stacklok / toolhive

50%

main: 71%

LAST BUILD ON BRANCH fix/defensive_auth

branch: fix/defensive_auth

CHANGE BRANCH

x

Reset

• fix/defensive_auth
• 2012-respect-x-forwarded
• 2023-inbound-network-permissions
• 2026-04-14-remove-deprecated-incomingauth-oidcconfig-from
• 2160-podman-mac
• 2680
• 3655-e2e-skills-tests
• 400-bad-client
• 404-on-not-found-workload
• 5687-5697-defaulting-and-error
• 5989-delegation-hardening
• 6322-actor-matcher
• 6323-6113-mayact-hardening
• 6336-6337-jwt-bearer-grant
• 6356-singleflight-storage
• 6424-cedar-upstream-tokens
• 6449-no-upstreams
• 6536-client_secret_basic
• 6538-oidc-dcr
• ChrisJBurns-patch-1
• Nashon-Steffen/sao-paulo
• accessor-helper-package
• action-ensure-all-have-run
• add-anonymous-usage-metrics
• add-antigravity-client
• add-bug-triage-agent
• add-buildargs-to-protocol-builds
• add-ca-bundle-otlp
• add-categories-to-all-crds
• add-claude-agents
• add-command-examples
• add-conditions-mcptoolconfig
• add-copilot-cli-client
• add-cors-support-proxy
• add-device-code-storage
• add-distributable-skills-ci
• add-embedding-engine
• add-flatpak-install-method
• add-gateway-flag-to-api
• add-gemini-cli-support
• add-ginkgolinter
• add-grafana-cli-example
• add-group-support-to-skills-api
• add-groups
• add-implement-code-plan-design-skills
• add-inputschema-to-toolmatch
• add-insecure-http-oidc-support
• add-k8s-export-format
• add-license-headers
• add-mcp-call-subcommand
• add-mcp-meta-field-support
• add-mcp-tasks-parser-support
• add-mcpgroup-proposal
• add-mcpoidcconfig-url-validation
• add-mcpregistry-controller-tests
• add-mcpremoteproxy-session-storage
• add-mcpserver-shortnames
• add-missing-api-validation
• add-mistral-codex-clients
• add-mpe
• add-needs-triage-workflow
• add-netwok-isolation-examples
• add-observed-generation
• add-oidc-resolver
• add-openai-embedding-client
• add-optimizer-metrics
• add-policy-gate-extension-point
• add-pr-size-labeler
• add-provider-factory-extension-point
• add-proxy
• add-proxy-logs-endpoint
• add-proxy-port-registry-support
• add-qoder-client
• add-registry-groups-cli-support
• add-release-notes-automation
• add-remote-mcp-e2e-tests
• add-remoteproxy-external-resource-tests
• add-retrydelay-to-errorhandling-crd
• add-rfc8707-resource-parameter-refresh-token
• add-runtime-env-config
• add-schema-version-sync-test
• add-skills-architecture-docs
• add-stackers
• add-swagger-annotations-registry-auth
• add-testing-rules-from-pr-4497
• add-tool-definitions-extension-proposal
• add-toolhive-meta
• add-toolhive-meta-schema
• add-ubi-latest-tag
• add-usage-metrics-config-api-endpoint
• add-v01-skills-endpoint
• add-vmcp-host-port-flags
• add-vmcp-overrides-composite-e2e-tests
• add-vmcp-yaml-loader-transform-tests
• add-vmcp-yardstick-e2e-tests
• add-vulncheck
• add_vmcp_config
• adding-contribution-guidelines-to-contributing.md/your-feature-3.-make-your-changes-and-write/updat
• adding-endpoints
• addpodtemplate
• addports
• adds-auth-runconfig
• adds-codecov-exclusions
• adds-database-details
• adds-global-config-otel
• adds-kubernetes-registry
• adds-missing-tests
• adds-rbac-registry-server
• adds-release-pr-actions
• adds-release-tag-action
• adds-remote-proxy-int-tests
• adds-slack-alert-toolhive
• adds-subagents
• adds-tests
• adopt-core-delegation-schema
• adopt-env-from-toolhive-core
• adopt-go-sdk-v1.7
• adopt-httperr-from-toolhive-core
• adopt-validation-from-toolhive-core
• agent-troubleshooting-for-toolhive-issue-5545
• agent/sdk-go-client-20260910
• aggregator-prompt-ambiguity-followup
• alert-tamarillo
• algisn-versions
• allow-docker-gateway-grant-access
• allow-private-endpoint
• alternative-workaround
• api-e2e-concurrency-bug
• api-e2e-phase-i
• api-e2e-phase-ii
• api-e2e-phase-iii
• api-e2e-phase-iv
• api-e2e-phase-ix
• api-e2e-phase-v
• api-e2e-phase-vi
• api-e2e-phase-vii
• api-e2e-phase-viii
• api-e2e-state-cleanup
• api-e2e-testcontainer
• api-e2e-tests
• api-proxy-port
• aponce/add-registry-source-url-to-run-config
• aponce/extract-policy-gate-add-registry-mutation
• aponce/optimizer-circuit-breaker-acceptance-test
• aponce/optimizer-multibackend-acceptance-test
