stacklok / toolhive

49%

main: 50%

LAST BUILD ON BRANCH docs/security-documentation

branch: docs/security-documentation

CHANGE BRANCH

x

Reset

• docs/security-documentation
• 2012-respect-x-forwarded
• 2023-inbound-network-permissions
• 2160-podman-mac
• 2680
• accessor-helper-package
• add-anonymous-usage-metrics
• add-antigravity-client
• add-buildargs-to-protocol-builds
• add-claude-agents
• add-ginkgolinter
• add-grafana-cli-example
• add-groups
• add-insecure-http-oidc-support
• add-k8s-export-format
• add-mcp-meta-field-support
• add-mcp-tasks-parser-support
• add-mcpgroup-proposal
• add-netwok-isolation-examples
• add-oidc-resolver
• add-pr-size-labeler
• add-proxy-logs-endpoint
• add-registry-groups-cli-support
• add-remote-mcp-e2e-tests
• add-retrydelay-to-errorhandling-crd
• add-schema-version-sync-test
• add-stackers
• add-tool-definitions-extension-proposal
• add-ubi-latest-tag
• add-usage-metrics-config-api-endpoint
• add-vmcp-host-port-flags
• add-vmcp-overrides-composite-e2e-tests
• add-vmcp-yaml-loader-transform-tests
• add-vmcp-yardstick-e2e-tests
• add-vulncheck
• add_vmcp_config
• adds-auth-runconfig
• adds-codecov-exclusions
• adds-database-details
• adds-global-config-otel
• adds-kubernetes-registry
• adds-missing-tests
• adds-rbac-registry-server
• adds-tests
• alternative-workaround
• api-proxy-port
• auth-discovery
• auth-refactored
• authenticated-token-source-monitoring
• auto-add-remote-server-to-clients
• backends_discovery_in_status
• bad_example
• bearer_token_util
• build-env-cli-templates
• build-env-config-foundation
• build-env-secrets-implementation
• build-env-secrets-proposal
• bump-go
• bump-go-1-25-3
• bump-operator-versions
• change-codecov
• change-default-proxy-mode-streamable-http
• change-default-proxy-mode-to-streamable-http
• change-otel-metric-defaults
• chore/change-renovate-commit-msg
• chore/ci-task-ensure-docs-proposal-names-format
• chore/decouple-transport-from-runtime
• chore/e2e-labels-matrix
• chore/fix-thv-2207-proposal-name
• chore/move-testkit-under-test
• chore/refactor-runconfig-builder-into-options
• chore/refactor-runconfigbuilder-to-option
• chore/rename-design-docs
• chore/use-testkit-client
• ci-tidy-names
• ci/add-renovate-config-validation
• claude-agent
• claude-commands_2025-10-21
• claude-helm
• claude-helm-skill
• claude/issue-1452-20250827-1021
• claude/issue-2119-20251008-1230
• claude/issue-2385-20251030-1527
• claude/issue-2507-20251107-1918
• claude/issue-2643-20251118-2153
• claude_skills
• cleanup-pid-after-migration
• client_id_not_required
• complex-data
• composite-tool-refs-resolution
• concurrent-restart-keyring-race-condition
• config-map-ref
• config-refactor-phase2-validation
• configure-telemetry-namespace
• consistent-workload-naming
• consolidate-pr-size-workflows
• containerfile-preflight
• continue-vmcp-crd
• contrib-guidelines-update
• converge-registry
• convert-reg-server-config-to-cm
• converts-mcpgroup-e2e-tests-to-int
• copilot/sub-pr-2906
• corrects-errors
• cosign_bundle_signing
• coveralls
• decouple-configmap-operator
• default-callback-port
• default_mcp_port
• delete-doc
• dependabot/github_actions/github/codeql-action-4
• dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.0.11
