https://aitoolchain.io/tools/toolhive New releases and features in ToolHive, tracked by The AI Toolchain. en Thu, 27 Aug 2026 17:04:19 GMT https://github.com/stacklok/toolhive/releases/tag/v0.46.0 https://github.com/stacklok/toolhive/releases/tag/v0.46.0 Thu, 27 Aug 2026 17:04:19 GMT ToolHive v0.46.0 adds private-CA trust for embedded auth servers and signer-rotation blocking on plugin upgrades. • Adds `--allow-signer-change` flag to `thv ai-plugin upgrade` so operators can explicitly confirm a signer rotation; without it, upgrades whose signature identity differs from the lock file — or that are unsigned — are blocked with exit code 4 and `signer-change-blocked`. • Adds `caBundleRef` field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to that upstream only. • Enables the signer-blocking behaviour via the `TOOLHIVE_PLUGINS_LOCK_ENABLED` environment variable (experimental plugins lock file). Breaking changes: • The `operator-crds` chart must be upgraded to 0.46.0 before or together with the operator chart; a stale CRD silently prunes the new `caBundleRef` field from applied resources instead of rejecting it. https://github.com/stacklok/toolhive/releases/tag/v0.46.0 https://github.com/stacklok/toolhive/releases/tag/v0.46.0 Thu, 27 Aug 2026 17:04:19 GMT ToolHive v0.46.0 adds private-CA trust for embedded auth servers and signer-rotation blocking on plugin upgrades. • Adds `--allow-signer-change` flag to `thv ai-plugin upgrade` so operators can explicitly confirm a signer rotation; without it, upgrades whose signature identity differs from the lock file — or that are unsigned — are blocked with exit code 4 and `signer-change-blocked`. • Adds `caBundleRef` field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to that upstream only. • Enables the signer-blocking behaviour via the `TOOLHIVE_PLUGINS_LOCK_ENABLED` environment variable (experimental plugins lock file). Breaking changes: • The `operator-crds` chart must be upgraded to 0.46.0 before or together with the operator chart; a stale CRD silently prunes the new `caBundleRef` field from applied resources instead of rejecting it. https://github.com/stacklok/toolhive/releases/tag/v0.45.0 https://github.com/stacklok/toolhive/releases/tag/v0.45.0 Wed, 26 Aug 2026 13:23:20 GMT ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523 auth flows, a diagnostics metrics port, and a new Qoder skill client. • Adds `--clients` flag to `thv skill sync` and `{"clients": [...]}` body field to `POST /api/v1beta/skills/sync` to explicitly scope which skill-supporting clients are targeted on each sync. • Adds `qoder` as the 18th skill-supporting client, materializing skills into `<project>/.qoder/skills/` on sync. • Enforces `Content-Type: application/json` on state-changing `thv serve` management API requests over TCP, and adds Origin validation with a loopback-only allowlist on those same listeners. • Prometheus metrics move to a dedicated diagnostics port, controlled by a migration switch. • The embedded auth server gains two new RFC 7523 flows. • Plugin artifacts now have end-to-end Sigstore bundle verification; stored bundles and git commit payloads/signatures are rejected with HTTP 422 above 1 MiB. • `thv skill push` now signs keylessly by default; requires exactly one of `--key`, `--identity-token`, or `--no-sign`. • Virtual MCP now honours `operational.timeouts` configured values and propagates backend health changes to live sessions. • Package names in `npx://`, `uvx://`, and `go://` references are now validated against `[A-Za-z0-9@/:._+=~[\]-]` at build time, blocking shell metacharacter injection into generated Dockerfiles. Breaking changes: • `thv serve` management API over TCP now requires `Content-Type: application/json` on state-changing requests with a body; callers omitting it receive `415 Unsupported Media Type`. • Package names in `npx://`, `uvx://`, and `go://` references containing characters outside `[A-Za-z0-9@/:._+=~[\]-]` now fail at build time with an 'invalid package name' error instead of being interpolated into the Dockerfile. • `thv skill sync` without `--clients` now targets every skill-supporting client; any skill locked under v0.44.0 will report as drifted on first sync after upgrade, and `thv skill sync --check` will exit non-zero in CI. • `runtime_config.build_with` on `npx://`/`go://` images is now a `400 Bad Request`; `runtime_config.runtime_env` is now actually applied (was silently discarded) via `POST /api/v1beta/workloads`. • `thv skill push` now returns `400` when both `--key` and `--no-sign` are supplied; exactly