{"record":{"id":"d755a80b31643003","repo":"BerriAI/litellm","slug":"key-requests-mcp-toolsets-not-allowed-by-team-te","errorCode":null,"errorMessage":"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': {sorted(disallowed_toolsets)}. Team allows: {sorted(team_mcp_toolsets)}.","messagePattern":"Key requests MCP toolsets not allowed by team '(.+?)': (.+?)\\. Team allows: (.+?)\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_helpers/object_permission_utils.py","lineNumber":684,"sourceCode":"            return\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail={\n                \"error\": (\n                    \"Key is not in a team. MCP toolsets cannot be assigned to \"\n                    \"personal keys by non-admin callers. Disallowed toolsets: \"\n                    f\"{sorted(requested_toolsets)}.\"\n                )\n            },\n        )\n    team_op: Final = team_obj.object_permission\n    team_mcp_toolsets: Final = team_op.mcp_toolsets if team_op is not None else None\n    if not team_mcp_toolsets:\n        return\n    disallowed_toolsets: Final = requested_toolsets - set(team_mcp_toolsets)\n    if not disallowed_toolsets:\n        return\n    raise HTTPException(\n        status_code=status.HTTP_403_FORBIDDEN,\n        detail={\n            \"error\": (\n                f\"Key requests MCP toolsets not allowed by team '{team_obj.team_id}': \"\n                f\"{sorted(disallowed_toolsets)}. \"\n                f\"Team allows: {sorted(team_mcp_toolsets)}.\"\n            )\n        },\n    )\n\n\ndef _extract_requested_vector_stores(\n    object_permission: ObjectPermissionDict | None,\n) -> set[str]:\n    \"\"\"Return vector_store IDs from a key's object_permission dict.\"\"\"\n    if not object_permission or not isinstance(object_permission, dict):\n        return set()\n    raw: Final = object_permission.get(\"vector_stores\")","sourceCodeStart":666,"sourceCodeEnd":702,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_helpers/object_permission_utils.py#L666-L702","documentation":"HTTPException(403) from _validate_requested_toolsets: the key request asks for MCP toolsets beyond the team's own allowlist (a non-empty team mcp_toolsets list). The message names the offending toolsets and the team's allowed set so the caller can correct the request.","triggerScenarios":"Thrown at litellm/proxy/management_helpers/object_permission_utils.py:684 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the disallowed MCP toolsets from the key request, or ask an admin to allow them for the team."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}