• dependabot/go_modules/github.com/olekukonko/tablewriter-1.1.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/sigs.k8s.io/controller-runtime-0.22.1
• deprecated-fields
• disable-failing-vmcp-e2e
• disable-labels-for-forked-repos
• disable-selinux-labeling
• docs-update-remote-auth
• docs/add-mcpgroup-to-operator-arch
• docs/arch
• docs/clarify-docs-file-name-format
• docs/operator-e2e-tests-and-task-improvements
• docs/runconfig-proposal
• docs/runtime-authoring-guide
• docs/update-go-version
• docs/update-middleware-documentation
• domain-model-diagram
• downgrade-go-1.24
• drop-test-silent
• e2e_dedup
• e2e_less_boilerplate
• e2e_no_hardcoded_version
• enable-configmap
• enforce-structured-logs-k8s
• enforce-xl-pr-justification
• enhancement/Add-ExcludeAll-option-for-tool-filtering-in-VirtualMCPServer-aggregation
• ensure-version-output
• env-secrets
• envtest_pin
• error-no-config
• exclude-mocks
• export-detail-api-inconsistencies
• external-auth-controller-impl
• fail-fast
• feat/add-continue-client
• feat/add-e2e-tests-for-tool-override-1515
• feat/add-kiro
• feat/add-proxy-mode-to-workload-api
• feat/add-tool-middleware-config-to-cli
• feat/add-tool-middleware-config-to-http-api
• feat/add_debug_k8s_proxy
• feat/add_invalid_config_tests
• feat/add_k8s_vmcp_e2e_tests
• feat/add_missing_vmcp_k8s_docs
• feat/add_resource_url_k8s
• feat/add_tool_filter_mcptoolconfig
• feat/add_virtualmcpcompositetooldefinition_crd
• feat/add_vmcp_examples
• feat/add_vmcp_status
• feat/build-auth-files
• feat/config-field-framework
• feat/discover_auth
• feat/improve-client-config-file-logic
• feat/issue-1638-configmap
• feat/issue-1638-state-storage
• feat/k8s-configmap-runconfig-1638
• feat/mcp-server-secrets-management
• feat/more_vmcp_tests
• feat/operator-audit-config
• feat/operator-authz-configmap
• feat/otel-use-config-framework
• feat/private-package-registries-proposal
• feat/registry-export-phase1
• feat/remove-tooltype-and-rename-createdat
• feat/remove-tooltype-field
• feat/restart-mcpserver-annotation-1880
• feat/session-storage-http-streaming
• feat/session-storage-interface-phase2
• feat/session-storage-pluggable
• feat/sort-client-setup
• feat/sync_mvmcp_crd
• feat/telemetry-tool-error-capture
• feat/test_group_membership
• feat/test_vmcp_inline_auth
• feat/token-exchange-env-var
• feat/update-mcp-parser-latest-spec
• feat/vmcp-elicitation-support
• feat/vmcp-routing-interfaces
• feat/vmcp_auth_strategies_incompatible
• feat/vmcp_binary
• feat/vmcp_composition_multistep
• feat/vmcp_composition_multistep_2
• feat/vmcp_controller_tests
• feat/vmcp_crd
• feat/vmcp_discovered_backend_tracking
• feat/vmcp_k8s_controller
• feat/vmcp_service
• feat/vmcp_status_collector
• feat/watch_vmcp_tool_composition
• feature/add-mcpremoteproxy-crd
• feature/docker-workload-tests
• feature/github-oauth-provider
• feature/header-injection-auth
• feature/increase-session-ttl
• feature/mcpremoteproxy-implementation
• feature/oidc-env-secret-support-clean
• feature/remove-info-logger
• feature/secretkeyref-oidc
• feature/telemetry-configmap-support
• feature/toolconfig-crd
• fix--registry-remote-server-running
• fix-2466-auth-constants
• fix-api-timeout-large-images
• fix-atlassian-issuer-mismatch
• fix-auditor-middleware-transport
• fix-auth-flags-for-registry
• fix-chainsaw-install_2025-10-21
• fix-converters
• fix-dashboard-uid
• fix-double-pod
