mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-13 03:59:12 +00:00
78b8d89afe
The probe test asserted that every request the peer saw carried the forwarded token, so a credential-less tool discovery session from either gateway (startup mapping, an OpenAPI registration elsewhere, or the 30s MCP reload) landing in the window failed it intermittently on the CircleCI mcp layout The caller now sends an allowlisted x-integration-caller marker, which the gateway forwards on the caller's listing and call sessions but never on the probe or on background discovery. Probes and marked requests must carry exactly the forwarded token, the single tools/call must be one of the caller's, and anything left over may not carry any Authorization at all. The admission key scan still covers every request Verified on a local two-gateway rig sharing Postgres and Redis while a thread registered and deleted OpenAPI servers on both gateways. The old assertions failed 207 of 240 runs there with the CI signature, the new ones 0 of 240. Dropping the token on the call session, on the listing session, or on the probe still fails all six cases Co-authored-by: Yuneng Jiang <yuneng@berri.ai> |
||
|---|---|---|
| .. | ||
| _config_mcp_e2e.yaml | ||
| _math_server.py | ||
| test_interactions.py | ||
| test_mcp_access_matrix.py | ||
| test_mcp_accounting_guardrails.py | ||
| test_mcp_agent_365_guardrail.py | ||
| test_mcp_akto_logging_only.py | ||
| test_mcp_credentials.py | ||
| test_mcp_lifecycle.py | ||
| test_mcp_listed_tool_metadata.py | ||
| test_mcp_llm_endpoints.py | ||
| test_mcp_management.py | ||
| test_mcp_oauth_flows.py | ||
| test_mcp_protocol_errors.py | ||
| test_mcp_rate_limits.py | ||
| test_mcp_resilience.py | ||
| test_mcp_submission_rules.py | ||
| test_mcp_tool_permission_merge.py | ||
| test_mcp_toolsets.py | ||
| test_mcp_transports.py | ||
| test_mcp_user_env_vars.py | ||
| test_oauth_configuration.py | ||
| test_pagination.py | ||
| test_proxy_mcp_e2e.py | ||
| test_responses_mcp_mixed_tools.py | ||