[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	v0.56.0 → v0.57.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive

v0.57.0

Compare Source

What's Changed

• Parse SKILL.md with maintained YAML fork by @​rdimitrov in #​6919
• Let delegate clients change policy on restart by @​jhrozek in #​6918
• Let embedders refuse refresh grants on dead upstreams by @​tgrunnagle in #​6902
• Mount workload auth secrets in inline mode by @​hellouz818 in #​6905
• Support authorization_details on token exchange by @​jhrozek in #​6921
• Reject request bodies on non-POST methods by @​peppescg in #​6806
• Add dcrConfig.registrationProbe with an authorization-endpoint strategy by @​aron-muon in #​6834
• Add opt-in upstream subject identifiers by @​jhrozek in #​6908
• Move remaining YAML parsing to go.yaml.in/yaml/v3 by @​rdimitrov in #​6920
• Classify MCPRemoteProxy pods by container readiness, not phase alone by @​feiiiiii5 in #​6765
• Decouple authserver identity from host auth types by @​jhrozek in #​6923
• test(vmcp): pin that the health path never opens a standalone GET stream by @​jstar0 in #​6520
• Wire OIDC transport flags into thv run auth middleware config by @​7487 in #​6529
• Fix vMCP incoming OIDC client secret resolution by @​xianshujun in #​6904
• Update docker images by @​renovate[bot] in #​6934
• Update issue triage model to Sonnet 5.5 by @​eleftherias in #​6943
• Read required environment variable prompts as a whole line by @​feiiiiii5 in #​6781
• Add backend-scoped vMCP authorization by @​Sanskarzz in #​6487
• Update github actions by @​renovate[bot] in #​6935
• Update go modules by @​renovate[bot] in #​6936
• Show upstream display name on consent page by @​tgrunnagle in #​6929
• Release v0.57.0 by @​toolhive-release-app[bot] in #​6947

New Contributors

• @​7487 made their first contribution in #​6529
• @​xianshujun made their first contribution in #​6904

Full Changelog: stacklok/toolhive@v0.56.0...v0.57.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.57.0

At a glance

Upstream	stacklok/toolhive v0.56.0 → v0.57.0
Hand-written changes	2 commit(s)
Reference assets	unchanged
Gaps	0
Owner	@rdimitrov - identified from merged release PR stacklok/toolhive#6947
Release contributors	6 review requested (see sidebar) · 5 not requested (no docs impact)
Action required	Spot-check skill-authored prose for accuracy

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Added a "Backend-scoped tools on a VirtualMCPServer" section and a Backend entity row at docs/toolhive/reference/authz-policy-reference.mdx, and replaced the warning that recommended tool-name prefix matching (Add backend-scoped vMCP authorization toolhive#6487)
• Added a backend-scoped policy example to the "Authorize requests" section in docs/toolhive/guides-vmcp/authentication.mdx (Add backend-scoped vMCP authorization toolhive#6487)
• Updated the "Re-register a dropped upstream client" section in docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx to document dcrConfig.registrationProbe (tokenEndpoint, authorizationEndpoint, none), and added the field to the DCR table in docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx (Add dcrConfig.registrationProbe with an authorization-endpoint strategy toolhive#6834)
• Updated the passthroughHeaders description in docs/toolhive/guides-vmcp/configuration.mdx: headers are now captured per request, not once per session
• Skipped upstream subject identifiers (Add opt-in upstream subject identifiers toolhive#6908), authorization_details on token exchange (Support authorization_details on token exchange toolhive#6921), and delegate-client/refresh hooks (Let delegate clients change policy on restart toolhive#6918, Let embedders refuse refresh grants on dead upstreams toolhive#6902) - Go-embedder-only settings that aren't reachable from the CLI, config files, or CRDs
• Skipped the upstream display_name for the consent page (Show upstream display name on consent page toolhive#6929) - exposed only in the run-config API schema (auto-generated reference), not on MCPExternalAuthConfig
• No doc changes needed for bug fixes Wire OIDC transport flags into thv run auth middleware config toolhive#6529, Reject request bodies on non-POST methods toolhive#6806, Fix vMCP incoming OIDC client secret resolution toolhive#6904, Mount workload auth secrets in inline mode toolhive#6905, Classify MCPRemoteProxy pods by container readiness, not phase alone toolhive#6765, and Read required environment variable prompts as a whole line toolhive#6781; existing docs already describe the corrected behavior

