@acarmisc/backstage-plugin-litellm-backend 0.24.0 → 0.25.0

package/dist/index.cjs.js

@@ -7982,20 +7982,20 @@ __export(index_exports, {
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common12.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common12.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common12.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common12.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common12.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common12.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common12.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common13.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common13.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common13.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common13.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common13.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common13.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common13.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common12.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common12.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common13.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common13.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common13.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
@@ -9167,7 +9167,7 @@ async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth,
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -10068,7 +10068,7 @@ function registerConfigRoutes(router, ctx) {
 }
 
 // src/routes/keys.ts
-var import_backstage_plugin_litellm_common3 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common4 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/services/modelAccess.ts
 var import_backstage_plugin_litellm_common2 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -10090,6 +10090,18 @@ async function findDisallowedModels(client, requested, allowed) {
   );
 }
 
+// src/services/mcpAccess.ts
+var import_backstage_plugin_litellm_common3 = require("@acarmisc/backstage-plugin-litellm-common");
+var NO_MCP_SERVERS = "no-mcp-servers";
+function teamMcpServers(team) {
+  const listed = team?.object_permission?.mcp_servers ?? [];
+  return [...new Set(listed)].filter((n) => import_backstage_plugin_litellm_common3.MCP_SERVER_NAME_RE.test(n));
+}
+function findDisallowedMcpServers(requested, allowed) {
+  const ok = new Set(allowed);
+  return [...new Set(requested)].filter((n) => !ok.has(n));
+}
+
 // src/services/keyService.ts
 var KeyServiceError = class extends Error {
   constructor(status, body, message2) {
@@ -10131,10 +10143,12 @@ async function createKeyForUser(user, input, ctx) {
       );
     }
   }
+  let teamPromise;
+  const getTeam = (teamId) => teamPromise ??= client.getTeamInfo(teamId);
   if (input.models && input.models.length > 0) {
     let allowedModels = [];
     if (input.team_id) {
-      const teamInfo = await client.getTeamInfo(input.team_id);
+      const teamInfo = await getTeam(input.team_id);
       allowedModels = teamInfo?.models ?? [];
     } else {
       allowedModels = userInfo?.models ?? [];
@@ -10167,6 +10181,19 @@ async function createKeyForUser(user, input, ctx) {
     ...clientMetadata,
     ...serverMetadata
   };
+  const mcpServers = input.mcp_servers ? [...new Set(input.mcp_servers)] : void 0;
+  if (mcpServers && mcpServers.length > 0) {
+    if (!input.team_id) {
+      throw new KeyServiceError(400, { error: "team_id is required when mcp_servers is set" });
+    }
+    const disallowed = findDisallowedMcpServers(mcpServers, teamMcpServers(await getTeam(input.team_id)));
+    if (disallowed.length > 0) {
+      throw new KeyServiceError(403, {
+        error: "One or more requested MCP servers are not allowed",
+        disallowed_mcp_servers: disallowed
+      });
+    }
+  }
   const upstreamRequest = {
     alias: input.alias,
     user_id: userInfo.user_id
@@ -10195,6 +10222,11 @@ async function createKeyForUser(user, input, ctx) {
   if (input.key_type !== void 0) {
     upstreamRequest.key_type = input.key_type;
   }
+  if (mcpServers) {
+    upstreamRequest.object_permission = {
+      mcp_servers: mcpServers.length > 0 ? mcpServers : [NO_MCP_SERVERS]
+    };
+  }
   upstreamRequest.metadata = enrichedMetadata;
   const result = await client.generateKey(upstreamRequest);
   logger.info("key.generate", { userId: userInfo.user_id, keyAlias: input.alias });
@@ -10217,8 +10249,8 @@ function registerKeysRoutes(router, ctx) {
     assertPermission,
     sendPermissionDenied
   } = ctx;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common3.createGenerateKeyInputSchema)(keyValidationConfig);
-  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common3.createUpdateKeyInputSchema)(keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createGenerateKeyInputSchema)(keyValidationConfig);
+  const updateKeyInputSchema = (0, import_backstage_plugin_litellm_common4.createUpdateKeyInputSchema)(keyValidationConfig);
   router.get("/user/info", async (_req, res) => {
     try {
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10255,8 +10287,8 @@ function registerKeysRoutes(router, ctx) {
   });
   router.post("/keys/prune-expired", async (_req, res) => {
     try {
-      if (!await assertPermission(_req, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
+      if (!await assertPermission(_req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
         return;
       }
       await getProvisionedUser(ctx, res);
@@ -10320,8 +10352,8 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const input = parseResult.data;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
@@ -10370,8 +10402,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, userId, key } = await authorizeKeyAction(req, keyId);
@@ -10448,8 +10480,8 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyRevokePermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10463,8 +10495,8 @@ function registerKeysRoutes(router, ctx) {
   router.post("/keys/:keyId/block", async (req, res) => {
     try {
       const { keyId } = req.params;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyManagePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyManagePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyManagePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyManagePermission);
         return;
       }
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
@@ -10492,8 +10524,8 @@ function registerKeysRoutes(router, ctx) {
     try {
       const { keyId } = req.params;
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyUnblockPermission);
         return;
       }
       await client.unblockKey(keyId);
@@ -10521,8 +10553,8 @@ function registerKeysRoutes(router, ctx) {
         });
         return;
       }
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyResetSpendPermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyResetSpendPermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyResetSpendPermission);
         return;
       }
       const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
@@ -10554,8 +10586,8 @@ function registerKeysRoutes(router, ctx) {
       res.status(403).json({ error: "Access denied: not a member of the audit group" });
       return;
     }
-    if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmAuditReadPermission)) {
-      sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmAuditReadPermission);
+    if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmAuditReadPermission)) {
+      sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmAuditReadPermission);
       return;
     }
     try {
@@ -10607,7 +10639,7 @@ function registerKeysRoutes(router, ctx) {
 }
 
