stacklok/toolhive

View on GitHub

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

Stars: 2.2k
Forks: 300
Open beginner issues: 10
Indexed issues: 320
Avg merge: 1d 15h
Merged PRs (30d): 184

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

15 beginner-friendly issues open

mcpservers CRD: shortNames collide with the CRD's own names, leaving NamesAccepted=False Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

stacklok/toolhive#6685 · 1 comment · Opened Sep 18, 2026
proxyrunner tool-filter middleware strips SEP-2322 Modern envelope from tools/list, breaking vMCP health checks Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6684 · Opened Sep 18, 2026
HttpClientBuilder.Build() ignores HTTP(S)_PROXY (auth-server OAuth/DCR calls bypass forward proxy) Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

stacklok/toolhive#6671 · 1 comment · Opened Sep 16, 2026
CEL rule on TokenExchangeIssuerPolicyConfig errors when allowMayAct is omitted + wildcard delegate client Open

authentication bug needs-triage operator

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

stacklok/toolhive#6531 · Opened Sep 8, 2026
`thv run` ignores `--oidc-insecure-allow-http` and `--thv-ca-bundle` — both dropped in `createOIDCConfig` (same as #1470) Open

authentication bug cli oidc p1

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6522 · 2 comments · Opened Sep 6, 2026
Redis user-keyed upstream token read does not verify row ownership Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

stacklok/toolhive#6273 · Opened Aug 10, 2026
Scope pods/attach Role rule to stdio transport only Open

good-tenth-issue kubernetes

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#6230 · 4 comments · Opened Aug 6, 2026
Delete the dead pkg/vmcp/server/adapter package Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

stacklok/toolhive#6191 · Opened Aug 4, 2026
Outgoing strategies differ on no-subject-provider fallback (xaa hard-fails, token_exchange and aws_sts fall back) and it is undocumented Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

stacklok/toolhive#6177 · Opened Aug 3, 2026
Flaky: mcp-oidc-config deletion tests race the controller's 30s deletion requeue Open

good-first-issue kubernetes

Difficulty 1/5 Under an hour Newbie friendliness 86/100

stacklok/toolhive#6155 · 1 comment · Opened Jul 31, 2026
Delete the unreachable legacy optimizer decorator path in sessionmanager Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

stacklok/toolhive#6103 · Opened Jul 28, 2026
OIDC proxy does not enforce scope claims from incoming JWTs (--oidc-scopes only advertises, not validates) Open

authentication enhancement go security

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

stacklok/toolhive#5284 · Opened May 14, 2026
Remove unused webhook server listening on port 9443 Open

bug go kubernetes operator

Difficulty 1/5 Under an hour Newbie friendliness 72/100

stacklok/toolhive#4627 · Opened Apr 7, 2026
Fix misleading 'enforced by webhook' comment in MCPExternalAuthConfig Open

api enhancement go kubernetes operator

Difficulty 1/5 Under an hour Newbie friendliness 78/100

stacklok/toolhive#4626 · Opened Apr 7, 2026
vMCP find_tool should have a dynamic description based on available tools Open

enhancement vmcp

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

stacklok/toolhive#4357 · 2 comments · Opened Mar 24, 2026

stacklok/toolhive

Get new issues in your inbox