ToolHive — The Cyber Toolchain

ToolHive v0.60.0

Mon, 02 Nov 2026 15:14:42 GMT

ToolHive adds `--scopes` flag to `thv llm setup` and `config set`, Redis storage for exchange grants, and refresh token issuance through token exchange⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Scope LLM authentication at setup time by passing `--scopes` to `thv llm setup` and `thv config set`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Store OAuth 2.0 exchange grants in Redis by configuring the new Redis storage backend for the token exchange subsystem. • Issue refresh tokens through token exchange, letting delegate clients obtain long-lived credentials without re-authentication. • Let DCR upstreams choose their token endpoint authentication method, expanding the range of identity providers that work with dynamic client registration. • Require a trust mode for `private_key_jwt` delegates, enforcing explicit trust configuration before asymmetric client authentication is permitted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.59.0

Wed, 28 Oct 2026 20:50:57 GMT

ToolHive adds Windows Claude Desktop credential helper support and TLS for operator-wide Redis defaults⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enable TLS for operator-wide Redis defaults to secure broker connections in Kubernetes deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • ToolHive now adds a credential helper for Windows Claude Desktop, extending client integration to Windows users. • Re-checks upstream Dynamic Client Registration (DCR) registrations while servers are running, keeping registrations current without restarts. • Adds in-memory backend storage for exchange grant data, supporting OAuth token exchange workflows. • Adds configured delegate client metadata support to expand OAuth delegation capabilities. • Adds Context7 ownership verification and expanded library configuration for the Context7 integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.58.0

Tue, 27 Oct 2026 12:03:24 GMT

ToolHive v0.58.0 adds opt-in AT+JWT token type for embedded AS access tokens and tightens auth-server lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds opt-in `at+jwt` `typ` header for embedded Authorization Server access tokens, enabling standards-compliant JWT typing for downstream consumers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Refuses refresh grants whose upstream credential has expired or been revoked, preventing silent use of dead credentials to obtain new tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.57.0

Mon, 26 Oct 2026 17:46:57 GMT

ToolHive v0.57.0 adds backend-scoped vMCP authorization, `authorization_details` token exchange, workload auth secret mounting, and OIDC transport wiring for `thv run`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `dcrConfig.registrationProbe` with an `authorization-endpoint` strategy for dynamic client registration probing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports `authorization_details` on token exchange requests, enabling fine-grained OAuth 2.0 Rich Authorization Requests (RAR) in vMCP token flows. • Wires OIDC transport flags into `thv run` auth middleware config, allowing OIDC settings to be passed directly at server launch. • Adds backend-scoped vMCP authorization, enabling per-backend access control policies on the Virtual MCP Server. • Mounts workload auth secrets in inline mode, so inline-mode deployments can consume workload identity credentials. • Adds opt-in upstream subject identifiers, letting operators surface the upstream identity subject in token and auth flows. • Lets delegate clients change policy on restart, so updated authorization policies take effect without full redeployment. • Lets embedders refuse refresh grants on dead upstreams, preventing silent token refresh against unreachable upstream services. • Classifies `MCPRemoteProxy` pods by container readiness rather than phase alone, improving accuracy of proxy pod health reporting. • Rejects request bodies on non-POST methods, hardening the MCP HTTP transport against malformed or abusive requests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.56.0

Thu, 22 Oct 2026 11:47:38 GMT

ToolHive v0.56.0 adds auth-server TLS/SPIFFE support, Claude Code gateway model discovery, and DCR client caps with 24h expiry in the CRD.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes DCR client cap and register rate limit as CRD fields, letting Kubernetes operators declare limits declaratively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds TLS listener and SPIFFE middleware to the auth server, and starts it in vMCP. • Caps Dynamic Client Registration (DCR) clients and expires unused ones after 24 hours. • Lets embedders skip OAuth consent for pre-authorized clients. • Decodes IPv4 addresses embedded in IPv4-compatible and SIIT (IPv4-mapped) IPv6 addresses. • Adds native Go fuzz targets for untrusted parsers. • Returns HTTP 401 when a token session holds no upstream access token. • Adds OSS Scanner audit configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.55.1

Mon, 19 Oct 2026 22:25:04 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.55.0

Mon, 19 Oct 2026 11:31:19 GMT

ToolHive v0.55.0 adds TLS/SPIFFE listener config, group-based vMCP upstream filtering, Pi LLM gateway support, and a Claude Desktop connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `dcrConfig.rotationKey` to re-register upstream DCR clients that have been evicted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes group-based upstream filter via the vMCP CRD, letting operators scope which upstreams a virtual MCP session can reach. • Adds TLS listener config and SPIFFE X.509 authority capability for securing MCP server endpoints. • Supports Pi in the LLM gateway setup. • Honors `PI_CODING_AGENT_DIR` environment variable for Pi MCP and skills configuration. • Adds `thv client connector` for Claude Desktop, enabling automatic client wiring. • Allows omitting scope on upstream token refresh, simplifying token exchange flows. • Restricts `pods/attach` RBAC permission to stdio transport only, tightening the least-privilege posture. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.54.0

Wed, 14 Oct 2026 17:18:03 GMT

ToolHive v0.54.0 adds Pi coding agent as a supported MCP client and a SPIFFE file bundle source for identity federation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Refreshes upstream tokens automatically when the ID token expires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.53.0

