LiteLLM 1.102.0 has reached the stable PyPI channel with the Agent Skills, Codex and Claude Code gateway setup, per-user MCP permissions, customer-managed KMS and routing telemetry introduced in its release candidate. Stabilization backports also fix request-parameter leakage, streamed spend tracking, retry behavior and team budget propagation. The release is now suitable for a controlled production-like trial rather than an RC-only proof of concept.
LiteLLM 1.106 makes remote MCP identity safer and disables stdio by default
2026-09-13Verified announcementTRIAL
LiteLLM 1.107.0 expands the stable gateway with Microsoft 365 Copilot and per-user GitHub Copilot OAuth, additional Decisions providers, signed-container verification and request-failure analytics. It also hardens MCP bearer propagation, Bedrock tool calls, spend accounting and OpenAI SDK 3 compatibility. The large aggregated release still requires a production-shaped canary.
Availability: stable 1.102.0 is installable from PyPI
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For teams using LiteLLM as an agent gateway, the safer defaults reduce credential spillover but can break local MCP setups. Enterprise-only items and release-note aggregation mean the final entitlement and behavior must be checked in a production-shaped canary.
Evidence & related material
LiteLLM 1.103.0 stable adds a Claude Code gateway, RFC 8693 token exchange, MCP client allowlists, live-session revocation and MCP-aware guardrails, alongside routing and budget-accounting fixes.
LiteLLM 1.104 hardens gateway identity, MCP routing and spend accounting
LiteLLM 1.104.2 stable adds OpenAI-compatible Decisions endpoints and provider support.
LiteLLM 1.105.0 stable expands agent gateway support, MCP discovery and authorization, and guardrails over retrieved chunks.
LiteLLM 1.106.0 disables stdio MCP by default and strengthens OAuth issuer, credential, encrypted-configuration and workload-identity boundaries.
1.107.0 stable: Microsoft 365 Copilot and per-user GitHub Copilot OAuth providers; hosted vLLM, Databricks and Azure Decisions routes; signed containers; failure-rate analytics; MCP bearer, Bedrock tool-call, spend and SDK 3 fixes.
LiteLLM 1.106.3 rotates its image-signing key and removes an old root CA
LiteLLM 1.106.4 fixes proxy startup failure when the remote cost map is unreachable and backports the fix to two maintained lines.
Subsequent changes
LiteLLM 1.103 strengthens Claude Code gateway, MCP sessions and identity controls
LiteLLM 1.104 hardens gateway identity, MCP routing and spend accounting
LiteLLM 1.104.2 stable adds the Decisions API
LiteLLM 1.105 expands agent gateway and MCP authorization boundaries
LiteLLM 1.106 tightens MCP and gateway identity boundaries
LiteLLM 1.107 expands agent gateways and Decisions routing
LiteLLM 1.106.3 rotates its image-signing key and removes an old root CA
LiteLLM fixes proxy startup failure when the cost map is offline
Technical details & scores
| Release | v1.102.0 stable; first stable PyPI artifact uploaded 2026-09-20T04:41:12.814548Z; Git tag commit 95293834e833b2d2979f87d1bd2a5be45db6728a |
|---|---|
| Agent Skills | serves registered skills through an Agent Skills well-known index and configures Claude Code or Codex with a gateway key |
| Mcp Controls | per-user MCP tool permissions apply to tools/list and tools/call; MCP OAuth and discovery handling improved; Conduct Guard integration added |
| Key Management | customer-managed KMS keys supported for virtual keys stored in AWS Secrets Manager |
| Observability | response headers expose the routed model, savings and complexity-routing decisions |
| Reliability | fixes cover spend double counting, Redis circuit-breaker state, streamed Bedrock spend buffering, secret redaction and fail-closed guardrail paths |
| Stabilization | backports fix request-parameter leakage, image/mask form handling, routing callback binding, streamed spend tracking, clean-snapshot fallback retries and team budget propagation |
| Availability | stable 1.102.0 is installable from PyPI |
| Latest Version | 1.106.4 |
| Supply Chain Change | Container image signing key changed; old cosign verification policies will fail until updated. The eMudhra root CA was removed. |
| Image Digest | e3fe3e08c44b16407fe0b37c43b4f8b603b3a0f4ee74c29e647bc022d762c2c0 |
| Time Basis | GitHub release published 2026-10-25T09:39:15Z. |
Technical impact 3
Engineering value 4
Adoption signal 2
Maturity 3
Verification cost 2
Risk 3
Historical update notes
· LiteLLM 1.103.0 adds Claude Code gateway, RFC 8693 token exchange, MCP client/session controls and routing/budget fixes; stays TRIAL