{"record":{"id":"0417b7ff3775874d","repo":"BerriAI/litellm","slug":"admin-access-required-to-approve-mcp-server-submis","errorCode":null,"errorMessage":"Admin access required to approve MCP server submissions.","messagePattern":"Admin access required to approve MCP server submissions\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":1340,"sourceCode":"            submissions.items = _sanitize_mcp_server_list_for_non_admin(submissions.items)\n        return submissions\n\n    @router.put(\n        \"/server/{server_id}/approve\",\n        description=\"Approve a pending MCP server submission (admin only). Mirrors PUT /guardrails/{id}/approve.\",\n        dependencies=[Depends(user_api_key_auth)],\n        response_model=LiteLLM_MCPServerTable,\n    )\n    @management_endpoint_wrapper\n    async def approve_mcp_server_submission(\n        server_id: str,\n        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n    ):\n        \"\"\"\n        Admin approves a pending or previously-rejected MCP server — sets approval_status=active and loads it into the runtime registry.\n        \"\"\"\n        if LitellmUserRoles.PROXY_ADMIN != user_api_key_dict.user_role:\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail={\"error\": \"Admin access required to approve MCP server submissions.\"},\n            )\n\n        prisma_client: Final = get_prisma_client_or_throw(\"Database not connected. Connect a database to your proxy\")\n\n        existing: Final = await get_mcp_server(prisma_client, server_id)\n        if existing is None:\n            raise HTTPException(\n                status_code=status.HTTP_404_NOT_FOUND,\n                detail={\"error\": f\"MCP server '{server_id}' not found.\"},\n            )\n        if existing.approval_status == MCPApprovalStatus.active:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail={\"error\": \"MCP server is already active.\"},\n            )\n","sourceCodeStart":1322,"sourceCodeEnd":1358,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L1322-L1358","documentation":"Role guard on PUT /v1/mcp/server/{server_id}/approve: approval flips a submission to active and loads it into the runtime registry, a privileged mutation. The caller's role is not exactly PROXY_ADMIN, so the request is rejected with 403 before the server is even looked up.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:1340 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Authenticate with a proxy admin API key.","Ask a proxy admin to approve the submission."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}