ToolHive

Summary

ToolHive is an open-source platform, licensed under Apache 2.0, that runs Model Context Protocol (MCP) servers in isolated containers and enforces identity and access policy on each request. It is run as a command-line tool, with a Kubernetes operator for cluster deployments, and covers developers connecting clients like Claude Code or Cursor to MCP servers, platform engineers standardizing MCP on existing Kubernetes infrastructure, and enterprises with compliance needs that rule out SaaS. Its own documentation contrasts it with SaaS-based MCP offerings, positioning self-hosting as the reason to choose it. Recent work adds Cedar-based authorization, OAuth token exchange for agentic delegation, and OpenTelemetry tracing for rate limiting, and with 143 contributors and a release cut 16 days ago, it is under active development.

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v0.46.0 Aug 27, 2026 · issue 009

   ToolHive v0.46.0 adds private-CA trust for embedded auth servers and signer-rotation blocking on plugin upgrades.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.46.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.46.0

   └──▷ TRY IT
   Upgrade a plugin while explicitly approving a signer identity change — required when the new release is signed by a different identity than what the lock file recorded.
   copy

   $ thv ai-plugin upgrade --allow-signer-change <plugin-name>

   Point an embedded auth server at an in-cluster IdP behind a private CA so ToolHive can reach its OIDC discovery and token endpoints.
   yaml copy

   caBundleRef: my-internal-ca-secret

   • ›Adds --allow-signer-change flag to thv ai-plugin upgrade so operators can explicitly confirm a signer rotation; without it, upgrades whose signature identity differs from the lock file — or that are unsigned — are blocked with exit code 4 and signer-change-blocked.
   • ›Adds caBundleRef field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to that upstream only.
   • ›Enables the signer-blocking behaviour via the TOOLHIVE_PLUGINS_LOCK_ENABLED environment variable (experimental plugins lock file).
   └──▷ BREAKING ON UPGRADE

   • !The operator-crds chart must be upgraded to 0.46.0 before or together with the operator chart; a stale CRD silently prunes the new caBundleRef field from applied resources instead of rejecting it.
2. v0.46.0 Aug 27, 2026 · issue 002

   ToolHive v0.46.0 adds private-CA trust for embedded auth servers and signer-rotation blocking on plugin upgrades.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.46.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.46.0

   └──▷ TRY IT
   Upgrade a plugin while explicitly approving a signer identity change — required when the new release is signed by a different identity than what the lock file recorded.
   copy

   $ thv ai-plugin upgrade --allow-signer-change <plugin-name>

   Point an embedded auth server at an in-cluster IdP behind a private CA so ToolHive can reach its OIDC discovery and token endpoints.
   yaml copy

   caBundleRef: my-internal-ca-secret

   • ›Adds --allow-signer-change flag to thv ai-plugin upgrade so operators can explicitly confirm a signer rotation; without it, upgrades whose signature identity differs from the lock file — or that are unsigned — are blocked with exit code 4 and signer-change-blocked.
   • ›Adds caBundleRef field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to that upstream only.
   • ›Enables the signer-blocking behaviour via the TOOLHIVE_PLUGINS_LOCK_ENABLED environment variable (experimental plugins lock file).
   └──▷ BREAKING ON UPGRADE

   • !The operator-crds chart must be upgraded to 0.46.0 before or together with the operator chart; a stale CRD silently prunes the new caBundleRef field from applied resources instead of rejecting it.
3. v0.45.0 Aug 26, 2026 · issue 009

   ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523RFC 7523An IETF standard that defines how a JSON Web Token (JWT) can be used as a credential to request an OAuth 2.0 access token, letting a cyber tool authenticate to an API without exchanging a username and password. auth flows, a diagnostics metrics port, and a new Qoder skill client.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.45.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.45.0

   └──▷ TRY IT
   Sync skills to only a specific client in CI so that the addition of the new qoder client does not cause unexpected drift and a non-zero exit.
   copy

   $ thv skill sync --check --clients claude-code

   Create a workload via the management API now that Content-Type: application/json is required on state-changing TCP requests.
   copy

   $ curl -X POST http://127.0.0.1:8080/api/v1beta/workloads \
     -H 'Content-Type: application/json' \
     -d '{"name":"fetch","image":"ghcr.io/example/fetch:latest"}'

