18 views
-/https://github.com/berriai/litellm/issues/24709
GitHub · issue

#24709 MCP: health check skipped for OAuth2 M2M servers — always shows 'unknown'

  • State: open
  • Author: @madhu19991

## Bug Report

### Description

MCP servers configured with OAuth2 `client_credentials` (M2M) auth always show `status: "unknown"` because the health check is unconditionally skipped.

### Root Cause

In `mcp_server_manager.py` `health_check_server()` (around line 2663), the health check is skipped when: ```python elif ( server.auth_type and server.auth_type != MCPAuth.none and server.auth_type != MCPAuth.aws_sigv4 and not server.authentication_token ): should_skip_health_check = True ```

For M2M OAuth2 servers, `authentication_token` is always `None` — the token is fetched dynamically at request time via `client_id`/`client_secret`/`token_url`. So this condition always evaluates to `True` and the health check never runs.

### Expected Behavior

For OAuth2 M2M servers (where `token_url`, `client_id`, and `client_secret` are configured), the health check should fetch an OAuth2 token using the stored credentials and use it to perform the health check, similar to how `execute_mcp_tool` fetches tokens at request time.

### Actual Behavior

Health check is skipped entirely. Status remains `"unknown"` in both UI and API responses.

### Steps to Reproduce

1. Create a…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (9 events)
#0 of 0 · 31d19h13m50s ago — entered · #import:https:::github.com:berriai:litellm post #1660
The right issue is harder because it spans proxy log serialization, provider-specific schema normalization, and multiple Logs View UI rendering paths, requiring broader cross-layer testing. The left issue is comparatively localized to authentication-aware MCP health-check execution and targeted backend tests.
31881 spans multiple guardrail lifecycle paths, streaming state management, and configuration scoping, creating broader integration and regression risk; 24709 is comparatively localized to MCP authentication and health-check control flow.
The right issue is harder because it crosses authentication, token acquisition, health-check execution, error handling, and security-sensitive integration tests, while the left issue is comparatively localized response-field normalization and provider mapping.
Model omitted braces; inferred difficulty from issue scope and surface area.
24709 is harder because it requires integrating credential acquisition into the MCP health-check lifecycle, handling asynchronous authentication and failure modes, and preserving security-sensitive behavior across existing request flows. 30778 is comparatively contained propagation work across HTTP handler constructors, transport creation, retries, and focused regression tests.
The OAuth2 health-check issue is harder because it requires coordinating token acquisition, MCP health-check execution, authentication edge cases, and regression coverage; the other issue lacks enough detail to indicate comparable implementation scope.
Model omitted braces; inferred difficulty from issue scope and surface area.
OAuth2-aware MCP health checking requires integrating credential acquisition into an existing execution path, handling async/error/security behavior, and adding coverage across authentication configurations. The Bedrock issue is comparatively narrow metadata/configuration alignment with focused regression testing.
#0 of 0 · 31d18h1m39s ago — current · #import:https:::github.com:berriai:litellm post #2846
The right-side task is harder because it spans MCP health-check control flow, OAuth token acquisition, failure handling, and regression coverage, while the left-side task is a localized schema and request-construction change.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search