stacklok/toolhive

View on GitHub

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

Stars: 2.2k
Forks: 300
Open beginner issues: 10
Indexed issues: 320
Avg merge: 1d 15h
Merged PRs (30d): 184

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

320 open issues indexed

v0.49.0 vmcp: health probe hangs on the streamable proxy's empty SSE response to server/discover; Ready stuck False Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6687 · 1 comment · Opened Sep 18, 2026
MCPServer spec.secrets list-map-keys=[name] makes two keys from one Secret unrepresentable Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 75/100

stacklok/toolhive#6686 · Opened Sep 18, 2026
mcpservers CRD: shortNames collide with the CRD's own names, leaving NamesAccepted=False Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

stacklok/toolhive#6685 · 1 comment · Opened Sep 18, 2026
proxyrunner tool-filter middleware strips SEP-2322 Modern envelope from tools/list, breaking vMCP health checks Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6684 · Opened Sep 18, 2026
MCPRemoteProxy + embeddedAuthServer: upstreamswap does not inject the stored per-user upstream token; the AS's own JWT is forwarded to the remote MCP (v0.49.0) Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6681 · 1 comment · Opened Sep 17, 2026
Add a group-aware UpstreamFilter implementation for the embedded auth server Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 28/100

stacklok/toolhive#6675 · 1 comment · Opened Sep 17, 2026
HttpClientBuilder.Build() ignores HTTP(S)_PROXY (auth-server OAuth/DCR calls bypass forward proxy) Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

stacklok/toolhive#6671 · 1 comment · Opened Sep 16, 2026
Use the pinned provider's id_token when its access token is opaque Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#6655 · 1 comment · Opened Sep 14, 2026
E2E coverage for the cosign key-pair signing path (skills and plugins) Open

needs-triage skills testing

Difficulty 4/5 3-5 days Newbie friendliness 56/100

stacklok/toolhive#6642 · 1 comment · Opened Sep 11, 2026
uvx:// protocol-scheme container for a Python/FastMCP stdio server restarts in a loop (exit 0), while npx:// containers work fine Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6634 · 2 comments · Opened Sep 10, 2026
Recover remote auth after vMCP session expires Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6556 · 1 comment · Opened Sep 8, 2026
OIDC upstream clients cannot use client_secret_basic (AuthStyle hardcoded) Open

bug needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 76/100

stacklok/toolhive#6542 · Opened Sep 8, 2026
CEL rule on TokenExchangeIssuerPolicyConfig errors when allowMayAct is omitted + wildcard delegate client Open

authentication bug needs-triage operator

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

stacklok/toolhive#6531 · Opened Sep 8, 2026
`thv run` ignores `--oidc-insecure-allow-http` and `--thv-ca-bundle` — both dropped in `createOIDCConfig` (same as #1470) Open

authentication bug cli oidc p1

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6522 · 2 comments · Opened Sep 6, 2026
Optimizer mode: allow an operator-pinned set of always-advertised tools Open

enhancement operator p2 vmcp

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6514 · 2 comments · Opened Sep 4, 2026
Carry upstream claims across RFC 8693 exchange so delegated tokens work with attribute-based Cedar policies Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6511 · 1 comment · Opened Sep 4, 2026
Embedded auth runtime DCR does not bind upstream refresh tokens to the DCR client generation Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6508 · 1 comment · Opened Sep 4, 2026
`thv llm setup --client claude-desktop` fails on Windows (POSIX credential-helper shim) Open

stacklok/toolhive#6507 · 3 comments · 1 assignee · Opened Sep 4, 2026
vMCP health probe uses HTTP GET, breaking backends that only accept POST (e.g. Tableau MCP) Open

stacklok/toolhive#6497 · 3 comments · 1 reaction · 1 assignee · Opened Sep 3, 2026
DCR credential resolution never refreshes after a replica's startup, allowing cross-replica generation drift Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6496 · Opened Sep 2, 2026
Stale operator-declared OAuth clients are never removed from durable storage Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#6477 · Opened Aug 31, 2026
CLI UX gaps around updating/recreating an existing workload's config Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 45/100

stacklok/toolhive#6475 · 1 comment · Opened Aug 31, 2026
Add --extended-ttl-cache to `thv llm setup` to opt clients into the one-hour prompt cache lifetime Open

enhancement

stacklok/toolhive#6453 · 1 comment · 1 assignee · Opened Aug 28, 2026
Metrics migration steps aren't performable/verifiable under the operator Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 68/100

