@acarmisc/backstage-plugin-litellm-backend 0.23.0 → 0.25.0

package/dist/index.cjs.js

@@ -7982,20 +7982,20 @@ __export(index_exports, {
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common12.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common12.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common12.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common12.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common12.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common12.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common12.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common13.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common13.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common13.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common13.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common13.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common13.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common13.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common12.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common12.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common13.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common13.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
@@ -8691,25 +8691,33 @@ var LiteLLMClient = class {
     return this.normalizeSpendLogs(raw, page, pageSize);
   }
   normalizeSpendLogs(raw, page, pageSize) {
-    const rows = Array.isArray(raw) ? raw : Array.isArray(raw?.data) ? raw.data : Array.isArray(raw?.results) ? raw.results : Array.isArray(raw?.logs) ? raw.logs : [];
-    const toNum = (v, fallback = 0) => {
-      const n = typeof v === "number" ? v : typeof v === "string" && v.trim() !== "" ? Number(v) : NaN;
-      return Number.isFinite(n) ? n : fallback;
+    const rows = [];
+    if (Array.isArray(raw)) rows.push(...raw);
+    else if (Array.isArray(raw?.data)) rows.push(...raw.data);
+    else if (Array.isArray(raw?.results)) rows.push(...raw.results);
+    else if (Array.isArray(raw?.logs)) rows.push(...raw.logs);
+    const toNum2 = (v, fallback = 0) => {
+      if (typeof v === "number") return Number.isFinite(v) ? v : fallback;
+      if (typeof v === "string" && v.trim() !== "") {
+        const n = Number(v);
+        return Number.isFinite(n) ? n : fallback;
+      }
+      return fallback;
     };
     const data = rows.map((r) => {
-      const promptTokens = toNum(
+      const promptTokens = toNum2(
         r?.prompt_tokens ?? r?.promptTokens ?? r?.input_tokens
       );
-      const completionTokens = toNum(
+      const completionTokens = toNum2(
         r?.completion_tokens ?? r?.completionTokens ?? r?.output_tokens
       );
       return {
         requestId: String(r?.request_id ?? r?.requestId ?? r?.id ?? ""),
         model: String(r?.model ?? r?.model_name ?? ""),
-        spend: toNum(r?.spend ?? r?.cost),
+        spend: toNum2(r?.spend ?? r?.cost),
         promptTokens,
         completionTokens,
-        totalTokens: toNum(
+        totalTokens: toNum2(
           r?.total_tokens ?? r?.totalTokens,
           promptTokens + completionTokens
         ),
@@ -8725,7 +8733,7 @@ var LiteLLMClient = class {
     });
     return {
       data,
-      total: toNum(raw?.total ?? raw?.total_count, data.length),
+      total: toNum2(raw?.total ?? raw?.total_count, data.length),
       page,
       pageSize,
       truncated: data.length >= pageSize
@@ -9159,7 +9167,7 @@ async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth,
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -9522,6 +9530,21 @@ function redactTeamMemberUsage(usage) {
   };
 }
 
+// src/langfuse.ts
+function readLangfuseConfig(config) {
+  const enabled = config.getOptionalBoolean("litellm.langfuse.enabled") ?? false;
+  return {
+    enabled,
+    baseUrl: config.getOptionalString("litellm.langfuse.baseUrl") ?? null,
+    publicKey: config.getOptionalString("litellm.langfuse.publicKey") ?? null,
+    secretKey: config.getOptionalString("litellm.langfuse.secretKey") ?? null,
+    userIdField: config.getOptionalString("litellm.langfuse.userIdField") ?? "userId"
+  };
+}
+function isLangfuseConfigured(cfg) {
+  return cfg.enabled && !!cfg.baseUrl && !!cfg.publicKey && !!cfg.secretKey;
+}
+
 // src/routes/middleware/withUser.ts
 function createRequireUser(ctx) {
   return async (req, res, next) => {
@@ -10045,7 +10068,7 @@ function registerConfigRoutes(router, ctx) {
 }
 
 // src/routes/keys.ts
-var import_backstage_plugin_litellm_common3 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common4 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/services/modelAccess.ts
 var import_backstage_plugin_litellm_common2 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -10067,6 +10090,18 @@ async function findDisallowedModels(client, requested, allowed) {
   );
 }
 
