LiteLLM 1.97

Apply the Python 3 prompt first. These rules cover the LiteLLM 1.97 Python SDK and proxy gateway, including authentication, provider routing, guardrails, MCP and agents, managed objects, budgets, caching, and observability.

Version and SDK boundary

• Treat 1.97 as outside LiteLLM's four-minor-line active support window; plan migration to a supported stable line instead of choosing 1.97 for a new deployment.
• When maintaining this line, lock the Python package in the lock file, deploy the newest container image on the line, and check PyPI and the container registry separately: LiteLLM ships some patches on a line only as container images, for example to refresh dependencies and the base image, with no matching PyPI release. Avoid rolling latest and main-stable tags.
• On LiteLLM 1.97 releases, which predate the fix for GHSA-7hp6-4w63-5g45 that LiteLLM first shipped in 1.100.4, an authenticated internal_user can escalate to proxy admin through the login path and from there reach the MCP stdio endpoints and command execution. Set EXPERIMENTAL_UI_LOGIN=false until you move to a fixed line, accepting that it also breaks CLI SSO and gateway logins, and limit who holds internal_user keys.
• Verify container signatures with the release's published Cosign key and deploy the verified image by digest. Do not interpret a signed or patched image as proof that every dependency is free of vulnerabilities.
• Use a maintained CPython release within the package's declared >=3.10,<3.15 range, and test the exact interpreter, provider SDKs, and optional extras deployed.