• aponce/unify-claude-config
• aponcedeleonch/rename-optimizer-examples
• aponcedeleonch/tei-batch-chunking
• apply-otel-config-from-api
• aron/fix-oauth-issues
• aron/mcpremoteproxy-optional-auth
• aron/redis-tls-support
• aron/retoken-issue
• atomic-writes-file-locking-secrets
• audit-act-claim-6035
• audit-authz-denials
• audit-delegation-review-fixes
• audit-full-chain-coverage
• audit-max-size
• audit-restore
• audit-stream-open-followups
• audit_docs
• audit_leak_shutdown
• auth-discovery
• auth-health-check
• auth-proxy-10-1-1-shared-discovery-types
• auth-proxy-multi-user-storage
• auth-proxy-oauth-userinfo
• auth-proxy-pr-1-storage
• auth-proxy-pr-10-1-handlers-infra
• auth-proxy-pr-10-2-1-client-cap-max
• auth-proxy-pr-10-2-2-dcr-harden
• auth-proxy-pr-10-2-handlers-token
• auth-proxy-pr-10-3-handlers-authorize
• auth-proxy-pr-10-4-handlers-dcr
• auth-proxy-pr-11-1-dedupe-and-relax-dcr
• auth-proxy-pr-11-config
• auth-proxy-pr-11-config-userinfo
• auth-proxy-pr-11-core-authserver
• auth-proxy-pr-11-key-management
• auth-proxy-pr-12-integration-test-1
• auth-proxy-pr-14-upstream-iface
• auth-proxy-pr-15-oidc-plumbing
• auth-proxy-pr-2-session
• auth-proxy-pr-3-client
• auth-proxy-pr-4-dcr
• auth-proxy-pr-5-upstream
• auth-proxy-pr-6-crypto
• auth-proxy-pr-7-1-oidc-methods
• auth-proxy-pr-7-oidc-1
• auth-proxy-pr-7-upstream-fetcher
• auth-proxy-pr-7-upstream-http-client
• auth-proxy-pr-7-upstream-http-error
• auth-proxy-pr-7-upstream-oauth
• auth-proxy-pr-8-in-memory-storage
• auth-proxy-pr-9-oauth2-server-config-jwks
• auth-refactored
• auth-server-addition-proposal
• auth-server-race-test
• auth-server_iss_234_2026-02-02
• auth-server_issue-226_2026-01-28
• auth-server_issue-227_2026-01-29
• auth-server_issue-229_2026-01-28
• auth-server_issue-230_2026-01-30
• auth-server_issue-230b_2026-01-30
• authenticated-token-source-monitoring
• authserver-multi-upstream/1-storage
• authserver-multi-upstream/2-chain
• authserver-multi-upstream/3-enable
• authserver-multi-upstream/4-tokens-in-identity
• authserver-oauth-constants
• authserver-respect-insecure-validation
• authz-dual-claim-5
• authz-filter-content-length
• authz-group-tests-6a
• authz-list-ops-7
• authz-log-skip-on-auth-failure
• authz-mcp-parent-6b
• authz-provider_issue_5197
• authz-resource-name-attr-4
• auto-add-remote-server-to-clients
• auto-update-branches
• autosecretDCR
• autoupdate-permission-issue
• awesome-cup
• awsSts-converter-vmcp_2026-04-22
• aws_debug
• aws_sts-pr-1-cel
• aws_sts-pr-2-mapper
• aws_sts-pr-3-tokenexchange
• aws_sts-pr-4--sign
• aws_sts-pr-5-middleware
• aws_sts-pr-5a-middleware
• aws_sts-pr-5b-runner-wiring
• aws_sts-pr-6-fixups-fix-1-misc
• aws_sts-pr-6-fixups-fix-2-no-regex
• aws_sts-pr-6-fixups-fix-3-priorities
• aws_sts-pr-7-crds-v2
• backend-watcher-outgoing-auth
• backends_discovery_in_status
• bad-gateway
• bad_example
• bearer-token-api
• bearer-token-pr1-foundation
• bearer-token-pr2-secrets
• bearer-token-pr3-discovery
• bearer-token-pr4-unauthenticated-state
• bearer-token-pr6-cli-wire-up
• bearer-token-support-kubernetes
• bearer_auth
• bearer_token_util
• brand-refresh
• build-env-cli-templates
• build-env-config-foundation
• build-env-secrets-implementation
• build-env-secrets-proposal
• build-with-rename
• bump-arch-docs
• bump-codeowners
• bump-core
• bump-go
• bump-go-1-25-3
• bump-go-jose-cves
• bump-go-toolchain-1.26.4
• bump-klauspost-compress
• bump-operator-versions
• bump-registry
• bump-registry-api-v1.0.1
• bump-releaseo-version-v0.0.4
• bump-testcontainers-go-0.42.0
• bump-toolhive-core-schema-fidelity
• bump-toolhive-core-v0.0.45
• bump-x-crypto-0.56.0
• bump-x-crypto-ssh-dos
• bump-yardstick-server
• cab/runner-probe-auth-401
• cb/map-ratelimit-serve-config
• cb/mcpremoteproxy-oidc-cabundle
• cb/proxy-body-size-limit
• cburns/2289-mcpremoteproxy-error-reporting
• cburns/2289-remaining-validations
• cburns/4252-add-printer-columns-to-all-crds
• cburns/authzconfigref-foundation
• cburns/authzconfigref-mcpremoteproxy
• cburns/authzconfigref-mcpserver
• cburns/authzconfigref-vmcp
• cburns/config-controllers-eventrecorder
• cburns/consolidate-oidcconfig-refs-ownership