+// src/services/mcpAccess.ts
+var import_backstage_plugin_litellm_common3 = require("@acarmisc/backstage-plugin-litellm-common");
+var NO_MCP_SERVERS = "no-mcp-servers";
+function teamMcpServers(team) {
+  const listed = team?.object_permission?.mcp_servers ?? [];
+  return [...new Set(listed)].filter((n) => import_backstage_plugin_litellm_common3.MCP_SERVER_NAME_RE.test(n));
+}
+function findDisallowedMcpServers(requested, allowed) {
+  const ok = new Set(allowed);
+  return [...new Set(requested)].filter((n) => !ok.has(n));
+}
+
 // src/services/keyService.ts
 var KeyServiceError = class extends Error {
   constructor(status, body, message2) {
@@ -10108,10 +10143,12 @@ async function createKeyForUser(user, input, ctx) {
       );
     }
   }
+  let teamPromise;
+  const getTeam = (teamId) => teamPromise ??= client.getTeamInfo(teamId);
   if (input.models && input.models.length > 0) {
     let allowedModels = [];
     if (input.team_id) {
-      const teamInfo = await client.getTeamInfo(input.team_id);
+      const teamInfo = await getTeam(input.team_id);
       allowedModels = teamInfo?.models ?? [];
     } else {
       allowedModels = userInfo?.models ?? [];
@@ -10144,6 +10181,19 @@ async function createKeyForUser(user, input, ctx) {
     ...clientMetadata,
     ...serverMetadata
   };
+  const mcpServers = input.mcp_servers ? [...new Set(input.mcp_servers)] : void 0;
+  if (mcpServers && mcpServers.length > 0) {
+    if (!input.team_id) {
+      throw new KeyServiceError(400, { error: "team_id is required when mcp_servers is set" });
+    }
+    const disallowed = findDisallowedMcpServers(mcpServers, teamMcpServers(await getTeam(input.team_id)));
+    if (disallowed.length > 0) {
+      throw new KeyServiceError(403, {
+        error: "One or more requested MCP servers are not allowed",
+        disallowed_mcp_servers: disallowed
+      });
+    }
+  }
   const upstreamRequest = {
     alias: input.alias,
     user_id: userInfo.user_id
@@ -10172,6 +10222,11 @@ async function createKeyForUser(user, input, ctx) {
   if (input.key_type !== void 0) {
     upstreamRequest.key_type = input.key_type;
   }
+  if (mcpServers) {
+    upstreamRequest.object_permission = {
+      mcp_servers: mcpServers.length > 0 ? mcpServers : [NO_MCP_SERVERS]
+    };
+  }
   upstreamRequest.metadata = enrichedMetadata;
   const result = await client.generateKey(upstreamRequest);
   logger.info("key.generate", { userId: userInfo.user_id, keyAlias: input.alias });
@@ -10194,8 +10249,8 @@ function registerKeysRoutes(router, ctx) {
     assertPermission,
     sendPermissionDenied
   } = ctx;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common3.createGenerateKeyInputSchema)(keyValidationConfig);
-  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common3.createUpdateKeyInputSchema)(keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createGenerateKeyInputSchema)(keyValidationConfig);
+  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createUpdateKeyInputSchema)(keyValidationConfig);
   router.get("/user/info", async (_req, res) => {
     try {
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10232,8 +10287,8 @@ function registerKeysRoutes(router, ctx) {
   });
   router.post("/keys/prune-expired", async (_req, res) => {
     try {
-      if (!await assertPermission(_req, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
+      if (!await assertPermission(_req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
         return;
       }
       await getProvisionedUser(ctx, res);
@@ -10297,8 +10352,8 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const input = parseResult.data;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10347,8 +10402,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, userId, key } = await authorizeKeyAction(req, keyId);
@@ -10425,8 +10480,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10440,8 +10495,8 @@ function registerKeysRoutes(router, ctx) {
   router.post("/keys/:keyId/block", async (req, res) => {
     try {
       const { keyId } = req.params;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
@@ -10469,8 +10524,8 @@ function registerKeysRoutes(router, ctx) {
     try {
       const { keyId } = req.params;
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission);
         return;
       }
       await client.unblockKey(keyId);
@@ -10498,8 +10553,8 @@ function registerKeysRoutes(router, ctx) {
         });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyResetSpendPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyResetSpendPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10531,8 +10586,8 @@ function registerKeysRoutes(router, ctx) {
       res.status(403).json({ error: "Access denied: not a member of the audit group" });
       return;
     }
-    if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmAuditReadPermission)) {
-      sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmAuditReadPermission);
+    if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmAuditReadPermission)) {
+      sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmAuditReadPermission);
       return;
     }
     try {
@@ -10584,7 +10639,7 @@ function registerKeysRoutes(router, ctx) {
 }
 