Tue, 13 Oct 2026 19:32:41 GMT

ToolHive v0.53.0 adds group-based upstream filtering in `authserver-config.yaml` for the vMCP embedded auth server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • `MCPServer.spec.permissionProfile` is deprecated; the Kubernetes operator now ignores it, emits a `PermissionProfileUnsupported` Warning event on MCPServers that set it, and `thv export --format k8s` no longer emits the field — use `podTemplateSpec` security contexts and `NetworkPolicy` resources instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • The Kubernetes operator no longer passes `spec.permissionProfile` to the runner; MCPServers that set the field may have their proxy pods rolled once after upgrading. • The `configmap` profile volume is no longer mounted by the operator. • `thv export --format k8s` no longer emits the `spec.permissionProfile` field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.52.0

Mon, 12 Oct 2026 17:37:12 GMT

ToolHive v0.52.0 adds TLS for Redis session storage, safer `thv llm` teardown defaults, and one-hour Claude Code prompt caching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `spec.sessionStorage.tls` (including `caCertSecretRef` for a private CA) to `MCPServer`, `MCPRemoteProxy`, and `VirtualMCPServer` Kubernetes resources, enabling TLS-encrypted Redis session storage in the operator; a startup WARN is logged when Redis runs without TLS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables TLS for Redis session storage in the proxy runner, vMCP, and their rate limiters, with support for system roots or a private CA bundle. • `thv llm setup` now configures Claude Code for one-hour prompt caching by default; pass `--short-prompt-cache` to opt out. • `thv llm teardown` now accepts `--keep-tokens` to preserve cached OIDC tokens when tearing down all configured LLM tools. Breaking changes: • `thv llm teardown` now purges cached OIDC tokens by default on a full teardown (all tools removed) and exits non-zero if the secrets provider is unavailable or token operations fail. Scripts that relied on tokens surviving teardown must add `--keep-tokens`. `--keep-tokens` and `--purge-tokens` are mutually exclusive. • Out-of-tree Go implementations of `pkg/authserver/storage.DCRCredentialStore` no longer compile until they add the new `UpdateDCRCredentialsIfUnchanged(ctx context.Context, creds *DCRCredentials, expected *DCRCredentials) error` method. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.51.0

Tue, 22 Sep 2026 12:16:30 GMT

ToolHive v0.51.0 adds SPIFFE JWT-SVID authentication for MCP clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Authenticates MCP clients using SPIFFE JWT-SVIDs, enabling workload identity-based access control for MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.50.0

Fri, 18 Sep 2026 15:27:59 GMT

ToolHive v0.50.0 adds RFC 8707 resource indicators, RFC 8628 device authorization grant, ID-JAG assertion support, catalog provenance enforcement, and Argon2id secrets key derivation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds RFC 8707 resource indicator parameters to the auth server's token-request handling, enabling audience-bound token requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds RFC 8628 device authorization grant (device flow) support, including a device flow verification page and Dynamic Client Registration (DCR) support. • Adds acceptance of ID-JAG assertions via a bound JWT-bearer handler in the auth server. • Enforces catalog provenance for plugin installs, ensuring plugins are verified against registry provenance before installation. • Derives the secrets encryption key using Argon2id, replacing the previous key derivation approach. • Adds lock-driven skill key rotation and plugin key rotation workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.49.0

Fri, 11 Sep 2026 18:41:44 GMT

ToolHive v0.49.0 ships a dependency-light generated Go client for the management API and per-backend dial-control policy via `session.WithDialControlResolver`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `session.WithDialControlResolver` to `pkg/vmcp/session`, replacing `WithDialControl` with a per-backend dial-policy resolver so different network controls can be applied per workload ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `tokenEndpointAuthMethod` / `token_endpoint_auth_method` field to `oauth2` upstream provider config, enabling explicit selection of `client_secret_basic` or POST-body credential delivery per upstream. Breaking changes: • `session.WithDialControl` in `pkg/vmcp/session` is removed; call sites must be migrated to `session.WithDialControlResolver` or the build fails with `undefined: session.WithDialControl`. Note: the identically-named `pkg/vmcp/client.WithDialControl` is unchanged. • OAuth2 upstream `tokenEndpointAuthMethod` default is reverted: upgrading from v0.48.0 with a pre-registered `oauth2` upstream that had a client secret and no explicit `tokenEndpointAuthMethod` reverts from `client_secret_basic` back to POST-body credential delivery; IdPs that require HTTP Basic must now set `tokenEndpointAuthMethod: client_secret_basic` explicitly. • AWS STS role claims of type object, number, boolean, or null now fail closed with HTTP 403 instead of silently granting the fallback role; a bare-string claim that exactly matches a configured `claim` now selects its mapped role instead of `fallbackRoleArn`. • The root Go module now requires Go 1.27; builds using `GOTOOLCHAIN=local` pinned to Go 1.26 will fail with `go: go.mod requires go >= 1.27`. The `go://` workload default builder image moves from `golang:1.26-alpine` to `golang:1.27-alpine`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.47.0

