BerriAI/litellm · error · HTTPException

User does not have permission to view mcp server with id {se

Error message

User does not have permission to view mcp server with id {server_id}. You can only view mcp servers that you have access to.

What it means

Returned (403) by the single MCP server fetch endpoint when the caller is not an admin-view user and the server is absent from their permitted set: for DB servers it checks get_all_mcp_servers_for_user, for registry/config servers the get_allowed_mcp_servers list. Authorization is deliberately checked before any health check so unauthorized callers cannot trigger server side-effects.

Source

Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:1480

            )

        # Implement authz restriction from requested user
        is_admin_view: Final = _user_has_admin_view(user_api_key_dict)
        is_restricted_virtual_key: Final = _is_restricted_virtual_key_request(user_api_key_dict)

        if not is_admin_view:
            # Perform authz check BEFORE any health check (avoid side-effects for
            # unauthorized callers).
            if from_db:
                mcp_server_records: Final = await get_all_mcp_servers_for_user(prisma_client, user_api_key_dict)
                exists = does_mcp_server_exist(mcp_server_records, server_id)
            else:
                # Registry/config server: use same access logic as list endpoint
                allowed_server_ids: Final = await global_mcp_server_manager.get_allowed_mcp_servers(user_api_key_dict)
                exists = mcp_server.server_id in allowed_server_ids

            if not exists:
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail={
                        "error": (
                            f"User does not have permission to view mcp server with id {server_id}. "
                            "You can only view mcp servers that you have access to."
                        )
                    },
                )

        # At this point caller is authorized to view the server.
        if from_db:
            await global_mcp_server_manager.add_server(mcp_server)

        # Perform health check on the server using server manager
        try:
            health_result: Final = await global_mcp_server_manager.health_check_server(server_id)
            # Update the server object with health check results
            mcp_server.status = health_result.status if health_result.status else "unknown"

View on GitHub (pinned to 77b7c6c40c)

Solutions

Grant access: attach the MCP server to the team (team mcp_servers / allowed servers setting) or to the virtual key that is calling.
Use the key's own list endpoint to see which servers it can view, and only fetch those.
Use a proxy-admin key (or the master key) when an unrestricted admin view is intended.

Example fix

# before: fetching a server the key cannot see
requests.get(f"{PROXY}/v1/mcp/server/{server_id}", headers={"Authorization": f"Bearer {TEAM_KEY}"})

# after: only fetch servers present in this key's visible list
visible = requests.get(f"{PROXY}/v1/mcp/server", headers={"Authorization": f"Bearer {TEAM_KEY}"}).json()
ids = {s["server_id"] for s in visible["servers"]}
if server_id in ids:
    requests.get(f"{PROXY}/v1/mcp/server/{server_id}", headers={"Authorization": f"Bearer {TEAM_KEY}"})

Defensive patterns

Strategy: validation

Validate before calling

visible = requests.get(f"{PROXY}/v1/mcp/server", headers={"Authorization": f"Bearer {TEAM_KEY}"}).json()["servers"]
if server_id not in {s["server_id"] for s in visible}:
    raise PermissionError(f"{server_id} not granted to this key; attach it to the team first")

Try / catch

try:
    fetch(server_id)
except HTTPError as e:
    if e.response.status_code == 403:
        # surface 'request access' message instead of a raw failure
        raise PermissionError("ask admin to grant this MCP server to your team")
    raise

Prevention

Fetch only servers present in the caller's own list response.
When provisioning a server, attach it to the teams that need it in the same change.
Use admin keys only for admin workflows, never as a workaround baked into user code.

When it happens

Trigger: GET /v1/mcp/server/{server_id} with a virtual key whose team/key was never granted that MCP server; a user viewing a server that belongs to another team; a non-admin key checking a server that exists but is not attached to the key, its team, or its organization.

Common situations: Team-scoped virtual keys used to inspect servers owned by a different team; server added to the proxy but not to any team's mcp_servers; admin assumes a regular user key can see everything admins see.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/6997dc13a00c3b54. Report an issue: GitHub.