mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
86a02f4f52
Enterprise MCP users mint virtual keys against tool access groups rather than explicit server ids. Nothing exercised that end to end. Registers the upstream MCP server tagged with a server-side access group (mcp_access_groups), then mints one key granted that group and one granted a different group. Asserts the granted key sees the tagged server's tools on tools/list and the other key sees none, so access-group scoping can't leak the server across the boundary. Adds mcp_access_groups support to the e2e MCP client (server registration, key generation, ObjectPermission) and the registry cell mcp.list_tools.api_key.access_group_scoped.
54 lines
1.4 KiB
Python
54 lines
1.4 KiB
Python
"""Shared helpers for e2e tests that register the real Datadog remote MCP server."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
from e2e_config import datadog_mcp_url, unique_marker
|
|
from lifecycle import ResourceManager
|
|
from mcp_client import McpClient
|
|
|
|
SEARCH_LOGS_TOOL = "search_datadog_logs"
|
|
|
|
|
|
def _dd_api_key() -> str:
|
|
return os.environ.get("DD_API_KEY", "").strip()
|
|
|
|
|
|
def _dd_app_key() -> str:
|
|
return os.environ.get("DD_APP_KEY", "").strip()
|
|
|
|
|
|
def assert_dd_mcp_creds() -> None:
|
|
if not _dd_api_key() or not _dd_app_key():
|
|
import pytest
|
|
|
|
pytest.fail(
|
|
"Datadog MCP e2e requires DD_API_KEY and DD_APP_KEY "
|
|
"(header auth to mcp.<site>/v1/mcp; on the cluster the secret manager "
|
|
"injects them, locally tests/e2e/.env)"
|
|
)
|
|
|
|
|
|
def register_datadog_mcp(
|
|
client: McpClient,
|
|
resources: ResourceManager,
|
|
*,
|
|
mcp_access_groups: list[str] | None = None,
|
|
) -> str:
|
|
assert_dd_mcp_creds()
|
|
name = f"e2e_dd_mcp_{unique_marker()}"
|
|
server_id = client.register_server(
|
|
server_name=name,
|
|
alias=name,
|
|
url=datadog_mcp_url(toolsets="core"),
|
|
transport="http",
|
|
static_headers={
|
|
"DD-API-KEY": _dd_api_key(),
|
|
"DD-APPLICATION-KEY": _dd_app_key(),
|
|
},
|
|
allowed_tools=[SEARCH_LOGS_TOOL],
|
|
mcp_access_groups=mcp_access_groups,
|
|
)
|
|
resources.defer(lambda: client.delete_server(server_id))
|
|
return server_id
|