litellm

mirror of https://github.com/BerriAI/litellm.git synced 2026-09-12 23:01:41 +00:00

History

tin-berri d4d6bc2577 fix(proxy): serve aggregate MCP endpoint on bare /mcp instead of 307-redirecting (#34845 ) The MCP sub-app is attached with app.mount("/mcp", ...) and a Starlette mount never matches its bare prefix, so POST /mcp fell through to the router's redirect_slashes 307. Behind a TLS-terminating ingress whose peer address is not in uvicorn's forwarded-allow-ips (default: loopback only) the redirect Location is built from the socket scheme as http://, and MCP clients strip the Authorization header on the cross-origin follow, so reconnects fail with ECONNRESET right after a successful OAuth flow. The redirect also fires before auth, so the bare spelling never returns the RFC 9728 WWW-Authenticate challenge that OAuth clients need to start the flow. Add an explicit /mcp route beside the existing /toolset/{name}/mcp and /{name}/mcp spellings, forwarding to handle_streamable_http_mcp with the same scope rewrite those routes already use (path=/mcp, _original_path preserved for OAuth challenge URL selection). When the mcp package is unavailable the route 404s, matching what the bare sub-app serves on /mcp/ in that state. /mcp/, /mcp/{server}, /{server}/mcp and /toolset/{name}/mcp spellings are unchanged; the exact-match route and the mount have disjoint match sets so registration order cannot matter.	2026-08-14 17:04:32 -07:00
..
__init__.py	feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557 )	2026-05-16 09:25:17 -07:00
allowlist.py	fix(proxy): serve aggregate MCP endpoint on bare /mcp instead of 307-redirecting (#34845 )	2026-08-14 17:04:32 -07:00

fix(proxy): serve aggregate MCP endpoint on bare /mcp instead of 307-redirecting (#34845 )

The MCP sub-app is attached with app.mount("/mcp", ...) and a Starlette
mount never matches its bare prefix, so POST /mcp fell through to the
router's redirect_slashes 307. Behind a TLS-terminating ingress whose
peer address is not in uvicorn's forwarded-allow-ips (default: loopback
only) the redirect Location is built from the socket scheme as http://,
and MCP clients strip the Authorization header on the cross-origin
follow, so reconnects fail with ECONNRESET right after a successful
OAuth flow. The redirect also fires before auth, so the bare spelling
never returns the RFC 9728 WWW-Authenticate challenge that OAuth
clients need to start the flow.

Add an explicit /mcp route beside the existing /toolset/{name}/mcp and
/{name}/mcp spellings, forwarding to handle_streamable_http_mcp with
the same scope rewrite those routes already use (path=/mcp,
_original_path preserved for OAuth challenge URL selection). When the
mcp package is unavailable the route 404s, matching what the bare
sub-app serves on /mcp/ in that state. /mcp/, /mcp/{server},
/{server}/mcp and /toolset/{name}/mcp spellings are unchanged; the
exact-match route and the mount have disjoint match sets so
registration order cannot matter.

2026-08-14 17:04:32 -07:00

__init__.py

feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557 )

2026-05-16 09:25:17 -07:00

allowlist.py

fix(proxy): serve aggregate MCP endpoint on bare /mcp instead of 307-redirecting (#34845 )

2026-08-14 17:04:32 -07:00