• fix-duplicate-listing
• fix-duplicate-operator-e2e-runs
• fix-duplicate-workload
• fix-flacky-tests
• fix-flaky-usagemetrics-test
• fix-flaky-vmcp-e2e-tests
• fix-git-test-race-condition
• fix-goreleaser
• fix-group-case-insensitive
• fix-host-networking
• fix-info-output
• fix-inspector
• fix-issuer
• fix-lint-issues
• fix-linter-cyclomatic-complexity
• fix-mcpremoteproxy-health-probe-timing
• fix-mkp-example
• fix-mockgen
• fix-oauth-issuer-discovery
• fix-oauth-secret-empty-check
• fix-operator-datarace-logger
• fix-operator-proxy-usage-metrics
• fix-pr-size-workflow-yaml
• fix-proxy-mode
• fix-race-detector-test-failures
• fix-registry-fallback-error
• fix-registry-info-custom-metadata
• fix-registry-schema-id
• fix-releaser-warns
• fix-remote-servers-tests
• fix-renovate-kindest-node-patch-only
• fix-rfc7591-scope-format
• fix-runconfig-save-race-condition-on-workload-edit
• fix-scopes-type
• fix-serviceaccount-configmap-mode
• fix-silent
• fix-staticcheck-nil-pointer
• fix-stdio-tests
• fix-thvignore-tmpcopyup
• fix-tool-call
• fix-trans
• fix-type-picking
• fix-ubi-image-arch
• fix-utilruntime-must
• fix-vmcp-composite-tool-parameters-json-schema
• fix-vmcp-controller-readiness-check
• fix-vmcp-health-test-flakiness
• fix-vmcp-name-mapping-conflict-resolution
• fix-vmcp-output-config-yaml-parsing
• fix-vmcp-patch
• fix-vmcp-schema-double-nesting
• fix-warns
• fix/2314-mcpremoteproxy-reconcile-spec-changes
• fix/auth_discovery_test
• fix/ci-security-scan-workflow
• fix/container-exit-reconnection
• fix/ct-install-all-charts
• fix/defensive_auth
• fix/e2e_test_conflict
• fix/egress-proxy-arm64-build
• fix/env-var-nil-pointer-1469
• fix/fix-authz-middleware-tools-list
• fix/fix-authz-tools-list
• fix/flaky-registry-api-image-test
• fix/issue-1874-proxy-mode
• fix/issue-1957-oidc-issuer-mismatch
• fix/issue-2843
• fix/jsonschema-v6-upgrade
• fix/log-middleware-names
• fix/mcpserver-auth-audit-persistence
• fix/mcpserver-crd-size-reduction
• fix/mcpserver-remote-path
• fix/mcpserver-url-proxymode
• fix/middleware-flusher-interface
• fix/move_vmcp_e2e_tests
• fix/operator-context-aware-logging
• fix/otel-insecure-config
• fix/proposal-naming-validation-for-updates
• fix/proxy-mode-sse-label
• fix/proxyrunner-tools-override-middleware
• fix/remote-workload-url-population
• fix/remove-pointer-to-interface-2169
• fix/remove_header_value_env
• fix/remove_mixed_mode
• fix/remove_token_cache_config
• fix/renovate-kindest-node-patch-only
• fix/set-correct-content-length
• fix/test_backend_health
• fix/token_exchange_crds
• fix/tool-middleware-connection-hang
• fix/tool-middleware-json-buffer-flushes
• fix/vmcp-backend-capability-name-translation
• fix/vmcp-config-ergonomics
• fix/vmcp-parameter-defaults
• fix/wait-for-initialize-before-client-update
• fix/waitforpodsready-logic-bug
• fix/zombie-supervisor-processes
• fix_anonymous_auth
• fix_ci
• fix_git_clone
• fix_gitpath
• fix_registy_api
• fix_used_port
• fixes-flaky-order-assertion
• fixes-flaky-test
• fixes-mocks
• fixes-release
• fixes-test-port
• fixes-tests
• gives-claude-permissions-write
• go-24-dev-guide
• go-mod-tidy
• golang-build-ubi
• google-oauth
• goose
• goreleaser-cosign-v3
• groups-crd-storage
• groups-registry-alt
• groups-registry-proposal
• hack/fix-mcp-port-host-network-linux
• helm-chart-contributing
