BerriAI/litellm · error · HTTPException

Only a proxy admin can grant a team access to all proxy MCP

Error message

Only a proxy admin can grant a team access to all proxy MCP servers ('all-proxy-mcpservers').

What it means

HTTPException(403) from the team MCP-server permission guard: a non-proxy-admin caller (e.g. a team admin) tried to add the 'all-proxy-mcpservers' sentinel to a team's object permissions. Granting proxy-wide MCP access is reserved for proxy admins; existing admin-granted sentinels are untouched so unrelated edits still succeed.

Source

Thrown at litellm/proxy/management_helpers/object_permission_utils.py:438

    Only a proxy admin may newly grant the all-proxy MCP sentinel.

    Scoping a team to every MCP server on the proxy is a proxy-wide authorization
    decision, so a caller who is not a proxy admin (e.g. a team admin managing their
    own team) cannot add ``all-proxy-mcpservers``. A sentinel a proxy admin already
    granted is left untouched, so unrelated edits to such a team still succeed.

    Raises HTTPException(403) when a non-admin tries to add the sentinel.
    """
    sentinel: Final = SpecialMCPServerName.all_proxy_servers.value
    if is_proxy_admin or sentinel not in (requested_mcp_servers or []):
        return
    existing_mcp_servers: Final = await _existing_object_permission_mcp_servers(
        object_permission_id=existing_object_permission_id,
        prisma_client=prisma_client,
    )
    if sentinel in existing_mcp_servers:
        return
    raise HTTPException(
        status_code=status.HTTP_403_FORBIDDEN,
        detail={
            "error": "Only a proxy admin can grant a team access to all proxy MCP servers ('all-proxy-mcpservers')."
        },
    )


async def _get_team_allowed_mcp_servers(
    team_obj: Optional["LiteLLM_TeamTableCachedObj"],
    prisma_client: PrismaClient | None = None,
) -> set[str]:
    """
    Get the full set of MCP server IDs a team allows.

    If team has no object_permission or no MCP config, returns empty set
    (meaning only allow_all_keys servers are permitted).
    """
    if team_obj is None:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Call with a PROXY_ADMIN key to grant 'all-proxy-mcpservers', or grant specific MCP servers instead.

When it happens

Trigger: Thrown at litellm/proxy/management_helpers/object_permission_utils.py:438 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/7fe80792df2b2f45. Report an issue: GitHub.