[Feat] IP-Based Access Control for MCP Servers

[ishaan-jaff]

IP-Based Access Control for MCP Servers

• Add available_on_public_internet flag to MCP servers so admins can control which servers are visible to external callers vs internal-only
  • External callers (public IPs) only see servers marked as public; internal callers (private IPs) see all servers
  • Add UI for toggling the flag on create/edit, displaying Public/Internal badges, and configuring private IP ranges

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🆕 New Feature
✅ Test

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 7, 2026 1:59am

[greptile-apps]

Greptile Overview

Greptile Summary

• Adds IP-based access control for MCP server discovery/registry and tool endpoints: external callers only see servers marked available_on_public_internet, while internal callers can see all.
• Introduces IPAddressUtils to derive client IP (optionally trusting X-Forwarded-For only from configured trusted proxy ranges) and new general settings for internal/trusted proxy CIDRs.
• Extends MCP server schema/types/UI to store and manage available_on_public_internet, plus adds a dashboard tab to configure internal IP ranges.
• Updates tests to account for IP filtering by mocking request client IP and server manager filtering behavior.

Confidence Score: 3/5

• This PR is mergeable after addressing a couple of concrete security/performance issues in the MCP network settings UI and server filtering path.
• Core changes are coherent (new schema field + IP-based filtering threaded through endpoints) and tests were added, but there is (1) a third-party IP-discovery call from the admin UI that leaks metadata and can break in restricted deployments, and (2) an inefficient filtering implementation that will be on hot request paths and scales poorly with server count.
• ui/litellm-dashboard/src/components/mcp_tools/MCPNetworkSettings.tsx; litellm/proxy/_experimental/mcp_server/mcp_server_manager.py

Important Files Changed

Filename	Overview
CLAUDE.md	Adds a style guideline discouraging inline imports; no functional impact.
litellm-proxy-extras/litellm_proxy_extras/schema.prisma	Adds available_on_public_internet boolean to LiteLLM_MCPServerTable schema; requires DB migration consistency with other prisma schemas.
litellm/proxy/_experimental/mcp_server/auth/litellm_auth_handler.py	Extends MCPAuthenticatedUser to store client_ip in auth context; safe if all callers pass/handle new field.
litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py	Threads client IP into MCP server lookup to hide non-public servers from external callers.
litellm/proxy/_experimental/mcp_server/mcp_server_manager.py	Implements IP-based filtering (public vs internal) and adds available_on_public_internet; introduces expensive per-request filtering path and repeats config-loading logic.
litellm/proxy/_experimental/mcp_server/rest_endpoints.py	Adds IP filtering to REST list_tools/call_tool flows and refactors header extraction; behavior change depends on correct client IP extraction.
litellm/proxy/_experimental/mcp_server/server.py	Adds client IP extraction for MCP session requests, plumbs it through auth context, and applies IP filtering to allowed-server computation; includes new exception handling.
litellm/proxy/_types.py	Extends MCP server request/response types with available_on_public_internet and adds general settings fields for MCP IP ranges.
litellm/proxy/auth/ip_address_utils.py	Introduces IP parsing/classification and trusted-proxy-aware client IP extraction; has edge-case behavior if request client info is missing.
litellm/proxy/management_endpoints/mcp_management_endpoints.py	Filters MCP registry response by client IP; adds available_on_public_internet when creating servers.
litellm/proxy/proxy_server.py	Exposes new general settings keys in config list and applies IP filtering in dynamic MCP route.
litellm/proxy/schema.prisma	Adds available_on_public_internet boolean column to MCP server table schema; must remain consistent with root schema.
litellm/types/mcp_server/mcp_server_manager.py	Adds available_on_public_internet field to MCPServer pydantic model.
schema.prisma	Adds available_on_public_internet boolean column to MCP server table schema in root prisma schema.
tests/mcp_tests/test_mcp_server.py	Updates MCP server REST tests to account for IP filtering by mocking manager methods and request client IP.
tests/test_litellm/proxy/auth/test_mcp_ip_filtering.py	Adds unit tests for internal/external IP classification and server filtering behavior.
ui/litellm-dashboard/src/components/mcp_tools/MCPNetworkSettings.tsx	Adds UI for configuring MCP internal IP ranges and calls external ipify to detect public IP (introduces third-party network call from UI).
ui/litellm-dashboard/src/components/mcp_tools/MCPPermissionManagement.tsx	Adds form toggle for available_on_public_internet in MCP permission management UI.
ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx	Includes available_on_public_internet in create MCP server payload.
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_columns.tsx	Adds 'Network Access' column showing Public/Internal based on available_on_public_internet.
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx	Adds available_on_public_internet to MCP server edit payload and defaults.
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_view.tsx	Displays available_on_public_internet status in server detail view.
ui/litellm-dashboard/src/components/mcp_tools/mcp_servers.tsx	Adds a 'Network Settings' tab to MCP servers UI to configure internal IP ranges.
ui/litellm-dashboard/src/components/mcp_tools/types.tsx	Extends MCPServer TS type with available_on_public_internet optional boolean.

Sequence Diagram

sequenceDiagram
  autonumber
  participant Client as MCP Client (external)
  participant Proxy as LiteLLM Proxy
  participant IPU as IPAddressUtils
  participant MSM as MCPServerManager
  participant MCP as Upstream MCP Server

  Client->>Proxy: "HTTP /mcp/{server_name}/... (or REST /mcp/tools)"
  Proxy->>IPU: "get_mcp_client_ip(request)"
  IPU-->>Proxy: "client_ip (direct or XFF)"
  Proxy->>MSM: "get_mcp_server_by_name(name, client_ip)"
  MSM->>MSM: "_is_server_accessible_from_ip(server, client_ip)"
  MSM->>MSM: "_get_general_settings()/parse_internal_networks()"
  MSM-->>Proxy: "server or None"

  alt "server visible & allowed"
    Proxy->>MSM: "get_allowed_mcp_servers(user_api_key_auth)"
    MSM-->>Proxy: "allowed_server_ids"
    Proxy->>MSM: "filter_server_ids_by_ip(allowed_server_ids, client_ip)"
    MSM-->>Proxy: "filtered_allowed_ids"
    Proxy->>MSM: "get_mcp_server_by_id(server_id)"
    MSM-->>Proxy: "MCPServer config"
    Proxy->>MCP: "list_tools / call_tool (merged auth headers)"
    MCP-->>Proxy: "tools/result"
    Proxy-->>Client: "response"
  else "server hidden/forbidden"
    Proxy-->>Client: "404/403"
  end

Loading

[greptile-apps]

_{24 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

N+1 lookup per request

filter_server_ids_by_ip() calls get_mcp_server_by_id() inside a list comprehension, and get_mcp_server_by_id() itself loops over registry.values(). This makes filtering O(N*M) on hot paths (REST list_tools / call_tool), and will degrade quickly as server count grows. Precompute an id→server map once per registry refresh or change get_mcp_server_by_id to be O(1) for this usage.

[andresC98]

Just a heads up; this is a breaking change.
We tested upgrading to 1.81.12-stable.1 tag in our DEV deployment and we noticed MCPs now are not able to authenticate as a result of LiteLLM being deployed on a k8s cluster, and MCP endpoints be deployed on a different cluster, thus treating them as "external/public". As by default now with this change available_on_public_internet is false and filter_server_ids_by_ip strips the server out, unless we manually set available_on_public_internet: true MCPs stop working.

[ishaan-jaff]

@andresC98 re: #20620 (comment) — fixed in #22331. Default is back to public. Patching onto stable as 1.81.12.stable.2. Migration script in the PR for flipping any existing servers that got set to private.