• hide-coverage
• identity-unify
• ignore-coverage
• implement-proper-health-checks
• implements-providers-strategies
• improve-test-coverage-and-fix-label-validation
• inherit-secret-codecov
• inline-crds
• installs-go-claude
• int-tests
• integration-tests-fix
• issue-1638-add-configmap-flag
• issue-1638-add-proxymode
• issue-1638-configmap-add-audit
• issue-1638-configmap-add-authn
• issue-1638-configmap-add-authz
• issue-1638-configmap-use
• issue-1638-use-configmap
• issue-1696-v1
• issue-1700
• issue-1717
• issue-1871
• issue-1873
• issue-1873-v1
• issue-1898
• issue-1941
• issue-1947
• issue-2114
• issue-2114-telemetry
• issue-2117
• issue-2166
• issue-2623-alternate
• issue-2660
• issue-2680
• issue-2781-vmcp-debug-level
• issue-2784
• issue-2784-followup
• issue-2786-centralize-e2e-images
• issue_156_2025-11-13
• issue_156_docs_2025-11-14
• issue_176_2025-11-20
• issue_2503_2025-11-17
• issue_2623_2025-11-17
• issue_2714_2025-11-25
• issue_2771_2025-12-01
• issuer-mistmatch
• jaosorior/custom-package-mirrors-proposal
• jaosorior/vmcp-composition-workflow-engine
• jerm/fix-2761
• jerm/fix-foreground-shutdown
• jerm/fix-graceful-shutdown
• jerm/jerm/refactor-telemetry-conversion
• jerm/vmcp-o11y
• jesseo.colima-runtime-support
• k8s-groups_2025-10-15
• k8s_and
• k8s_registry
• kill-patch-coverage
• kind-dns-issues
• lint-cache
• lint-fix
• lock-file-cleanup
• main
• maintainers
• mcp-auto-transport-fallback
• mcp-optimizer-hide
• mcpregistry-configmap-label-selector-proposal
• merge-integration-tests
• meta-mcp-in-registry
• migrate-pid-files
• migrate-pid-files-iii
• migrate_oauth_config
• misc
• missed-main-test
• mockgen-install
• move-crds-to-crds-directory
• move-workload-update-logic-into-manager
• moves-configmap-retrieval
• moves-e2e-ext-auth-test-to-int-test
• moves-tool-config
• multi-cm-source
• multi-ds-operator
• multiple-rm-arguments
• multiple-rm-stop-arguments
• network-isolation-e2e
• no_best_effort
• no_local_auth_in_k8s
• no_pass_through
• oauth/mcp-wellknown-uri-fallback
• oidc-registration-endpoint-fallback
• oidc_refactor
• op-img-micro-to-minimal
• opencode-client
• operator-build-epel10-golang-update
• operator-crds-optional-virtualmcp
• optimize-e2e-workflow-binary-build
• otel-custom-attributes
• otel-defaults
• otel-example
• path-clean-windows-destination
• pid-in-state-file
• pid-in-state-file-ii
• pins-envtest
• pins-registry-server-image
• poc
• poc-faster-build
• podtemplate-registry
• podtemplate-spec-registry
• podtemplate-user
• port-auth-cm-e2e-test
• port-authz-cm-ref-e2e-test
• port-examples
• port-validation
• prm_discovery
• prm_with_path
• proposal-mcp-registry-upstream-support
• proposal/deployment-architecture-k8s
• proposal/dynamic-webhook-middleware
• proposal/kubernetes-registry-source
• proposal/operator-registry-gateway-api-integration
• proposal/operator-valkey-integration
• proposal/remote-mcp-proxy
• proposal/shared-key-auth-localhost
• proposal/virtual-mcp-server
• pvc-source
• refactor-rbac-operator
• refactor-status-collector
• refactor-telemetry
• refactor-telemetry-runconfog
• refactor/auth-resolution-logic
• refactor/ca-cert-config-pattern
• refactor/consolidate-k8s-client
• refactor/consolidate-oauth-package
• refactor/docker-api-adapter-tests
• refactor/extract-common-controller-helpers
