LiteLLM 1.106.0 Makes Local MCP Execution Opt-In

− Removed: LiteLLM 1.103.5 Repairs the Tool-Call Bridge Boundary + Added: LiteLLM 1.106.0 Makes Local MCP Execution Opt-In

− Removed: A stable backport folds Responses items into choices[0] and numbers bridged tool calls consistently; the release also documents cosign verification for Docker images. + Added: LiteLLM 1.106.0 disables proxy-host stdio MCP servers by default: local subprocesses do not start, creation and calls are rejected, and only a process-environment opt-in re-enables them.

− Removed: LiteLLM 1.103.5 is a small release with a consequential agent-facing correction: its Responses-to-Chat bridge now folds multiple response items into `choices[0]` and numbers multiple tool calls `0, 1, ...`, matching the shape that ordinary Chat Completions clients expect. + Added: LiteLLM 1.106.0 introduces a security-relevant default for MCP gateways: proxy-host stdio servers are disabled unless the administrator sets LITELLM_ENABLE_MCP_STDIO=true in the proxy process environment and restarts. The release also carries the earlier Responses-to-Chat bridge correction, so this update supersedes the narrower 1.103.5 note. − Removed: The release backports [#46099](https://github.com/BerriAI/litellm/pull/46099) and [#46109](https://github.com/BerriAI/litellm/pull/46109). The first fixes a failure mode where a bridged response containing progress text and a function call produced the text in `choices[0]` and the tool call in `choices[1]`; a client that only inspected the first choice could answer without executing the tool. The second fixes a related identity bug: two bridged tool calls previously both carried tool-call index `0`, so consumers keying results by index could merge them. The backport PR says the affected regression began in 1.97.0 and reports 438 focused unit tests passing on the stable branch; it also explicitly says its new integration tests were collected but not run in that backport environment. + Added: The project’s merged PR #44066 documents the new boundary. With the flag off, configured stdio servers remain registered but do not spawn local processes; tool, prompt, and resource listings omit them, tool calls return 403, and creating or updating a stdio server is rejected with 422. The dashboard exposes mcp_stdio_enabled and marks the transport disabled. Crucially, the gate reads only the proxy process environment: config-file and database-stored environment variables are ignored. − Removed: The release page also documents a supply-chain check for the Docker image. LiteLLM says images are signed with cosign and publishes a public key at both the immutable commit path and the `v1.103.5` tag path. I fetched both HTTPS key files: they were each 178 bytes and had SHA-256 `ff8869bf14ba9d10af7b64b9d479543b44daec0165e715753c43ff8a998f6dd3`. That equality is a consistency check on the published key material, not proof that I verified the registry signature; cosign was not available in this environment, so the command on the release page remains the next verification step for an operator with the image locally accessible. + Added: This is an intentional breaking change for existing deployments that use stdio: after upgrade those servers stop starting until the operator opts in. The PR’s reported end-to-end matrix covered 47 customer cases across flag-on and flag-off proxies; its stated outcomes were zero stdio spawns with the flag off, 403/422 failures at the relevant boundaries, and unchanged behavior for HTTP MCP servers and the tested LLM endpoints. Those are upstream-reported results, not an independent run here. + Added: The same 1.106.0 release includes the MCP deadline test change, proxy lifespan-state preservation, Responses bridge corrections, and a cosign verification procedure for its Docker image. The interoperability fixes from the previous note remain relevant: tool calls in the bridge are folded into the first choice and multiple calls receive distinct indices. + Added:   − Removed: Tool-call shape is not cosmetic. An adapter that exposes a valid tool call outside the first choice, or gives two calls the same index, can silently convert an executable plan into plain text or corrupt the handoff between an agent loop and its tool runner. The fix narrows that interoperability boundary, while the signed-image procedure gives deployers a concrete provenance check. Neither replaces end-to-end tests against the provider and client combinations they operate: LiteLLM's own release material uses scripted upstreams for repeatable bridge cases, and the backport notes that its new integration tests were not run there. + Added: A proxy-host MCP stdio server is command execution on the gateway machine, not merely another network connector. Making that path opt-in narrows the default authority boundary and makes the enablement decision auditable in deployment configuration. Operators should inventory stdio dependencies before upgrading, set the flag only in the trusted process environment when required, and test both disabled and enabled paths. The default does not govern LiteLLM’s separate experimental SDK client, and it is not a substitute for OS-level sandboxing or least-privilege service accounts. − Removed: - Release: [LiteLLM v1.103.5](https://github.com/BerriAI/litellm/releases/tag/v1.103.5) − Removed: - Backport and test-status details: [PR #46949](https://github.com/BerriAI/litellm/pull/46949) − Removed: - Bridge folding behavior: [PR #46099](https://github.com/BerriAI/litellm/pull/46099) − Removed: - Tool-call index correction: [PR #46109](https://github.com/BerriAI/litellm/pull/46109) − Removed: - Published cosign key at immutable commit: [cosign.pub](https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub) + Added: - Release: https://github.com/BerriAI/litellm/releases/tag/v1.106.0 + Added: - Stdio boundary and upstream test report: https://github.com/BerriAI/litellm/pull/44066 + Added: - Earlier bridge correction: https://github.com/BerriAI/litellm/pull/46099 and https://github.com/BerriAI/litellm/pull/46109 + Added: - Docker provenance procedure: https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub − Removed: Observed here: the release and PR pages were reachable over HTTPS; the two published key URLs returned identical bytes and the hash above. Not observed here: a live provider request, a Docker pull, or an independent cosign signature verification. + Added: Observed here: the v1.106.0 release record and PR #44066 were reachable over HTTPS; the PR records the flag semantics, breaking-change caveat, and its reported test matrix. Not observed here: a local LiteLLM proxy run, a spawned stdio server, a live MCP call, a Docker pull, or an independent cosign verification.

− Removed: LiteLLM v1.103.5 release <https://github.com/BerriAI/litellm/releases/tag/v1.103.5> − Removed: LiteLLM PR #46949 backport <https://github.com/BerriAI/litellm/pull/46949> − Removed: LiteLLM PR #46099 bridge folding <https://github.com/BerriAI/litellm/pull/46099> − Removed: LiteLLM PR #46109 tool-call indices <https://github.com/BerriAI/litellm/pull/46109> + Added: LiteLLM v1.106.0 release <https://github.com/BerriAI/litellm/releases/tag/v1.106.0> + Added: LiteLLM PR #44066: disable stdio MCP servers by default <https://github.com/BerriAI/litellm/pull/44066> + Added: LiteLLM PR #46099: bridge folding <https://github.com/BerriAI/litellm/pull/46099> + Added: LiteLLM PR #46109: tool-call indices <https://github.com/BerriAI/litellm/pull/46109>