stacklok/toolhive

View on GitHub

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

Stars: 2.2k
Forks: 300
Open beginner issues: 10
Indexed issues: 320
Avg merge: 1d 15h
Merged PRs (30d): 184

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

320 open issues indexed

Add SPIFFE interoperability, security, and end-to-end coverage Open

authentication authorization enhancement go

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6206 · 1 comment · Opened Aug 5, 2026
Add SPIRE and operator deployment integration for SPIFFE client auth Open

authentication authorization enhancement go

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6205 · 1 comment · Opened Aug 5, 2026
Integrate SPIFFE principals with OAuth grants and discovery Open

authentication authorization enhancement go

Difficulty 5/5 Over a week Newbie friendliness 32/100

stacklok/toolhive#6204 · 2 comments · Opened Aug 5, 2026
Implement JWT-SVID OAuth client authentication (spiffe_jwt) Open

authentication authorization enhancement go

stacklok/toolhive#6203 · 1 comment · 1 assignee · Opened Aug 5, 2026
Implement X.509-SVID OAuth client authentication (spiffe_x509) Open

authentication authorization enhancement go

stacklok/toolhive#6202 · 1 comment · 1 assignee · Opened Aug 5, 2026
Implement SPIFFE trust-domain bundle management and rotation Open

authentication authorization enhancement go

stacklok/toolhive#6201 · 1 comment · 1 assignee · Opened Aug 5, 2026
Define the SPIFFE client identity, association, and configuration model Open

authentication authorization enhancement go

stacklok/toolhive#6200 · 1 assignee · Opened Aug 5, 2026
Embedded auth server should accept SPIFFE SVIDs as client credentials Open

authentication authorization enhancement go research

stacklok/toolhive#6199 · 1 assignee · Opened Aug 5, 2026
ValidateRemoteURL misses empty-host, trailing-dot, zone-ID, and non-standard IP forms Open

operator p2 security

stacklok/toolhive#6197 · 5 comments · 1 assignee · Opened Aug 5, 2026
Delete the dead pkg/vmcp/server/adapter package Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

stacklok/toolhive#6191 · Opened Aug 4, 2026
Preserve per-item ResourceContents._meta in vMCP Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 72/100

stacklok/toolhive#6190 · Opened Aug 4, 2026
Warn on hidden/invisible Unicode characters in SKILL.md (bidi, zero-width, tag block) Open

stacklok/toolhive#6178 · 1 comment · 1 assignee · Opened Aug 3, 2026
Outgoing strategies differ on no-subject-provider fallback (xaa hard-fails, token_exchange and aws_sts fall back) and it is undocumented Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

stacklok/toolhive#6177 · Opened Aug 3, 2026
Upstream token read cannot verify ownership: ErrInvalidBinding documents a subject check the signature cannot make Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6176 · Opened Aug 3, 2026
stacklok.build_info exports as stacklok_build_info_ratio (drop WithUnit("1") upstream) Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6170 · Opened Aug 1, 2026
Bound client-controlled tool/prompt name cardinality on per-request metrics Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 48/100

stacklok/toolhive#6169 · Opened Aug 1, 2026
vmcp: operational.timeouts and partialFailureMode are validated and documented but never read Open

bug needs-triage operator vmcp

Difficulty 5/5 Over a week Newbie friendliness 38/100

stacklok/toolhive#6164 · Opened Jul 31, 2026
Flaky: mcp-oidc-config deletion tests race the controller's 30s deletion requeue Open

good-first-issue kubernetes

Difficulty 1/5 Under an hour Newbie friendliness 86/100

stacklok/toolhive#6155 · 1 comment · Opened Jul 31, 2026
Upgrade thv inspector to MCP Inspector v2 Open

cli enhancement needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6151 · Opened Jul 30, 2026
Align embedded v0.1 registry list endpoints with client contract (search/pagination mismatch) Open

enhancement needs-triage registry

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6138 · Opened Jul 29, 2026
Tool filtering and rate limiting are enforced against the pre-mutation request Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6134 · Opened Jul 29, 2026
Embeddings Service Requirement for ToolHive Operator Open

enhancement kubernetes

stacklok/toolhive#6105 · 1 comment · 1 assignee · Opened Jul 28, 2026
Delete the unreachable legacy optimizer decorator path in sessionmanager Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