Tue, 08 Sep 2026 11:24:08 GMT

ToolHive v0.47.0 adds SPIFFE trust config, key-signed artifact verification, configurable proxy body limits, and Cedar delegation without upstream sessions. • Adds SPIFFE trust configuration and exposes SPIFFE client-auth registration through the operator CRDs. • Verifies key-signed skill and plugin installs against a public key, and records the pinned cosign key in the lock schema. • Honoured pinned cosign key is now applied on `sync` and `upgrade` operations, and plugin pushes are signed with the lock feature gate removed. • Makes proxy request-body limit configurable. • Allows Cedar delegation without requiring an upstream session. • Exposes canonical inbound grants in CRDs. • Allows embedded auth servers to operate without upstreams. • Guards OIDC discovery against private IPs. • Trusts private CAs for RFC 8693 trusted issuers. • Routes Claude workflows through the Stacklok LLM gateway. • Detects GUI editors without a PATH binary. • Suppresses OAuth callback Referer header. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.46.0

Thu, 27 Aug 2026 17:04:19 GMT

ToolHive v0.46.0 adds private-CA trust for OIDC upstreams and signer-rotation blocking on plugin upgrades • Adds `--allow-signer-change` flag to `thv ai-plugin upgrade`, which re-records a new signer identity in the project lock file; without it, upgrades whose signature identity differs from the lock file (or that are unsigned) exit with code 4 and report `signer-change-blocked`. • Adds `caBundleRef` field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to an in-cluster identity provider. • Controlled by the `TOOLHIVE_PLUGINS_LOCK_ENABLED` environment variable; lock entries with no recorded provenance are unaffected by the new signer-rotation check. Breaking changes: • The `operator-crds` chart must be updated to 0.46.0 before or together with the operator chart — a stale CRD silently prunes `caBundleRef` from applied resources instead of rejecting it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.45.0

Wed, 26 Aug 2026 13:23:20 GMT

ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523 auth flows, Prometheus diagnostics port, and a new `qoder` skill client. • Adds `Content-Type: application/json` enforcement and `Origin` validation to the `thv serve` management API for TCP listeners, blocking CORS-based cross-origin attacks (GHSA-xv9h-79wp-q9w6). • Constrains `npx://`, `uvx://`, and `go://` package names to `[A-Za-z0-9@/:._+=~[]-]` at build time, preventing shell metacharacter injection into generated Dockerfiles. • Adds end-to-end Sigstore bundle verification for plugin artifacts; stored bundles and git commit payloads/signatures are now size-capped at 1 MiB (rejected with 422 above that limit). • `thv skill push` now signs artifacts keylessly by default; requires exactly one of `--key`, `--identity-token`, or `--no-sign`. • Adds two new RFC 7523 flows to the embedded auth server. • Adds `qoder` as the 18th skill-supporting client; `thv skill sync` without `--clients` now targets every skill-supporting client including `.qoder/skills/`. • Virtual MCP now honours `operational.timeouts` and propagates backend health changes to live sessions. • Non-2xx list responses from backends are now correctly forwarded with their original status code instead of being delivered as HTTP 200 with an unfiltered body. • A UTF-8 BOM in `tools/list`, `prompts/list`, or `resources/list` responses no longer bypasses Cedar policy or tool-filter authorization. Breaking changes: • `thv serve` now requires `Content-Type: application/json` on state-changing requests that carry a body over TCP; callers without it receive `415 Unsupported Media Type`. UNIX-socket paths (`--socket=`) are unaffected. • `thv serve` now validates `Origin` against a loopback-only allowlist for TCP listeners; non-loopback binds log a `WARN` and pass through. • Package names for `npx://`, `uvx://`, and `go://` references are now constrained to `[A-Za-z0-9@/:._+=~[]-]`; references containing other characters fail at build time instead of being interpolated into the Dockerfile. • `thv skill sync` without `--clients` now targets every skill-supporting client; existing locked skills are reported as drifted on first sync after upgrade, and `thv skill sync --check` exits non-zero in CI until re-synced. • `runtime_config.build_with` on `npx://` or `go://` images via `POST /api/v1beta/workloads` now returns `400 Bad Request` instead of silently discarding the field. • `thv skill push` now returns 400 if both `--key` and `--no-sign` are specified; exactly one of `--key`, `--identity-token`, or `--no-sign` is required. • Virtual MCP now honours `operational.timeouts`; a configured value below 30 s will now actually cut backend calls that previously silently got the 30 s default. • The `thv llm` local proxy returns `401 token_required` instead of `502 server_error` when the stored credential has been rejected by the IdP. • Exported Go interfaces `plugins.MaterializationAdapter`, `state.Store` writers, `storage.UpstreamTokenStorage`, and six function signatures gained required methods or changed signatures; no effect on the CLI, operator, wire protocol, or persisted state. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.44.0

Tue, 18 Aug 2026 16:37:51 GMT

ToolHive v0.44.0 adds actor_token support in RFC 8693 token exchange and hardens OAuth/delegation security. • Supports `actor_token` parameter in RFC 8693 token exchange flows, enabling richer delegation chains in outgoing authentication. • Guards OAuth token and DCR (Dynamic Client Registration) endpoints against SSRF attacks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.43.0

