{"record":{"id":"7b2cb66853275a38","repo":"BerriAI/litellm","slug":"key-requests-mcp-access-groups-not-allowed-by-team","errorCode":null,"errorMessage":"Key requests MCP access groups not allowed by team '{team_id}': {sorted(disallowed_groups)}. Team allows: {sorted(team_access_groups)}.","messagePattern":"Key requests MCP access groups not allowed by team '(.+?)': (.+?)\\. Team allows: (.+?)\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_helpers/object_permission_utils.py","lineNumber":637,"sourceCode":"        allowed_access_groups = team_access_groups\n        if teamless_admin_assignment:\n            allowed_access_groups = team_access_groups | requested_access_groups\n\n        disallowed_groups: Final = requested_access_groups - allowed_access_groups\n        if disallowed_groups:\n            if team_obj is not None:\n                team_id = team_obj.team_id\n                detail = (\n                    f\"Key requests MCP access groups not allowed by team '{team_id}': \"\n                    f\"{sorted(disallowed_groups)}. \"\n                    f\"Team allows: {sorted(team_access_groups)}.\"\n                )\n            else:\n                detail = (\n                    f\"Key is not in a team. MCP access groups cannot be assigned to \"\n                    f\"keys outside of a team. Disallowed groups: {sorted(disallowed_groups)}.\"\n                )\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail={\"error\": detail},\n            )\n\n    _validate_requested_toolsets(\n        requested_toolsets=requested_toolsets,\n        team_obj=team_obj,\n        is_proxy_admin=is_proxy_admin,\n    )\n\n    return object_permission\n\n\ndef _validate_requested_toolsets(\n    requested_toolsets: set[str],\n    team_obj: Optional[\"LiteLLM_TeamTableCachedObj\"],\n    is_proxy_admin: bool,\n) -> None:","sourceCodeStart":619,"sourceCodeEnd":655,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_helpers/object_permission_utils.py#L619-L655","documentation":"HTTPException(403) from key-vs-team MCP access-group validation: the key creation/update request asks for MCP access groups that are not in the creating team's allowlist (and the caller is not a teamless-admin assignment). The message lists the disallowed groups and the team's allowed set.","triggerScenarios":"Thrown at litellm/proxy/management_helpers/object_permission_utils.py:637 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the disallowed MCP access groups from the key request, or ask an admin to allow them for the team."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}