   Scope a REST skill sync to specific clients so CI pipelines do not unexpectedly expand to all skill-supporting clients after upgrade.
   copy

   $ curl -X POST http://127.0.0.1:8080/api/v1beta/skills/sync \
     -H 'Content-Type: application/json' \
     -d '{"clients": ["claude-code", "cursor"]}'

   • ›Adds --clients flag to thv skill sync and {"clients": [...]} body field to POST /api/v1beta/skills/sync to explicitly scope which skill-supporting clients are targeted on each sync.
   • ›Adds qoder as the 18th skill-supporting client, materializing skills into <project>/.qoder/skills/ on sync.
   • ›Enforces Content-Type: application/json on state-changing thv serve management API requests over TCP, and adds Origin validation with a loopback-only allowlist on those same listeners.
   • ›Prometheus metrics move to a dedicated diagnostics port, controlled by a migration switch.
   • ›The embedded auth server gains two new RFC 7523 flows.
   +4 moreshow less

   • ›Plugin artifacts now have end-to-end Sigstore bundle verification; stored bundles and git commit payloads/signatures are rejected with HTTP 422 above 1 MiB.
   • ›thv skill push now signs keylessly by default; requires exactly one of --key, --identity-token, or --no-sign.
   • ›Virtual MCP now honours operational.timeouts configured values and propagates backend health changes to live sessions.
   • ›Package names in npx://, uvx://, and go:// references are now validated against [A-Za-z0-9@/:._+=~[\]-] at build time, blocking shell metacharacter injection into generated Dockerfiles.
   └──▷ BREAKING ON UPGRADE

   • !thv serve management API over TCP now requires Content-Type: application/json on state-changing requests with a body; callers omitting it receive 415 Unsupported Media Type.
   • !Package names in npx://, uvx://, and go:// references containing characters outside [A-Za-z0-9@/:._+=~[\]-] now fail at build time with an 'invalid package name' error instead of being interpolated into the Dockerfile.
   • !thv skill sync without --clients now targets every skill-supporting client; any skill locked under v0.44.0 will report as drifted on first sync after upgrade, and thv skill sync --check will exit non-zero in CI.
   • !runtime_config.build_with on npx:///go:// images is now a 400 Bad Request; runtime_config.runtime_env is now actually applied (was silently discarded) via POST /api/v1beta/workloads.
   • !thv skill push now returns 400 when both --key and --no-sign are supplied; exactly one of --key, --identity-token, or --no-sign is required.
   • !Virtual MCP now honours operational.timeouts; a configured value below 30 s will now actually cut backend calls that previously received the silent 30 s default.
   • !Exported Go interfaces plugins.MaterializationAdapter, state.Store writers, storage.UpstreamTokenStorage, and six function signatures gained required methods or changed signatures.
   • !The thv llm local proxy now returns 401 token_required instead of 502 server_error when the stored credential has been rejected by the IdP.
4. v0.45.0 Aug 26, 2026 · issue 002

   ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523RFC 7523An IETF standard that defines how a JSON Web Token (JWT) can be used as a credential to request an OAuth 2.0 access token, letting a cyber tool authenticate to an API without exchanging a username and password. auth flows, a diagnostics metrics port, and a new Qoder skill client.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.45.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.45.0

   └──▷ TRY IT
   Sync skills to only a specific client in CI so that the addition of the new qoder client does not cause unexpected drift and a non-zero exit.
   copy

   $ thv skill sync --check --clients claude-code

   Create a workload via the management API now that Content-Type: application/json is required on state-changing TCP requests.
   copy

   $ curl -X POST http://127.0.0.1:8080/api/v1beta/workloads \
     -H 'Content-Type: application/json' \
     -d '{"name":"fetch","image":"ghcr.io/example/fetch:latest"}'

   Scope a REST skill sync to specific clients so CI pipelines do not unexpectedly expand to all skill-supporting clients after upgrade.
   copy

   $ curl -X POST http://127.0.0.1:8080/api/v1beta/skills/sync \
     -H 'Content-Type: application/json' \
     -d '{"clients": ["claude-code", "cursor"]}'