No docs impact identified

5 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

• @aponcedeleonch (merged Wire OIDC transport flags into thv run auth middleware config toolhive#6529)
• @ChrisJBurns (merged Add backend-scoped vMCP authorization toolhive#6487)
• @jhrozek (merged Add dcrConfig.registrationProbe with an authorization-endpoint strategy toolhive#6834)

Run cost

Session	Turns	Cost (USD)
Generation	57	$1.8584
Editorial review	23	$0.5907
Total	80	$2.4491

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)
• docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 27, 2026 1:20am UTC

[claude]

Claude finished @renovate[bot]'s task in 4m 25s —— View job

---

Upstream release docs: stacklok/toolhive v0.57.0

• Phase 1: Discovery
• Phase 2: Deep dive (verify against source)
• Phase 3: Audit existing docs
• Phase 4: Implementation
• Phase 5: Validation (Prettier, ESLint, and npm run build all pass)
• Artifacts (REVIEWERS.json, SUMMARY.md)

Changes (commit 9bfc813)

• Backend-scoped Cedar policies for vMCP (Add backend-scoped vMCP authorization toolhive#6487): added a Backend entity row and a "Backend-scoped tools on a VirtualMCPServer" section to reference/authz-policy-reference.mdx. The section covers resource in Backend::"...", where the backend ID comes from, and what it means for composite tools. Replaced the old warning, which was no longer true, that told readers to match tool-name prefixes. Also added a short example to guides-vmcp/authentication.mdx.
• dcrConfig.registrationProbe (Add dcrConfig.registrationProbe with an authorization-endpoint strategy toolhive#6834): documented tokenEndpoint (the default), authorizationEndpoint, and none in the re-registration section of guides-k8s/embedded-auth-server-k8s.mdx, and added the field to the DCR table in guides-vmcp/embedded-auth-server-vmcp.mdx.
• passthroughHeaders: guides-vmcp/configuration.mdx now says headers are read from each request. The page used to say they were captured once per session, which the updated CRD schema shows is no longer true.

Not documented on purpose

• Add opt-in upstream subject identifiers toolhive#6908, Support authorization_details on token exchange toolhive#6921, Let delegate clients change policy on restart toolhive#6918, Let embedders refuse refresh grants on dead upstreams toolhive#6902: these settings are only available to Go embedders. The CLI, config files, and CRDs can't reach them.
• Show upstream display name on consent page toolhive#6929 display_name: it's only in the run-config API spec, not on MCPExternalAuthConfig.
• Bug fixes Wire OIDC transport flags into thv run auth middleware config toolhive#6529, Reject request bodies on non-POST methods toolhive#6806, Fix vMCP incoming OIDC client secret resolution toolhive#6904, Mount workload auth secrets in inline mode toolhive#6905, Classify MCPRemoteProxy pods by container readiness, not phase alone toolhive#6765, Read required environment variable prompts as a whole line toolhive#6781: the existing docs already describe the fixed behavior.

[claude]

Claude finished @renovate[bot]'s task in 1m 27s —— View job

---

Editorial review of v0.57.0 content

• Identify changed files (5 docs from 9bfc813)
• Run /docs-review over the changed docs
• Apply fixes
• Format and lint (prettier:fix, eslint:fix), commit, push

Summary

The generated content is accurate and well structured. I checked the backend-scoped Cedar content against the upstream docs/authz.md and docs/arch/10-virtual-mcp-architecture.md, and it matches: the Backend parent, no entities_json entry needed, and composite tools having no backend. The registrationProbe table, the passthrough-header capture text, and the new DCR field row read clearly. I found no blocking issues. I pushed four small editorial fixes in 81d5bc8:

docs/toolhive/reference/authz-policy-reference.mdx

• Changelog framing: "so existing policies are unaffected" became "so policies scoped to the vMCP still match", which describes how it works today instead of framing it as a change.
• Placeholders: <backend-id> became <backend_id> so it matches the Cedar entity table on the same page.
• Composite-tools warning: "Express backend restrictions as conditions on permit policies" was vague. It now tells the reader to write the restriction as a condition on their permit policies instead of as a backend-scoped forbid. This is the same guidance as upstream, with no new claims.

docs/toolhive/guides-vmcp/authentication.mdx

• Placeholder style: <backend-name> became <BACKEND_NAME>, following the style guide's <ALL_CAPS> rule for values the reader supplies.

I didn't touch the auto-generated files (static/api-specs/, reference/helm/, reference/cli/, CRD pages) or the signal files.
• renovate/stacklok-toolhive-0.x

[tgrunnagle]

Ack "skipped consent display_name and refresh-grant hooks" as not needed for public docs.