feat(ui): dcr_bridge toggle for client-forwarded MCP auth modes

[tin-berri]

Relevant issues

Linear ticket

Part of LIT-4337 (the dashboard surface for the dcr_bridge server flag added in #32745)

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review)

Screenshots / Proof of Fix

Captured against a live PostgreSQL-backed proxy on port 4000 and the dashboard on port 3000. Before is merge-base 34602ff627575117f4c1bab9bbb1ba70f1d3286b; after is PR head 8b8a28848cb57811751ea9671c9214b1f30cfe56. The toggle now sits inside the browser-only authorize box, after the OAuth client ID and secret fields and just before the Authorize & Fetch Tools button; those client fields now read plain (optional) (the earlier not-saved qualifier is gone)

Before: create form has no DCR bridge control	After: client-forwarded create defaults DCR bridge on

Before: edit form cannot display the stored flag	After: edit reads stored dcr_bridge=true

After: stored true	After: stored false

Runtime findings

Re-verified on PR head 8b8a28848cb57811751ea9671c9214b1f30cfe56 after the toggle moved into the authorize box and the client-field labels changed:

• Passed: create defaults the toggle on for True Passthrough and OAuth Delegate, and hides it for API Key
• Passed: edit reads both stored boolean values from the server record (aria-checked matched the API for the stored-true and stored-false records)
• Passed: the live UI/API save and reopen round-trip persisted false -> true -> false in its new location (API confirmed dcr_bridge=true then dcr_bridge=false)
• Passed: the toggle renders inside the bordered authorize box between OAuth Client Secret and Authorize & Fetch Tools, and the OAuth client fields read plain (optional)

Separate backend update finding

An earlier recorded run saw two auth-type transitions return HTTP 500 from the MCP server update endpoint. Saving auth_type=none failed even though the payload contained no client ID, client secret, or credentials and explicitly sent dcr_bridge=false. A later API Key to True Passthrough update also returned HTTP 500

This PR changes dashboard code only. The UI sent the expected toggle values, and the force-clear behavior was verified with API Key as the non-client-forwarded mode, matching the PR's regression test. The backend root cause was not isolated in this test

Type

🆕 New Feature

Changes

Adds a per-server "Gateway-hosted sign-in (DCR bridge)" toggle to the MCP server create and edit forms, surfacing the dcr_bridge flag from #32745. The toggle renders only for the client-forwarded token modes (true_passthrough and oauth_delegate) via the existing isClientForwardedTokenMode helper, and is a self-gating component that renders nothing for any other auth type

On create the toggle defaults on, so an admin onboarding a client-forwarded server gets the DCR front door without extra steps; on edit it initializes from the server's stored value, so a server saved before this flag existed shows it off. In both forms the submitted payload carries an explicit boolean only when the field is shown, and forces false for any other auth type so a stale true is never persisted, matching the sibling delegate_auth_to_upstream and oauth_passthrough flags right next to it. This sidesteps the antd onFinish mounted-fields-only behavior by building the value from the submitted auth type rather than relying on the form store

A follow-up commit moves the toggle inside the browser-only authorize box, after the OAuth client ID and secret fields and just before the Authorize & Fetch Tools button, in both the create and edit forms; DOM-order regression tests in both suites pin that placement. The box copy now labels the OAuth client fields as plain (optional), since an unqualified form field reads as persisted; the previous not-saved qualifier is gone, the intro explains that a configured OAuth app is stored with the server, and the client ID hint keeps the original one-sentence note about upstreams without dynamic client registration, dropping only the stale browser-only clause. The intro matches #32752 (the dashboard-side persistence fix); #32752 should merge first since it is the change that actually persists those fields

The DcrBridgeToggle component mirrors the existing TruePassthroughWarning / PassthroughAuthorizeSection idiom (self-gate, then render), the type addition matches the neighboring optional fields, and the tests assert the render gating for each auth type, the create default, the edit initialization from stored value, and the exact payload key presence and value across mode switches

Link to Devin session: https://app.devin.ai/sessions/f03da2725ec94d28b3facf766871b102

[greptile-apps]

Greptile Summary

Adds a "Gateway-hosted sign-in (DCR bridge)" toggle to the MCP server create and edit forms, surfacing the dcr_bridge backend flag introduced in #32745. The toggle is self-gated to the two client-forwarded auth modes (true_passthrough / oauth_delegate) and is absent for all other auth types.