Fri, 14 Aug 2026 15:58:12 GMT

ToolHive v0.43.0 adds confidential client support, RFC 8693 delegate clients, lock file plugins, macOS binary signing, and rate-limiting observability. • Adds `plugins` key to the lock file schema, enabling plugin entries to be tracked in lock provenance. • Adds `PluginLockService` and a managed install flag for plugin lifecycle management. • Records certificate ref and runner in lock provenance, and enforces them on skill verification. • Supports confidential clients in dynamic client registration for OAuth flows. • Makes RFC 8693 delegate clients reachable and usable for token-exchange workflows. • Signs pushes by default and removes the lock feature gate (previously required opt-in). • Adds rate-limiting observability via metrics and tracing (OpenTelemetry). • Displays recorded trust state to the user in the CLI. • Parses multi-line Modern SSE events, broadening SSE protocol compatibility. • Drops build fingerprint from the proxy `/health` response to reduce information exposure. • Resets the LLM config automatically when the last tool is torn down. • Uses a bare `thv` command as the LLM token helper. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.42.1

Mon, 10 Aug 2026 10:21:23 GMT

ToolHive v0.42.1 adds deny-by-default vMCP visibility, MCP tool annotations for composite tools, external OIDC trusted_issuers, and TOOLHIVE_API_TIMEOUT • Adds `aggregation.defaultToolVisibility: deny` to vMCP config so only workloads explicitly listed in `aggregation.tools` have their tools advertised, closing the fail-open gap where adding a workload to a group silently exposed it. • Adds `insecureAllowHTTP: true` under `spec.inline` of `MCPOIDCConfig` to explicitly opt in to plain-HTTP issuer and JWKS URLs in dev/test environments; inline configs without it now validate both `issuer` and `jwksUrl` at reconcile time. • Adds `TOOLHIVE_API_TIMEOUT` environment variable to override the CLI's API client timeout for `thv skill` and `thv ai-plugin` commands (new default is 10 minutes). • Composite tools now support MCP tool annotations — `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` — with a fail-closed safety floor derived from step tools when none are set explicitly. • The embedded auth server now accepts `trusted_issuers` configuration, enabling agents to exchange subject tokens minted by external OIDC providers (Entra, Okta, Keycloak) for ToolHive-scoped delegated tokens under an RFC 8693 fail-closed consent policy. Breaking changes: • With Cedar authorization enabled (`--authz-config` or `authzConfig` in the CRD), `POST` requests without `Content-Type: application/json` (including a missing header) now return `400` instead of being forwarded; all MCP POST requests must send `Content-Type: application/json`. • vMCP tools excluded via `aggregation.tools` `filter`, per-workload `excludeAll`, or global `excludeAllTools` are no longer directly callable on the Modern (2026-07-28) path — direct `tools/call` now returns JSON-RPC error `-32602` at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool to keep it reachable. • `MCPOIDCConfig` resources of `spec.type: inline` with a plain-HTTP, malformed, or scheme-less `issuer` or `jwksUrl` now flip to `Valid=False` on their next reconcile and block reconciliation of every `MCPServer`, `MCPRemoteProxy`, and `VirtualMCPServer` referencing them; switch to HTTPS or add `insecureAllowHTTP: true` under `spec.inline`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.42.0

Wed, 05 Aug 2026 13:26:20 GMT

thv ai-plugin gets a full CLI + REST API, registry catalog, and Sigstore signature verification at install/sync/upgrade • Adds `thv ai-plugin` subcommand with a full CLI and REST API for end-to-end AI-tool plugin management. • Adds a registry catalog to `thv ai-plugin` for discovering and deploying plugins from a curated index. • Adds Sigstore signature verification for skills/plugins at install, sync, and upgrade time. • Enables multiple MCP clients to share a single stdio server concurrently. Breaking changes: • `status.referencingWorkloads` and `status.referenceCount` fields (and the `References` printer column) are removed from all six config CRDs (`MCPOIDCConfig`, `MCPAuthzConfig`, `MCPExternalAuthConfig`, `MCPToolConfig`, `MCPWebhookConfig`, `MCPTelemetryConfig`); replace any automation that reads them with workload field queries. • Cedar authorization policy is now evaluated against the post-mutation MCP request — if you run a mutating webhook (`--webhook-config` with a `mutating:` entry, or `MCPWebhookConfig.spec.mutating`) alongside Cedar authz, policy decisions and audit records (`type`, `target.name`) can change on upgrade; re-audit policies against the post-mutation shape before upgrading. • Recovered HTTP panics no longer emit a `slog.Error` log line or stack trace — setups relying on log-based alerts or support bundles to diagnose recovered panics will silently lose that diagnostic output (a patch fix is expected). • `pkg/telemetry/providers` was deleted and two long-published `optimizerdec` constants were removed from the Go API, breaking any out-of-tree importers that reference them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.41.0

