{"record":{"id":"7fe80792df2b2f45","repo":"BerriAI/litellm","slug":"only-a-proxy-admin-can-grant-a-team-access-to-all","errorCode":null,"errorMessage":"Only a proxy admin can grant a team access to all proxy MCP servers ('all-proxy-mcpservers').","messagePattern":"Only a proxy admin can grant a team access to all proxy MCP servers \\('all-proxy-mcpservers'\\)\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_helpers/object_permission_utils.py","lineNumber":438,"sourceCode":"    Only a proxy admin may newly grant the all-proxy MCP sentinel.\n\n    Scoping a team to every MCP server on the proxy is a proxy-wide authorization\n    decision, so a caller who is not a proxy admin (e.g. a team admin managing their\n    own team) cannot add ``all-proxy-mcpservers``. A sentinel a proxy admin already\n    granted is left untouched, so unrelated edits to such a team still succeed.\n\n    Raises HTTPException(403) when a non-admin tries to add the sentinel.\n    \"\"\"\n    sentinel: Final = SpecialMCPServerName.all_proxy_servers.value\n    if is_proxy_admin or sentinel not in (requested_mcp_servers or []):\n        return\n    existing_mcp_servers: Final = await _existing_object_permission_mcp_servers(\n        object_permission_id=existing_object_permission_id,\n        prisma_client=prisma_client,\n    )\n    if sentinel in existing_mcp_servers:\n        return\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,\n        detail={\n            \"error\": \"Only a proxy admin can grant a team access to all proxy MCP servers ('all-proxy-mcpservers').\"\n        },\n    )\n\n\nasync def _get_team_allowed_mcp_servers(\n    team_obj: Optional[\"LiteLLM_TeamTableCachedObj\"],\n    prisma_client: PrismaClient | None = None,\n) -> set[str]:\n    \"\"\"\n    Get the full set of MCP server IDs a team allows.\n\n    If team has no object_permission or no MCP config, returns empty set\n    (meaning only allow_all_keys servers are permitted).\n    \"\"\"\n    if team_obj is None:","sourceCodeStart":420,"sourceCodeEnd":456,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_helpers/object_permission_utils.py#L420-L456","documentation":"HTTPException(403) from the team MCP-server permission guard: a non-proxy-admin caller (e.g. a team admin) tried to add the 'all-proxy-mcpservers' sentinel to a team's object permissions. Granting proxy-wide MCP access is reserved for proxy admins; existing admin-granted sentinels are untouched so unrelated edits still succeed.","triggerScenarios":"Thrown at litellm/proxy/management_helpers/object_permission_utils.py:438 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Call with a PROXY_ADMIN key to grant 'all-proxy-mcpservers', or grant specific MCP servers instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}