{"record":{"id":"1ab7f193af667ebb","repo":"BerriAI/litellm","slug":"restricted-virtual-keys-cannot-query-team-scoped-m","errorCode":null,"errorMessage":"Restricted virtual keys cannot query team-scoped MCP servers.","messagePattern":"Restricted virtual keys cannot query team-scoped MCP servers\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":1092,"sourceCode":"        \"\"\"\n        Get all of the configured mcp servers for the user in the db with their associated teams\n        ```\n        curl --location 'http://localhost:4000/v1/mcp/server' \\\n        --header 'Authorization: Bearer your_api_key_here'\n\n        # Filter by team scope (for Create Key UI)\n        curl --location 'http://localhost:4000/v1/mcp/server?team_id=team-123' \\\n        --header 'Authorization: Bearer your_api_key_here'\n        ```\n        \"\"\"\n\n        # If team_id is provided, return team-scoped servers + allow_all_keys servers\n        is_restricted_virtual_key: Final = _is_restricted_virtual_key_request(user_api_key_dict)\n        if team_id is not None and isinstance(team_id, str) and team_id.strip():\n            # Restricted virtual keys must not use the team_id filter to\n            # bypass their own access limitations.\n            if is_restricted_virtual_key:\n                raise HTTPException(\n                    status_code=403,\n                    detail=\"Restricted virtual keys cannot query team-scoped MCP servers.\",\n                )\n\n            # Only proxy admins may query another team's MCP servers.\n            # Non-admins must belong to the requested team.\n            sanitized_team_id: Final = team_id.strip()\n            is_admin: Final = _user_has_admin_view(user_api_key_dict)\n            if not is_admin:\n                from litellm.proxy.auth.auth_checks import get_team_object\n                from litellm.proxy.proxy_server import (\n                    prisma_client,\n                    user_api_key_cache,\n                )\n\n                team_obj: Final = await get_team_object(\n                    team_id=sanitized_team_id,\n                    prisma_client=prisma_client,","sourceCodeStart":1074,"sourceCodeEnd":1110,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L1074-L1110","documentation":"Scope guard on the team-filtered server list: a restricted virtual key (a key with object_permission-level MCP restrictions) attempted GET /v1/mcp/server?team_id=..., which would let it enumerate team-scoped servers. Restricted keys are only allowed their explicitly granted server set, not team-scoped listings.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:1092 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a non-restricted (full-access) virtual key to query team-scoped MCP servers.","Ask a proxy admin to grant the key access to the required routes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}