* feat(chat-ui): add MCP OAuth2 value prop and OAuth2 pill on server cards
- Add subtitle in chat empty state explaining MCP OAuth2 value prop with 'Open Apps' link
- Update MCPAppsPanel header copy to explain the flow more clearly
- Show OAuth2 pill badge on server cards where auth_type is oauth2
* fix(chat-ui): use AUTH_TYPE.OAUTH2 constant instead of hardcoded string
- Invert lookup order in get_provider_chat_config so Python classes
(with custom overrides) are checked before JSON providers, matching
the pattern already used in get_provider_responses_api_config.
Prevents regression where providers like Perplexity (declared in
providers.json) would silently lose their custom chat config.
- Add 'models' to Perplexity Responses API supported params (fallback
chain feature documented in Perplexity API).
* fix: guard prisma import in config_override_endpoints to fix proxy import without prisma
Top-level `from prisma.errors import RecordNotFoundError` was introduced in the
Hashicorp Vault feature PR and breaks `import litellm.proxy.proxy_server` when
prisma is not installed (e.g. plain `pip install litellm[proxy]` in CI).
Wraps the import in try/except ImportError so the module loads cleanly when
prisma is absent; the except branch aliases RecordNotFoundError to Exception,
which is safe because the code path that catches it only logs a debug message.
* fix: sync poetry.lock with pyproject.toml (litellm-proxy-extras 0.4.51 → 0.4.52)
poetry.lock was regenerated for 0.4.51 but pyproject.toml was subsequently
bumped to 0.4.52 without re-running poetry lock. This caused the
proxy_e2e_azure_batches_tests CI job to fail at the Install Dependencies step
('pyproject.toml changed significantly since poetry.lock was last generated'),
preventing all 3 tests in that job from running.
* Revert "fix: sync poetry.lock with pyproject.toml (litellm-proxy-extras 0.4.51 → 0.4.52)"
This reverts commit 249ec7c9c2.
* feat(ui): add OpenAPI MCP server support with popular API quick-picker
- New `openapi_registry.json` with 10 well-known APIs (GitHub, Atlassian, Figma, Google, Stripe, HubSpot, Notion, Slack, Shopify, Snowflake) — each with validated spec URLs and OAuth 2.0 endpoints
- Backend endpoint `GET /v1/mcp/registry.json` to serve the registry (reads fresh from disk)
- `OpenAPIQuickPicker` component: logo grid for popular APIs with letter fallback for broken images
- `OpenAPIFormSection` component: encapsulates picker + spec URL input as a clean unit
- When selecting a preset, spec URL and OAuth fields are pre-filled automatically
- Fixed `useTestMCPConnection`: for OpenAPI transport, tools load from the spec as soon as the URL is set — no auth type or OAuth token required
- Validated all spec URLs are reachable; removed Linear (GraphQL-only, no REST spec)
* feat(ui): add curated key tools preview for OpenAPI MCP servers
When selecting a popular API from the quick-picker, show the 8 most
useful MCP tools for that API in a collapsible preview card. First 4
are shown by default; clicking "expand" shows all 8 with descriptions
on hover.
- Added `key_tools` array (8 tools each) to all 10 APIs in openapi_registry.json
- New `KeyToolsPreview` component in OpenAPIFormSection with expand/collapse
- Extended `OpenAPIRegistryEntry` type with `key_tools?: OpenAPIKeyTool[]`
* fix(ui): move key tools preview inside Tool Configuration card
* fix(ui): pin suggested tools at top of tool list, fix TDZ crash, add per-section enable/disable
* fix: address greptile review - fix registry spec URLs, remove redundant dep, add error handling
* fix: restore enable/disable all buttons for non-preset MCP servers
* refactor: extract ToolRow component, move handlers to component body, fix key props
* fix: remove rewrites() from next.config.mjs (incompatible with output: export), fix OAuth field paths
* fix: enable/disable all operates on full tool set, not just filtered subset
* fix: cache openapi registry, make oauth optional, reset preset auto-select on new preset
* fix: use official Shopify API specs repo, move lru_cache error handling to caller
* fix: use Shopify 2023-10 REST spec, co-locate rest section header with tool rows
* fix: guard fuzzy-match against empty keywords, remove placeholder OAuth URLs for Shopify/Snowflake
* fix: lift useTestMCPConnection to parent to eliminate duplicate requests, clear keyTools on manual spec URL edit
* fix: clear stale OAuth fields when switching to non-OAuth preset, show expected tools on empty spec
* fix: gate registry fetch on modal visibility, use resetFields to clear OAuth fields
* feat(mcp): add BYOM (Bring Your Own MCPs) submission + admin review workflow
Non-admins can now submit MCP servers for review via POST /v1/mcp/server/register.
