LiteLLM 1.106

Apply these rules to LiteLLM 1.106 SDK and proxy deployments, including its MCP gateway, Decisions API, agent harnesses, and trace ingestion. Route admission, upstream credentials, and application tool authorization each need their own check.

Artifact and service trust

• Use a security-supported CPython minor inside the package's declared >=3.10,<3.15 range. Inspect the actual PyPI and image artifacts separately, verify the image signature with the public key identified by its release, and deploy a reviewed digest. Refuse the withdrawn compromised LiteLLM 1.107.0 PyPI and container artifacts; if they ran, follow the project's incident response before returning the host to service.
• Supply a long random LITELLM_MASTER_KEY from protected runtime configuration; never enable the dangerous weak-key override. Give applications scoped virtual keys instead of the master key, and preserve LITELLM_SALT_KEY so stored provider and MCP credentials remain recoverable during planned rotation.
• Keep migration checks enabled and fail startup on database setup errors. Separate migration and runtime privileges; protect Postgres, Redis, and ClickHouse trace storage with authenticated network access and limited accounts.

Identity and session access

• Issue expiring keys with narrow models, allowed_routes, team_id, object_permission, budget, and rate limits. Empty model lists and * are broad grants; a proxy-admin key is inappropriate for tenant inference. Test effective permissions after alias resolution and on native provider, MCP, file, RAG, and management routes.