   • ›Adds --clients flag to thv skill sync and {"clients": [...]} body field to POST /api/v1beta/skills/sync to explicitly scope which skill-supporting clients are targeted on each sync.
   • ›Adds qoder as the 18th skill-supporting client, materializing skills into <project>/.qoder/skills/ on sync.
   • ›Enforces Content-Type: application/json on state-changing thv serve management API requests over TCP, and adds Origin validation with a loopback-only allowlist on those same listeners.
   • ›Prometheus metrics move to a dedicated diagnostics port, controlled by a migration switch.
   • ›The embedded auth server gains two new RFC 7523 flows.
   +4 moreshow less

   • ›Plugin artifacts now have end-to-end Sigstore bundle verification; stored bundles and git commit payloads/signatures are rejected with HTTP 422 above 1 MiB.
   • ›thv skill push now signs keylessly by default; requires exactly one of --key, --identity-token, or --no-sign.
   • ›Virtual MCP now honours operational.timeouts configured values and propagates backend health changes to live sessions.
   • ›Package names in npx://, uvx://, and go:// references are now validated against [A-Za-z0-9@/:._+=~[\]-] at build time, blocking shell metacharacter injection into generated Dockerfiles.
   └──▷ BREAKING ON UPGRADE

   • !thv serve management API over TCP now requires Content-Type: application/json on state-changing requests with a body; callers omitting it receive 415 Unsupported Media Type.
   • !Package names in npx://, uvx://, and go:// references containing characters outside [A-Za-z0-9@/:._+=~[\]-] now fail at build time with an 'invalid package name' error instead of being interpolated into the Dockerfile.
   • !thv skill sync without --clients now targets every skill-supporting client; any skill locked under v0.44.0 will report as drifted on first sync after upgrade, and thv skill sync --check will exit non-zero in CI.
   • !runtime_config.build_with on npx:///go:// images is now a 400 Bad Request; runtime_config.runtime_env is now actually applied (was silently discarded) via POST /api/v1beta/workloads.
   • !thv skill push now returns 400 when both --key and --no-sign are supplied; exactly one of --key, --identity-token, or --no-sign is required.
   • !Virtual MCP now honours operational.timeouts; a configured value below 30 s will now actually cut backend calls that previously received the silent 30 s default.
   • !Exported Go interfaces plugins.MaterializationAdapter, state.Store writers, storage.UpstreamTokenStorage, and six function signatures gained required methods or changed signatures.
   • !The thv llm local proxy now returns 401 token_required instead of 502 server_error when the stored credential has been rejected by the IdP.
5. v0.44.0 Aug 18, 2026 · issue 005

   ToolHive v0.44.0 adds RFC 8693 actor_token support in token exchange and hardens OAuth/DCR endpoints against SSRF.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.44.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.44.0

   • ›Supports actor_token in RFC 8693 token exchange flows, enabling delegated identity scenarios where an acting party is distinct from the subject.
   • ›Guards OAuth token and Dynamic Client Registration (DCR) endpoints against Server-Side Request Forgery (SSRF) attacks.
6. v0.44.0 Aug 18, 2026 · issue 002

   ToolHive v0.44.0 adds RFC 8693 actor_token support in token exchange and hardens OAuth/DCR endpoints against SSRF.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.44.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.44.0

   • ›Supports actor_token in RFC 8693 token exchange flows, enabling delegated identity scenarios where an acting party is distinct from the subject.
   • ›Guards OAuth token and Dynamic Client Registration (DCR) endpoints against Server-Side Request Forgery (SSRF) attacks.
7. v0.43.0 Aug 14, 2026 · issue 005

   ToolHive v0.43.0 adds confidential OAuth clients, RFC 8693 delegate clients, multi-line SSE parsing, macOS binary signing, and lock-file plugin tracking.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.43.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.43.0

   └──▷ USE IT
   Configure an OAuth token-exchange backend in vmcp so that downstream calls use RFC 8693 delegate tokens — now fully reachable after this release.
   vmcp-config.yaml copy

   backends:
     github:
       type: token_exchange
       tokenExchange:
         tokenUrl: "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token"
         clientId: "vmcp-github-exchange"
         clientSecretEnv: "GITHUB_EXCHANGE_SECRET"
         audience: "github-api"
         scopes: ["repo", "read:org"]