• refactor/move-remote-auth-to-auth-package
• refactor/phase1-extract-common-helpers
• refactor/typed-backend-auth-strategy
• refactor/use-defaultAuthzKey-constant
• refactor_proposal
• reg-server-configmap
• reg-server-configmap-operator
• registry-docs
• registry-groups-updated
• registry-server-config
• registry-server-config-type
• registry_apisource
• registry_cm
• registry_crds
• registry_filter
• registry_fix_sync
• registry_githandler
• registry_no_serverCount
• registry_promote
• registry_sync
• registry_tests
• reinstate-stale-config-fix
• releaser-thv-fix
• remote-mcp-server-restart-fix
• remote-server-apis
• remote-server-proxy-url-in-list
• remote-workload-proxy-stuck
• remote-workload-spurious-warning
• remove-flag-driven-oidc
• remove-get-claims-from-context
• remove-legacy-converters
• remove-old-converter
• remove-old-status-methods
• remove-registry-api
• remove-secret-provider-depdendency
• remove-steptype-conditional
• removes-auto-sync-operator
• removes-binary
• removes-datasources
• removes-e2e-test-configmap
• removes-e2e-tests-authz-configmap
• removes-filters
• removes-flag-driven-config-more
• removes-flag-driven-config-patch
• removes-flags-proxyrunner
• removes-not-allowed-item
• removes-otel-test
• removes-registry-server-image-loading
• removes-test-integartion-verbosity
• removes-unused-flags
• removes-unused-functions
• rename-registry-type
• renames-test-suites
• renovate/actions-checkout-6.x
• renovate/actions-checkout-digest
• renovate/actions-download-artifact-digest
• renovate/actions-github-script-8.x
• renovate/actions-setup-go-6.x
• renovate/actions-setup-go-digest
• renovate/actions-setup-python-6.x
• renovate/actions-setup-python-digest
• renovate/actions-upload-artifact-digest
• renovate/add-kindest-node-patch-updates
• renovate/alpine-3.x
• renovate/anchore-sbom-action-0.x
• renovate/anthropics-claude-code-action-digest
• renovate/docker-login-action-3.x
• renovate/docker-metadata-action-5.x
• renovate/dockerfile-template-base-images
• renovate/github-codeql-action-4.x
• renovate/github.com-cedar-policy-cedar-go-1.x
• renovate/github.com-charmbracelet-bubbletea-1.x
• renovate/github.com-charmbracelet-lipgloss-2.x
• renovate/github.com-docker-docker-28.x
• renovate/github.com-go-git-go-billy-v5-5.x
• renovate/github.com-go-git-go-git-v5-5.x
• renovate/github.com-gofrs-flock-0.x
• renovate/github.com-google-go-containerregistry-0.x
• renovate/github.com-lestrrat-go-httprc-v3-3.x
• renovate/github.com-lestrrat-go-jwx-v3-3.x
• renovate/github.com-mark3labs-mcp-go-0.x
• renovate/github.com-modelcontextprotocol-registry-1.x
• renovate/github.com-olekukonko-tablewriter-1.x
• renovate/github.com-onsi-ginkgo-v2-2.x
• renovate/github.com-onsi-gomega-1.x
• renovate/github.com-prometheus-client_golang-1.x
• renovate/github.com-santhosh-tekuri-jsonschema-v5-6.x
• renovate/github.com-sigstore-sigstore-go-1.x
• renovate/github.com-sigstore-sigstore-go-digest
• renovate/github.com-spf13-cobra-1.x
• renovate/github.com-spf13-pflag-1.x
• renovate/github.com-spf13-viper-1.x
• renovate/go.uber.org-zap-1.x
• renovate/golang.ngrok.com-ngrok-v2-2.x
• renovate/golang.org-x-exp-jsonrpc2-digest
• renovate/golang.org-x-mod-0.x
• renovate/golang.org-x-net-0.x
• renovate/golang.org-x-oauth2-0.x
• renovate/golang.org-x-sync-0.x
• renovate/golang.org-x-sys-0.x