Tue, 28 Jul 2026 17:10:55 GMT

ToolHive v0.41.0 adds MCP 2026-07-28 support, reproducible skill lock files, RFC 8693 token exchange, and an Envoy network-isolation backend. • Supports the MCP 2026-07-28 stateless ('Modern') spec across all proxies and Virtual MCP, bridging era-mismatched client×backend combinations automatically. • Virtual MCP is now fully MCP-conformant: completions, resource templates, subscriptions, and mid-call server→client forwarding (progress, sampling, elicitation) all work. • Adds `thv skill sync` to restore a project's pinned skill set on any machine and verify on-disk content in CI. • Adds `thv skill upgrade` to re-resolve pinned skills to newer content without silent lock drift. • Project-scoped skill installs are now pinned in a `toolhive.lock.yaml` lock file for reproducibility. • Sigstore signing groundwork for skill OCI artifacts: provenance fields in the lock schema, a signer package, and commit-signature plumbing with bundle storage. • RFC 8693 token exchange is wired into the embedded authorization server's token endpoint, with delegated token audience bounded by the subject token. • Subject tokens from trusted external OIDC issuers (Keycloak, Entra, Okta) can be validated for token exchange. • Audit logs capture the RFC 8693 `act` claim and full delegation chain, making 'agent X acting for Alice' distinguishable from Alice. • Dynamically registered OAuth clients renew expiring client secrets automatically per RFC 7591/7592. • Multi-valued JWT claims can be normalized to canonical space-delimited form for Cedar policies. • W3C trace context propagates through outbound MCP `_meta`, joining backend spans to the client→proxy→server trace. • Backend `list_changed` notifications are propagated to clients for tools, resources, and prompts. • Opt-in strict `MCP-Protocol-Version` header validation for the streamable proxy. • Sync and upgrade commands gain typed exit codes and a pre-install confirmation gate for scriptable CI use. Breaking changes: • Namespace-scoped operator installs (`operator.rbac.scope=namespace`) now fail `helm upgrade` at render time unless `operator.features.storageVersionMigrator: false` is explicitly set, because the StorageVersionMigrator controller is enabled by default. • JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code `-32600` instead of being executed; send individual requests. • The rate-limit JSON-RPC error code changed from `-32029` to `429`; clients branching on `error.code == -32029` must match `429` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.40.1

Mon, 20 Jul 2026 08:32:36 GMT

ToolHive v0.40.1 adds per-session prompt serving in vMCP and audit logging for authorization denials on the proxy runner path. • Serves MCP prompts on a per-session basis in VirtualMCP (vMCP), enabling session-scoped prompt isolation. • Audits authorization denials on the proxy runner path, giving operators a log trail of rejected requests. • Respects DCR-negotiated token endpoint authentication methods, improving standards-compliant OAuth flows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.40.0

Fri, 17 Jul 2026 15:42:56 GMT

ToolHive v0.40.0 adds RFC 8693 token exchange for agentic delegation and early MCP 2026-07-28 revision support. • Adds RFC 8693 OAuth 2.0 Token Exchange grant handler to the embedded authorization server, enabling agents to exchange a user token for a delegated token carrying both the user (`sub`) and the acting agent (`act.sub`) — the foundation for agentic delegation. • Adds request-parsing support for the upcoming MCP 2026-07-28 ('Modern') stateless revision, including a revision classifier, `Mcp-Method`/`Mcp-Name` headers, `_meta` vocabulary, and `server/discover`/`subscriptions/listen` authz registration (dormant until wired into proxy routing). • Migrates MCP protocol handling from `mark3labs/mcp-go` to the official `modelcontextprotocol/go-sdk` via the `toolhive-core/mcpcompat` compatibility shim. Breaking changes: • The stdio bridge now forwards only progress/message notifications; `tools/list_changed` and similar notifications are dropped, so dynamic-capability servers may show stale capability lists until clients re-list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.39.0

Thu, 16 Jul 2026 15:44:11 GMT

ToolHive v0.39.0 adds AWS Bedrock compatibility flag to the LLM setup command. • Adds a Bedrock compatibility flag to `thv llm setup`, enabling AWS Bedrock as an LLM backend. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.38.0

Wed, 15 Jul 2026 17:26:10 GMT

ToolHive v0.38.0 adds Codex App LLM setup support. • Adds Codex App LLM setup support for configuring ToolHive with the Codex App. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.37.0

Wed, 15 Jul 2026 12:39:37 GMT

ToolHive v0.37.0 adds podTemplateSpec support for MCPRemoteProxy and exposes --allow-docker-gateway in the workload API. • Adds `spec.podTemplateSpec` support to `MCPRemoteProxy`, enabling Kubernetes-native pod customization for remote MCP proxies. • Exposes `--allow-docker-gateway` option in the workload API, allowing workloads to reach the Docker host gateway network. • Adds runtime-stage environment variables to protocol Dockerfiles, enabling environment configuration at container runtime. • Adds MCP conformance CI validation for `thv run proxy`, improving protocol compliance guarantees. • Validates `aud` and `resource` claims in returned ID-JAG JWTs, strengthening authentication token verification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.36.0

Tue, 14 Jul 2026 10:40:11 GMT

ToolHive v0.36.0 adds OpenAI Codex CLI direct-mode support to the `thv llm setup` command. • Adds Codex CLI direct-mode support to `thv llm setup`, enabling direct LLM connections alongside existing proxy-mode configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.35.0

Mon, 13 Jul 2026 20:04:07 GMT

ToolHive v0.35.0 adds rate-limiting observability, HTTP OIDC issuer support, and new backend discovery APIs. • Adds metrics and tracing for rate limiting, enabling observability into throttling behavior. • Supports HTTP upstream OIDC issuers for in-cluster development environments. • Adds `ListBackends` and `LookupBackend` methods to the vMCP core interface for programmatic backend discovery. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.34.0