   • ›Adds plugins key to the lock file schema, enabling plugin entries to be tracked in lock provenance.
   • ›Adds PluginLockService and a managed install flag to support plugin lifecycle management through the lock file.
   • ›Records certificate ref and runner in lock provenance, strengthening supply-chain traceability for installed servers.
   • ›Enforces recorded ref and runner fields during skill verification, so provenance is validated at use time.
   • ›Enables signing of pushes by default and removes the lock feature gate, making image signing the standard behavior.
   +10 moreshow less

   • ›Supports confidential clients in dynamic client registration, expanding OAuth client types available to the auth layer.
   • ›Makes RFC 8693 delegate (token-exchange) clients reachable and usable, enabling downstream token exchange workflows in vmcp-config.yaml.
   • ›Supports parsing of multi-line Modern SSE events, improving compatibility with SSE-based MCP transports.
   • ›Signs the macOS thv binary with a Developer ID certificate, removing Gatekeeper warnings for macOS users.
   • ›Adds rate-limiting observability via metrics and tracing (OpenTelemetry), covering the proxy rate-limit path.
   • ›Drops the build fingerprint from the proxy /health response, reducing information exposure on that endpoint.
   • ›Displays recorded trust state to the user in the CLI, surfacing container image trust information at runtime.
   • ›Resets the LLM config when the last tool is torn down, preventing stale LLM configuration from persisting after all tools exit.
   • ›Uses a bare thv command as the LLM token helper, simplifying the token-helper integration for LLM clients.
   • ›Ignores unsupported grant types in CIMD documents, improving interoperability with authorization servers that advertise non-standard grant types.
8. v0.43.0 Aug 14, 2026 · issue 002

   ToolHive v0.43.0 adds confidential OAuth clients, RFC 8693 delegate clients, multi-line SSE parsing, macOS binary signing, and lock-file plugin tracking.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.43.0 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.43.0

   └──▷ USE IT
   Configure an OAuth token-exchange backend in vmcp so that downstream calls use RFC 8693 delegate tokens — now fully reachable after this release.
   vmcp-config.yaml copy

   backends:
     github:
       type: token_exchange
       tokenExchange:
         tokenUrl: "https://keycloak.example.com/realms/myrealm/protocol/openid-connect/token"
         clientId: "vmcp-github-exchange"
         clientSecretEnv: "GITHUB_EXCHANGE_SECRET"
         audience: "github-api"
         scopes: ["repo", "read:org"]

   • ›Adds plugins key to the lock file schema, enabling plugin entries to be tracked in lock provenance.
   • ›Adds PluginLockService and a managed install flag to support plugin lifecycle management through the lock file.
   • ›Records certificate ref and runner in lock provenance, strengthening supply-chain traceability for installed servers.
   • ›Enforces recorded ref and runner fields during skill verification, so provenance is validated at use time.
   • ›Enables signing of pushes by default and removes the lock feature gate, making image signing the standard behavior.
   +10 moreshow less

   • ›Supports confidential clients in dynamic client registration, expanding OAuth client types available to the auth layer.
   • ›Makes RFC 8693 delegate (token-exchange) clients reachable and usable, enabling downstream token exchange workflows in vmcp-config.yaml.
   • ›Supports parsing of multi-line Modern SSE events, improving compatibility with SSE-based MCP transports.
   • ›Signs the macOS thv binary with a Developer ID certificate, removing Gatekeeper warnings for macOS users.
   • ›Adds rate-limiting observability via metrics and tracing (OpenTelemetry), covering the proxy rate-limit path.
   • ›Drops the build fingerprint from the proxy /health response, reducing information exposure on that endpoint.
   • ›Displays recorded trust state to the user in the CLI, surfacing container image trust information at runtime.
   • ›Resets the LLM config when the last tool is torn down, preventing stale LLM configuration from persisting after all tools exit.
   • ›Uses a bare thv command as the LLM token helper, simplifying the token-helper integration for LLM clients.
   • ›Ignores unsupported grant types in CIMD documents, improving interoperability with authorization servers that advertise non-standard grant types.
9. v0.42.1 Aug 10, 2026 · issue 005

