test(mcp): retire the last file of the dead tests/litellm mirror

[yuneng-berri]

TLDR

Problem this solves:

• tests/litellm/ is a mirror no job ever ran
• Its last file froze; 25 of 32 cases now fail
• An allowlist entry asked someone to decide its fate

How it solves it:

• Three of its five orphan behaviours are already covered better
• The other two get ported onto live mock conventions
• Delete the file, drop the allowlist entry

User Flow

No end-user behavior changes. A client hitting
https://litellm-domain/mcp/.well-known/oauth-protected-resource gets the same
response resolved the same way; this is test coverage around those endpoints,
not the endpoints

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• The handful of test files covering my change pass locally
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

Shared setup: is_request_from_trusted_proxy decides whether X-Forwarded-*
headers are believed. Cases 2 and 3 pin its two answers open in turn and ask the
suite whether it notices, which is the only way to tell ported coverage from
ported text.

G=litellm/proxy/auth/ip_address_utils.py
F=tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py
pin() { cp $G /tmp/gate.bak; python3 -c "
import pathlib;p=pathlib.Path('$G');s=p.read_text().splitlines(keepends=True);s.insert(141,'        return $1\n');p.write_text(''.join(s))"; }
unpin() { cp /tmp/gate.bak $G; }

Before (ff02d5c)

1. the second mirror against today's code

1. uv run pytest tests/litellm/ -q -p no:randomly | tail -1

25 failed, 7 passed, 1 warning in 3.76s

2. the trust gate pinned to always-trust

1. pin True; uv run pytest $F -q -p no:randomly -k validate_trusted_redirect_uri | tail -1; unpin

1 failed, 310 deselected, 2 warnings in 1.92s

3. the trust gate pinned to never-trust

1. pin False; uv run pytest $F -q -p no:randomly -k validate_trusted_redirect_uri | tail -1; unpin

1 passed, 310 deselected, 2 warnings in 1.90s

4. the live file

1. uv run pytest $F -q -p no:randomly | tail -1

311 passed, 6 warnings in 2.58s

After (13d4074)

1. the second mirror against today's code

1. uv run pytest tests/litellm/ -q -p no:randomly | tail -1

no tests ran in 0.01s

2. the trust gate pinned to always-trust

1. pin True; uv run pytest $F -q -p no:randomly -k validate_trusted_redirect_uri | tail -1; unpin

2 failed, 1 passed, 310 deselected, 2 warnings in 1.95s

3. the trust gate pinned to never-trust

1. pin False; uv run pytest $F -q -p no:randomly -k validate_trusted_redirect_uri | tail -1; unpin

1 failed, 2 passed, 310 deselected, 2 warnings in 2.02s

4. the live file

1. uv run pytest $F -q -p no:randomly | tail -1

313 passed, 6 warnings in 2.68s

Case 3 is the one that justifies porting rather than deleting. A gate that never
trusts anything survives the suite as it stands and is caught after

Type

🧹 Refactoring

✅ Test

Caveats (if any)

• Case 2 was already caught, so only the accept direction is new
• The five orphan behaviours were judged by name and by reading
• tests/integration, load_tests and vector_store_tests still run nowhere
• tests/litellm-proxy-extras runs nowhere and 4 of its 28 fail
• Touches test-quality-budget.json, as do test: drop the cwd-relative sys.path.insert calls from the test suite #37802, test: unwind environment writes in tests/test_litellm with monkeypatch #37806 and test(cost-calc): stop 182 global writes leaking out of the cost-calc suites #37815

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This PR retires the final unused tests/litellm/ mirror file and removes its coverage allowlist entry. It ports the remaining trusted-proxy redirect coverage into the live MCP test suite and ratchets the test-quality budget.

Confidence Score: 5/5

The PR appears safe to merge, with the retired mirror’s relevant coverage preserved in the active MCP test suite.

The added tests drive the production trusted-proxy decision in both directions using the exact settings and request fields read by the implementation, and no actionable regression was identified.

Important Files Changed

Filename	Overview
tests/test_litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py	Adds two live test cases that exercise both acceptance and rejection through the real forwarded-header trust gate.
tests/litellm/proxy/_experimental/mcp_server/test_discoverable_endpoints.py	Deletes the obsolete mirror after its unique valid trust-gate behavior is ported to the active suite and its other relevant behaviors are already covered there.
.github/ci-coverage-allowlist.yml	Removes the obsolete allowlist entry for the deleted mirror file.
test-quality-budget.json	Ratchets the TQ001 ceiling alongside the test cleanup; no concrete budget-gate failure was established.

_{Reviews (1): Last reviewed commit: "test(mcp): retire the last file of the d..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!