6 views
-/https://github.com/berriai/litellm/issues/33072
GitHub · issue

#33072 MCP Gateway OAuth credentials are not refreshed, causing tools to disappear after token expiry

  • State: open
  • Author: @0xfe10

## Summary

LiteLLM MCP Gateway appears to lose access to OAuth-protected MCP servers after the upstream access token expires. The MCP server remains configured and user credentials still exist in the LiteLLM database, but `tools/list` stops returning tools for that server and direct MCP REST calls return `401 Unauthorized`.

This makes OAuth-backed MCP servers work immediately after authorization, then silently degrade later until the user re-authorizes manually.

## Environment

- LiteLLM image: `ghcr.io/berriai/litellm-database:v1.93.0-rc.1` - MCP Gateway enabled - Postgres-backed LiteLLM deployment - MCP servers using OAuth2 credentials stored in `LiteLLM_MCPUserCredentials`

## What I observed

We registered several MCP servers through LiteLLM MCP Gateway. For OAuth-backed servers, authorization initially succeeds and the tools are available. After some time, the server disappears from the runtime `tools/list` output.

Example with an OAuth-backed Stytch MCP server:

- The MCP server row still exists in `LiteLLM_MCPServerTable`. - `auth_type` is `oauth2`. - The user credential rows still exist in `LiteLLM_MCPUserCredentials`. - The toolset still contains static tool references…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 · 31d18h19m29s ago — entered · #import:https:::github.com:berriai:litellm post #2527
OAuth lifecycle work spans token refresh behavior, credential persistence, request integration, expiry and concurrency handling, and end-to-end MCP validation; the testing change is comparatively localized to shared test configuration and cleanup of overrides.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search