 // src/routes/opencode.ts
-var import_backstage_plugin_litellm_common4 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
 function isValidRedirectUri(uri) {
   if (!uri) return false;
   try {
@@ -10649,8 +10681,8 @@ function registerOpencodeRoutes(router, ctx) {
         return null;
       }
       const redirectUri = redirectUriParam;
-      if (!await assertPermission(req, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission)) {
-        sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common5.litellmKeyCreatePermission);
         return null;
       }
       const computedUserId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
@@ -10818,7 +10850,7 @@ function registerOpencodeRoutes(router, ctx) {
 }
 
 // src/routes/teams.ts
-var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
 function respondTeam(res, team, ctx, caller) {
@@ -10913,7 +10945,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common5.litellmTeamCreatePermission,
+      permission: import_backstage_plugin_litellm_common6.litellmTeamCreatePermission,
       logger
     });
     if (!check.ok) {
@@ -10987,7 +11019,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common5.litellmTeamManagePermission
+      import_backstage_plugin_litellm_common6.litellmTeamManagePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor, team: existing } = authz;
@@ -11028,7 +11060,7 @@ function registerTeamsRoutes(router, ctx) {
     const authz = await authorizeTeamSubresource(
       req,
       res,
-      import_backstage_plugin_litellm_common5.litellmTeamDeletePermission
+      import_backstage_plugin_litellm_common6.litellmTeamDeletePermission
     );
     if (!authz) return;
     const { teamId, owningGroup, actor } = authz;
@@ -11069,7 +11101,7 @@ function registerTeamsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common5.litellmTeamManagePermission,
+      permission: import_backstage_plugin_litellm_common6.litellmTeamManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11092,7 +11124,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11197,7 +11229,7 @@ function registerTeamsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        import_backstage_plugin_litellm_common6.litellmTeamMembersManagePermission,
         { allowTeamRole: true }
       );
       if (!authz) return;
@@ -11245,7 +11277,7 @@ function registerTeamsRoutes(router, ctx) {
 }
 
 // src/routes/objectPermissions.ts
-var import_backstage_plugin_litellm_common6 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerObjectPermissionsRoutes(router, ctx) {
   const {
     client,
@@ -11270,7 +11302,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamKnowledgebaseManagePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11292,7 +11324,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamKnowledgebaseManagePermission
+        import_backstage_plugin_litellm_common7.litellmTeamKnowledgebaseManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11352,7 +11384,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       permissions,
       catalogClient,
       teamAdminGroup: teamAdminCfg.group,
-      permission: import_backstage_plugin_litellm_common6.litellmTeamMcpManagePermission,
+      permission: import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission,
       logger
     });
     if (!check.ok) {
@@ -11374,7 +11406,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
       const authz = await authorizeTeamSubresource(
         req,
         res,
-        import_backstage_plugin_litellm_common6.litellmTeamMcpManagePermission
+        import_backstage_plugin_litellm_common7.litellmTeamMcpManagePermission
       );
       if (!authz) return;
       const { teamId, owningGroup, actor, team } = authz;
@@ -11427,7 +11459,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
 }
 
 // src/routes/teamUsage.ts
-var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerTeamUsageRoutes(router, ctx) {
   const {
     client,
@@ -11525,7 +11557,7 @@ function registerTeamUsageRoutes(router, ctx) {
       }
       const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
       const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
-      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common7.litellmTeamUsageReadPermission);
+      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
       if (!allowed) {
         res.status(403).json({
           error: "Access denied: viewing per-member usage needs a team role or permission"
@@ -13306,8 +13338,8 @@ async function bridgeListKeys(client, claims, provisioningEnabled, provisioningD
 }
 
 // src/routes/bridge.ts
-var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -13320,7 +13352,7 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common9.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common10.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -13481,11 +13513,37 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         }
         const team = await client.getTeamInfo(teamId);
         const allowed = team.models;
-        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common8.ALL_PROXY_MODELS)) {
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common9.ALL_PROXY_MODELS)) {
           res.json(models);
           return;
         }
-        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common8.isModelAllowed)(m, allowed)));
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common9.isModelAllowed)(m, allowed)));
+      } catch (error) {
+        handleBridgeError(error, res);
+      }
+    });
+    router.get("/bridge/mcp", async (req, res) => {
+      try {
+        const claims = await requireClaims(req);
+        const teamId = typeof req.query.team_id === "string" ? req.query.team_id : "";
+        if (!teamId) {
+          res.status(400).json({ error: "team_id is required" });
+          return;
+        }
+        const user = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
+        if (!(user.teams ?? []).includes(teamId)) {
+          res.status(403).json({ error: "Access denied: team is not one of your teams", team_id: teamId });
+          return;
+        }
+        const names = teamMcpServers(await client.getTeamInfo(teamId));
+        res.json(names.map((server_name) => ({ server_name })));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -13517,13 +13575,13 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
     maxRpm: keyMaxRpm,
     allowedDurations: keyAllowedDurations,
-    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_BUDGET_DURATIONS
+    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common11.DEFAULT_KEY_BUDGET_DURATIONS
   };
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
@@ -13736,10 +13794,11 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
 var BRIDGE_UNAUTHENTICATED_PATHS = [
   "/bridge/health",
   "/bridge/keys",
+  "/bridge/mcp",
   "/bridge/models",
   "/bridge/user/info"
 ];
@@ -13765,7 +13824,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common11.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common12.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13785,7 +13844,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common13 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,