• cburns/envoy-allow-port
• cburns/envoy-e2e
• cburns/envoy-e2e-enable
• cburns/envoy-harden-5903
• cburns/envoy-network-proxy
• cburns/envoy-proxy-seam
• cburns/envoy-readiness-fix
• cburns/fix-authzconfig-watchhandlers-datarace
• cburns/fix-flaky-scaling-test
• cburns/fix-mcpserverentry-headerforward
• cburns/groupref-typed-struct
• cburns/headerforward-envvar
• cburns/ignore-docker-daemon-vulns
• cburns/listmapkey-parity-sibling-configs
• cburns/mcpoidcconfig-controller-4248
• cburns/mcpoidcconfig-types-4248
• cburns/migrate-sibling-controllers-mutatepatchstatus
• cburns/network-isolation-gateway-tests
• cburns/oidc-configref-resource-url
• cburns/operator-test-reconciler-helpers
• cburns/refactor-backend-check-lifecycle
• cburns/refactor-referencing-workloads-helpers
• cburns/remove-deprecated-crd-fields
• cburns/runtime-config-wrapper
• cburns/sampling-rate-validation
• cburns/transparent-interception
• cburns/vmcp-core-list-backends
• cburns/vmcp-oidc-cabundle
• cedar-followup-review-nits
• cedar-merge-upstream-as-claims
• cedar-nested-map-claims
• ceder-auth-vmcp
• cel-validation-union-types
• change-codecov
• change-default-proxy-mode-streamable-http
• change-default-proxy-mode-to-streamable-http
• change-otel-metric-defaults
• chart-crds-version
• childish-waste
• chip-editor
• chore/add-codeowners
• chore/add-skills-types
• chore/audit-consts-core
• chore/bump-toolhive-core-and-catalog
• chore/change-renovate-commit-msg
• chore/ci-task-ensure-docs-proposal-names-format
• chore/decouple-transport-from-runtime
• chore/e2e-labels-matrix
• chore/enable-parallel-lint-runners
• chore/fix-thv-2207-proposal-name
• chore/images-keychain-core
• chore/migrate-trivy-to-grype
• chore/move-testkit-under-test
• chore/recovery-core-shim
• chore/refactor-runconfig-builder-into-options
• chore/refactor-runconfigbuilder-to-option
• chore/remove-legacy-optimizer-decorator
• chore/rename-design-docs
• chore/telemetry-providers-core
• chore/use-core-mcp-semconv-buckets
• chore/use-testkit-client
• chris/api-compat-noop-companion
• chris/api-compat-per-crd-iteration
• chris/api-compat-phase-2
• chris/api-compat-trigger-on-label
• chris/config-controllers-drop-stale-scan
• chris/config-stale-ref-helper
• chris/dedup-operator-rules
• chris/default-storage-version-migrator
• chris/drop-referencing-workloads-status
• chris/envtest-refactor
• chris/fix-codespell-unparseable
• chris/llm-lazy-message-wording
• chris/llm-setup-lazy
• chris/oidc-config-ref-indexer
• chris/operator-integration-test-gaps-3363
• chris/operator-rules
• chris/proto-v1beta1test-builders
• chris/svm-chart-surface
• chris/svm-controller
• chris/svm-docs
• chris/svm-opt-in-labels
• chris/test-api-compat-add-field
• chris/test-api-compat-break
• chris/test-api-compat-enforcement
• chris/test-api-compat-rename
• chris/v1beta1test-embeddingserver-migration
• chris/v1beta1test-remoteproxy-migration
• chris/v1beta1test-vmcp-migration
• chris/v1beta1test-workload-builders
• chrisburns/4592-add-missing-shortnames
• chrisburns/4658-vmcp-entry-static-backend
• chrisburns/4659-mcpserverentry-docs
• chrisburns/4659-vmcp-entry-dynamic-reconciler
• chrisburns/add-listtype-annotations
• chrisburns/add-mcptelemetryconfig-controller
• chrisburns/add-release-notes-skill
• chrisburns/fix-image-validation-configyaml
• chrisburns/fix-protectedresource-allowprivateip
• chrisburns/mcpoidcconfig-workload-reference
• chrisburns/mcpregistry-status-consolidation
• chrisburns/mcpremoteproxy-telemetry-config-ref
• chrisburns/mcptelemetryconfig-types
• chrisburns/oidc-config-ready-condition
• chrisburns/proxy-request-timeouts
• chrisburns/remove-groupref-and-external-auth-enum
• chrisburns/standardize-workload-phases-ready
• chrisburns/vmcp-converter-resolve-oidc
• chrisburns/vmcp-mcpoidcconfig-ref
• chrisburns/vmcp-mcpoidcconfig-ref-v2
• ci-arch
• ci-fix
• ci-tidy-names
• ci-workflow-updates
• ci/add-renovate-config-validation
• cimd-auth-methods-fallback
• cimd-client-audience
• cimd-client-persistence
• cimd-followup-tests
• cimd-ignore-unsupported-grant-types
• cimd-phase2-pr1-fetch-validate
• cimd-phase2-pr2-storage-decorator
• cimd-phase2-pr3-wiring