 // src/routes/opencode.ts
-var import_backstage_plugin_litellm_common4 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
 function isValidRedirectUri(uri) {
   if (!uri) return false;
   try {
@@ -10626,8 +10681,8 @@ function registerOpencodeRoutes(router, ctx) {
         return null;
       }
       const redirectUri = redirectUriParam;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission);
         return null;
       }
       const computedUserId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
@@ -10795,7 +10850,7 @@ function registerOpencodeRoutes(router, ctx) {
 }
 
 // src/routes/teams.ts
-var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
 function respondTeam(res, team, ctx, caller) {
@@ -10890,7 +10945,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common5.litellmTeamCreatePermission,
+      permission: import_backstage_plugin_litellm_common6.litellmTeamCreatePermission,
       logger
     });
     if (!check.ok) {
@@ -10964,7 +11019,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common5.litellmTeamManagePermission
+      import_backstage_plugin_litellm_common6.litellmTeamManagePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor, team: existing } = authz;
@@ -11005,7 +11060,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common5.litellmTeamDeletePermission
+      import_backstage_plugin_litellm_common6.litellmTeamDeletePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor } = authz;
@@ -11046,7 +11101,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common5.litellmTeamManagePermission,
+      permission: import_backstage_plugin_litellm_common6.litellmTeamManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11069,7 +11124,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11174,7 +11229,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11222,7 +11277,7 @@ function registerTeamsRoutes(router, ctx) {
 }
 
 // src/routes/objectPermissions.ts
-var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerObjectPermissionsRoutes(router, ctx) {
   const {
     client,
@@ -11247,7 +11302,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamKnowledgebaseManagePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11269,7 +11324,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamKnowledgebaseManagePermission
+        import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11329,7 +11384,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamMcpManagePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11351,7 +11406,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamMcpManagePermission
+        import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11404,7 +11459,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
 }
 
 // src/routes/teamUsage.ts
-var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerTeamUsageRoutes(router, ctx) {
   const {
     client,
@@ -11502,7 +11557,7 @@ function registerTeamUsageRoutes(router, ctx) {
       }
       const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
       const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
-      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common7.litellmTeamUsageReadPermission);
+      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
       if (!allowed) {
         res.status(403).json({
           error: "Access denied: viewing per-member usage needs a team role or permission"
@@ -11558,6 +11613,143 @@ function registerTeamUsageRoutes(router, ctx) {
   }
 }
 
