# [Security] MCP Server `_probe_upstream_auth` — SSRF + Fail-Open Auth Bypass

## Summary The MCP Server's `_probe_upstream_auth()` function in `server.py` makes HTTP POST requests to user-configured MCP server URLs **without SSRF protection** (uses raw `client.post()` instead of `async_safe_get()`). Additionally, the function **fails open** on network errors — returning `(200, None)` which allows the request through without auth verification. This creates both an SSRF vector and an authentication bypass.

## Affected Component - **File**: `litellm/proxy/_experimental/mcp_server/server.py` - **Function**: `_probe_upstream_auth()` (line 3864) - **Caller**: `_check_passthrough_upstream_auth()` (line ~3920), called during MCP request routing

## Root Cause

### Issue 1: SSRF ```python # server.py line 3888-3889 client = get_async_httpx_client( llm_provider=httpxSpecialProvider.MCP, params={"timeout": timeout}, ) # ... resp = await client.post( # ← raw HTTP, no SSRF protection url=url, # ← user-configured MCP server URL headers=probe_headers, json=probe_payload, timeout=timeout, ) ```

The `url` parameter comes from `mcp_server.url` which …