Admins get a Submissions tab in the UI to approve or reject pending servers.
Approved servers enter the active runtime; rejected ones stay out with notes.
- DB: add approval_status, submitted_by, submitted_at, reviewed_at, review_notes
to LiteLLM_MCPServerTable with migration
- Backend: new endpoints register, submissions, approve, reject
- reload_servers_from_database now only loads approval_status=active servers
- UI: Submissions tab with stat cards, card list, confirm dialogs; non-admin
"Submit MCP Server" button wired to /register endpoint
- Fix get_mcp_submissions to filter by submitted_at IS NOT NULL (not submitted_by,
which can be null for team-scoped keys without an associated user)
* feat(mcp): rename nav item to Team MCPs + add New badge
* fix(mcp): revert nav label, rename Submissions tab to Team MCPs + New badge
* feat(mcp): add MCP Standards — required fields config + CI-style checks on submissions
Adds a "Standards" tab (admin-only) to MCP Servers where admins define which
server fields are required for a submission to pass. Each submission card in
Team MCPs then shows a green ✓ or red ✗ for each required field, with a
summary "N/M checks" badge in the header — like GitHub CI status rows.
Also adds a `source_url` field (GitHub / Source URL) to the MCP server schema
so non-admins can link to the source repo when submitting a server.
- schema.prisma: add `source_url String?` to LiteLLM_MCPServerTable
- migration: 20260309000001_add_mcp_source_url
- _types.py: source_url on NewMCPServerRequest, UpdateMCPServerRequest, LiteLLM_MCPServerTable
- types.tsx: source_url on MCPServer interface
- create_mcp_server.tsx: GitHub/Source URL form field
- MCPStandardsSettings.tsx: new — toggle which fields are required (stored in general settings as mcp_required_fields)
- mcp_servers.tsx: Standards tab (admin-only)
- MCPSubmissionsTab.tsx: load required fields + CI-style check pills on each card
* refactor(mcp): move submission rules into Team MCPs tab, grouped free-form UI
Folds the Standards tab into Team MCPs. Submission Rules panel now lives at the
top of the Team MCPs tab — collapsible, shows active rules as chips when closed,
expands to a grouped checkbox editor (Documentation / Source / Connection /
Security). Removes the separate Standards tab from the nav.
MCPStandardsSettings.tsx is now constants-only (FIELD_GROUPS, MCP_REQUIRED_FIELD_DEFS,
SETTINGS_KEY) — the UI lives in MCPSubmissionsTab.
* feat(mcp): add mcp_required_fields to ConfigGeneralSettings + config/list endpoint
Registers mcp_required_fields as a proper general_settings field so the UI
can read/write it via /config/list and /config/field/update without the
"Invalid field" error. Also fixes a pre-existing pyright None-check issue
in _sync_ui_settings_to_general_settings.
