passthrough) takes precedence over one that only
+        changes the response flow, so a fast passthrough can never let a slower
+        block be bypassed. Each per-guardrail coroutine sets ``guardrail_to_apply``
+        immediately before awaiting, and the unified hook pops it before its first
+        suspension point, so concurrent guardrails never race on that key.
+        """
+
+        async def _run_one(callback: CustomGuardrail) -> None:
+            if callback.should_run_guardrail(data=guardrail_data, event_type=GuardrailEventHooks.post_call) is not True:
+                return
+            if "apply_guardrail" in type(callback).__dict__:
+                data["guardrail_to_apply"] = callback
+                await self._run_guardrail_with_metrics(
+                    callback,
+                    unified_guardrail.async_post_call_success_hook(
+                        user_api_key_dict=user_api_key_dict,
+                        data=data,
+                        response=response,
+                    ),
+                    "post_call",
+                )
+            else:
+                await self._run_guardrail_with_metrics(
+                    callback,
+                    callback.async_post_call_success_hook(
+                        user_api_key_dict=user_api_key_dict,
+                        data=data,
+                        response=response,
+                    ),
+                    "post_call",
+                )
+
+        results = await asyncio.gather(
+            *(_run_one(callback) for callback in guardrails),
+            return_exceptions=True,
+        )
+        raised = tuple(result for result in results if isinstance(result, BaseException))
+        blocking = next((exc for exc in raised if not _exception_changes_request_flow(exc)), None)
+        if blocking is not None:
+            raise blocking
+        if raised:
+            raise raised[0]
+
     async def post_call_response_headers_hook(
         self,
         data: dict,
@@ -2922,6 +3058,14 @@ class PrismaClient:
             return self.db.writer
         return self.db
 
+    def tx(self) -> "TransactionManager":
+        """Open an interactive transaction on the writer.
+
+        Callers go through this instead of reaching into ``self.db`` so writer
+        selection and read-replica routing stay encapsulated in the wrapper.
+        """
+        return cast("TransactionManager", self.db.tx())  # cast-ok: wrappers delegate tx via __getattr__ (untyped)
+
     def get_request_status(self, payload: Union[dict, SpendLogsPayload]) -> Literal["success", "failure"]:
         """
         Determine if a request was successful or failed based on payload metadata.
@@ -6159,6 +6303,9 @@ def create_model_info_response(
     if model_cost_info is not None:
         max_input_tokens = coerce_token_limit(model_cost_info.get("max_input_tokens"))
         max_output_tokens = coerce_token_limit(model_cost_info.get("max_output_tokens"))
+        mode = model_cost_info.get("mode")
+        if isinstance(mode, str):
+            base["mode"] = mode
 
     if llm_router is not None:
         configured_input, configured_output = llm_router.get_configured_token_limits(model_id)

litellm/repositories/team_repository.py

@@ -4,11 +4,18 @@ Team repository for database operations on LiteLLM_TeamTable.
 
 import json
 from datetime import datetime
-from typing import Any, Dict, List, Optional, Type
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Type
 
-from litellm.models.team import LiteLLM_TeamTable
+from pydantic import TypeAdapter
+
+from litellm.models.team import LiteLLM_TeamTable, Member
 from litellm.repositories.base_repository import BaseRepository
 
+if TYPE_CHECKING:
+    from prisma import Prisma
+
+_MEMBERS_WITH_ROLES_ADAPTER = TypeAdapter(list[Member])
+
 
 class TeamRepository(BaseRepository[LiteLLM_TeamTable]):
     """Repository for team database operations."""
@@ -46,6 +53,24 @@ class TeamRepository(BaseRepository[LiteLLM_TeamTable]):
 
         return LiteLLM_TeamTable(**data)
 
+    async def get_members_with_roles_locked(self, tx: "Prisma", team_id: str) -> List[Member]:
+        """Return the team's members_with_roles, locking the row FOR UPDATE.
+
+        Must be called inside a transaction so the row lock is held until
+        commit. This serializes concurrent membership writers on the team row
+        so the losing writer appends onto the winner's committed result instead
+        of overwriting it from a stale snapshot.
+        """
+        rows = await tx.query_raw(
+            'SELECT members_with_roles FROM "LiteLLM_TeamTable" WHERE team_id = $1 FOR UPDATE',
+            team_id,
+        )
+        raw_value = rows[0]["members_with_roles"] if rows else None
+        parsed = json.loads(raw_value) if isinstance(raw_value, str) else raw_value
+        if not parsed:
+            return []
+        return _MEMBERS_WITH_ROLES_ADAPTER.validate_python(parsed)
+
     async def find_by_id(self, team_id: str, id_field: str = "team_id") -> Optional[LiteLLM_TeamTable]:
         return await super().find_by_id(team_id, id_field)
 

