## Summary

When creating a virtual key (or team), leaving the `models` field empty (`[]` or unset) grants access to **all models on the proxy**. In contrast, leaving `object_permission.mcp_servers` empty grants access to **no MCP servers**. These opposite defaults create a security risk for models.

## Current Behavior

| Field | Empty/unset | Explicit list | |---|---|---| | `models` | **All models** (unlimited access) | Only listed models | | `object_permission.mcp_servers` | **No servers** (no access) | Only listed servers |

### How it works in the code

**Models** (`litellm/proxy/auth/model_checks.py:157-190`): ```python # Fallback chain: key models → team models → ALL proxy models if key_models: append_unique(key_models) elif team_models: append_unique(team_models) else: append_unique(proxy_model_list) # ← grants everything ```

And in `litellm/proxy/auth/auth_checks.py:2055`: ```python if (len(filtered_models) == 0 and len(models) == 0): all_model_access = True # ← empty = unlimited ```

**MCP servers** (`litellm/proxy/_experimental/mcp_server/db.py:199-232`): - Empty `object_permission.mcp_servers` → empty set → no access (least-privilege)

## Risk

A team…