* ui(mcp): GitHub-style PR checks panel on submission cards
* ui: rename Team MCPs -> Submitted Tools, Team Guardrails -> Submitted Guardrails
* address greptile review feedback (greploop iteration 1)
* fix: inline import, add approval workflow tests, rename Submitted MCPs
* fix(mcp): allow re-approval of rejected MCP server submissions
* fix(mcp): evict rejected servers from runtime; enforce mcp_required_fields on /register
* fix(mcp): sort submissions newest-first; force active status on admin-created servers
* fix(mcp): add missing mock in test, show Approve for rejected, clear submission metadata, drop spurious Content-Type
* fix(mcp/ui): show Reject for active servers; show submit form to non-admins with team-key note
* fix(mcp): conditional reload on reject; view-only admin for submissions; block admin from /register
* fix(mcp): match auth_type required-field validation to UI compliance check (reject 'none')
* fix(mcp): block view-only admin from /register; log settings failure; warn on active server reject
* fix(mcp): allow view-only admin to use /register; add _validate_mcp_required_fields tests
* fix(mcp): validate field names in mcp_required_fields; surface backend error in submit UI
* fix(mcp): fix falsy field check; add field-name validation; add take limit; document server-managed fields; close dialog on error
* docs: add pip/venv upgrade workflow guide
- Add comprehensive guide for upgrading LiteLLM proxy via pip
- Covers Prisma client regeneration and DB migration steps
- Includes verification commands and troubleshooting tips
- Links to existing Prisma migration troubleshooting doc
* docs: clarify Python version in prisma generate command
- Update example to show multiple Python versions (3.11, 3.12, 3.13)
- Make it clear LiteLLM supports multiple Python versions, not just 3.11
* docs: emphasize venv activation before running commands
- Add info box at top reminding users to activate venv
- Include venv activation step before starting proxy (both options)
- Add Windows activation command for cross-platform clarity
- Make it clear all commands assume activated venv
* docs: add pip_venv_upgrade to sidebar navigation
- Add new page to Troubleshooting section in sidebars.js
- Positioned after Performance/Latency category and before rollback
- Makes the upgrade guide discoverable through docs navigation
* docs: show explicit --schema flag in prisma migrate deploy
- Add explicit --schema path to Option B migration command
- Remove ambiguous instruction about running from litellm_proxy_extras
- Include path variable guidance for clarity
- Makes the command immediately runnable without directory navigation
* Update docs/my-website/docs/troubleshoot/pip_venv_upgrade.md
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update docs/my-website/docs/troubleshoot/pip_venv_upgrade.md
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* fix: close code block and add missing section in pip_venv_upgrade.md
* docs: define schema-path placeholder in verification section
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Add vitest tests for TypeBadges, ErrorViewer, ConfigInfoMessage, TimeCell, and TruncatedValue covering rendering, user interactions, and edge cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Resolve conflict in perplexity/responses/transformation.py by keeping
the simplified ~50 line version (PR's goal) instead of main's ~410 line
version. Added supports_native_websocket() -> False from main.
Keep unified _FINISH_REASON_MAP dict approach, discard upstream's
inconsistent _VALID_OPENAI_FINISH_REASONS frozenset that mapped to
values not in the OpenAIChatCompletionFinishReason Literal.
Add usage example with concrete model entry, explanation of load-time
expansion, and cross-reference to model_alias_map to clarify the
difference between the two features.
The _list_has_thinking guard only checked for type == "thinking" but
Anthropic can also return redacted_thinking blocks (safety-filtered).
These are also accumulated in thinking_blocks, so the same duplication
bug would occur with redacted thinking content.
Add `supports_web_search: true` to 31 OpenAI models that support the
`web_search_preview` tool via the Responses API. This enables the Router
to correctly include these deployments when requests use web search tools.
Models excluded (tested, confirmed unsupported):
- o1-pro (Tool 'web_search_preview' is not supported)
- gpt-audio / gpt-audio-mini (not supported)
- gpt-4.1-nano (not supported)
- codex-mini-latest (model not found)
Also removes the invalid `gpt-5.3` entry added in prior commit
(model name does not exist in OpenAI API; use gpt-5.3-chat-latest).
- Remove dead fields: supports_none_reasoning_effort, supports_xhigh_reasoning_effort
(not referenced anywhere in the codebase)
- Remove supports_web_search (inconsistent with other base models)
- Add supports_service_tier (consistent with gpt-5, gpt-5.1, gpt-5.2)
* fix(mcp): add AWS SigV4 auth for Bedrock AgentCore MCP servers
Add aws_sigv4 auth type to MCP client via httpx.Auth subclass that
signs each request with SigV4 using botocore. Enables mcp_servers
config to connect to AgentCore-hosted MCP servers.
* docs(mcp): add AWS SigV4 auth documentation for Bedrock AgentCore
Add dedicated docs page for configuring MCP servers with AWS SigV4
authentication, update MCP overview with aws_sigv4 auth type and
config example, and link from Bedrock AgentCore provider docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(mcp): address Greptile review — requires_request_body, full header signing, health check
- Add requires_request_body = True to MCPSigV4Auth so httpx buffers the
request body before calling auth_flow (prevents empty body hash for
streaming requests)
- Pass all request headers to AWSRequest for canonical SigV4 signing
instead of only Content-Type
- Exclude aws_sigv4 from health check skip logic since it has its own
credential fields (not authentication_token)
- Fix docs: mark aws_access_key_id/aws_secret_access_key as optional
(falls back to boto3 credential chain)
- Add test for requires_request_body flag
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Krish Dholakia <krrishdholakia@gmail.com>
- Add 'token' to MCPAuth enum for custom token auth format
- Implement token auth in MCP client (_get_auth_headers)
- Add token auth support for OpenAPI-based MCP tools
- Add comprehensive unit tests to existing test_mcp_client.py
- Fixes issue where MCP servers expecting 'Authorization: token <value>' header could not connect
When guardrails return the full data dict (e.g. guardrails_ai), the
guardrail response logged to spend logs and OTEL traces could contain
data["secret_fields"].raw_headers with plaintext Authorization headers.