• cimd-phase2-pr4-integration-tests
• cimd-phase2-pr5-crd-field
• cimd-phase2-pr6-cimd-validation
• cimd-thv-run-client-support
• claim/toolhive-5675-remove-amp-editor-clients
• classifier-legacy-header-authoritative
• classify-legacy-only-methods
• claude-agent
• claude-bedrock-config
• claude-commands_2025-10-21
• claude-helm
• claude-helm-skill
• claude-prompt-pr-split
• claude/issue-1452-20250827-1021
• claude/issue-2119-20251008-1230
• claude/issue-2385-20251030-1527
• claude/issue-2507-20251107-1918
• claude/issue-2643-20251118-2153
• claude/pr-4299-20260321-1418
• claude_skills
• clean/runtime-config-api
• cleanup-llmgateway-mode-literals
• cleanup-pid-after-migration
• cleanup/client-filtering-followup
• cleanup/remove-dead-mcpserverconfig
• clear-helm-publish-findings
• clear-release-tag-findings
• cli-practices-docs
• cli-registry-auth
• cli/thv-start-command
• client-list-consolidation
• client_id_not_required
• coal-cress
• code-dead-code-analysis-and-removal-potential
• code-mode_issue_4742
• code-reviewer-agent
• codex/fix-contributing-guide-link
• codex/strip-json-response-bom
• complex-data
• composite-tool-refs-resolution
• concurrent-restart-keyring-race-condition
• config-map-ref
• config-refactor-phase2-validation
• configurable-1
• configurable-2
• configure-telemetry-namespace
• conformance-diagnostics
• conformance-no-debug-probe
• consistent-error-comparison
• consistent-workload-naming
• consolidate-negotiate-down-rationale
• consolidate-pr-size-workflows
• containerfile-preflight
• content-fallback
• context7-mcp-spec-lookups
• continue-vmcp-crd
• contrib-guidelines-update
• converge-registry
• convert-reg-server-config-to-cm
• converts-mcpgroup-e2e-tests-to-int
• copilot/sub-pr-2906
• corrects-errors
• cosign_bundle_signing
• couple-registry-auth
• coveralls
• crd-upstream-allow-private-ip
• dcr-1b_issue_5371
• dcr-3a_issue_5183
• dcr-3b_issue_5184
• dcr-3c_issue_5185
• dcr-4a_issue_5145
• dcr-4b_issue_5219
• dcr-private-key-jwt
• debug/stdio-operator-e2e
• decouple-configmap-operator
• default-callback-port
• default-scope-intersection
• default_mcp_port
• defaults-in-cli-docs
• deflake-ci-e2e
• deflake-dial-error-test
• deflake-envoy-allowport
• deflake-forwarding-realbackend-5962
• deflake-integration-tests
• deflake-vmcp-backend-transport
• deflake-vmcp-forwarding-progress
• deflake-workflow-parallel-execution
• delegate-clients-6082
• delegate-on-loopback
• delete-doc
• denyinwebhook
• dependabot/github_actions/github/codeql-action-4
• dependabot/go_modules/github.com/buger/jsonparser-1.1.2
• dependabot/go_modules/github.com/go-git/go-git/v5-5.17.1
• dependabot/go_modules/github.com/go-git/go-git/v5-5.18.0
• dependabot/go_modules/github.com/go-git/go-git/v5-5.19.0
• dependabot/go_modules/github.com/go-git/go-git/v5-5.19.1
• dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
• dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.4
• dependabot/go_modules/github.com/in-toto/in-toto-golang-0.11.0
• dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.0.11
• dependabot/go_modules/github.com/moby/go-archive-0.3.0
• dependabot/go_modules/github.com/moby/spdystream-0.5.1
• dependabot/go_modules/github.com/modelcontextprotocol/registry-1.7.7
• dependabot/go_modules/github.com/olekukonko/tablewriter-1.1.0
• dependabot/go_modules/github.com/sigstore/rekor-1.5.0
• dependabot/go_modules/github.com/sigstore/sigstore-1.10.4
• dependabot/go_modules/github.com/sigstore/timestamp-authority/v2-2.0.6
• dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1
• dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.4.1
• dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp-1.43.0
• dependabot/go_modules/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp-1.43.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.43.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/google.golang.org/grpc-1.79.3
• dependabot/go_modules/google.golang.org/grpc-1.82.1
• dependabot/go_modules/google.golang.org/grpc-1.83.1
• dependabot/go_modules/google.golang.org/grpc-1.83.2
• dependabot/go_modules/sigs.k8s.io/controller-runtime-0.22.1
• dependencies/update-inspector
• deprecate-regup