litellm/responses/main.py

@@ -494,7 +494,14 @@ async def aresponses(
                 prompt_label=kwargs.get("prompt_label", None),
                 prompt_version=kwargs.get("prompt_version", None),
             )
-            input = cast(Union[str, ResponseInputParam], merged_input)
+            input = cast(
+                Union[str, ResponseInputParam],
+                ResponsesAPIRequestUtils.merge_prompt_management_input(
+                    original_input=input,
+                    client_input=client_input,
+                    merged_input=merged_input,
+                ),
+            )
             if model != original_model:
                 _, custom_llm_provider, _, _ = litellm.get_llm_provider(model=model)
             kwargs.pop("prompt_id", None)
@@ -609,7 +616,14 @@ def _apply_prompt_management_to_responses_call(
             prompt_label=kwargs.get("prompt_label", None),
             prompt_version=kwargs.get("prompt_version", None),
         )
-        input = cast(Union[str, ResponseInputParam], merged_input)
+        input = cast(
+            Union[str, ResponseInputParam],
+            ResponsesAPIRequestUtils.merge_prompt_management_input(
+                original_input=input,
+                client_input=client_input,
+                merged_input=merged_input,
+            ),
+        )
         local_vars["input"] = input
         local_vars["model"] = model
         if model != original_model:

litellm/responses/utils.py

@@ -19,7 +19,9 @@ import litellm
 from litellm._logging import verbose_logger
 from litellm.llms.base_llm.responses.transformation import BaseResponsesAPIConfig
 from litellm.types.llms.openai import (
+    AllMessageValues,
     ResponseAPIUsage,
+    ResponseInputParam,
     ResponsesAPIOptionalRequestParams,
     ResponsesAPIResponse,
     ResponseText,
@@ -36,6 +38,57 @@ from litellm.types.utils import (
 class ResponsesAPIRequestUtils:
     """Helper utils for constructing ResponseAPI requests"""
 
+    @staticmethod
+    def merge_prompt_management_input(
+        original_input: str | ResponseInputParam,
+        client_input: list[AllMessageValues],
+        merged_input: list[AllMessageValues],
+    ) -> list[object]:
+        if isinstance(original_input, str):
+            return [*merged_input]
+
+        original_items = tuple(original_input)
+        client_item_ids = frozenset(id(item) for item in client_input)
+        message_positions = tuple(index for index, item in enumerate(original_items) if id(item) in client_item_ids)
+
+        if len(message_positions) == len(original_items):
+            return [*merged_input]
+        if not message_positions:
+            verbose_logger.warning(
+                "Prompt management hook returned messages without Responses API input messages; merged messages were ignored"
+            )
+            return [*original_items]
+
+        corresponding_messages = len(client_input) == len(merged_input) and all(
+            original.get("role") == merged.get("role")
+            and (not isinstance(original.get("id"), str) or original.get("id") == merged.get("id"))
+            for original, merged in zip(client_input, merged_input)
+        )
+        if corresponding_messages:
+            merged_by_position = dict(zip(message_positions, merged_input))
+            return [
+                merged_by_position[index] if index in merged_by_position else item
+                for index, item in enumerate(original_items)
+            ]
+
+        all_messages_preserved = all(any(original is merged for merged in merged_input) for original in client_input)
+        if all_messages_preserved:
+            prefixes = {
+                id(original_items[position]): original_items[
+                    message_positions[index - 1] + 1 if index else 0 : position
+                ]
+                for index, position in enumerate(message_positions)
+            }
+            trailing_items = original_items[message_positions[-1] + 1 :]
+            return [item for merged in merged_input for item in (*prefixes.get(id(merged), ()), merged)] + list(
+                trailing_items
+            )
+
+        verbose_logger.warning(
+            "Prompt management hook replaced Responses API messages; non-message input items were dropped"
+        )
+        return [*merged_input]
+
     @staticmethod
     def _check_valid_arg(
         supported_params: Optional[List[str]],
@@ -996,6 +1049,7 @@ class ResponseAPILoggingUtils:
                     audio_tokens=getattr(response_api_usage.input_tokens_details, "audio_tokens", None),
                     text_tokens=getattr(response_api_usage.input_tokens_details, "text_tokens", None),
                     image_tokens=getattr(response_api_usage.input_tokens_details, "image_tokens", None),
+                    cache_write_tokens=getattr(response_api_usage.input_tokens_details, "cache_write_tokens", None),
                 )
         completion_tokens_details: Optional[CompletionTokensDetailsWrapper] = None
         output_tokens_details = getattr(response_api_usage, "output_tokens_details", None)

