{"record":{"id":"997ff51d2c377055","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-access-mcp-discovery-your-r","errorCode":null,"errorMessage":"Only proxy admins can access MCP discovery. Your role={user_api_key_dict.user_role}","messagePattern":"Only proxy admins can access MCP discovery\\. Your role=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":2730,"sourceCode":"\n    @router.get(\n        \"/discover\",\n        description=\"Returns a curated list of well-known MCP servers for discovery UI\",\n        dependencies=[Depends(user_api_key_auth)],\n    )\n    async def discover_mcp_servers(\n        query: str | None = Query(None, description=\"Search filter for server names and descriptions\"),\n        category: str | None = Query(None, description=\"Filter by category\"),\n        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n    ):\n        \"\"\"\n        Returns a curated list of well-known MCP servers that can be added to the proxy.\n\n        Used by the UI to show a discovery grid when adding new MCP servers.\n        \"\"\"\n        # Admin Viewer follows the read-parity rule.\n        if not _user_has_admin_view(user_api_key_dict):\n            raise HTTPException(\n                status_code=403,\n                detail={\n                    \"error\": f\"Only proxy admins can access MCP discovery. Your role={user_api_key_dict.user_role}\"\n                },\n            )\n\n        registry: Final = _load_mcp_registry()\n        servers = registry.get(\"servers\", [])\n\n        # Apply query filter\n        if query:\n            query_lower: Final = query.lower()\n            servers = [\n                s\n                for s in servers\n                if query_lower in s.get(\"name\", \"\").lower()\n                or query_lower in s.get(\"title\", \"\").lower()\n                or query_lower in s.get(\"description\", \"\").lower()","sourceCodeStart":2712,"sourceCodeEnd":2748,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L2712-L2748","documentation":"Admin gate on the MCP discovery listing endpoint: only PROXY_ADMIN may browse the curated MCP server catalog; other roles get HTTP 403 with their role embedded.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2730 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a PROXY_ADMIN API key to access MCP discovery."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}