mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-14 04:09:09 +00:00
d5c9d17d47
Motivation: _probe_upstream_auth predicts whether a true_passthrough MCP server will accept the caller's request before a stateful session opens, so LiteLLM can return a 401 up front instead of masking the rejection as an empty tool list. The probe only ever sent Accept and Authorization upstream. When an upstream identifies the caller through a different header the admin already configured in server.extra_headers (a gateway-issued platform header, for example), the probe always looked anonymous to it, so it answered 401 for every caller including ones with a valid session, and every connect got the pre-session challenge regardless of whether the caller was actually authorized. Approach: Added _extra_headers_for_probe, which takes the caller's raw request headers and the server's configured extra_headers list and returns just the values for those header names (case-insensitively matched), always excluding authorization since the probe already sets that separately. _probe_upstream_auth gained an extra_headers parameter that merges into the outgoing probe request. The is_true_passthrough branch in _raise_preemptive_401_for_unauthenticated_servers now passes the caller's configured extra headers into the probe, using the raw_headers parameter that function already receives. The is_oauth_passthrough / _check_passthrough_upstream_auth path is untouched, matching the issue's stated scope. Validation: PYTHONPATH=. pytest tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server.py -v passes all 240 tests (235 existing + 5 new). Reverting only the server.py change (git stash) makes the 5 new/changed tests fail, including one that raises the exact HTTPException: 401 the issue describes, confirming they are a real regression guard rather than a structural check. ruff check, ruff format --check, and basedpyright were run on both changed files: no new basedpyright errors were introduced in server.py (236 before and after), and the small increase in the test file (reportPrivateUsage / reportAny noise from calling internal helpers directly, matching this test file's existing whitebox pattern) stays well under the repo's basedpyright-code-budget.json limits for those rules. Disclosure: dependencies were installed into a local virtualenv rather than through the maturin/editable install this repo normally uses, because of disk-space limits in this environment; litellm was imported directly from source with PYTHONPATH, and the Rust bridge already no-ops gracefully when its compiled extension is absent. No live MCP server was reachable to reproduce the issue end to end; the fix and its tests are demonstrated at the unit level described above. Report: https://github.com/BerriAI/litellm/issues/40099 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Assisted-by: claude-sonnet-5 (via Claude Code) |
||
|---|---|---|
| .. | ||
| _support | ||
| agent_tests | ||
| audio_tests | ||
| base_sdk_tests | ||
| basic_proxy_startup_tests | ||
| batches_tests | ||
| benchmarks | ||
| code_coverage_tests | ||
| documentation_tests | ||
| e2e | ||
| guardrails_tests | ||
| harness_e2e | ||
| image_gen_tests | ||
| integration | ||
| litellm_utils_tests | ||
| llm_responses_api_testing | ||
| llm_translation | ||
| load_tests | ||
| local_testing | ||
| logging_callback_tests | ||
| mcp_tests | ||
| multi_instance_e2e_tests | ||
| ocr_tests | ||
| openai_endpoints_tests | ||
| otel_tests | ||
| pass_through_tests | ||
| pass_through_unit_tests | ||
| proxy_admin_ui_tests | ||
| proxy_behavior | ||
| proxy_e2e_anthropic_messages_tests | ||
| proxy_migration_tests | ||
| proxy_security_tests | ||
| proxy_unit_tests | ||
| router_unit_tests | ||
| rust-python-harness | ||
| search_tests | ||
| spend_tracking_tests | ||
| store_model_in_db_tests | ||
| test_litellm | ||
| test_litellm_rust | ||
| unified_google_tests | ||
| unit | ||
| vector_store_tests | ||
| windows_tests | ||
| __init__.py | ||
| _fake_openai_endpoint_server.py | ||
| _flush_vcr_cache.py | ||
| _live_test_helpers.py | ||
| _openai_record_replay_proxy.py | ||
| _process_helpers.py | ||
| _vcr_conftest_common.py | ||
| _vcr_redis_persister.py | ||
| _wait_helpers.py | ||
| _ws_vcr.py | ||
| AGENTS.md | ||
| capturing_transport.py | ||
| eval_swe_bench.py | ||
| fake_openai_endpoint.py | ||
| gettysburg.wav | ||
| large_text.py | ||
| openai_batch_completions.jsonl | ||
| pyrightconfig.json | ||
| README.MD | ||
| test_anthropic_compaction_usage.py | ||
| test_budget_management.py | ||
| test_callbacks_on_proxy.py | ||
| test_debug_warning.py | ||
| test_default_encoding_non_root.py | ||
| test_end_users.py | ||
| test_fallbacks.py | ||
| test_gpt5_azure_temperature_support.py | ||
| test_health.py | ||
| test_keys.py | ||
| test_litellm_proxy_responses_config.py | ||
| test_logging.conf | ||
| test_models.py | ||
| test_new_vector_store_endpoints.py | ||
| test_openai_endpoints.py | ||
| test_otel_thread_leak.py | ||
| test_presidio_latency.py | ||
| test_proxy_server_non_root.py | ||
| test_ratelimit.py | ||
| test_resource_cleanup.py | ||
| test_rust_python_harness.py | ||
| test_service_logger_otel.py | ||
| test_spend_logs.py | ||
| test_team.py | ||
| test_team_logging.py | ||
| test_team_members.py | ||
| test_users.py | ||
| white_100x100.png | ||
In total litellm runs 1000+ tests
[02/20/2025] Update:
To make it easier to contribute and map what behavior is tested,
we've started mapping the litellm directory in tests/unit
This folder can only run mock tests.