{"record":{"id":"23eae872309aedb1","repo":"BerriAI/litellm","slug":"key-is-not-in-a-team-mcp-toolsets-cannot-be-assig","errorCode":null,"errorMessage":"Key is not in a team. MCP toolsets cannot be assigned to personal keys by non-admin callers. Disallowed toolsets: {sorted(requested_toolsets)}.","messagePattern":"Key is not in a team\\. MCP toolsets cannot be assigned to personal keys by non-admin callers\\. Disallowed toolsets: (.+?)\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_helpers/object_permission_utils.py","lineNumber":667,"sourceCode":"\n\ndef _validate_requested_toolsets(\n    requested_toolsets: set[str],\n    team_obj: Optional[\"LiteLLM_TeamTableCachedObj\"],\n    is_proxy_admin: bool,\n) -> None:\n    \"\"\"\n    Validate mcp_toolsets requested on a key.\n\n    Non-admin callers cannot assign toolsets to a personal (no team) key. Team\n    keys must request a subset of the team's own toolset allowlist.\n    \"\"\"\n    if not requested_toolsets:\n        return\n    if team_obj is None:\n        if is_proxy_admin:\n            return\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail={\n                \"error\": (\n                    \"Key is not in a team. MCP toolsets cannot be assigned to \"\n                    \"personal keys by non-admin callers. Disallowed toolsets: \"\n                    f\"{sorted(requested_toolsets)}.\"\n                )\n            },\n        )\n    team_op: Final = team_obj.object_permission\n    team_mcp_toolsets: Final = team_op.mcp_toolsets if team_op is not None else None\n    if not team_mcp_toolsets:\n        return\n    disallowed_toolsets: Final = requested_toolsets - set(team_mcp_toolsets)\n    if not disallowed_toolsets:\n        return\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,","sourceCodeStart":649,"sourceCodeEnd":685,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_helpers/object_permission_utils.py#L649-L685","documentation":"HTTPException(403) from _validate_requested_toolsets: a non-admin caller tried to assign mcp_toolsets to a personal (teamless) key. Toolset-based MCP scoping is only defined for team keys or when a proxy admin makes the assignment; the message lists the requested toolsets.","triggerScenarios":"Thrown at litellm/proxy/management_helpers/object_permission_utils.py:667 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Assign the key to a team first, remove the requested toolsets, or call as a proxy admin."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}