one of `--key`, `--identity-token`, or `--no-sign` is required. • Virtual MCP now honours `operational.timeouts`; a configured value below 30 s will now actually cut backend calls that previously received the silent 30 s default. • Exported Go interfaces `plugins.MaterializationAdapter`, `state.Store` writers, `storage.UpstreamTokenStorage`, and six function signatures gained required methods or changed signatures. • The `thv llm` local proxy now returns `401 token_required` instead of `502 server_error` when the stored credential has been rejected by the IdP. https://github.com/stacklok/toolhive/releases/tag/v0.45.0 https://github.com/stacklok/toolhive/releases/tag/v0.45.0 Wed, 26 Aug 2026 13:23:20 GMT ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523 auth flows, a diagnostics metrics port, and a new Qoder skill client. • Adds `--clients` flag to `thv skill sync` and `{"clients": [...]}` body field to `POST /api/v1beta/skills/sync` to explicitly scope which skill-supporting clients are targeted on each sync. • Adds `qoder` as the 18th skill-supporting client, materializing skills into `<project>/.qoder/skills/` on sync. • Enforces `Content-Type: application/json` on state-changing `thv serve` management API requests over TCP, and adds Origin validation with a loopback-only allowlist on those same listeners. • Prometheus metrics move to a dedicated diagnostics port, controlled by a migration switch. • The embedded auth server gains two new RFC 7523 flows. • Plugin artifacts now have end-to-end Sigstore bundle verification; stored bundles and git commit payloads/signatures are rejected with HTTP 422 above 1 MiB. • `thv skill push` now signs keylessly by default; requires exactly one of `--key`, `--identity-token`, or `--no-sign`. • Virtual MCP now honours `operational.timeouts` configured values and propagates backend health changes to live sessions. • Package names in `npx://`, `uvx://`, and `go://` references are now validated against `[A-Za-z0-9@/:._+=~[\]-]` at build time, blocking shell metacharacter injection into generated Dockerfiles. Breaking changes: • `thv serve` management API over TCP now requires `Content-Type: application/json` on state-changing requests with a body; callers omitting it receive `415 Unsupported Media Type`. • Package names in `npx://`, `uvx://`, and `go://` references containing characters outside `[A-Za-z0-9@/:._+=~[\]-]` now fail at build time with an 'invalid package name' error instead of being interpolated into the Dockerfile. • `thv skill sync` without `--clients` now targets every skill-supporting client; any skill locked under v0.44.0 will report as drifted on first sync after upgrade, and `thv skill sync --check` will exit non-zero in CI. • `runtime_config.build_with` on `npx://`/`go://` images is now a `400 Bad Request`; `runtime_config.runtime_env` is now actually applied (was silently discarded) via `POST /api/v1beta/workloads`. • `thv skill push` now returns `400` when both `--key` and `--no-sign` are supplied; exactly one of `--key`, `--identity-token`, or `--no-sign` is required. • Virtual MCP now honours `operational.timeouts`; a configured value below 30 s will now actually cut backend calls that previously received the silent 30 s default. • Exported Go interfaces `plugins.MaterializationAdapter`, `state.Store` writers, `storage.UpstreamTokenStorage`, and six function signatures gained required methods or changed signatures. • The `thv llm` local proxy now returns `401 token_required` instead of `502 server_error` when the stored credential has been rejected by the IdP. https://github.com/stacklok/toolhive/releases/tag/v0.44.0 https://github.com/stacklok/toolhive/releases/tag/v0.44.0 Tue, 18 Aug 2026 16:37:51 GMT ToolHive v0.44.0 adds RFC 8693 actor_token support in token exchange and hardens OAuth/DCR endpoints against SSRF. • Supports `actor_token` in RFC 8693 token exchange flows, enabling delegated identity scenarios where an acting party is distinct from the subject. • Guards OAuth token and Dynamic Client Registration (DCR) endpoints against Server-Side Request Forgery (SSRF) attacks. https://github.com/stacklok/toolhive/releases/tag/v0.44.0 https://github.com/stacklok/toolhive/releases/tag/v0.44.0 Tue, 18 Aug 2026 16:37:51 GMT ToolHive v0.44.0 adds RFC 8693 actor_token support in token exchange and hardens OAuth/DCR endpoints against SSRF. • Supports `actor_token` in RFC 8693 token exchange flows, enabling delegated identity scenarios where an acting party is distinct from the subject. • Guards OAuth token and Dynamic