stacklok/toolhive#6103 · Opened Jul 28, 2026
Priority tool resolver can annex an unlisted backend's tool name Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6097 · Opened Jul 28, 2026
WorkflowAuditor leaks the audit log file descriptor Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

stacklok/toolhive#6094 · 1 comment · Opened Jul 28, 2026
Port the Redis session specs to RawMCPClient so they pin the Legacy era explicitly Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 72/100

stacklok/toolhive#6090 · Opened Jul 28, 2026
Optimizer is unavailable to Modern (2026-07-28) clients Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 45/100

stacklok/toolhive#6089 · Opened Jul 28, 2026
Cedar must not take its principal from an unverified id_token Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6081 · Opened Jul 28, 2026
Removing a workload can delete the shared toolhive-external network out from under a concurrent create Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 68/100

stacklok/toolhive#6078 · Opened Jul 28, 2026
Telemetry: retire legacy span attribute dual-emission (useLegacyAttributes) Open

deprecation needs-triage telemetry

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6072 · Opened Jul 28, 2026
Modern push delivery: honor subscriptions and deliver notifications over subscriptions/listen Open

needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6065 · Opened Jul 27, 2026
Modern dispatch answers ping, which 2026-07-28 removed, and omits the required resultType Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 72/100

stacklok/toolhive#6064 · Opened Jul 27, 2026
Flaky: TestForwarding_Progress_RealBackend times out waiting for a forwarded notification Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 45/100

stacklok/toolhive#6062 · Opened Jul 27, 2026
Support MRTR pass-through for Modern backends in vMCP Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 44/100

stacklok/toolhive#6059 · Opened Jul 27, 2026
vMCP Modern dispatch cannot stream a per-request response Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#6058 · Opened Jul 27, 2026
Identity does not expose the upstream subject, so OAuth 2.0-only upstreams cannot have a correct Cedar principal Open

bug needs-triage

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#6053 · Opened Jul 27, 2026
Cedar cannot see group claims that the upstream asserts only in its id_token Open

bug needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#6049 · Opened Jul 27, 2026
Cedar claim source and principal differ between JWT and opaque upstream access tokens Open

bug needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

stacklok/toolhive#6048 · Opened Jul 27, 2026
Second getFreePort bind-close-rebind race in streamable proxy tests Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

stacklok/toolhive#6045 · Opened Jul 27, 2026
httpsse POST session-not-found 404 does not echo the request JSON-RPC id Open

needs-triage

Difficulty 3/5 1-2 days Newbie friendliness 58/100

stacklok/toolhive#6042 · Opened Jul 27, 2026
Flaky: optimizer search-quality E2E spec is blocking unrelated PRs Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 35/100

stacklok/toolhive#6026 · 1 comment · Opened Jul 27, 2026
Retire the hand-rolled Modern wire shim in vMCP Open

needs-triage

Difficulty 4/5 3-5 days Newbie friendliness 35/100

stacklok/toolhive#6018 · Opened Jul 27, 2026
vMCP elicitation: fast-fail without a standalone stream, and cross-pod origination Open

stacklok/toolhive#5975 · 2 comments · 1 assignee · Opened Jul 24, 2026
Streamable proxy drops/fails requests under high concurrent load (fixed 100-buffer channels, no backpressure) Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

stacklok/toolhive#5952 · Opened Jul 23, 2026
Envoy Proxy: Explore transparent L3/L4 interception via Envoy TPROXY Open

enhancement p2

Difficulty 5/5 Over a week Newbie friendliness 25/100

stacklok/toolhive#5947 · Opened Jul 23, 2026
Envoy Proxy: Make Envoy the default network proxy backend Open

p2

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#5946 · Opened Jul 23, 2026
Support server-initiated requests (elicitation/sampling) over the streamable proxy Open

chore

Difficulty 5/5 Over a week Newbie friendliness 35/100

stacklok/toolhive#5939 · Opened Jul 23, 2026
Export MCP notification-method constants and converge call sites Open

chore

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#5938 · Opened Jul 23, 2026
Unify the three keyed-mutex implementations into a shared package Open

chore

Difficulty 4/5 3-5 days Newbie friendliness 52/100

stacklok/toolhive#5937 · Opened Jul 23, 2026
Consumers silently ignore unsupported MCPExternalAuthConfig types Open

kubernetes

stacklok/toolhive#5930 · 3 comments · 1 assignee · Opened Jul 22, 2026

stacklok/toolhive

Get new issues in your inbox