• deprecate-roo-code-client
• deprecated-fields
• deprecating-mcpregistry-crd-plan-and-design
• disable-failing-vmcp-e2e
• disable-labels-for-forked-repos
• disable-selinux-labeling
• docker-socket-fallback-on-ping-failure
• docs-allow-docker-gateway-port-independent
• docs-stale-paths
• docs-update-remote-auth
• docs/4615-helm-notes-txt
• docs/add-mcpgroup-to-operator-arch
• docs/ai-plugin-architecture-and-cli-skill
• docs/arch
• docs/arch-refresh-2026-05
• docs/clarify-docs-file-name-format
• docs/contributor-expectations
• docs/crd-overview-diagram
• docs/fix-contributing-periods-and-dco
• docs/fix-doc-rot
• docs/openpgp-exclusion-trigger
• docs/operator-e2e-tests-and-task-improvements
• docs/operator-phase-conditions-4545
• docs/otel-telemetry-documentation
• docs/remove-stale-chart-version-guidance
• docs/runconfig-proposal
• docs/runtime-authoring-guide
• docs/security-documentation
• docs/update-crd-stabilization-documentation
• docs/update-go-version
• docs/update-middleware-documentation
• docs/update-readme-interfaces
• docs/vmcp-architecture-updates
• document-spdx-headers
• document-vmcp-revision-classification
• domain-model-diagram
• downgrade-go-1.24
• dramatic-hose
• drift-detection-walker-and-telemetry-test
• drop-authserver-redis-password-guard
• drop-pr-number-artifact
• drop-rh-ubi-images
• drop-test-silent
• drop-unused-fields
• drop_cache_size
• dual-era-e2e-tests
• dynamicwebhook1
• dynamicwebhook2
• dynamicwebhook3
• dynamicwebhook4
• dynamicwebhook5
• e2e-backend-routing-acceptance-test
• e2e-mcpserver-cross-replica-session-test
• e2e_dedup
• e2e_less_boilerplate
• e2e_no_hardcoded_version
• early-policy-check
• echo-jsonrpc-id-in-session-404
• edit-api-port-reuse
• embedded-resource-content-access
• enable-configmap
• enable-zizmor-gate
• encrypted-manager-cross-process-reads
• enforce-structured-logs-k8s
• enforce-xl-pr-justification
• enhancement/Add-ExcludeAll-option-for-tool-filtering-in-VirtualMCPServer-aggregation
• ensure-version-output
• enterprise-server-extensions-hook
• env-secrets
• envelope-sse-delivery
• envtest_pin
• error-handling-cleanup
• error-handling-linting
• error-levels-api
• error-levels-config-secret
• error-levels-logs-proxy
• error-levels-proxy
• error-levels-transport-telemetry-auth
• error-no-config
• exclude-mocks
• export-detail-api-inconsistencies
• extensible-runtime-registry
• external-auth-controller-impl
• extract-workflow-auditor-prologue
• extreme-snout
• factory-ai-client
• fail-fast
• fallback-userInfo_2026-04-28
• feat-cedar-id-token-group-claims-6049
• feat-modern-capability-errors
• feat-modern-mrtr
• feat-modern-subscriptions-listen
• feat/5101-mcpregistry-image-pull-secrets
• feat/5101-vmcp-image-pull-secrets
• feat/5102-default-image-pull-secrets-foundation
• feat/5143-llm-client-flag
• feat/5455-user-id-span-attribution
• feat/5529-plugin-registry-catalog
• feat/5748-vmcp-backend-notifications
• feat/add-continue-client
• feat/add-e2e-tests-for-tool-override-1515
• feat/add-kiro
• feat/add-proxy-mode-to-workload-api
• feat/add-tool-annotations
• feat/add-tool-middleware-config-to-cli
• feat/add-tool-middleware-config-to-http-api
• feat/add_debug_k8s_proxy
• feat/add_invalid_config_tests
• feat/add_k8s_vmcp_e2e_tests
• feat/add_missing_vmcp_k8s_docs
• feat/add_resource_url_k8s
• feat/add_tool_filter_mcptoolconfig
• feat/add_virtualmcpcompositetooldefinition_crd
• feat/add_vmcp_examples
• feat/add_vmcp_status
• feat/additional-token-params
• feat/authorization-endpoint-base-url-override
• feat/authserver-standalone-redis
• feat/build-auth-files
• feat/cli-desktop-validation
• feat/codex-app-llm-setup
• feat/config-field-framework
• feat/configurable-session-affinity
• feat/deprecate-sse-proxy-mode-for-stdio-transport
• feat/disable-workload-rbac
• feat/discover_auth
• feat/enable-llm
• feat/excludeall-vmcp-tools
• feat/hide-registered-clients-in-setup
• feat/improve-client-config-file-logic
• feat/inspector-auto-cleanup
• feat/interactive-wizard
• feat/issue-1638-configmap
• feat/issue-1638-state-storage
• feat/issue-2850-user-identity
• feat/issue-2980
• feat/issue-2980-backend
• feat/issue-2980-cli