Tue, 07 Jul 2026 10:40:04 GMT

ToolHive v0.34.0 adds plugin lifecycle management, Claude Desktop gateway support, and Cedar nested-map claim authorization. • Adds plugin install/list/info/uninstall commands plus a MaterializationAdapter for managing ToolHive plugins. • Adds Claude Desktop as a supported LLM gateway client. • Supports nested map claims in Cedar authorization for the `act` claim, enabling richer policy evaluation. • Allows custom HTTP headers on the OpenAI embedding client for flexible authentication and routing. • Filters the upstream auth chain via a configurable callback hook (`UpstreamFilter`) exposed through the `authserver.New` facade. • Preserves external annotations on operator-managed Kubernetes Services across reconciliation cycles. • Sorts aggregated tools by name for deterministic embedding order. Breaking changes: • The `--allow-docker-gateway` flag now actively grants host-level network access rather than merely unblocking it, which changes the effective network permissions for containers using this flag. • The Amp editor extension clients have been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.33.0

Wed, 01 Jul 2026 14:10:59 GMT

ToolHive v0.33.0 adds rate limiting on VirtualMCPServer and XAA auth strategy CRD support. • Supports configuring rate limits on VirtualMCPServer via the new rate-limit configuration. • Adds XAA authentication strategy support as a CRD for MCP server access control. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.32.0

Tue, 30 Jun 2026 16:43:21 GMT

ToolHive v0.32.0 adds XAA cross-app auth, OBO strategy seam, upstream ID-token propagation, OpenAI-compatible embeddings, and Origin/DNS-rebind protection. • Adds XAA (Cross-Application Access) outgoing auth strategy implementing the ID-JAG two-step token exchange (RFC 8693 → RFC 7523) for per-backend cross-application access tokens. • Surfaces upstream ID tokens through the auth middleware, consolidating access and ID token retrieval into a single bulk lookup. • Adds the vMCP OBO (on-behalf-of) strategy seam — a new optional `OBO` field on `BackendAuthStrategy` with strategy registration and override hook. • Enables the vMCP optimizer to use an OpenAI-compatible embedding client via optional `embeddingProvider`/`embeddingModel` config fields (defaults to TEI, so existing configs are unchanged). • Adds `insecureAllowHTTP` to `EmbeddedAuthServerConfig` to allow an `http://` issuer for in-cluster VirtualMCPServer deployments, with admission-time validation. • Adds HTTP Origin header validation (MCP 2025-11-25 DNS-rebind protection) and a new `--allowed-origins` flag on `thv run` and `thv proxy` for SSE CORS control. • Operator Helm chart now prints a post-install `NOTES.txt` with verification commands, a minimal MCPServer example, and documentation links. Breaking changes: • ToolHive now validates the HTTP `Origin` header and removed `Access-Control-Allow-Origin: *` from the legacy SSE transport; browser clients on a non-`http://localhost` origin must pass the new `--allowed-origins` flag to `thv run` or `thv proxy`. • `pkg/vmcp/server.New` dropped its `discovery.Manager` parameter (7 → 6 args) and the `pkg/vmcp/discovery` package was removed; out-of-tree Go code calling `server.New` must remove the `discovery.Manager` argument, ensure `Config.Aggregator` is non-nil, and pair `Config.AuthzMiddleware` with `Config.Authz` or receive `ErrInvalidConfig`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.31.0

Wed, 24 Jun 2026 19:47:54 GMT

ToolHive v0.31.0 adds opt-in code mode decorator for vMCP and allows private IPs for OIDC/OAuth2 • Adds `--code-mode` CLI flag to enable the new opt-in code mode decorator for vMCP sessions • Removes private IP restriction for in-cluster OIDC and OAuth2 upstream providers, allowing self-hosted IdPs Breaking changes: • Removed dead legacy session-registration path and session-factory aggregation logic; configurations relying on these internal components will fail Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.30.1

Tue, 23 Jun 2026 23:38:55 GMT

ToolHive v0.30.1 adds network isolation defaults, OIDC subjectClaim selection, global Redis store config, and new Go APIs. • New `--isolate-network` and `--allow-docker-gateway` flags on `thv run` enable default network isolation for local MCP servers • New optional `subjectClaim` field on `MCPOIDCConfig` CRD and Go config allows selecting the OIDC subject claim instead of hardcoded `sub` • New `operator.defaultRedis` (or `global.redis`) operator config key sets a global default Redis/Valkey session store for workloads lacking explicit storage • New public `NewKubernetesBackendRegistry` constructor enables live Kubernetes-driven backend discovery for vMCP embedders • REST API `network_isolation` field now defaults to enabled (optional `*bool`) when omitted in create/modify requests Breaking changes: • `thv run` and REST API-created workloads now have network isolation ON by default; omitting `--isolate-network=false` or `"network_isolation": false` will block host access • The `thv mcp serve` command and `--experimental-mcp*` flags are removed, breaking scripts relying on the unauthenticated embedded MCP control-plane server • A non-Cedar `authzConfigRef` on a `VirtualMCPServer` now fails reconciliation instead of being silently ignored Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.30.0

