LiteLLM Internet-Facing MCP Endpoint Accessed

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•2

Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.