Add http support to custom code guardrails + Unified guardrails for MCP + Agent guardrail support

[krrishdholakia]

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 7, 2026 1:33am

[greptile-apps]

Greptile Overview

Greptile Summary

• Adds async HTTP primitives (http_request/http_get/http_post) and async apply_guardrail support to custom code guardrails.
• Introduces unified guardrail translation for MCP tool calls and A2A agent (JSON-RPC) traffic, routing through ProxyBaseLLMRequestProcessing.
• Extends Playground UI to support “MCP direct” tool calling with a structured arguments form, and passes guardrails through to MCP and A2A calls.
• Refactors MCP REST endpoints to share auth-context/server-allowlist resolution and to run common pre-call processing for guardrails/logging.

Confidence Score: 2/5

• This PR should not be merged until the UI compile error and MCP guardrail input regression are fixed.
• Two definite correctness issues were introduced: a syntax-breaking indentation error in ChatUI.tsx and MCP guardrail translation no longer supplies tool call arguments to guardrails. Additionally, the new HTTP primitive mis-encodes list bodies, breaking APIs expecting JSON arrays.
• ui/litellm-dashboard/src/components/playground/chat_ui/ChatUI.tsx; litellm/proxy/_experimental/mcp_server/guardrail_translation/handler.py; litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py

Important Files Changed

Filename	Overview
docs/my-website/docs/proxy/guardrails/custom_code_guardrail.md	Documented async apply_guardrail support and new async HTTP primitives for custom code guardrails.
litellm/llms/a2a/chat/guardrail_translation/README.md	Added documentation for A2A guardrail translation handler and how to pass guardrails via params.metadata.
litellm/llms/a2a/chat/guardrail_translation/init.py	Registered A2A guardrail translation mappings for CallTypes.send_message and CallTypes.asend_message.
litellm/llms/a2a/chat/guardrail_translation/handler.py	Implemented A2A input/output translation for unified guardrails by extracting text parts and mapping updates back into JSON-RPC structures.
litellm/proxy/_experimental/mcp_server/guardrail_translation/handler.py	Refactored MCP guardrail translation to use tool definitions; currently drops actual tool call arguments from guardrail inputs (see review comment).
litellm/proxy/_experimental/mcp_server/mcp_server_manager.py	Minor formatting + SEP-986 tool name validation import adjustments; no behavioral changes spotted in diff.
litellm/proxy/_experimental/mcp_server/rest_endpoints.py	Updated MCP REST tool call endpoint to run common pre-call processing and enforce server access via shared helper.
litellm/proxy/agent_endpoints/a2a_endpoints.py	Added support for passing LiteLLM params (e.g., guardrails) through A2A params and moved to ProxyBaseLLMRequestProcessing for pre-call processing.
litellm/proxy/common_request_processing.py	Extended ProxyBaseLLMRequestProcessing route types to include A2A send_message and MCP tool calls; no issues found in diff.
litellm/proxy/guardrails/guardrail_hooks/custom_code/custom_code_guardrail.py	Added async apply_guardrail support (await coroutine results) and enabled MCP-related event hooks for custom code guardrails.
litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py	Added async HTTP request primitives (http_request/get/post) using cached async httpx client; list-body handling currently routes to data= instead of json= (see review comment).
litellm/proxy/guardrails/guardrail_hooks/unified_guardrail/unified_guardrail.py	Adjusted unified guardrail hook to use pre_mcp_call/during_mcp_call for CallTypes.call_mcp_tool.
ui/litellm-dashboard/src/components/guardrails/custom_code/CustomCodeModal.tsx	Updated custom code modal templates and primitive list to include async HTTP primitives and async apply_guardrail example.
ui/litellm-dashboard/src/components/guardrails/guardrail_info.tsx	UI updates for guardrail configuration screen to integrate custom code modal changes.
ui/litellm-dashboard/src/components/mcp_tools/MCPToolArgumentsForm.tsx	Added structured MCP tool arguments form generation from JSON schema, with ref-based submit value extraction.
ui/litellm-dashboard/src/components/networking.tsx	Added callMCPTool options to pass guardrails via litellm_metadata and improved error parsing for MCP tool calls.
ui/litellm-dashboard/src/components/playground/chat_ui/ChatUI.tsx	Added MCP direct tool-call mode and passing guardrails to MCP/A2A; introduces a syntax-breaking indentation error in handleSendMessage (see review comment).
ui/litellm-dashboard/src/components/playground/chat_ui/chatConstants.ts	Added MCP endpoint option label to playground endpoint dropdown.
ui/litellm-dashboard/src/components/playground/chat_ui/mode_endpoint_mapping.tsx	Added EndpointType.MCP to endpoint mapping enum for playground mode selection.

Sequence Diagram

sequenceDiagram
  autonumber
  participant UI as Playground UI (ChatUI)
  participant Net as UI networking.callMCPTool
  participant API as Proxy /mcp-rest/tools/call
  participant Proc as ProxyBaseLLMRequestProcessing
  participant UG as UnifiedLLMGuardrails
  participant MTr as MCPGuardrailTranslationHandler
  participant GR as CustomGuardrail.apply_guardrail
  participant MCP as MCPServerManager.execute_mcp_tool

  UI->>Net: callMCPTool(server_id,name,arguments, litellm_metadata.guardrails)
  Net->>API: POST /mcp-rest/tools/call
  API->>Proc: common_processing_pre_call_logic(route_type=call_mcp_tool)
  Proc-->>API: enriched data + logging_obj
  API->>UG: pre-call hook (CallTypes.call_mcp_tool)
  UG->>MTr: process_input_messages(data)
  MTr->>GR: apply_guardrail(inputs, request_data)
  UG-->>API: allow/block
  API->>MCP: execute_mcp_tool(name, arguments, allowed_servers)
  MCP-->>API: CallToolResult
  API-->>UI: tool result

Loading

[greptile-apps]

_{19 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Broken function indentation

handleSendMessage is now declared with extra leading spaces (" const handleSendMessage = async () => {"), which breaks the component’s block structure and will fail to compile (the subsequent if (...) is also mis-indented). This needs to be aligned with other top-level handlers in the component.

Suggested change

	const handleSendMessage = async () => {
	if (
	inputMessage.trim() === "" &&
	const handleSendMessage = async () => {

[greptile-apps]

Incorrect JSON body handling

_prepare_http_body() returns (None, json.dumps(body)) for list inputs, which routes list bodies to the data= parameter instead of json=. That sends a string payload without setting JSON encoding semantics and differs from the docstring (“JSON-encoded if dict/list”), causing APIs expecting JSON arrays to misinterpret the request.

Suggested change

	if isinstance(body, list):
	return None, json.dumps(body)
	if isinstance(body, str):
	return None, body
	return None, str(body)
	if isinstance(body, list):
	return body, None

[greptile-apps]

Tool call missing args

process_input_messages() now passes only tools=[...] into GenericGuardrailAPIInputs and does not include the actual tool call + arguments anywhere in inputs. On the custom-code path, inputs["tool_calls"] will be empty, so guardrails that validate/modify tool arguments won’t see the call payload.

Concrete failure: a custom guardrail expecting inputs["tool_calls"][0]["function"]["arguments"] will never trigger for MCP tool calls.

Consider adding a tool_calls entry (name + JSON arguments) alongside tools.