• feat/issue-2980-composite-workflow
• feat/issue-2999
• feat/issue-3000
• feat/issue-3001
• feat/issue-3004
• feat/issue-3036-healthcheck
• feat/issue-3036-healthcheck-1
• feat/issue-3036-healthcheck-2
• feat/issue-3036-healthcheck-3
• feat/issue-3036-healthcheck-circuitbreaker
• feat/issue-3036-healthcheck-circuitbreaker-remove-unhealthy
• feat/issue-3036-healthcheck-partial-mode
• feat/issue-5158
• feat/issue-5173-gemini-env-injection
• feat/k8s-configmap-runconfig-1638
• feat/llm-all-clients-e2e
• feat/llm-claude-desktop
• feat/llm-gemini-cli
• feat/llm-skip-browser-flag
• feat/make-registry-auth-configurable
• feat/mcp-backend-session-affinity
• feat/mcp-server-secrets-management
• feat/more_vmcp_tests
• feat/operator-audit-config
• feat/operator-authz-configmap
• feat/otel-use-config-framework
• feat/private-package-registries-proposal
• feat/ratelimit-tool-attribution
• feat/registry-auth-defaulter
• feat/registry-auth-serve-mode
• feat/registry-export-phase1
• feat/registry-login-logout
• feat/registry-skills-client
• feat/registry-skills-provider
• feat/release-app-token
• feat/remove-mcp-go
• feat/remove-tooltype-and-rename-createdat
• feat/remove-tooltype-field
• feat/request-body-size-limit
• feat/restart-mcpserver-annotation-1880
• feat/session-storage-http-streaming
• feat/session-storage-interface-phase2
• feat/session-storage-pluggable
• feat/skill-api-stubs
• feat/skill-cli-stubs
• feat/skill-clients-field
• feat/skill-install-git-refs
• feat/skill-install-git-refs-v2
• feat/skill-install-git-refs-v3
• feat/skill-installer
• feat/skill-oci-build-push
• feat/skill-stubs
• feat/sort-client-setup
• feat/stateless-streamable-http
• feat/status-command
• feat/sticky-sessions
• feat/sync_mvmcp_crd
• feat/telemetry-tool-error-capture
• feat/test_composite_tools
• feat/test_group_membership
• feat/test_vmcp_inline_auth
• feat/thv-0047-crd-type-changes
• feat/token-exchange-env-var
• feat/untrusted-mcp-egress-broker
• feat/update-mcp-parser-latest-spec
• feat/vmcp-audit-log_output_destination
• feat/vmcp-composite-tool-annotations
• feat/vmcp-declarative-upstream-filter
• feat/vmcp-elicitation-fastfail-test
• feat/vmcp-elicitation-support
• feat/vmcp-passthrough-headers
• feat/vmcp-resolve-authz-configmap
• feat/vmcp-resource-meta-forward
• feat/vmcp-revision-refute-ttl
• feat/vmcp-routing-interfaces
• feat/vmcp-watch-authz-configmap
• feat/vmcp_auth_strategies_incompatible
• feat/vmcp_binary
• feat/vmcp_composition_multistep
• feat/vmcp_composition_multistep_2
• feat/vmcp_controller_tests
• feat/vmcp_crd
• feat/vmcp_discovered_backend_tracking
• feat/vmcp_k8s_controller
• feat/vmcp_service
• feat/vmcp_status_collector
• feat/watch_vmcp_tool_composition
• feature/add-mcpremoteproxy-crd
• feature/client-skill-metadata
• feature/configurable-session-ttl
• feature/docker-workload-tests
• feature/github-oauth-provider
• feature/header-injection-auth
• feature/increase-session-ttl
• feature/mcpremoteproxy-implementation
• feature/memory-server-core
• feature/oidc-env-secret-support-clean
• feature/propolis-runtime
• feature/remove-info-logger
• feature/secretkeyref-oidc
• feature/telemetry-configmap-support
• feature/toolconfig-crd
• finding-b-truncate-label-values
• finding-f-health-fingerprint
• fix--registry-remote-server-running
• fix-2466-auth-constants
• fix-3043-convert-secretgo-subcommands-from-run-to
• fix-3044-standardize-cli-output-messages-to-use-w
• fix-3048-improve-error-messages-with-actionable-r
• fix-3049-add-default-values-to-cli-flag-help-text
• fix-3108-ensure-toolhive-errors-are-wra-1229-0001
• fix-6038-omit-absent-jsonrpc-id
• fix-6039-jsonrpc-codes
• fix-6066-review-followups
• fix-address-already-in-use-on-restart
• fix-agent-permission-mode
• fix-aggregator-conflicts
• fix-api-timeout-large-images
• fix-api-validation-413
• fix-atlassian-issuer-mismatch
• fix-auditor-middleware-transport
• fix-auth-401-rfc6750-json-response
• fix-auth-flags-for-registry
• fix-authz-call-tool-key-case
• fix-authz-filter-bypasses
• fix-build-ubi-image
• fix-call-tool-nested-tool-name
• fix-canonical-rationale-references
• fix-cedar-opaque-claim-source-6048
• fix-chainsaw-install_2025-10-21