   ToolHive v0.42.1 adds deny-by-default vMCP visibility, external OIDC trusted issuers, composite tool annotations, and a TOOLHIVE_API_TIMEOUT override.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.42.1 https://github.com/stacklok/toolhive.git
   # already have the repo? check out this version:
   $ git checkout v0.42.1

   └──▷ USE IT
   Lock down a vMCP group so new workloads are hidden by default and only explicitly listed ones expose tools.
   vmcp-config.yaml copy

   name: "engineering-vmcp"
   groupRef: "engineering-team"
   aggregation:
     defaultToolVisibility: deny
     tools:
       - workload: github
       - workload: jira

   Fail CI faster when thv skill calls time out in a slow environment by shortening the API client timeout.
   copy

   $ TOOLHIVE_API_TIMEOUT=30s thv skill list

   Allow a dev/test inline OIDC config pointing at an in-cluster Keycloak over HTTP to pass URL validation after upgrading.
   yaml copy

   apiVersion: toolhive.stacklok.dev/v1beta1
   kind: MCPOIDCConfig
   metadata:
     name: keycloak-auth
   spec:
     type: inline
     inline:
       issuer: http://keycloak:8080/realms/toolhive
       jwksUrl: http://keycloak:8080/realms/toolhive/protocol/openid-connect/certs
       insecureAllowHTTP: true

   • ›Adds aggregation.defaultToolVisibility: deny to vMCP config so only workloads explicitly listed in aggregation.tools have their tools advertised, closing the fail-open gap in tool aggregation.
   • ›Adds trusted_issuers to the embedded auth server config, enabling agents to exchange subject tokens from external OIDC providers (Entra, Okta, Keycloak) for ToolHive-scoped delegated tokens under a fail-closed RFC 8693 consent policy.
   • ›Adds TOOLHIVE_API_TIMEOUT environment variable to override the CLI API client timeout for thv skill and thv ai-plugin commands (default is 10 minutes).
   • ›Adds insecureAllowHTTP: true field under spec.inline in MCPOIDCConfig to explicitly opt in to plain-HTTP issuer and JWKS URLs for dev/test environments; production configs must use HTTPS.
   • ›Composite tools now support MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), with a conservative fail-closed safety floor derived from the workflow's step tools when none are set explicitly.
   └──▷ BREAKING ON UPGRADE

   • !With Cedar authorization enabled (--authz-config), POST requests without Content-Type: application/json (including a missing header) now return 400 instead of being forwarded unauthorized; all MCP POST clients must send Content-Type: application/json.
   • !vMCP tools excluded via filter, excludeAll, or excludeAllTools are no longer directly callable on the Modern (2026-07-28) path — tools/call now returns -32602 at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool.
   • !MCPOIDCConfig resources of spec.type: inline with a plain-HTTP, malformed, or scheme-less issuer or jwksUrl flip to Valid=False on next reconcile and block reconciliation of every MCPServer, MCPRemoteProxy, and VirtualMCPServer referencing them; add insecureAllowHTTP: true or switch to HTTPS.
10. v0.42.1 Aug 10, 2026 · issue 002

    ToolHive v0.42.1 adds deny-by-default vMCP visibility, external OIDC trusted issuers, composite tool annotations, and a TOOLHIVE_API_TIMEOUT override.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.42.1 https://github.com/stacklok/toolhive.git
    # already have the repo? check out this version:
    $ git checkout v0.42.1

    └──▷ USE IT
    Lock down a vMCP group so new workloads are hidden by default and only explicitly listed ones expose tools.
    vmcp-config.yaml copy

    name: "engineering-vmcp"
    groupRef: "engineering-team"
    aggregation:
      defaultToolVisibility: deny
      tools:
        - workload: github
        - workload: jira

    Fail CI faster when thv skill calls time out in a slow environment by shortening the API client timeout.
    copy

