Unprefixed tool names on path-addressed MCP endpoint resolve through global mapping

Finding: On LiteLLM v1.104.0 (reporter's setup: Kubernetes, 1 replica, DB-managed MCP servers, virtual keys), a JSON-RPC tools/call with an unprefixed tool name on /{server_name}/mcp is reported not to resolve against the server in the URL path. Per the reporter, it instead resolves via the process-wide tool_name_to_mcp_server_name_mapping, which is keyed by unprefixed name, filled by tools/list, and overwritten by the last server listed (https://github.com/BerriAI/litellm/issues/44831). Reported symptoms: (1) With a cold mapping, such as after restart or after another server is deleted, the call returns "Tool 'list_items' not found" (404) and keeps failing on retry. The reporter says this persists on v1.104.0 even though it includes the #42072 warm-up. (2) When two servers expose the same tool name, calling the tool on one server's endpoint after the other was listed returns "User not allowed to call this tool." (403). Listing the other server flips which one fails. The reporter notes that one caller's tools/list can change another caller's tools/call outcome. The prefixed name (<alias>-<tool>) reportedly works in all cases (same issue). Hypothesis, not maintainer-confirmed: A contributor reading current main says the JSON-RPC route never passes the path server into execute_mcp_tool as requested_server_id. It is populated only by the REST /tools/call endpoint and tool-search. So the fallback is the global mapping, and the cold-mapping guard or the is_tool_allowed check against the wrong server produces the 404 or 403. The contributor suggests threading the path's server name into execute_mcp_tool so the existing warm-up and checks apply to the addressed server. They flag an open design question for stateful sessions created on one server path and reused on another (https://github.com/BerriAI/litellm/issues/44831#issuecomment-6014086459). Status: The supplied sources show the issue open, with no merged fix or release. The contributor offered a patch only after the approach is confirmed. Practical mitigation (reporter-stated, not verified): call tools by their prefixed name. Limitations: This is an external report plus a contributor's code reading, with no KFA reproduction. Behavior on other versions, multi-replica deployments, or stateful-session setups is unknown. Comment coverage is partial.