{"record":{"id":"df3121ee1cdebf91","repo":"BerriAI/litellm","slug":"call-not-allowed-to-update-mcp-server-user-is-not","errorCode":null,"errorMessage":"Call not allowed to update MCP server. User is not a proxy admin. route={}","messagePattern":"Call not allowed to update MCP server\\. User is not a proxy admin\\. route=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":2529,"sourceCode":"        Parameters:\n        - payload: UpdateMCPServerRequest - Required. The updated mcp server data.\n        ```\n        curl -X \"PUT\" --location 'http://localhost:4000/v1/mcp/server' \\\n        --header 'Authorization: Bearer your_api_key_here'\n        ```\n        \"\"\"\n        prisma_client: Final = get_prisma_client_or_throw(\n            \"Database not connected. Connect a database to your proxy - https://docs.litellm.ai/docs/simple_proxy#managing-auth---virtual-keys\"\n        )\n\n        payload_fields_set: Final = set(payload.fields_set())\n\n        # Validate and normalize payload fields\n        validate_and_normalize_mcp_server_payload(payload)\n\n        # Authz - restrict only admins to delete mcp servers\n        if LitellmUserRoles.PROXY_ADMIN != user_api_key_dict.user_role:\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail={\n                    \"error\": \"Call not allowed to update MCP server. User is not a proxy admin. route={}\".format(\n                        \"PUT /v1/mcp/server\"\n                    )\n                },\n            )\n\n        # Snapshot the pre-update identity so we can detect a mint-relevant change below. The read is\n        # advisory (it only feeds the stale-token purge decision), so a failure skips the purge with a\n        # warning instead of failing the edit, whose primary job is the update itself.\n        try:\n            old_server_record = await get_mcp_server(prisma_client, payload.server_id)\n            old_server_record_read_failed = False\n        except Exception as exc:  # noqa: BLE001 - advisory read; invalidation is best-effort end-to-end\n            verbose_logger.warning(\n                \"MCP server %s: could not snapshot the pre-update record; skipping the stale-token check: %s\",\n                payload.server_id,","sourceCodeStart":2511,"sourceCodeEnd":2547,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L2511-L2547","documentation":"Role guard in the MCP server update flow (PUT /v1/mcp/server): the caller is not a proxy admin, so mutating a server configuration is denied. The route is interpolated into the message for logging/debuggability.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2529 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the request with a PROXY_ADMIN API key."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}