    $ TOOLHIVE_API_TIMEOUT=30s thv skill list

    Allow a dev/test inline OIDC config pointing at an in-cluster Keycloak over HTTP to pass URL validation after upgrading.
    yaml copy

    apiVersion: toolhive.stacklok.dev/v1beta1
    kind: MCPOIDCConfig
    metadata:
      name: keycloak-auth
    spec:
      type: inline
      inline:
        issuer: http://keycloak:8080/realms/toolhive
        jwksUrl: http://keycloak:8080/realms/toolhive/protocol/openid-connect/certs
        insecureAllowHTTP: true

    • ›Adds aggregation.defaultToolVisibility: deny to vMCP config so only workloads explicitly listed in aggregation.tools have their tools advertised, closing the fail-open gap in tool aggregation.
    • ›Adds trusted_issuers to the embedded auth server config, enabling agents to exchange subject tokens from external OIDC providers (Entra, Okta, Keycloak) for ToolHive-scoped delegated tokens under a fail-closed RFC 8693 consent policy.
    • ›Adds TOOLHIVE_API_TIMEOUT environment variable to override the CLI API client timeout for thv skill and thv ai-plugin commands (default is 10 minutes).
    • ›Adds insecureAllowHTTP: true field under spec.inline in MCPOIDCConfig to explicitly opt in to plain-HTTP issuer and JWKS URLs for dev/test environments; production configs must use HTTPS.
    • ›Composite tools now support MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint), with a conservative fail-closed safety floor derived from the workflow's step tools when none are set explicitly.
    └──▷ BREAKING ON UPGRADE

    • !With Cedar authorization enabled (--authz-config), POST requests without Content-Type: application/json (including a missing header) now return 400 instead of being forwarded unauthorized; all MCP POST clients must send Content-Type: application/json.
    • !vMCP tools excluded via filter, excludeAll, or excludeAllTools are no longer directly callable on the Modern (2026-07-28) path — tools/call now returns -32602 at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool.
    • !MCPOIDCConfig resources of spec.type: inline with a plain-HTTP, malformed, or scheme-less issuer or jwksUrl flip to Valid=False on next reconcile and block reconciliation of every MCPServer, MCPRemoteProxy, and VirtualMCPServer referencing them; add insecureAllowHTTP: true or switch to HTTPS.
11. v0.42.0 Aug 5, 2026 · issue 005

    ToolHive v0.42.0 adds a full thv ai-plugin CLI and REST API, a registry catalog, and Sigstore signature verification for skills installs.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.42.0 https://github.com/stacklok/toolhive.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    • ›Adds thv ai-plugin subcommand with a full CLI and REST API for end-to-end AI-tool plugin management.
    • ›Introduces a registry catalog for discovering and managing AI-tool plugins.
    • ›Adds Sigstore signature verification for skills at install, sync, and upgrade time.
    • ›Enables multiple MCP clients to share a single stdio server simultaneously.
    • ›Stabilizes vMCP protocol negotiation, stopping flapping between Modern and Legacy MCP revisions.
    +1 moreshow less

    • ›Cedar authorization policy is now evaluated against the post-mutation MCP request, closing a bypass window for length-preserving mutating webhook rewrites.
    └──▷ BREAKING ON UPGRADE

    • !status.referencingWorkloads, status.referenceCount, and the References printer column are removed from all six config CRDs (MCPOIDCConfig, MCPAuthzConfig, MCPExternalAuthConfig, MCPToolConfig, MCPWebhookConfig, MCPTelemetryConfig); replace any automation reading them with workload field queries via -o json | jq.
    • !Cedar policy and audit records now evaluate against the post-mutation MCP request body; re-audit Cedar policies and update SIEM rules keyed on type or target.name before upgrading workloads that combine a mutating: entry in --webhook-config (or MCPWebhookConfig.spec.mutating) with Cedar authorization.
    • !Recovered HTTP panics no longer produce a slog.Error log line or stack trace; log-based alerts on recovered panics will silently stop firing unless Sentry is configured.
    • !pkg/telemetry/providers is deleted and two optimizerdec constants are removed from the Go API; out-of-tree Go importers must drop references to these before upgrading.
12. v0.42.0 Aug 5, 2026 · issue 002

