Issues

• Surface tool-definition changes for servers in the registry

  needs-triage
  stacklok/toolhive#6734 · Filter by author rufat325 opened on Oct 1, 2026

• TLS configuration for VirtualMCPServer Redis session storage

  kubernetesneeds-triage
  stacklok/toolhive#6730 · Filter by author kraashen opened on Sep 29, 2026
  2

  

• Standalone Docker runtime: support read-only root filesystem for MCP workloads

  needs-triage
  stacklok/toolhive#6729 · Filter by author iambrazooka-stack opened on Sep 28, 2026

• MCPRemoteProxy reports Ready from pod phase alone, so a crash-looping proxy is published as healthy

  needs-triage
  stacklok/toolhive#6726 · Filter by author feiiiiii5 opened on Sep 27, 2026
  1

• Audit records outcome=success for JSON-RPC error bodies over 512 bytes

  needs-triage
  stacklok/toolhive#6720 · Filter by author feiiiiii5 opened on Sep 26, 2026
  2

• lockfile: CleanupAll/CleanupStaleLocks still unlock before unlink

  needs-triage
  stacklok/toolhive#6713 · Filter by author jhrozek opened on Sep 25, 2026

• Authz list filters drop resultType, cacheScope and ttlMs from 2026-07-28 results

  needs-triage
  stacklok/toolhive#6708 · Filter by author alex-feel opened on Sep 24, 2026

• v0.49.0 vmcp: health probe hangs on the streamable proxy's empty SSE response to server/discover; Ready stuck False

  needs-triage
  stacklok/toolhive#6687 · Filter by author lightsabit opened on Sep 18, 2026
  2

• proxyrunner tool-filter middleware strips SEP-2322 Modern envelope from tools/list, breaking vMCP health checks

  stacklok/toolhive#6684 · Filter by author soulwhisper opened on Sep 18, 2026
  2

  

• MCPRemoteProxy + embeddedAuthServer: upstreamswap does not inject the stored per-user upstream token; the AS's own JWT is forwarded to the remote MCP (v0.49.0)

  bug
  stacklok/toolhive#6681 · Filter by author tissoni opened on Sep 17, 2026
  1

• Add a group-aware UpstreamFilter implementation for the embedded auth server

  stacklok/toolhive#6675 · Filter by author hellouz818 opened on Sep 17, 2026
  6

  

• HttpClientBuilder.Build() ignores HTTP(S)_PROXY (auth-server OAuth/DCR calls bypass forward proxy)

  needs-triage
  stacklok/toolhive#6671 · Filter by author schonmann opened on Sep 16, 2026
  2

• Use the pinned provider's id_token when its access token is opaque

  needs-triage
  stacklok/toolhive#6655 · Filter by author rdimitrov opened on Sep 14, 2026
  1

• Define an optional export contract for signed authorization audit records

  needs-triage
  stacklok/toolhive#6651 · Filter by author jagmarques opened on Sep 13, 2026

• E2E coverage for the cosign key-pair signing path (skills and plugins)

  needs-triageskillstesting
  Chore 🧹

  stacklok/toolhive#6642 · Filter by author samuv opened on Sep 11, 2026
  1

• uvx:// protocol-scheme container for a Python/FastMCP stdio server restarts in a loop (exit 0), while npx:// containers work fine

  bug
  stacklok/toolhive#6634 · Filter by author S76-A opened on Sep 10, 2026
  2

• Recover remote auth after vMCP session expires

  stacklok/toolhive#6556 · Filter by author danbarr opened on Sep 8, 2026
  1

• OIDC upstream clients cannot use client_secret_basic (AuthStyle hardcoded)

  bugneeds-triage
  stacklok/toolhive#6542 · Filter by author jhrozek opened on Sep 8, 2026

• thv run ignores --oidc-insecure-allow-http and --thv-ca-bundle — both dropped in createOIDCConfig (same as #1470)

  authenticationbugclioidcp1
  stacklok/toolhive#6522 · Filter by author mapyr opened on Sep 6, 2026
  2

• Optimizer mode: allow an operator-pinned set of always-advertised tools

  enhancementoperatorp2vmcp
  stacklok/toolhive#6514 · Filter by author premctl opened on Sep 4, 2026
  2

• Carry upstream claims across RFC 8693 exchange so delegated tokens work with attribute-based Cedar policies

  needs-triage
  stacklok/toolhive#6511 · Filter by author jhrozek opened on Sep 4, 2026
  1

• Embedded auth runtime DCR does not bind upstream refresh tokens to the DCR client generation

  needs-triage
  stacklok/toolhive#6508 · Filter by author aron-muon opened on Sep 4, 2026
  1

• thv llm setup --client claude-desktop fails on Windows (POSIX credential-helper shim)

  stacklok/toolhive#6507 · Filter by author stantheman0128 opened on Sep 4, 2026
  3

  

• vMCP health probe uses HTTP GET, breaking backends that only accept POST (e.g. Tableau MCP)

  stacklok/toolhive#6497 · Filter by author ktc-yoo-jiyeon opened on Sep 3, 2026
  3

  

• DCR credential resolution never refreshes after a replica's startup, allowing cross-replica generation drift

  needs-triage
  stacklok/toolhive#6496 · Filter by author jhrozek opened on Sep 2, 2026