{"record":{"id":"0864635503d6c49d","repo":"BerriAI/litellm","slug":"tool-tool-name-is-not-allowed-for-your-key-tea","errorCode":null,"errorMessage":"Tool '{tool_name}' is not allowed for your key/team on server '{server.name}'. Contact proxy admin for access.","messagePattern":"Tool '(.+?)' is not allowed for your key/team on server '(.+?)'\\. Contact proxy admin for access\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/mcp_server_manager.py","lineNumber":4532,"sourceCode":"        Raises:\n            HTTPException: If tool is not allowed for this key/team\n        \"\"\"\n        from litellm.proxy._experimental.mcp_server.auth.user_api_key_auth_mcp import (\n            MCPRequestHandler,\n        )\n\n        if not user_api_key_auth:\n            return\n\n        # Check if tool is allowed\n        is_allowed: Final = await MCPRequestHandler.is_tool_allowed_for_server(\n            tool_name=tool_name,\n            server_id=server.server_id,\n            user_api_key_auth=user_api_key_auth,\n        )\n\n        if not is_allowed:\n            raise HTTPException(\n                status_code=403,\n                detail={\n                    \"error\": f\"Tool '{tool_name}' is not allowed for your key/team on server '{server.name}'. Contact proxy admin for access.\"\n                },\n            )\n\n    async def _call_openapi_tool_handler(\n        self,\n        server: MCPServer,\n        tool_name: str,\n        arguments: _ToolArguments,\n    ) -> CallToolResult:\n        \"\"\"\n        Call an OpenAPI tool handler directly.\n\n        For OpenAPI servers, instead of using MCP protocol, we call the tool handler\n        that was registered during OpenAPI spec parsing. This handler makes direct\n        HTTP requests to the API.","sourceCodeStart":4514,"sourceCodeEnd":4550,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py#L4514-L4550","documentation":"Authorization check before an MCP tool call: MCPRequestHandler.is_tool_allowed_for_server returned False, meaning the virtual key/team's allowed_routes or mcp_tools scope does not include this tool on this server.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/mcp_server_manager.py:4532 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ask the proxy admin to grant your key/team access to this tool."],"exampleFix":"Contact admin to add the tool to your key's allowed list.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}