+// src/langfuseClient.ts
+var DEFAULT_TIMEOUT2 = 15e3;
+var LangfuseUpstreamError = class extends Error {
+  constructor(status, statusText) {
+    super(`Langfuse API error: ${status} ${statusText}`);
+    this.status = status;
+  }
+};
+async function queryMetrics(baseUrl, publicKey, secretKey, queryObj, timeout = DEFAULT_TIMEOUT2) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+  try {
+    const url = `${baseUrl.replace(/\/$/, "")}/api/public/v2/metrics?query=${encodeURIComponent(
+      JSON.stringify(queryObj)
+    )}`;
+    const response = await fetch(url, {
+      signal: controller.signal,
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${publicKey}:${secretKey}`).toString("base64")}`
+      }
+    });
+    if (!response.ok) {
+      throw new LangfuseUpstreamError(response.status, response.statusText);
+    }
+    return response.json();
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function toNum(v) {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null;
+  if (typeof v === "string" && v.trim() !== "") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+function pick(row, names) {
+  const scopes = [row, row?.metrics, row?.dimensions];
+  for (const scope of scopes) {
+    if (!scope || typeof scope !== "object") continue;
+    for (const name of names) {
+      const n = toNum(scope[name]);
+      if (n !== null) return n;
+    }
+  }
+  return null;
+}
+function pickText(row, names) {
+  const scopes = [row, row?.metrics, row?.dimensions];
+  for (const scope of scopes) {
+    if (!scope || typeof scope !== "object") continue;
+    for (const name of names) {
+      const v = scope[name];
+      if (typeof v === "string" && v) return v;
+    }
+  }
+  return null;
+}
+function metricRows(body) {
+  if (Array.isArray(body)) return body;
+  if (Array.isArray(body?.data)) return body.data;
+  if (Array.isArray(body?.results)) return body.results;
+  if (Array.isArray(body?.rows)) return body.rows;
+  return [];
+}
+function parseObservations(body) {
+  const byModel = metricRows(body).map((row) => ({
+    model: pickText(row, ["providedModelName", "model", "modelName"]) ?? "",
+    cost: pick(row, ["sum_totalCost", "totalCost", "sum_total_cost", "cost", "sum_cost"]) ?? 0,
+    tokens: pick(row, ["sum_totalTokens", "totalTokens", "sum_total_tokens", "tokens"]) ?? 0,
+    avgLatencyMs: pick(row, ["avg_latency", "latency", "avg_latency_ms", "latencyMs"]),
+    requests: pick(row, ["count_id", "count", "id_count", "requests", "observations"]) ?? 0
+  })).filter((r) => r.model !== "");
+  byModel.sort((a, b) => b.cost - a.cost);
+  return byModel;
+}
+function parseScores(body) {
+  const scores = metricRows(body).map((row) => ({
+    name: pickText(row, ["name", "scoreName"]) ?? "",
+    avg: pick(row, ["avg_value", "value", "avg"]) ?? NaN,
+    count: pick(row, ["count_id", "count", "id_count", "scores"]) ?? 0
+  })).filter((s) => s.name !== "" && Number.isFinite(s.avg));
+  scores.sort((a, b) => a.name.localeCompare(b.name));
+  return scores;
+}
+function toTimestamp(day2, endOfDay) {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(day2)) {
+    return endOfDay ? `${day2}T23:59:59.999Z` : `${day2}T00:00:00.000Z`;
+  }
+  return day2;
+}
+async function getQualitySummary(cfg, opts) {
+  if (!isLangfuseConfigured(cfg)) return null;
+  const { baseUrl, publicKey, secretKey, userIdField } = cfg;
+  const fromTimestamp = toTimestamp(opts.from, false);
+  const toTimestampValue = toTimestamp(opts.to, true);
+  try {
+    const observations = await queryMetrics(baseUrl, publicKey, secretKey, {
+      view: "observations",
+      metrics: [
+        { measure: "totalCost", aggregation: "SUM" },
+        { measure: "totalTokens", aggregation: "SUM" },
+        { measure: "latency", aggregation: "AVG" },
+        { measure: "id", aggregation: "COUNT" }
+      ],
+      dimensions: [{ field: "providedModelName" }],
+      filters: [
+        { column: userIdField, operator: "=", value: opts.userId, type: "string" }
+      ],
+      fromTimestamp,
+      toTimestamp: toTimestampValue,
+      config: { row_limit: 50 }
+    });
+    let scores = [];
+    try {
+      const scoresBody = await queryMetrics(baseUrl, publicKey, secretKey, {
+        view: "scores-numeric",
+        metrics: [
+          { measure: "value", aggregation: "AVG" },
+          { measure: "id", aggregation: "COUNT" }
+        ],
+        dimensions: [{ field: "name" }],
+        fromTimestamp,
+        toTimestamp: toTimestampValue,
+        config: { row_limit: 50 }
+      });
+      scores = parseScores(scoresBody);
+    } catch {
+      scores = [];
+    }
+    return { configured: true, byModel: parseObservations(observations), scores };
+  } catch {
+    return null;
+  }
+}
+
 // src/routes/insights.ts
 function registerInsightsRoutes(router, ctx) {
   const { client, catalogClient, auth, logger, auditGroup } = ctx;
@@ -11596,6 +11788,41 @@ function registerInsightsRoutes(router, ctx) {
       sendError(res, error, logger, "fetch spend logs");
     }
   });
+  router.get("/insights/quality", requireUser, async (req, res) => {
+    try {
+      const { start_date, end_date, userId } = req.query;
+      if (!start_date || !end_date) {
+        res.status(400).json({ error: "start_date and end_date are required" });
+        return;
+      }
+      const tokenEntityRef = res.locals.tokenEntityRef;
+      await getProvisionedUser(ctx, res);
+      const callerId = res.locals.userId;
+      const isAudit = auditGroup ? await isUserMemberOfGroup(
+        tokenEntityRef,
+        auditGroup,
+        catalogClient,
+        auth,
+        logger
+      ) : false;
+      if (!isLangfuseConfigured(ctx.langfuseCfg)) {
+        res.json({ configured: false });
+        return;
+      }
+      const summary = await getQualitySummary(ctx.langfuseCfg, {
+        from: start_date,
+        to: end_date,
+        userId: isAudit ? userId || callerId : callerId
+      });
+      res.json(summary ?? { configured: false });
+    } catch (error) {
+      if (error instanceof ProvisioningError) {
+        res.status(error.status).json(error.body);
+        return;
+      }
+      sendError(res, error, logger, "fetch quality summary");
+    }
+  });
 }
 
