mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-17 04:34:25 +00:00
2d82915084
* feat(mcp): advertise the SDK's latest spec revision and validate the RFC 9207 iss MCPSpecVersion stopped at 2025-06-18 while the pinned SDK negotiates 2025-11-25, and the version LiteLLM puts on its own outbound initialize was a hardcoded historical member. Add the missing revision, name the highest revision we speak once, and pin it to the SDK's LATEST_PROTOCOL_VERSION with a test so the two cannot drift apart silently. /authorize now seals the issuer it sent the user to into the OAuth state, and /callback holds the authorization response's RFC 9207 iss against it, refusing to forward a code that came back from an authorization server we never sent the user to. An absent iss, an unanchored server row and a state minted before the seal all keep their current behavior. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): keep params, query and fragment significant in issuer comparison The shared canonicalizer drops all three, so two issuers differing only outside the path compared equal and a response from another tenant's authorization server would have continued through the flow. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): refresh generated API snapshots Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(mcp): cover OAuth client isolation and lint checks * fix(mcp): preserve registered clients in the existing save payload * test(mcp): cover optional OAuth registration metadata * fix(mcp): preserve compatible OAuth registrations across edits * fix(mcp): retain OAuth state through pending authorization * fix(mcp): guard pending OAuth at form submission * fix(mcp): discard canceled OAuth edit snapshots * test(mcp): preserve complete OAuth registration assertions * refactor(mcp): construct OAuth credential updates without mutation * fix(mcp): simplify issuer binding and reject unverifiable callbacks * fix(mcp): preserve replacement clients and pending redirect bindings * fix(mcp): retain clients with replacement authentication methods * fix(mcp): preserve cached clients and pin manual OAuth issuers --------- Co-authored-by: yucheng <yucheng@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Joshua Valluru <326636767+joshua-berri@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| containers | ||
| google_genai | ||
| images | ||
| integrations | ||
| interactions | ||
| litellm_core_utils | ||
| llms | ||
| management_endpoints | ||
| mcp_server | ||
| passthrough_endpoints | ||
| prompts | ||
| proxy | ||
| repositories | ||
| responses | ||
| secret_managers | ||
| videos | ||
| access_group.py | ||
| adapter.py | ||
| agents.py | ||
| caching.py | ||
| completion.py | ||
| compression.py | ||
| decisions.py | ||
| embedding.py | ||
| files.py | ||
| fine_tuning.py | ||
| guardrail_base_init.py | ||
| guardrails.py | ||
| lar1.py | ||
| litellm_params.py | ||
| mcp.py | ||
| memory_management.py | ||
| model_insights.py | ||
| object_permission.py | ||
| policy_engine.py | ||
| rag.py | ||
| realtime.py | ||
| rerank.py | ||
| roi_calculator.py | ||
| roi_observed.py | ||
| router.py | ||
| router_weights.py | ||
| scheduler.py | ||
| search.py | ||
| services.py | ||
| tag_management.py | ||
| tool_management.py | ||
| utils.py | ||
| vector_store_files.py | ||
| vector_stores.py | ||
| workload_identity.py | ||