diff --git a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260409000000_add_mcp_token_validation/migration.sql b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260409000000_add_mcp_token_validation/migration.sql
new file mode 100644
index 00000000000..569a48088e4
--- /dev/null
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260409000000_add_mcp_token_validation/migration.sql
@@ -0,0 +1,5 @@
+-- Add OAuth token validation fields to LiteLLM_MCPServerTable
+-- AlterTable
+ALTER TABLE "LiteLLM_MCPServerTable"
+  ADD COLUMN IF NOT EXISTS "token_validation"          JSONB,
+  ADD COLUMN IF NOT EXISTS "token_storage_ttl_seconds" INTEGER;
diff --git a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
index fce95465b55..fddb145f14c 100644
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@@ -328,6 +328,8 @@ model LiteLLM_MCPServerTable {
   submitted_at     DateTime?
   reviewed_at      DateTime?
   review_notes     String?
+  token_validation            Json?
+  token_storage_ttl_seconds   Int?
 
   @@index([approval_status])
 }
diff --git a/litellm/proxy/schema.prisma b/litellm/proxy/schema.prisma
index fce95465b55..fddb145f14c 100644
--- a/litellm/proxy/schema.prisma
+++ b/litellm/proxy/schema.prisma
@@ -328,6 +328,8 @@ model LiteLLM_MCPServerTable {
   submitted_at     DateTime?
   reviewed_at      DateTime?
   review_notes     String?
+  token_validation            Json?
+  token_storage_ttl_seconds   Int?
 
   @@index([approval_status])
 }
diff --git a/schema.prisma b/schema.prisma
index fce95465b55..490018139ba 100644
--- a/schema.prisma
+++ b/schema.prisma
@@ -328,6 +328,10 @@ model LiteLLM_MCPServerTable {
   submitted_at     DateTime?
   reviewed_at      DateTime?
   review_notes     String?
+  // Per-user OAuth token validation rules: key-value pairs that must match fields
+  // in the OAuth token response. Tokens that don't match are rejected with HTTP 403.
+  token_validation            Json?
+  token_storage_ttl_seconds   Int?
 
   @@index([approval_status])
 }