Tue, 16 Jun 2026 18:55:23 GMT

ToolHive v0.30.0 adds rate limiting, header passthrough, CRD-based auth, and headless OIDC for virtual MCP servers. • `spec.config.rateLimiting` on `VirtualMCPServer` enables shared and per-user token bucket rate limiting backed by Redis session storage • New `MCPAuthzConfig` CRD allows any registered authorizer backend (e.g. Cedar, HTTP PDP) to be referenced via `authzConfigRef` on `MCPServer`, `MCPRemoteProxy`, and `VirtualMCPServer` • `spec.passthroughHeaders` on `VirtualMCPServer` allows an allowlist of incoming header names to be forwarded unchanged to backend services • `spec.replicas` and `spec.sessionStorage` on `MCPRemoteProxy` enable high-availability deployments with load balancing and Redis-backed shared session state • OBO external-auth type on `MCPExternalAuthConfig` now exposes a configuration schema (`tenantId`, `authority`, `clientId`, etc.) for Microsoft Entra On-Behalf-Of flow • New `disableUpstreamTokenInjection` flag on the embedded auth server allows MCP clients to authenticate via OAuth while forwarding unauthenticated requests to the backend • `--skip-browser` flag on `thv llm setup`, `thv llm token`, and `thv llm proxy start` prints the OIDC authorization URL instead of opening a browser Breaking changes: • Go code implementing `AuthorizerFactory` must add the required `ConfigKey() string` method to compile. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.29.2

Wed, 10 Jun 2026 18:29:24 GMT

ToolHive v0.29.2 adds security headers to REST API and fixes OTLP header delivery • Adds `X-Content-Type-Options: nosniff` and `Cross-Origin-Resource-Policy: same-origin` headers to all `thv` REST API responses. • OTLP exporter headers from the `OTEL_EXPORTER_OTLP_HEADERS` environment variable are no longer dropped on `POST /api/v1/workloads`. Breaking changes: • The `MCPRegistry` CRD is deprecated and will be removed in a future release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.29.1

Thu, 04 Jun 2026 12:48:38 GMT

ToolHive v0.29.1 adds `--lazy` flag to `thv llm setup` and defines VMCP core interface. • Adds `--lazy` flag to `thv llm setup` to enable lazy mode for deferred LLM configuration • Defines VMCP core interface and Config contract to standardize MCP backend interactions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.28.0

Tue, 19 May 2026 15:05:20 GMT

ToolHive v0.28.0 adds `TOOLHIVE_SKIP_UPDATE_CHECK`, RFC 7523 JWT auth, registry refresh API, and GitHub Copilot CLI support • Adds `TOOLHIVE_SKIP_UPDATE_CHECK` environment variable to disable update checks • Adds RFC 7523 JWT Bearer grant package support • Adds identityFromToken field to MCPExternalAuthConfig CRD • Adds API endpoint to refresh the registry cache • Adds GitHub Copilot CLI as a supported MCP client Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.27.2

Tue, 12 May 2026 12:18:02 GMT

ToolHive v0.27.2 adds forward of MCPServerEntry header in vMCP traffic and OTEL config support for API-created workloads. • Forward `MCPServerEntry` header to vMCP outbound requests • Apply OTEL configuration to workloads created via the API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.27.1

Mon, 11 May 2026 09:14:57 GMT

ToolHive v0.27.1 adds Windows named-pipe support to the API listener and a Redis backend for DCRCredentialStore. • Restrict Windows named-pipe DACL to creating user • Add persistent DCRCredentialStore types and memory backend • Expose explicit primaryUpstreamProvider for Cedar authz on VirtualMCPServer Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.27.0

Thu, 07 May 2026 06:06:05 GMT

Adds `--client` flag for LLM setup, DCR credential store with Redis/Redis Cluster support, Envoy AI Gateway path prefix flag, and Gemini CLI .env injection. • `thv llm setup` and `thv llm teardown` now accept the `--client` flag to specify the OAuth client • Support for CIMD (Confidential Client ID) as the preferred OAuth client registration method in `thv run` • Auth server storage now supports standalone Redis and Redis Cluster mode via a new DCR credential store and resolver • Adds `--anthropic-path-prefix` flag to control path routing for the Envoy AI Gateway integration • Automatic injection of Gemini CLI `.env` file during LLM gateway proxy setup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.26.1

Thu, 30 Apr 2026 11:06:43 GMT

ToolHive v0.26.1 adds `--tls-skip-verify` to LLM commands and DCR discovery for auth servers • Adds `--tls-skip-verify` flag to `thv llm setup`, `config set`, and `proxy start` commands. • Adds authserver DCR discovery and config surface. • Make Cedar group entity type name configurable. • Auto-detect Docker Desktop socket on Linux. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.26.0

Wed, 29 Apr 2026 16:48:47 GMT

Adds interactive TUI dashboard for MCP servers and `awsSts` auth type for vMCP • Adds `interactive TUI dashboard` for managing MCP servers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.25.0

Tue, 28 Apr 2026 11:32:37 GMT

ToolHive v0.25.0 adds `thv llm` commands for LLM gateway config and token management plus `thv registry convert`. • Add `thv llm` command group with subcommands to manage LLM gateway configuration and tokens • Add `thv registry convert` command to transform registry configurations Breaking changes: • Drop legacy registry format support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.24.1

