From f5bcd08ee56d29d0affaae9f6ef9a3bff06e3c5f Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 04:53:10 +0000
Subject: [PATCH] fix(mcp): keep BYOK fallback when per-server dict omits
 Authorization

Greptile P2: when mcp_server_auth_headers carries only non-Authorization
per-server headers, still apply the BYOK mcp_auth_header so an
operator-configured credential is not silently dropped.
---
 .../_experimental/mcp_server/mcp_server_manager.py    |  2 ++
 .../mcp_server/test_mcp_server_manager.py             | 11 +++++++++++
 2 files changed, 13 insertions(+)

diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
index 9d6248d2acd..a9befbf14b2 100644
--- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
+++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
@@ -379,6 +379,8 @@ def _resolve_openapi_tool_auth(
                 auth_value = header_val
             else:
                 extra[header_key] = header_val
+        if auth_value is None and mcp_auth_header:
+            auth_value = _format_byok_openapi_auth_header(mcp_server, mcp_auth_header)
         return auth_value, (extra or None)
     if isinstance(per_server_auth_header, str) and per_server_auth_header:
         return per_server_auth_header, forwarded
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
index 0757bf21d59..2c303ea6ff5 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
@@ -7685,6 +7685,17 @@ class TestResolveOpenAPIToolAuth:
         )
         assert auth_value == "ApiKey byok-raw-token"
 
+    def test_per_server_non_auth_only_falls_back_to_byok_auth_header(self):
+        auth_value, forwarded = _resolve_openapi_tool_auth(
+            mcp_server=self._server(),
+            mcp_auth_header="byok-raw-token",
+            mcp_server_auth_headers={"report_openapi": {"X-Tenant-Id": "acme"}},
+            raw_headers=None,
+            user_api_key_auth=None,
+        )
+        assert auth_value == "Bearer byok-raw-token"
+        assert forwarded == {"X-Tenant-Id": "acme"}
+
     def test_no_credential_returns_none(self):
         auth_value, forwarded = _resolve_openapi_tool_auth(
             mcp_server=self._server(),