{"record":{"id":"c8f4aa34d88e7713","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-create-mcp-toolsets","errorCode":null,"errorMessage":"Only proxy admins can create MCP toolsets.","messagePattern":"Only proxy admins can create MCP toolsets\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":2828,"sourceCode":"        NewMCPToolsetRequest,\n        UpdateMCPToolsetRequest,\n    )\n\n    @router.post(\n        \"/toolset\",\n        description=\"Create a new MCP toolset (admin only)\",\n        status_code=status.HTTP_201_CREATED,\n    )\n    @management_endpoint_wrapper\n    async def add_mcp_toolset(\n        payload: NewMCPToolsetRequest,\n        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n        litellm_changed_by: str | None = Header(None),\n    ):\n        \"\"\"Create a named toolset — a curated selection of {server_id, tool_name} pairs.\"\"\"\n        prisma_client: Final = get_prisma_client_or_throw(\"Database not connected. Connect a database to your proxy\")\n        if LitellmUserRoles.PROXY_ADMIN != user_api_key_dict.user_role:\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail={\"error\": \"Only proxy admins can create MCP toolsets.\"},\n            )\n        touched_by: Final = (\n            get_audit_log_changed_by(\n                litellm_changed_by=litellm_changed_by,\n                user_api_key_dict=user_api_key_dict,\n                litellm_proxy_admin_name=LITELLM_PROXY_ADMIN_NAME,\n            )\n            or LITELLM_PROXY_ADMIN_NAME\n        )\n        try:\n            result: Final = await create_mcp_toolset(prisma_client, payload, touched_by)\n        except UniqueViolationError:\n            raise HTTPException(\n                status_code=status.HTTP_409_CONFLICT,\n                detail={\"error\": f\"A toolset named '{payload.toolset_name}' already exists.\"},\n            )","sourceCodeStart":2810,"sourceCodeEnd":2846,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L2810-L2846","documentation":"Role guard on POST /v1/mcp/toolset: creating a named toolset (a curated {server_id, tool_name} selection) is an admin-only mutation. The caller's role is not exactly PROXY_ADMIN, so the request is rejected before any DB write.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2828 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a PROXY_ADMIN API key to create MCP toolsets."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}