• renovate/golang.org-x-term-0.x
• renovate/golang.org-x-time-0.x
• renovate/golangci-golangci-lint-action-9.x
• renovate/helm-chart-testing-action-2.x
• renovate/helm-kind-action-1.x
• renovate/helm-kind-action-digest
• renovate/k8s.io-utils-digest
• renovate/kindest-node-1.x
• renovate/kubernetes-go
• renovate/kyverno-action-install-chainsaw-0.x
• renovate/major-dockerfile-template-base-images
• renovate/major-github-artifact-actions
• renovate/peter-evans-create-pull-request-digest
• renovate/python-3.x
• renovate/registry.access.redhat.com-ubi10-go-toolset-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-micro-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-minimal-10.x
• renovate/sigs.k8s.io-controller-runtime-0.x
• renovate/sigstore-cosign-installer-3.x
• renovate/sigstore-cosign-installer-4.x
• research-67
• retrydelay_harden
• revert-2882-renovate/alpine-3.x
• revert-accidental-merge
• revert-signal-handler
• revert_py3.14
• reverts-cosign-installer-bump
• reverts-mocks
• review_model
• rfc8707
• rm-dependabot
• single-workload-list
• skill-tweak
• skills-mcp
• skip-mocks
• spec-generation
• speeds-e2e-tests-operator
• split_out_podtemplate
• sse-channel-full
• state-management-bug
• stop-reading-pid-files-tests
• stop-writing-to-pids
• support-colima
• support_orbstack
• task-test-fail-only
• telemetry-providers
• telemetry-refactor
• test/add-testkit
• test/docker-high-roi
• test/token-exchange-integration
• tests/docker-runtime-query-coverage
• thv-k8s-rework
• thv-proxy-swap
• thv-registry-api
• thv-registry-api-file
• thv-registry-deploy-from-controller
• thv-registry-enforce
• thv-te-cli
• thv-te-iface
• thv-te-mware
• thv-te-proposal
• thv-vmcp-minor
• thv-vmcp-te
• tracing-operatpr
• trae-ide-client
• transport-mock
• typo
• unified-workload-manager
• unpins-registry-server
• update-claude-code-action
• update-docs-workflow
• update-inspector
• update-k8s-examples
• update-k8s-test-versions
• update-maintainers
• update-mcp-agent-spec-2025-11-25
• update-operator-crds
• update-readme
• update-readmes
• update-registry-from-release
• update-task-helm-deployment
• update-upstream-registry-schema
• updates-registry-int-tests
• upgrade-go
• upgrades-golang
• upstream_registry
• use-new-update-url
• use-status-file-for-pids
• use-ubuntu-slim-runners
• use_thv_client_secret
• validate-composite-tool-ref-status
• validate-group-case
• validate_headers
• vault-annotations
• vault-te-proposal
• vault_fix
• vmcp-capability-merging-routing
• vmcp-composite-workflow-integration
• vmcp-conflict-resolution
• vmcp-external-auth-discovery
• vmcp-integration
• vmcp-local-deploy
• vmcp-partial-capabilities
• vmcp-server-shutdown-error
• vmcp/add-cache-and-registry-tests
• vmcp/capability-discovery
• vmcp/cli-serve-command-and-session-management
• vmcp_auth
• vmcp_no_req_client_secret_env
• vmcp_operational_fix
• vmcp_out_strategies
• warn-secret-users-on-update
• work-around-stale-config
• workload-manager-tests
• wrap-crds
• wrong-place
• yaml-v3
• zed

Build # 19567438012

Build Type

Pull #2659

github

Committed by web-flow

Commit Message

Merge bd660f9a1 into 5f1a532d3

Pull Request Pull Request #2659: Add initial security documentation (attack tree & threat model)

Run Details

24612 of 50409 relevant lines covered (48.82%)

61.16 hits per line