Client Registration (DCR) endpoints against Server-Side Request Forgery (SSRF) attacks. https://github.com/stacklok/toolhive/releases/tag/v0.43.0 https://github.com/stacklok/toolhive/releases/tag/v0.43.0 Fri, 14 Aug 2026 15:58:12 GMT ToolHive v0.43.0 adds confidential OAuth clients, RFC 8693 delegate clients, multi-line SSE parsing, macOS binary signing, and lock-file plugin tracking. • Adds `plugins` key to the lock file schema, enabling plugin entries to be tracked in lock provenance. • Adds `PluginLockService` and a managed install flag to support plugin lifecycle management through the lock file. • Records certificate ref and runner in lock provenance, strengthening supply-chain traceability for installed servers. • Enforces recorded ref and runner fields during skill verification, so provenance is validated at use time. • Enables signing of pushes by default and removes the lock feature gate, making image signing the standard behavior. • Supports confidential clients in dynamic client registration, expanding OAuth client types available to the auth layer. • Makes RFC 8693 delegate (token-exchange) clients reachable and usable, enabling downstream token exchange workflows in `vmcp-config.yaml`. • Supports parsing of multi-line Modern SSE events, improving compatibility with SSE-based MCP transports. • Signs the macOS `thv` binary with a Developer ID certificate, removing Gatekeeper warnings for macOS users. • Adds rate-limiting observability via metrics and tracing (OpenTelemetry), covering the proxy rate-limit path. • Drops the build fingerprint from the proxy `/health` response, reducing information exposure on that endpoint. • Displays recorded trust state to the user in the CLI, surfacing container image trust information at runtime. • Resets the LLM config when the last tool is torn down, preventing stale LLM configuration from persisting after all tools exit. • Uses a bare `thv` command as the LLM token helper, simplifying the token-helper integration for LLM clients. • Ignores unsupported grant types in CIMD documents, improving interoperability with authorization servers that advertise non-standard grant types. https://github.com/stacklok/toolhive/releases/tag/v0.43.0 https://github.com/stacklok/toolhive/releases/tag/v0.43.0 Fri, 14 Aug 2026 15:58:12 GMT ToolHive v0.43.0 adds confidential OAuth clients, RFC 8693 delegate clients, multi-line SSE parsing, macOS binary signing, and lock-file plugin tracking. • Adds `plugins` key to the lock file schema, enabling plugin entries to be tracked in lock provenance. • Adds `PluginLockService` and a managed install flag to support plugin lifecycle management through the lock file. • Records certificate ref and runner in lock provenance, strengthening supply-chain traceability for installed servers. • Enforces recorded ref and runner fields during skill verification, so provenance is validated at use time. • Enables signing of pushes by default and removes the lock feature gate, making image signing the standard behavior. • Supports confidential clients in dynamic client registration, expanding OAuth client types available to the auth layer. • Makes RFC 8693 delegate (token-exchange) clients reachable and usable, enabling downstream token exchange workflows in `vmcp-config.yaml`. • Supports parsing of multi-line Modern SSE events, improving compatibility with SSE-based MCP transports. • Signs the macOS `thv` binary with a Developer ID certificate, removing Gatekeeper warnings for macOS users. • Adds rate-limiting observability via metrics and tracing (OpenTelemetry), covering the proxy rate-limit path. • Drops the build fingerprint from the proxy `/health` response, reducing information exposure on that endpoint. • Displays recorded trust state to the user in the CLI, surfacing container image trust information at runtime. • Resets the LLM config when the last tool is torn down, preventing stale LLM configuration from persisting after all tools exit. • Uses a bare `thv` command as the LLM token helper, simplifying the token-helper integration for LLM clients. • Ignores unsupported grant types in CIMD documents, improving interoperability with authorization servers that advertise non-standard grant types. https://github.com/stacklok/toolhive/releases/tag/v0.42.1 https://github.com/stacklok/toolhive/releases/tag/v0.42.1 Mon, 10 Aug 2026 10:21:23 GMT ToolHive v0.42.1 adds deny-by-default vMCP visibility, external OIDC trusted issuers, composite tool annotations, and a `TOOLHIVE_API_TIMEOUT` override. • Adds `aggregation.defaultToolVisibility: