BerriAI/litellm · error · HTTPException

Admin access required to reject MCP server submissions.

Error message

Admin access required to reject MCP server submissions.

What it means

Role guard on PUT /v1/mcp/server/{server_id}/reject: rejecting a submission changes another user's proposed server state and is admin-only. The caller's role is not PROXY_ADMIN, so the request is rejected before any lookup or write.

Source

Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:1385

        return _redact_mcp_credentials(approved)

    @router.put(
        "/server/{server_id}/reject",
        description="Reject a pending MCP server submission (admin only). Mirrors PUT /guardrails/{id}/reject.",
        dependencies=[Depends(user_api_key_auth)],
        response_model=LiteLLM_MCPServerTable,
    )
    @management_endpoint_wrapper
    async def reject_mcp_server_submission(
        server_id: str,
        payload: RejectMCPServerRequest,
        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
    ):
        """
        Admin rejects a pending MCP server — sets approval_status=rejected with optional review_notes.
        """
        if LitellmUserRoles.PROXY_ADMIN != user_api_key_dict.user_role:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail={"error": "Admin access required to reject MCP server submissions."},
            )

        prisma_client: Final = get_prisma_client_or_throw("Database not connected. Connect a database to your proxy")

        existing: Final = await get_mcp_server(prisma_client, server_id)
        if existing is None:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail={"error": f"MCP server '{server_id}' not found."},
            )
        if existing.approval_status == MCPApprovalStatus.rejected:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail={"error": "MCP server is already rejected."},
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Authenticate with a proxy admin API key.
  2. Ask a proxy admin to reject the submission.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:1385 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f92cdcbdada306a5. Report an issue: GitHub.