Thu, 23 Apr 2026 14:08:43 GMT

ToolHive v0.24.1 adds `--debug` to `vmcp`, new OCI pull fallback, and exposes OAuth exchange fields. • Adds `--debug` flag to the `vmcp` subcommand to enable debug output in virtual MCP sessions • Exchanges Config fields via shared OAuth constants, allowing access to raw exchange response data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.24.0

Wed, 22 Apr 2026 14:17:25 GMT

Enables `thv vmcp` CLI commands for local vMCP support • `thv vmcp` commands are now enabled by default and documented in the local vMCP architecture guide. • Local skill builds are automatically marked with an OCI descriptor annotation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.23.0

Tue, 21 Apr 2026 15:21:30 GMT

ToolHive v0.23.0 adds server-scoped Cedar policy support and CRD API stability via v1beta1. • CRDs now serve `toolhive.stacklok.dev/v1beta1` as the storage version • Server-scoped Cedar policies like `resource in MCP::""` now work Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.19.0

Mon, 13 Apr 2026 16:45:01 GMT

ToolHive v0.19.0 adds webhook auth for `thv run`, multi-client skills install, Skills API v0.1, and Cursor client support • `thv run` gains `--webhook-url`, `--webhook-timeout`, and `--webhook-failure-policy` flags to enable webhook-based tool call authorization • Two new Skills API v0.1 endpoints for browsing and fetching skills from the registry • `thv skills install` now accepts `--clients` (comma-separated) or `--all-clients` to install to multiple clients in a single command with atomic rollback on failure • Cursor is now recognized as a skill-supporting client • MCPRemoteProxy gains `telemetryConfigRef` for shared telemetry configuration Breaking changes: • `remoteURL` and `externalURL` JSON tags are renamed to `remoteUrl` and `externalUrl`; existing MCPRemoteProxy and MCPServerEntry resources in etcd will silently lose their values unless manifests are updated and re-applied • Skills install API `client` field is replaced by `clients`; CLI `--client` flag is removed in favor of `--clients` or `--all-clients` • `enforceServers` is removed from MCPRegistry; manifests containing this field will fail validation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.18.0

Fri, 10 Apr 2026 16:30:00 GMT

ToolHive v0.18.0 adds per-user rate limiting and transparent proxy health check env vars; breaks legacy MCPRegistry config fields. • Configures `spec.configYAML` on `MCPRegistry` resources for sources, registries, database, and auth settings • Sets `perUser` field on `RateLimitConfig` to enable per-user token bucket rate limits at server or tool level • Uses environment variables to configure transparent proxy health check interval, timeout, and failure threshold Breaking changes: • MCPRegistry CRD `spec.sources`, `spec.registries`, `spec.databaseConfig`, `spec.authConfig`, and `spec.telemetryConfig` fields are removed; resources must migrate to the required `spec.configYAML` field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.17.0

Thu, 09 Apr 2026 20:07:22 GMT

ToolHive v0.17.0 adds MCPServerEntry CRD for zero-infrastructure catalogs, mutating webhook JSONPatch middleware, and rate limiting. • Adds `MCPServerEntry` CRD for declaring remote MCP servers as lightweight catalog entries without proxy pods • Adds JSONPatch support to mutating webhook middleware for dynamic request/response mutation • Adds rate-limiting middleware that returns HTTP 429 with `-32029` error for `tools/call` requests • Adds `authServerRef` field on MCPServer and MCPRemoteProxy CRDs to configure outgoing token exchange alongside embedded auth • Adds `configYAML` passthrough field on MCPRegistry CRD to bypass operator typed-field parsing with direct `config.yaml` control • Adds `caBundleRef` field on `MCPTelemetryOTelConfig` to mount custom CA bundles for OTLP exporters • Adds `supports_skills` field to `GET /api/v1beta/discovery/clients` API response • Introduces type-safe `UpdateRegistryConfig` and `DeleteRegistryConfig` structs for registry policy gates Breaking changes: • The `.status.phase` value for MCPServer, EmbeddingServer, and MCPRegistry is renamed from `Running` to `Ready` • MCPRegistry CRD spec replaces flat `registries[]` with separate top-level `sources[]` and `registries[]` fields; PVC-based registry sources are removed • MCPRegistryStatus flattens `.status.syncStatus` and `.status.apiStatus` to `.status.phase`, `.status.conditions` (type Ready), `.status.readyReplicas`, and `.status.url` • The legacy MCPRegistry typed spec fields `spec.sources[]`, `spec.registries[]`, `spec.databaseConfig`, `spec.authConfig`, and `spec.telemetryConfig` are deprecated in favor of `spec.configYAML` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive

ToolHive v0.14.1

Mon, 30 Mar 2026 15:07:47 GMT

Adds scoped and user secret providers with system key isolation; fixes OTel config respect, token scope preservation, JSON-RPC error handling, PID 0 liveness, upstream CRD converter • Respect global config for OTel tracing and metrics enabled in `toolhive` • Preserve scopes in token refresh request for `toolhive` API calls • Return JSON-RPC errors for expired sessions via the `toolhive` CLI/API • Treat PID 0 as dead in supervisor liveness check for `toolhive` processes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/toolhive