deny` to vMCP config so only workloads explicitly listed in `aggregation.tools` have their tools advertised, closing the fail-open gap in tool aggregation. • Adds `trusted_issuers` to the embedded auth server config, enabling agents to exchange subject tokens from external OIDC providers (Entra, Okta, Keycloak) for ToolHive-scoped delegated tokens under a fail-closed RFC 8693 consent policy. • Adds `TOOLHIVE_API_TIMEOUT` environment variable to override the CLI API client timeout for `thv skill` and `thv ai-plugin` commands (default is 10 minutes). • Adds `insecureAllowHTTP: true` field under `spec.inline` in `MCPOIDCConfig` to explicitly opt in to plain-HTTP issuer and JWKS URLs for dev/test environments; production configs must use HTTPS. • Composite tools now support MCP tool annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`), with a conservative fail-closed safety floor derived from the workflow's step tools when none are set explicitly. Breaking changes: • With Cedar authorization enabled (`--authz-config`), `POST` requests without `Content-Type: application/json` (including a missing header) now return `400` instead of being forwarded unauthorized; all MCP POST clients must send `Content-Type: application/json`. • vMCP tools excluded via `filter`, `excludeAll`, or `excludeAllTools` are no longer directly callable on the Modern (2026-07-28) path — `tools/call` now returns `-32602` at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool. • `MCPOIDCConfig` resources of `spec.type: inline` with a plain-HTTP, malformed, or scheme-less `issuer` or `jwksUrl` flip to `Valid=False` on next reconcile and block reconciliation of every `MCPServer`, `MCPRemoteProxy`, and `VirtualMCPServer` referencing them; add `insecureAllowHTTP: true` or switch to HTTPS. https://github.com/stacklok/toolhive/releases/tag/v0.42.1 https://github.com/stacklok/toolhive/releases/tag/v0.42.1 Mon, 10 Aug 2026 10:21:23 GMT ToolHive v0.42.1 adds deny-by-default vMCP visibility, external OIDC trusted issuers, composite tool annotations, and a `TOOLHIVE_API_TIMEOUT` override. • Adds `aggregation.defaultToolVisibility: deny` to vMCP config so only workloads explicitly listed in `aggregation.tools` have their tools advertised, closing the fail-open gap in tool aggregation. • Adds `trusted_issuers` to the embedded auth server config, enabling agents to exchange subject tokens from external OIDC providers (Entra, Okta, Keycloak) for ToolHive-scoped delegated tokens under a fail-closed RFC 8693 consent policy. • Adds `TOOLHIVE_API_TIMEOUT` environment variable to override the CLI API client timeout for `thv skill` and `thv ai-plugin` commands (default is 10 minutes). • Adds `insecureAllowHTTP: true` field under `spec.inline` in `MCPOIDCConfig` to explicitly opt in to plain-HTTP issuer and JWKS URLs for dev/test environments; production configs must use HTTPS. • Composite tools now support MCP tool annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`), with a conservative fail-closed safety floor derived from the workflow's step tools when none are set explicitly. Breaking changes: • With Cedar authorization enabled (`--authz-config`), `POST` requests without `Content-Type: application/json` (including a missing header) now return `400` instead of being forwarded unauthorized; all MCP POST clients must send `Content-Type: application/json`. • vMCP tools excluded via `filter`, `excludeAll`, or `excludeAllTools` are no longer directly callable on the Modern (2026-07-28) path — `tools/call` now returns `-32602` at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool. • `MCPOIDCConfig` resources of `spec.type: inline` with a plain-HTTP, malformed, or scheme-less `issuer` or `jwksUrl` flip to `Valid=False` on next reconcile and block reconciliation of every `MCPServer`, `MCPRemoteProxy`, and `VirtualMCPServer` referencing them; add `insecureAllowHTTP: true` or switch to HTTPS. https://github.com/stacklok/toolhive/releases/tag/v0.42.0 https://github.com/stacklok/toolhive/releases/tag/v0.42.0 Wed, 05 Aug 2026 13:26:20 GMT ToolHive v0.42.0 adds a full `thv ai-plugin` CLI and REST API, a registry catalog, and Sigstore signature verification for skills installs. • Adds `thv ai-plugin` subcommand with a full CLI and REST API for end-to-end AI-tool plugin management. • Introduces a registry catalog for discovering and managing AI-tool plugins. • Adds Sigstore signature verification for skills at install, sync, and upgrade time. • Enables multiple MCP clients to share a single stdio server simultaneously. • Stabilizes