BerriAI/litellm · error · HTTPException

Key requests MCP servers not allowed by team '{team_id}': {s

Error message

Key requests MCP servers not allowed by team '{team_id}': {sorted(disallowed_servers)}. Team allows: {sorted(team_allowed_servers)}. Global (allow_all_keys) servers: {sorted(allow_all_keys_servers)}.

What it means

Error "Key requests MCP servers not allowed by team '{team_id}': {sorted(disallowed_servers)}. Team allows: {sorted(team_allowed_servers)}. Global (allow_all_keys) servers: {sorted(allow_all_keys_servers)}." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_helpers/object_permission_utils.py:604

            allowed_servers = all_allowed_servers | active_requested_servers

        disallowed_servers: Final = active_requested_servers - allowed_servers
        if disallowed_servers:
            if team_obj is not None:
                team_id = team_obj.team_id
                detail = (
                    f"Key requests MCP servers not allowed by team '{team_id}': "
                    f"{sorted(disallowed_servers)}. "
                    f"Team allows: {sorted(team_allowed_servers)}. "
                    f"Global (allow_all_keys) servers: {sorted(allow_all_keys_servers)}."
                )
            else:
                detail = (
                    f"Key is not in a team. Only globally available (allow_all_keys) MCP servers "
                    f"can be assigned: {sorted(allow_all_keys_servers)}. "
                    f"Disallowed servers: {sorted(disallowed_servers)}."
                )
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail={"error": detail},
            )

    # Validate requested access groups (must be subset of team's access groups)
    if requested_access_groups:
        team_access_groups: set[str] = set()
        if (
            team_obj is not None
            and team_obj.object_permission is not None
            and team_obj.object_permission.mcp_access_groups
        ):
            team_access_groups = set(team_obj.object_permission.mcp_access_groups)

        allowed_access_groups = team_access_groups
        if teamless_admin_assignment:
            allowed_access_groups = team_access_groups | requested_access_groups

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Remove the disallowed MCP servers listed in the error from the key request, or ask an admin to allow them for the team.

When it happens

Trigger: Thrown at litellm/proxy/management_helpers/object_permission_utils.py:604 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/0d9a1ec3bc1d5459. Report an issue: GitHub.