    ToolHive v0.42.0 adds a full thv ai-plugin CLI and REST API, a registry catalog, and Sigstore signature verification for skills installs.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.42.0 https://github.com/stacklok/toolhive.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    • ›Adds thv ai-plugin subcommand with a full CLI and REST API for end-to-end AI-tool plugin management.
    • ›Introduces a registry catalog for discovering and managing AI-tool plugins.
    • ›Adds Sigstore signature verification for skills at install, sync, and upgrade time.
    • ›Enables multiple MCP clients to share a single stdio server simultaneously.
    • ›Stabilizes vMCP protocol negotiation, stopping flapping between Modern and Legacy MCP revisions.
    +1 moreshow less

    • ›Cedar authorization policy is now evaluated against the post-mutation MCP request, closing a bypass window for length-preserving mutating webhook rewrites.
    └──▷ BREAKING ON UPGRADE

    • !status.referencingWorkloads, status.referenceCount, and the References printer column are removed from all six config CRDs (MCPOIDCConfig, MCPAuthzConfig, MCPExternalAuthConfig, MCPToolConfig, MCPWebhookConfig, MCPTelemetryConfig); replace any automation reading them with workload field queries via -o json | jq.
    • !Cedar policy and audit records now evaluate against the post-mutation MCP request body; re-audit Cedar policies and update SIEM rules keyed on type or target.name before upgrading workloads that combine a mutating: entry in --webhook-config (or MCPWebhookConfig.spec.mutating) with Cedar authorization.
    • !Recovered HTTP panics no longer produce a slog.Error log line or stack trace; log-based alerts on recovered panics will silently stop firing unless Sentry is configured.
    • !pkg/telemetry/providers is deleted and two optimizerdec constants are removed from the Go API; out-of-tree Go importers must drop references to these before upgrading.
13. v0.41.0 Jul 28, 2026 · issue 005

    ToolHive v0.41.0 adds MCP 2026-07-28 spec support, thv skill sync/upgrade with lock file, RFC 8693 token exchange, and Envoy network isolation.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.41.0 https://github.com/stacklok/toolhive.git
    # already have the repo? check out this version:
    $ git checkout v0.41.0

    └──▷ TRY IT
    Restore and verify a project's pinned MCP skill set in CI to ensure every machine uses exactly the locked versions.
    copy

    $ thv skill sync

    Re-resolve all pinned skills to newer content and update toolhive.lock.yaml without silent drift.
    copy

    $ thv skill upgrade

    Opt out of the StorageVersionMigrator on a namespace-scoped Helm install to avoid a broken helm upgrade.
    yaml copy

    operator:
      rbac:
        scope: namespace
      features:
        storageVersionMigrator: false

    • ›Adds thv skill sync to restore a project's pinned skill set on any machine and verify on-disk content in CI.
    • ›Adds thv skill upgrade to re-resolve pinned skills to newer content without silent lock drift.
    • ›Pins project-scoped skill installs in a toolhive.lock.yaml lock file, including Sigstore provenance fields.
    • ›Adds typed exit codes and a pre-install confirmation gate to thv skill sync and thv skill upgrade for scriptable CI use.
    • ›Adds opt-in strict MCP-Protocol-Version header validation for the streamable proxy.
    +14 moreshow less

    • ›Supports the MCP 2026-07-28 stateless ('Modern') spec revision end to end across transport proxies, transparent proxy, and Virtual MCP — bridging era-mismatched client×backend combinations.
    • ›Modern client-facing dispatch is gated per capability instead of a global kill-switch, with listen-stream support and pagination.
    • ›W3C trace context propagates through outbound MCP _meta (SEP-414), joining backend spans to the client→proxy→server trace.
    • ›Wires RFC 8693 token exchange into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token.
    • ›Subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can now be validated for RFC 8693 token exchange.
    • ›Audit logs capture the RFC 8693 act claim and full delegation chain, making 'agent X acting for Alice' distinguishable from Alice.
    • ›Dynamically registered OAuth clients now renew expiring client secrets automatically (RFC 7591/7592).
    • ›Multi-valued JWT claims can be normalized to canonical space-delimited form for Cedar policies.
    • ›Backend list_changed notifications are now consumed and propagated to clients for tools, resources, and prompts.
    • ›Virtual MCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server-to-client forwarding all work.
    • ›Guarantees tools/list pagination completeness for aggregated sets exceeding 1,000 tools.
    • ›Tool definitions carrying invalid x-mcp-header annotations (SEP-2243) are now rejected as the spec requires.
    • ›Readiness probe now sends the current MCP protocol version instead of a hardcoded 2024-11-05.
    • ›Adds an opt-in Envoy network-isolation backend.
    └──▷ BREAKING ON UPGRADE