vMCP protocol negotiation, stopping flapping between Modern and Legacy MCP revisions. • Cedar authorization policy is now evaluated against the post-mutation MCP request, closing a bypass window for length-preserving mutating webhook rewrites. Breaking changes: • `status.referencingWorkloads`, `status.referenceCount`, and the `References` printer column are removed from all six config CRDs (`MCPOIDCConfig`, `MCPAuthzConfig`, `MCPExternalAuthConfig`, `MCPToolConfig`, `MCPWebhookConfig`, `MCPTelemetryConfig`); replace any automation reading them with workload field queries via `-o json | jq`. • Cedar policy and audit records now evaluate against the post-mutation MCP request body; re-audit Cedar policies and update SIEM rules keyed on `type` or `target.name` before upgrading workloads that combine a `mutating:` entry in `--webhook-config` (or `MCPWebhookConfig.spec.mutating`) with Cedar authorization. • Recovered HTTP panics no longer produce a `slog.Error` log line or stack trace; log-based alerts on recovered panics will silently stop firing unless Sentry is configured. • `pkg/telemetry/providers` is deleted and two `optimizerdec` constants are removed from the Go API; out-of-tree Go importers must drop references to these before upgrading. https://github.com/stacklok/toolhive/releases/tag/v0.42.0 https://github.com/stacklok/toolhive/releases/tag/v0.42.0 Wed, 05 Aug 2026 13:26:20 GMT ToolHive v0.42.0 adds a full `thv ai-plugin` CLI and REST API, a registry catalog, and Sigstore signature verification for skills installs. • Adds `thv ai-plugin` subcommand with a full CLI and REST API for end-to-end AI-tool plugin management. • Introduces a registry catalog for discovering and managing AI-tool plugins. • Adds Sigstore signature verification for skills at install, sync, and upgrade time. • Enables multiple MCP clients to share a single stdio server simultaneously. • Stabilizes vMCP protocol negotiation, stopping flapping between Modern and Legacy MCP revisions. • Cedar authorization policy is now evaluated against the post-mutation MCP request, closing a bypass window for length-preserving mutating webhook rewrites. Breaking changes: • `status.referencingWorkloads`, `status.referenceCount`, and the `References` printer column are removed from all six config CRDs (`MCPOIDCConfig`, `MCPAuthzConfig`, `MCPExternalAuthConfig`, `MCPToolConfig`, `MCPWebhookConfig`, `MCPTelemetryConfig`); replace any automation reading them with workload field queries via `-o json | jq`. • Cedar policy and audit records now evaluate against the post-mutation MCP request body; re-audit Cedar policies and update SIEM rules keyed on `type` or `target.name` before upgrading workloads that combine a `mutating:` entry in `--webhook-config` (or `MCPWebhookConfig.spec.mutating`) with Cedar authorization. • Recovered HTTP panics no longer produce a `slog.Error` log line or stack trace; log-based alerts on recovered panics will silently stop firing unless Sentry is configured. • `pkg/telemetry/providers` is deleted and two `optimizerdec` constants are removed from the Go API; out-of-tree Go importers must drop references to these before upgrading. https://github.com/stacklok/toolhive/releases/tag/v0.41.0 https://github.com/stacklok/toolhive/releases/tag/v0.41.0 Tue, 28 Jul 2026 17:10:55 GMT ToolHive v0.41.0 adds MCP 2026-07-28 spec support, `thv skill sync`/`upgrade` with lock file, RFC 8693 token exchange, and Envoy network isolation. • Adds `thv skill sync` to restore a project's pinned skill set on any machine and verify on-disk content in CI. • Adds `thv skill upgrade` to re-resolve pinned skills to newer content without silent lock drift. • Pins project-scoped skill installs in a `toolhive.lock.yaml` lock file, including Sigstore provenance fields. • Adds typed exit codes and a pre-install confirmation gate to `thv skill sync` and `thv skill upgrade` for scriptable CI use. • Adds opt-in strict `MCP-Protocol-Version` header validation for the streamable proxy. • Supports the MCP 2026-07-28 stateless ('Modern') spec revision end to end across transport proxies, transparent proxy, and Virtual MCP — bridging era-mismatched client×backend combinations. • Modern client-facing dispatch is gated per capability instead of a global kill-switch, with listen-stream support and pagination. • W3C trace context propagates through outbound MCP `_meta` (SEP-414), joining backend spans to the client→proxy→server trace. • Wires RFC 8693 token exchange into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token. • Subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can