This adds a pop("secret_fields") in the guardrail logging path,
matching the existing pattern used by Langfuse and Arize integrations.
Tested: Verified fix removes secret_fields/raw_headers/authorization
from both /spend/logs/ui responses and OTEL trace span attributes.
* fix(streaming): map unknown finish_reason values to finish_reason_unspecified
Some LLM providers return non-standard finish_reason values that are not
in the OpenAIChatCompletionFinishReason Literal (e.g. ZhipuAI/GLM returns
'network_error' when a streaming error occurs mid-response).
Previously map_finish_reason() fell through with return finish_reason,
passing the unknown value directly to Choices.__init__() which calls
Pydantic validation. This caused a ValidationError that was caught by
stream_chunk_builder() and re-raised as the misleading:
litellm.APIError: Error building chunks for logging/streaming usage calculation
Fix: after all known provider-specific mappings, check if the value is in
the valid set (stop, length, tool_calls, content_filter, function_call,
guardrail_intervened, eos, finish_reason_unspecified, malformed_function_call).
Any value not in this set is mapped to 'finish_reason_unspecified' instead
of being returned as-is.
This is consistent with how other unknown stop reasons (e.g. Vertex AI's
FINISH_REASON_UNSPECIFIED) are already handled.
* refactor: use get_args(OpenAIChatCompletionFinishReason) for valid set
Per code review feedback: replace the hardcoded _valid_finish_reasons set
with a module-level frozenset derived dynamically from the source-of-truth
Literal type via typing.get_args(). This ensures the valid-reason check
stays in sync automatically when new finish reasons are added to the Literal,
and avoids recreating the set on every streaming chunk call.
* test(map_finish_reason): add unit tests and warning log for unknown finish reasons
- Add TestMapFinishReason class in test_core_helpers.py covering:
- All known OpenAI-native values pass through unchanged (parametrized)
- Provider-specific mappings: Anthropic, Cohere, Vertex AI
- Unknown/provider-specific values map to 'finish_reason_unspecified'
- Regression test for ZhipuAI/GLM-5 'network_error' case
- Add verbose_logger.warning() in map_finish_reason() when an unknown
finish_reason is encountered, so operators can track which providers
return non-standard values
When assistant content is already a list containing thinking blocks
inline (not str/None), SEQUENTIAL MODE was still prepending all
thinking_blocks from provider_specific_fields, causing duplication
and breaking Anthropic's position-dependent signature verification.
Now detects if the content list already has thinking blocks and skips
the extend(thinking_blocks) to preserve the original interleaved order.
Addresses the correctness gap identified by Greptile review where
list-content messages bypass INTERLEAVED MODE.
Fixes: https://github.com/BerriAI/litellm/issues/23047
Fixes#23267 — plain `gpt-5.3` was missing from the model pricing
JSON, causing tool_choice (and other capability flags) to default
to unsupported. Copied fields from gpt-5.3-chat-latest.
* fix: add missing indexes for top CPU-consuming queries
Add indexes to eliminate full table scans on two of the top 5 queries
by CPU usage:
1. LiteLLM_VerificationToken(key_alias) — for ORDER BY key_alias ASC
queries when listing verification tokens
2. LiteLLM_SpendLogs(user, startTime) — for WHERE user = $1 AND
startTime BETWEEN $2 AND $3 GROUP BY queries on the spend logs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use CREATE INDEX CONCURRENTLY to avoid table locks
Both indexes are now created with CONCURRENTLY and IF NOT EXISTS
to avoid blocking writes on large production tables.
Uses -- SkipTransactionBlock for Prisma migrate compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add tip boxes explaining that gpt-5.4 does not support reasoning_effort
with function tools in /v1/chat/completions, and that the responses
bridge (openai/responses/gpt-5.4) should be used instead.