• fix-ci-docs
• fix-client-registration
• fix-client-status-sort-order
• fix-config-test-isolation-894
• fix-content-annotations
• fix-converters
• fix-coverage
• fix-crd-doc-anchors
• fix-crd-docs
• fix-crdref-gen-root-dir-paths
• fix-create-release-pr-stale-branch-cleanup
• fix-dashboard-uid
• fix-docker-restart
• fix-docs
• fix-double-pod
• fix-dual-era-port-bind-race
• fix-dual-era-readyreplicas-flake
• fix-duplicate-listing
• fix-duplicate-operator-e2e-runs
• fix-duplicate-workload
• fix-e2e-batch-rejection-5932
• fix-e2e-test-skills
• fix-empty-pulls-column-in-registry-list
• fix-encrypted-secrets-toctou
• fix-encrypted-tests-context-deadline-exceeded
• fix-endpoint-ctx
• fix-external-network-create-race
• fix-find-tool-response-filtering
• fix-find-tools-cedar-optimizer
• fix-flacky-tests
• fix-flaky-close-closed-channel
• fix-flaky-foreach-abort-test
• fix-flaky-lifecycle-e2e-test
• fix-flaky-mcpremoteproxy-test
• fix-flaky-parallel-execution-test
• fix-flaky-session-management-timeout
• fix-flaky-usagemetrics-test
• fix-flaky-vmcp-e2e-tests
• fix-flaky-workload-from-container-info
• fix-git-test-race-condition
• fix-goose-client
• fix-goreleaser
• fix-group-case-insensitive
• fix-group-rm-e2e-flake
• fix-health-check-retry
• fix-host-network-isolation
• fix-host-networking
• fix-ida-pro-mcp-import
• fix-info-output
• fix-ingress-port-collision
• fix-inspector
• fix-inspector-url-transport
• fix-invalid-act
• fix-issuer
• fix-jwks-errnotready
• fix-jwks-publishes-fallback-keys
• fix-jwks-resource-client
• fix-k8s-export-volume-validation
• fix-leader-election-namespace
• fix-lint-issues
• fix-lint-mcpgroup
• fix-linter-cyclomatic-complexity
• fix-loopback-localhost-6189
• fix-main-reserved-meta-test-build
• fix-mcp-server-tests-no-runtime
• fix-mcpremoteproxy-health-probe-timing
• fix-mkp-example
• fix-mockgen
• fix-mutation-parse-staleness
• fix-nonconformant-jsonrpc-denials
• fix-oauth-issuer-discovery
• fix-oauth-secret-empty-check
• fix-observedgeneration-composite-tool-fes
• fix-oci-tag-validation-use-library
• fix-oidc-discovery-race
• fix-operator-datarace-logger
• fix-operator-env-default-type
• fix-operator-proxy-usage-metrics
• fix-optimizer-store-schema-loss
• fix-partial-failure-mode-validation
• fix-port-issue
• fix-pr-size-workflow-yaml
• fix-proxy-mode
• fix-pullpolicy-type
• fix-race-detector-test-failures
• fix-redis-acl-examples_2026-04-08
• fix-registry
• fix-registry-fallback-error
• fix-registry-info-custom-metadata
• fix-registry-list
• fix-registry-schema-id
• fix-release-notes-trigger
• fix-releaseo-bin-version
• fix-releaser-warns
• fix-remote-servers-tests
• fix-renovate-kindest-node-patch-only
• fix-resource-relay
• fix-resource-template-response-filtering
• fix-restart
• fix-rfc7591-scope-format
• fix-rfc8414-path-aware-issuer-discovery
• fix-rfc8707-resource-parameter-cached-token-restore
• fix-runconfig-save-race-condition-on-workload-edit
• fix-scopes-type
• fix-security-md-broken-image-links
• fix-service-annotation-hotloop-5730
• fix-serviceaccount-configmap-mode
• fix-silent
• fix-skill-and-installer-tests-using-real-temp-dir
• fix-skill-names-spec-compliance
• fix-skills-arch-doc-accuracy
• fix-skills-client-discovery-isolation
• fix-spdy-eof-hang
• fix-sse-endpoint-rewrite-e2e-tests
• fix-sse-filter-error-framing
• fix-standalone-sse-filtered-tool-test
• fix-staticcheck-nil-pointer
• fix-stdio-tests
• fix-structured-startup-log
• fix-swagger
• fix-swagger-embedded-struct-fields
• fix-swagger-enum-duplication
• fix-telemetry-teardown-fl
• fix-thv-list-status-poisoning
• fix-thvignore-tmpcopyup
• fix-tool-call
• fix-tool-filter-terminal-drain
• fix-toolhive-external-network-race
• fix-tools-override-streamable-http
• fix-trans
• fix-type-picking
• fix-ubi-image-arch
• fix-unsupported-version-conformance
• fix-upstream-refresh-persist
• fix-upstream-refresh-singleflight
• fix-utilruntime-must
• fix-validate-oci-tag-or-reference
• fix-version-discrepency
• fix-vmcp-cedar-upstream-provider
• fix-vmcp-composite-tool-parameters-json-schema
• fix-vmcp-configured-timeouts
• fix-vmcp-controller-readiness-check
• fix-vmcp-debug-flag-no-op