• DcrBridgeToggle is a new self-gating component that mirrors the existing TruePassthroughWarning / PassthroughAuthorizeSection idiom; it renders inside the authorize box between the OAuth client secret field and the Authorize button.
• Create form defaults the toggle on via dcrBridgeInitialChecked={true}; the submit handler forces an explicit false for all non-client-forwarded auth types to prevent a stale true from being persisted if the mode is later switched.
• Edit form seeds the toggle from Form initialValues (Boolean(mcpServer.dcr_bridge)) and applies the same force-false guard on submit; the ?? mcpServer.dcr_bridge fallback in the submit handler provides an extra safety net if the field drops from the form store.
• Both forms include comprehensive test suites asserting render gating per auth type, default/stored-value initialization, explicit true/false on save, DOM order, and force-false when switching away from a client-forwarded mode.

Confidence Score: 5/5

This is a UI-only change adding a single boolean toggle to two forms; it cannot affect backend behavior beyond what the admin explicitly submits.

The change is well-scoped: a new self-gating component wired into two existing forms with explicit force-false guards on submit for all non-applicable auth types. Both forms have comprehensive test coverage across all auth-type branches, DOM-order assertions, and round-trip save scenarios. No existing tests were weakened.

No files require special attention.

Important Files Changed

Filename	Overview
ui/litellm-dashboard/src/components/mcp_tools/DcrBridgeToggle.tsx	New self-gating component that renders the DCR bridge Switch inside a Form.Item; correctly guards with isClientForwardedTokenMode and seeds via initialValue.
ui/litellm-dashboard/src/components/mcp_tools/PassthroughAuthorizeSection.tsx	Adds dcrBridgeInitialChecked prop and inserts DcrBridgeToggle after the OAuth secret field; label copy updated to remove 'saved' qualifier (intentionally paired with PR #32752).
ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.tsx	Extracts dcr_bridge from form values and forces it explicitly true/false at submit time; passes dcrBridgeInitialChecked={true} to PassthroughAuthorizeSection so create defaults on.
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.tsx	Seeds dcr_bridge via Form initialValues from the stored Boolean; submit handler mirrors the delegate_auth_to_upstream/oauth_passthrough force-false pattern for non-client-forwarded modes.
ui/litellm-dashboard/src/components/mcp_tools/types.tsx	Adds dcr_bridge?: boolean
ui/litellm-dashboard/src/components/mcp_tools/create_mcp_server.test.tsx	Adds a full test suite covering toggle visibility per auth type, default-on create, explicit false on uncheck, force-false on mode switch, and DOM order; label text assertions updated to match the new copy.
ui/litellm-dashboard/src/components/mcp_tools/mcp_server_edit.test.tsx	Adds edit-form test suite covering stored-true/stored-null init, uncheck-then-save, force-false on auth type switch, and value preservation across client-forwarded mode switches.

_{Reviews (5): Last reviewed commit: "Merge branch 'litellm_internal_staging' ..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_lit4337_dcr_bridge_ui (f3bfafe) with litellm_internal_staging (a4199d3)}

[devin-ai-integration]

Re-tested the DCR bridge toggle end-to-end on PR head 8b8a28848cb57811751ea9671c9214b1f30cfe56, after the toggle moved into the browser-only authorize box and the OAuth client-field labels changed to plain (optional). Ran against a live PostgreSQL-backed proxy on port 4000 with the dashboard on port 3000

The toggle now renders inside the bordered authorize box, between OAuth Client Secret and the Authorize & Fetch Tools button. All toggle behavior still passes.

Stored true	Stored false after round-trip

Runtime assertions (re-run on 8b8a288)

• Passed: create defaults the toggle on only for True Passthrough and OAuth Delegate; hidden for API Key
• Passed: edit reads both stored boolean values (aria-checked matched the API for stored-true and stored-false)
• Passed: UI/API round-trip persisted false -> true -> false in the new location (API confirmed dcr_bridge=true then dcr_bridge=false)
• Passed: toggle sits inside the authorize box between OAuth Client Secret and Authorize & Fetch Tools; OAuth client fields read plain (optional)

Method

Each change was saved through the dashboard, reopened after save, and cross-checked with GET /v1/mcp/server/<id>. Full description screenshots (before merge-base 34602ff627 vs after 8b8a28848c) are in the PR body.

Devin session: https://app.devin.ai/sessions/f03da2725ec94d28b3facf766871b102

[tin-berri]

@greptileai

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[tin-berri]

@greptileai

[tin-berri]

@greptileai

[ryan-crabbe-berri]

lgtm

[tin-berri]

@greptileai rereview

[tin-berri]

bugbut run