now be validated for RFC 8693 token exchange. • Audit logs capture the RFC 8693 `act` claim and full delegation chain, making 'agent X acting for Alice' distinguishable from Alice. • Dynamically registered OAuth clients now renew expiring client secrets automatically (RFC 7591/7592). • Multi-valued JWT claims can be normalized to canonical space-delimited form for Cedar policies. • Backend `list_changed` notifications are now consumed and propagated to clients for tools, resources, and prompts. • Virtual MCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server-to-client forwarding all work. • Guarantees `tools/list` pagination completeness for aggregated sets exceeding 1,000 tools. • Tool definitions carrying invalid `x-mcp-header` annotations (SEP-2243) are now rejected as the spec requires. • Readiness probe now sends the current MCP protocol version instead of a hardcoded 2024-11-05. • Adds an opt-in Envoy network-isolation backend. Breaking changes: • Namespace-scoped Helm installs (`operator.rbac.scope=namespace`) now fail `helm upgrade` at render time unless `operator.features.storageVersionMigrator: false` is set, because the StorageVersionMigrator controller is now enabled by default (`operator.features.storageVersionMigrator: true`). • JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code `-32600` instead of being executed; send individual requests. • Rate-limit JSON-RPC error code changed from `-32029` to `429`; clients branching on `error.code == -32029` must match `429` instead. https://github.com/stacklok/toolhive/releases/tag/v0.41.0 https://github.com/stacklok/toolhive/releases/tag/v0.41.0 Tue, 28 Jul 2026 17:10:55 GMT ToolHive v0.41.0 adds MCP 2026-07-28 spec support, `thv skill sync`/`upgrade` with lock file, RFC 8693 token exchange, and Envoy network isolation. • Adds `thv skill sync` to restore a project's pinned skill set on any machine and verify on-disk content in CI. • Adds `thv skill upgrade` to re-resolve pinned skills to newer content without silent lock drift. • Pins project-scoped skill installs in a `toolhive.lock.yaml` lock file, including Sigstore provenance fields. • Adds typed exit codes and a pre-install confirmation gate to `thv skill sync` and `thv skill upgrade` for scriptable CI use. • Adds opt-in strict `MCP-Protocol-Version` header validation for the streamable proxy. • Supports the MCP 2026-07-28 stateless ('Modern') spec revision end to end across transport proxies, transparent proxy, and Virtual MCP — bridging era-mismatched client×backend combinations. • Modern client-facing dispatch is gated per capability instead of a global kill-switch, with listen-stream support and pagination. • W3C trace context propagates through outbound MCP `_meta` (SEP-414), joining backend spans to the client→proxy→server trace. • Wires RFC 8693 token exchange into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token. • Subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can now be validated for RFC 8693 token exchange. • Audit logs capture the RFC 8693 `act` claim and full delegation chain, making 'agent X acting for Alice' distinguishable from Alice. • Dynamically registered OAuth clients now renew expiring client secrets automatically (RFC 7591/7592). • Multi-valued JWT claims can be normalized to canonical space-delimited form for Cedar policies. • Backend `list_changed` notifications are now consumed and propagated to clients for tools, resources, and prompts. • Virtual MCP is now MCP-conformant: completions, resource templates, subscriptions, and mid-call server-to-client forwarding all work. • Guarantees `tools/list` pagination completeness for aggregated sets exceeding 1,000 tools. • Tool definitions carrying invalid `x-mcp-header` annotations (SEP-2243) are now rejected as the spec requires. • Readiness probe now sends the current MCP protocol version instead of a hardcoded 2024-11-05. • Adds an opt-in Envoy network-isolation backend. Breaking changes: • Namespace-scoped Helm installs (`operator.rbac.scope=namespace`) now fail `helm upgrade` at render time unless `operator.features.storageVersionMigrator: false` is set, because the StorageVersionMigrator controller is now enabled by default (`operator.features.storageVersionMigrator: true`). • JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code `-32600` instead of being executed; send individual requests. • Rate-limit JSON-RPC error code changed from `-32029` to `429`; clients branching on `error.code == -32029` must match `429` instead.