    • !Namespace-scoped Helm installs (operator.rbac.scope=namespace) now fail helm upgrade at render time unless operator.features.storageVersionMigrator: false is set, because the StorageVersionMigrator controller is now enabled by default (operator.features.storageVersionMigrator: true).
    • !JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code -32600 instead of being executed; send individual requests.
    • !Rate-limit JSON-RPC error code changed from -32029 to 429; clients branching on error.code == -32029 must match 429 instead.
14. v0.41.0 Jul 28, 2026 · issue 002

    ToolHive v0.41.0 adds MCP 2026-07-28 spec support, thv skill sync/upgrade with lock file, RFC 8693 token exchange, and Envoy network isolation.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.41.0 https://github.com/stacklok/toolhive.git
    # already have the repo? check out this version:
    $ git checkout v0.41.0

    └──▷ TRY IT
    Restore and verify a project's pinned MCP skill set in CI to ensure every machine uses exactly the locked versions.
    copy

    $ thv skill sync

    Re-resolve all pinned skills to newer content and update toolhive.lock.yaml without silent drift.
    copy

    $ thv skill upgrade

    Opt out of the StorageVersionMigrator on a namespace-scoped Helm install to avoid a broken helm upgrade.
    yaml copy

    operator:
      rbac:
        scope: namespace
      features:
        storageVersionMigrator: false

    • ›Adds thv skill sync to restore a project's pinned skill set on any machine and verify on-disk content in CI.
    • ›Adds thv skill upgrade to re-resolve pinned skills to newer content without silent lock drift.
    • ›Pins project-scoped skill installs in a toolhive.lock.yaml lock file, including Sigstore provenance fields.
    • ›Adds typed exit codes and a pre-install confirmation gate to thv skill sync and thv skill upgrade for scriptable CI use.
    • ›Adds opt-in strict MCP-Protocol-Version header validation for the streamable proxy.
    +14 moreshow less

    • ›Supports the MCP 2026-07-28 stateless ('Modern') spec revision end to end across transport proxies, transparent proxy, and Virtual MCP — bridging era-mismatched client×backend combinations.
    • ›Modern client-facing dispatch is gated per capability instead of a global kill-switch, with listen-stream support and pagination.
    • ›W3C trace context propagates through outbound MCP _meta (SEP-414), joining backend spans to the client→proxy→server trace.
    • ›Wires RFC 8693 token exchange into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token.
    • ›Subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can now be validated for RFC 8693 token exchange.
    • ›Audit logs capture the RFC 8693 act claim and full delegation chain, making 'agent X acting for Alice' distinguishable from Alice.
    • ›Dynamically registered OAuth clients now renew expiring client secrets automatically (RFC 7591/7592).
    • ›Multi-valued JWT claims can be normalized to canonical space-delimited form for Cedar policies.
    • ›Backend list_changed notifications are now consumed and propagated to clients for tools, resources, and prompts.
    • ›Virtual MCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server-to-client forwarding all work.
    • ›Guarantees tools/list pagination completeness for aggregated sets exceeding 1,000 tools.
    • ›Tool definitions carrying invalid x-mcp-header annotations (SEP-2243) are now rejected as the spec requires.
    • ›Readiness probe now sends the current MCP protocol version instead of a hardcoded 2024-11-05.
    • ›Adds an opt-in Envoy network-isolation backend.
    └──▷ BREAKING ON UPGRADE

    • !Namespace-scoped Helm installs (operator.rbac.scope=namespace) now fail helm upgrade at render time unless operator.features.storageVersionMigrator: false is set, because the StorageVersionMigrator controller is now enabled by default (operator.features.storageVersionMigrator: true).
    • !JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code -32600 instead of being executed; send individual requests.
    • !Rate-limit JSON-RPC error code changed from -32029 to 429; clients branching on error.code == -32029 must match 429 instead.