- Cache _get_agent_object_permission via user_api_key_cache (sentinel for
no-permission rows) so MCP requests from agent keys don't hit the DB on
every tool-list / tool-call.
- Re-raise HTTPException in handle_sse_mcp so 401 + WWW-Authenticate
challenges (and other HTTP errors) propagate to SSE clients instead of
being swallowed as 500.
- Normalise booleans in _validate_token_response so admin rules written as
JSON-style "true" / "false" match upstream responses that return
Python True / False.
- Treat configured JWT issuer claim mappings as advisory: when a mapped
field is absent or empty, leave the normalised claim unset instead of
raising, matching the global litellm_jwtauth path.
Co-authored-by: Claude <noreply@anthropic.com>