stacklok/toolhive#6434 · Opened Aug 26, 2026
Confirm vMCP cuts over to the diagnostics port before #6384 flips the default Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 42/100

stacklok/toolhive#6433 · Opened Aug 26, 2026
Gate inbound DCR (/oauth/register) behind an initial access token Open

enhancement needs-triage security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6425 · Opened Aug 25, 2026
Let RFC 8693 delegate clients self-register with private_key_jwt (no shared secret) Open

authentication enhancement go needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 20/100

stacklok/toolhive#6421 · Opened Aug 24, 2026
vMCP: hang the per-session list_changed resync worker off the MultiSession instead of a hand-synced registry Open

enhancement

stacklok/toolhive#6418 · 1 assignee · Opened Aug 24, 2026
User-keyed upstream credential read for delegated agent tokens Open

authentication enhancement go needs-triage security

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6407 · Opened Aug 21, 2026
Support non-interactive agents reading stored upstream credentials Open

authentication enhancement go needs-triage security

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6406 · Opened Aug 21, 2026
Add sub_ns claim to mark a token as backed by a real resolved user Open

authentication enhancement needs-triage security

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6404 · Opened Aug 20, 2026
Add upstreamCredentialScope opt-in and enforce its issuer trust Open

authentication bug needs-triage security

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#6403 · Opened Aug 20, 2026
MCPRemoteProxy: persist/refresh unattended upstream OAuth for always-on clients Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

stacklok/toolhive#6395 · 3 comments · Opened Aug 20, 2026
vMCP: passthroughHeaders blocks Authorization/Cookie even for backends whose outgoing-auth strategy sets nothing (unauthenticated) Open

auth bug p1 vmcp

Difficulty 4/5 3-5 days Newbie friendliness 74/100

stacklok/toolhive#6394 · 4 comments · Opened Aug 20, 2026
docs/: fifteen paths name files and directories that are not in the tree Open

stacklok/toolhive#6387 · 1 comment · 1 assignee · Opened Aug 19, 2026
Complete the metrics port move and remove metricsOnTransportPort Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6384 · Opened Aug 19, 2026
Handle concurrent default-group creation during startup Open

Difficulty 4/5 3-5 days Newbie friendliness 64/100

stacklok/toolhive#6359 · Opened Aug 18, 2026
thv llm: support the OAuth device flow for headless and remote SSH boxes Open

llm gateway oauth

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#6357 · Opened Aug 18, 2026
Discovered-mode outgoing auth: should an explicit per-backend override win over discovered auth? Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 25/100

stacklok/toolhive#6329 · Opened Aug 14, 2026
Reduce delegate-client provisioning cost: TrustedIssuer actor matching and client-assertion auth Open

authentication authorization enhancement go needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6321 · Opened Aug 13, 2026
Consolidate duplicate JWKS fetch and cache machinery Open

authentication enhancement go needs-triage

Difficulty 5/5 Over a week Newbie friendliness 42/100

stacklok/toolhive#6319 · 1 comment · Opened Aug 13, 2026
Cursor LLM gateway config is a no-op: writes settings Cursor never reads Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6293 · 4 comments · Opened Aug 12, 2026
Drop the GO-2026-5932 openpgp exclusion once rekor releases the migration Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 55/100

stacklok/toolhive#6287 · Opened Aug 12, 2026
Redis user-keyed upstream token read does not verify row ownership Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

stacklok/toolhive#6273 · Opened Aug 10, 2026
Telemetry + diagnostics hardening: bound label length (OOM), overflow lock, tool/prompt cardinality, diagnostics bypass, /health fingerprint Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 32/100

stacklok/toolhive#6271 · 2 comments · Opened Aug 10, 2026
Release failure Slack notice never shows the release triggerer Open

bug ci-cd needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6265 · Opened Aug 10, 2026
upstreamtoken: ID token can go permanently stale because refresh is keyed on access-token expiry Open

bug

stacklok/toolhive#6237 · 1 assignee · Opened Aug 7, 2026
Consolidate duplicated JWKS caching and IP classification Open

enhancement good-tenth-issue

Difficulty 5/5 Over a week Newbie friendliness 42/100

stacklok/toolhive#6232 · 1 comment · Opened Aug 6, 2026
Scope pods/attach Role rule to stdio transport only Open

good-tenth-issue kubernetes

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6230 · 4 comments · Opened Aug 6, 2026
Support forcing transitive dependency versions in protocol-scheme builds Open

enhancement needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 25/100

stacklok/toolhive#6209 · Opened Aug 5, 2026

stacklok/toolhive

Get new issues in your inbox