 // node_modules/jose/dist/node/esm/runtime/base64url.js
@@ -13111,8 +13338,8 @@ async function bridgeListKeys(client, claims, provisioningEnabled, provisioningD
 }
 
 // src/routes/bridge.ts
-var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -13125,7 +13352,7 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common9.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common10.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -13286,11 +13513,37 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         }
         const team = await client.getTeamInfo(teamId);
         const allowed = team.models;
-        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common8.ALL_PROXY_MODELS)) {
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common9.ALL_PROXY_MODELS)) {
           res.json(models);
           return;
         }
-        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common8.isModelAllowed)(m, allowed)));
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common9.isModelAllowed)(m, allowed)));
+      } catch (error) {
+        handleBridgeError(error, res);
+      }
+    });
+    router.get("/bridge/mcp", async (req, res) => {
+      try {
+        const claims = await requireClaims(req);
+        const teamId = typeof req.query.team_id === "string" ? req.query.team_id : "";
+        if (!teamId) {
+          res.status(400).json({ error: "team_id is required" });
+          return;
+        }
+        const user = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
+        if (!(user.teams ?? []).includes(teamId)) {
+          res.status(403).json({ error: "Access denied: team is not one of your teams", team_id: teamId });
+          return;
+        }
+        const names = teamMcpServers(await client.getTeamInfo(teamId));
+        res.json(names.map((server_name) => ({ server_name })));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -13322,13 +13575,13 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
     maxRpm: keyMaxRpm,
     allowedDurations: keyAllowedDurations,
-    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_BUDGET_DURATIONS
+    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_BUDGET_DURATIONS
   };
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
@@ -13336,6 +13589,7 @@ async function createRouter(options) {
   const teamBudgetVisibility = readTeamBudgetVisibility(config);
   const opencodeCfg = readOpencodeConfig(config);
   const memberBreakdownCfg = readMemberBreakdownConfig(config);
+  const langfuseCfg = readLangfuseConfig(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -13382,6 +13636,7 @@ async function createRouter(options) {
     teamBudgetVisibility,
     opencodeCfg,
     memberBreakdownCfg,
+    langfuseCfg,
     // Helper functions - defined inline below this object
     authorizeKeyAction: async (req, keyId) => {
       if (!req.res || !req.res.locals.tokenEntityRef || !req.res.locals.userId) {
@@ -13539,10 +13794,11 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
 var BRIDGE_UNAUTHENTICATED_PATHS = [
   "/bridge/health",
   "/bridge/keys",
+  "/bridge/mcp",
   "/bridge/models",
   "/bridge/user/info"
 ];
@@ -13568,7 +13824,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common11.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common12.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13588,7 +13844,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common13 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,