docs(mcp): document the internal user as an MCP entitlement level - #710
Open
yassin-berriai wants to merge 1 commit into
Open
docs(mcp): document the internal user as an MCP entitlement level#710yassin-berriai wants to merge 1 commit into
yassin-berriai wants to merge 1 commit into
Conversation
MCP entitlements could be attached to a key, a team, an end user, an agent or an organization, but never to the human. The permission hierarchy is now six levels: add the internal user row and flowchart node, and a worked example of an admin granting one person a tool subset via /user/update with the /v2/user/info read-back. Also notes the two things that are easy to get wrong: only a proxy admin may set the entitlement, and an admin-role caller without an explicit key-level mcp_servers list stops seeing the whole registry once they carry an entitlement of their own. Sweeps the stale five-level claim on the auth overview page.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Merged
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TLDR
Documents the internal user as an MCP entitlement level, which is what BerriAI/litellm#35146 adds
The permission hierarchy page said "five distinct levels" and listed the entities that can carry
mcp_tool_permissionsas "the key, team, end-user, agent, or organization". Neither included the human, because until now nothing didChanges
docs/mcp_control.mdgains the Internal user row in the permission-hierarchy table and the matching node in the flowchart, both placed between Agent and Organization to match the resolution order. The per-entity tool-level section gains the human alongside the other principals and a worked example: an admin setting a person's tool subset with/user/update, the/v2/user/inforead-back, the refusal text a call outside the entitlement gets, and an Admin UI screenshot of the new section on the internal user page. Two notes go with it: only a proxy admin may set the entitlement, and a human's own entitlement binds them even when their role would otherwise hand them the whole server registrydocs/auth_overview.mdanddocs/mcp_tool_search.mdeach carried the same now-stale enumeration of the levels; both are correctedMerge order
Merge after BerriAI/litellm#35146, or alongside it. The behavior these pages describe does not exist before that PR