mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-05 02:41:56 +00:00
e9fd8fccdf
The responses API surface still routed tool calls by server name. It built the caller's reachable set as MCPServer objects, narrowed by both the key's grants and the requested server filter, then discarded that identity by flattening to display names. `tool_server_map` carried a name, and dispatch re-resolved it with `get_mcp_server_by_name`, which walks the whole registry and returns the first match. Server names are not unique, so a tool listed from a reachable server could dispatch to a same-named server the caller cannot reach, sending that server's upstream credential. That is the bug this PR already fixed for MCP JSON-RPC, on the one surface that had not been converted. The fix is the same: stop discarding identity. `tool_server_map` now carries the server_id resolved within the caller's reachable set through `resolve_tool_route`, the same scoped resolver the JSON-RPC path uses, so a name two reachable servers share stays ambiguous here too rather than silently picking one. Dispatch looks the server up by id. A tool with no reachable owner fails closed and reports a result for its tool call, matching how every other failure in that loop is surfaced, rather than being dropped. `resolved_server` is a parameter this PR introduced, and it let a caller hand `call_tool` any server at all. That is the same class of defect one layer down, so the check belongs at the chokepoint rather than at each caller: `call_tool` now takes the reachable set the server was resolved against and refuses to dispatch outside it, covering the caller's server and one it resolves by name itself, which also walks the whole registry. Supplying `resolved_server` without that set is rejected, so caller-supplied identity always arrives with its provenance. Both callers already computed the set, so nothing recomputes it. |
||
|---|---|---|
| .. | ||
| test_chat_completions_handler.py | ||
| test_litellm_proxy_mcp_handler.py | ||
| test_mcp_streaming_iterator.py | ||