litellm/setup_wizard.py

@@ -52,12 +52,13 @@ PROVIDERS: List[Dict] = [
     {
         "id": "anthropic",
         "name": "Anthropic",
-        "description": "Claude Fable 5, Opus 4.8, Opus 4.7, Opus 4.6, Sonnet 4.6, Haiku 4.5",
+        "description": "Claude Fable 5, Opus 5, Opus 4.8, Opus 4.7, Opus 4.6, Sonnet 5, Sonnet 4.6, Haiku 4.5",
         "env_key": "ANTHROPIC_API_KEY",
         "key_hint": "sk-ant-...",
         "test_model": "claude-haiku-4-5-20251001",
         "models": [
             "claude-fable-5",
+            "claude-opus-5",
             "claude-sonnet-5",
             "claude-opus-4-8",
             "claude-opus-4-7",

litellm/types/guardrails.py

@@ -725,6 +725,18 @@ class BaseLitellmParams(ContentFilterConfigModel):  # works for new and patch up
         description="When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)",
     )
 
+    only_scan_new_messages: Optional[bool] = Field(
+        default=False,
+        description=(
+            "When True, the guardrail only scans messages that have not already been scanned "
+            "earlier in the same session (identified by litellm_session_id / session_id). "
+            "Message content is hashed per session and cached; only the diff (new or edited "
+            "messages) is sent to the guardrail provider on follow-up calls. Falls back to a "
+            "full scan when the request has no session id or the cache is unavailable. Intended "
+            "for blocking/detection guardrails; not applied when mask_request_content is set."
+        ),
+    )
+
     skip_system_message_in_guardrail: Optional[bool] = Field(
         default=None,
         description=(
@@ -898,6 +910,17 @@ class BaseLitellmParams(ContentFilterConfigModel):  # works for new and patch up
         ),
     )
 
+    run_in_parallel: Optional[bool] = Field(
+        default=None,
+        description=(
+            "When True, this pre_call or post_call guardrail runs concurrently with other opted-in "
+            "guardrails of the same hook, after the sequential guardrails have run. Use only for "
+            "block-only guardrails that inspect and reject; do not enable it for guardrails that "
+            "modify the request or response (e.g. PII masking or sensitive-data routing), since "
+            "parallel runs share one snapshot and their mutations would race."
+        ),
+    )
+
     @field_validator(
         "mode",
         "default_action",

litellm/types/mcp_server/mcp_server_manager.py

@@ -261,12 +261,3 @@ class MCPServer(BaseModel):
         if self.oauth_passthrough is not True:
             return False
         return any(h.lower() == "authorization" for h in self.extra_headers)
-
-    @property
-    def has_token_exchange_config(self) -> bool:
-        """True if this server is configured for OAuth2 token exchange (OBO / RFC 8693)."""
-        return (
-            self.auth_type == MCPAuth.oauth2_token_exchange
-            and bool(self.client_id and self.client_secret)
-            and bool(self.token_exchange_endpoint or self.token_url)
-        )

litellm/types/proxy/management_endpoints/ui_sso.py

@@ -148,6 +148,28 @@ class SSOConfig(LiteLLMPydanticObjectBase):
         default=None,
         description="User info endpoint URL for generic OAuth provider",
     )
+    generic_scope: Optional[str] = Field(
+        default=None,
+        description="Space-separated OAuth scopes requested from the generic provider, e.g. 'openid email profile'",
+    )
+
+    # SAML SSO
+    saml_idp_metadata_url: Optional[str] = Field(
+        default=None,
+        description="URL of the SAML IdP metadata to fetch and parse for SSO authentication",
+    )
+    saml_idp_metadata_xml: Optional[str] = Field(
+        default=None,
+        description="Inline SAML IdP metadata XML, used when a metadata URL is not available",
+    )
+    saml_sp_entity_id: Optional[str] = Field(
+        default=None,
+        description="SAML Service Provider entityID; defaults to the proxy's /sso/saml/metadata URL",
+    )
+    saml_allow_unsolicited: Optional[str] = Field(
+        default=None,
+        description="'true' to accept IdP-initiated (unsolicited) SAML responses, which cannot be browser-bound against login CSRF",
+    )
 
     # Common settings
     proxy_base_url: Optional[str] = Field(

litellm/types/proxy/model_listing.py

@@ -10,12 +10,16 @@ class ModelInfoMetadata(TypedDict):
 
 
 class ModelInfoResponse(TypedDict):
-    """OpenAI-compatible model object. `metadata` is present only when the
-    endpoint is called with include_metadata=true.
+    """OpenAI-compatible model object. `mode`, `max_input_tokens`, and
+    `max_output_tokens` are attached when the cost map knows them; `metadata`
+    is present only when the endpoint is called with include_metadata=true.
     """
 
     id: str
     object: Literal["model"]
     created: int
     owned_by: str
+    mode: NotRequired[str]
+    max_input_tokens: NotRequired[int]
+    max_output_tokens: NotRequired[int]
     metadata: NotRequired[ModelInfoMetadata]