[Fix] Pass MCP auth headers from request into tool fetch for /v1/responses and chat completions

[shivamrawat1]

Relevant issues

When calling /v1/responses or /chat/completions with MCP tools and auth sent via headers (e.g. x-mcp-linear_config-authorization: Bearer ), the model received an empty tools list. MCP servers that rely on dynamic auth from headers (e.g. Linear) returned no tools because auth was not forwarded to the tool fetch.

mcp_server_auth_headers were read from secret_fields via extract_mcp_headers_from_request, but were never passed into _process_mcp_tools_without_openai_transform. The tool fetch always used mcp_server_auth_headers=None, so MCP servers without auth_value in config (e.g. linear_config) got no auth and returned 0 tools.

Pre-Submission checklist

Before:

After:

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Type

🐛 Bug Fix
✅ Test

Changes

Extract MCP auth headers from secret_fields before fetching tools and pass mcp_auth_header and mcp_server_auth_headers into _process_mcp_tools_without_openai_transform in both litellm/responses/main.py (responses API) and litellm/responses/mcp/chat_completions_handler.py (chat completions). This applies to the initial tool fetch and to the auto-execute output-element fetch. The handler already supported these parameters; the missing step was wiring them through from the request.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 28, 2026 2:03am

[greptile-apps]

Greptile Summary

This PR fixes a bug where MCP auth headers sent via request headers (e.g. x-mcp-linear_config-authorization) were extracted from secret_fields but never forwarded to the tool-fetching functions. MCP servers relying on dynamic auth (like Linear) received no auth and returned an empty tools list.

• Wires mcp_auth_header and mcp_server_auth_headers through from extract_mcp_headers_from_request into _process_mcp_tools_without_openai_transform in both the responses API (main.py) and chat completions handler (chat_completions_handler.py)
• In chat_completions_handler.py, moves the extract_mcp_headers_from_request call to before the tool fetch (previously it was called after, so the extracted values were never used for fetching)
• Adds the mcp_auth_header and mcp_server_auth_headers parameters to _get_mcp_tools_from_manager and _process_mcp_tools_without_openai_transform in the handler class, passing them through to the underlying _get_tools_from_mcp_servers call
• Adds mock tests in both tests/test_litellm/ and tests/mcp_tests/ verifying the auth headers are correctly propagated

Confidence Score: 5/5

• This PR is safe to merge — it wires through existing parameters without changing control flow or adding new dependencies.
• The fix is minimal and well-scoped: it passes two already-extracted auth parameters through existing function signatures. No new logic, no database queries, no new dependencies. The changes are consistent across both code paths (responses API and chat completions). Tests validate the fix using mocks with no real network calls.
• No files require special attention.

Important Files Changed

Filename	Overview
litellm/responses/main.py	Extracts MCP auth headers from secret_fields and passes them to _process_mcp_tools_without_openai_transform for both the initial tool fetch and the auto-execute output-element fetch. Correctly guarded with isinstance check.
litellm/responses/mcp/chat_completions_handler.py	Moves extract_mcp_headers_from_request call before _process_mcp_tools_without_openai_transform so auth headers are available when fetching tools. The method handles None secret_fields safely.
litellm/responses/mcp/litellm_proxy_mcp_handler.py	Adds mcp_auth_header and mcp_server_auth_headers parameters to _get_mcp_tools_from_manager and _process_mcp_tools_without_openai_transform, wiring them through to _get_tools_from_mcp_servers.
tests/mcp_tests/test_aresponses_api_with_mcp.py	Adds a mock test verifying that MCP server auth headers from secret_fields are passed through to _process_mcp_tools_without_openai_transform in the responses API path.
tests/test_litellm/responses/mcp/test_chat_completions_handler.py	Adds a mock test verifying that MCP server auth headers from secret_fields are passed through to _process_mcp_tools_without_openai_transform in the chat completions handler path.

Sequence Diagram

sequenceDiagram
    participant Client
    participant ResponsesAPI as main.py / chat_completions_handler.py
    participant Utils as ResponsesAPIRequestUtils
    participant MCPHandler as LiteLLM_Proxy_MCP_Handler
    participant MCPServer as _get_tools_from_mcp_servers

    Client->>ResponsesAPI: Request with x-mcp-*-authorization headers
    ResponsesAPI->>Utils: extract_mcp_headers_from_request(secret_fields, tools)
    Utils-->>ResponsesAPI: mcp_auth_header, mcp_server_auth_headers
    ResponsesAPI->>MCPHandler: _process_mcp_tools_without_openai_transform(mcp_auth_header, mcp_server_auth_headers)
    MCPHandler->>MCPHandler: _get_mcp_tools_from_manager(mcp_auth_header, mcp_server_auth_headers)
    MCPHandler->>MCPServer: _get_tools_from_mcp_servers(mcp_auth_header, mcp_server_auth_headers)
    MCPServer-->>MCPHandler: MCP tools (now with auth)
    MCPHandler-->>ResponsesAPI: deduplicated tools, tool_server_map
    ResponsesAPI-->>Client: Response with discovered tools

Loading

_{Last reviewed commit: f3ee517}

[greptile-apps]

_{5 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[shivamrawat1]

@greptile re-review with the new commit that resolves Indentation bug breaks multi-server tool discovery concern