• fix-vmcp-discovered-auth-env-var-ordering
• fix-vmcp-dispatch-legacy-fallback
• fix-vmcp-health-test-flakiness
• fix-vmcp-imagepullsecrets-hot-reconcile
• fix-vmcp-integration-port-race
• fix-vmcp-name-mapping-conflict-resolution
• fix-vmcp-output-config-yaml-parsing
• fix-vmcp-patch
• fix-vmcp-podtemplatespec-hot-reconcile
• fix-vmcp-probe-nil-registry
• fix-vmcp-race
• fix-vmcp-schema-double-nesting
• fix-vmcp-test-defaulttei-rename
• fix-volume-mount-validation
• fix-warns
• fix-workflow-ref-interpolation
• fix-workload-delete-race-condition
• fix-xforwarded-proto-tls-upstream
• fix/2314-mcpremoteproxy-reconcile-spec-changes
• fix/4761-target-port-host-validation
• fix/4920-treat-401-as-healthy
• fix/5009-authz-accepts-client-responses
• fix/5009-client-response-authz-bypass
• fix/5099-mcpremoteproxy-image-pull-secrets
• fix/5100-embeddingserver-podtemplatespec-merge
• fix/5110-podtemplatespec-isempty
• fix/5137-consolidate-apply-config
• fix/5179-test-quality-llm-gateway
• fix/5217-windows-dacl-discovery
• fix/5337-identity-from-context-typed-nil
• fix/5339-registry-api-events-rbac
• fix/5365-redis-password-drift
• fix/5567-forwarded-proto-upstream-scheme
• fix/5619-vmcp-volume-drift
• fix/5619-volume-drift-detection
• fix/5655-sse-event-name
• fix/5655-streamable-sse-event-name
• fix/6194-retry-id-token-validation-after-refresh
• fix/6211-relative-project-root
• fix/6212-client-timeout
• fix/6213-ref-change-guard
• fix/6291-windows-afunix-url
• fix/6292-gui-editor-llm-detect
• fix/6346-mcpregistry-deprecation-warn-once
• fix/6497-health-probe-no-standalone-get
• fix/6507-claude-desktop-windows-helper
• fix/add-debug-logs-to-detached-process
• fix/add-observed-generation-to-conditions
• fix/add-security-response-headers
• fix/ai-plugin-relative-project-root
• fix/ai-plugin-timeouts
• fix/align-openshift-values-image-tags
• fix/amp-client-installed-detection
• fix/audit-jsonrpc-error-detection
• fix/audit-level-name
• fix/audit-log-level-audit-string-4296
• fix/auth-retrying-cross-tick
• fix/auth_discovery_test
• fix/authserver-refresh-token-tests
• fix/authserver-test-miniredis-import
• fix/authserver-unprovisioned-identity-access-denied
• fix/authz-list-filter-annotations
• fix/authz-nonjson-content-type
• fix/authz-sse-line-fallthrough
• fix/awssts-string-role-claim-fallback
• fix/bom-json-response-filter-bypass
• fix/bridge-regression-reserved-meta-api
• fix/bump-go-1.25.7
• fix/cedar-opaque-token-fallback
• fix/cedar-uri-entity-id-collision
• fix/ci-extra-volumes-keys
• fix/ci-lint-and-test-timeout
• fix/ci-security-scan-workflow
• fix/ci-typecheck-and-keyctl-flake
• fix/cli-cmd-context-3045
• fix/codeql-sarif-ref-comment
• fix/config-crd-condition-type-naming
• fix/configurable-health-check-4084
• fix/configurable-proxy-timeout-4061
• fix/consolidate-jwks-fetch-cache
• fix/container-exit-reconnection
• fix/correct-CRD-type
• fix/crd-conditions-listtype-markers
• fix/crd-helm-release-namespace-annotation
• fix/crd-int-to-int32
• fix/ct-install-all-charts
• fix/dcr-audience-whitelist
• fix/dcr-refresh-token-grant
• fix/dcr-response-scope
• fix/default-registry-format
• fix/deletion-check-order
• fix/dev-mode-oci-registry
• fix/discovery-cache-partial-results
• fix/e2e-proxy-sse-test-failures
• fix/e2e_test_conflict
• fix/egress-proxy-arm64-build
• fix/elicitation-comment-paths
• fix/env-var-nil-pointer-1469
• fix/error-wrapping-cli
• fix/exclude-terminating-pods-from-ready-count
• fix/fix-authz-middleware-tools-list
• fix/fix-authz-tools-list
• fix/fix-sse-response-processor-rewrite
• fix/flaky-cleanup-loop-test
• fix/flaky-e2e-lifecycle-tool-discovery
• fix/flaky-e2e-port-allocation-race
• fix/flaky-proxy-port-test
• fix/flaky-registry-api-image-test
• fix/ghsa-3768-ssrf-guard
• fix/go-1.26.2-stdlib-vulns
• fix/go-version-1.25.6-vulnerabilities
• fix/gomemlimit-typo-and-value
• fix/google-tokeninfo-audience
• fix/goreleaser-cli-docs-path
• fix/gosec-lint-nosec-annotations
• fix/groupref-reconcile-error
• fix/guard-pid-zero-4400
• fix/health-check-zombie-process
• fix/healthcheck-cleanup-4790
• fix/helm-chart-publish-path
• fix/helm-operator-helpers-namespace
• fix/helm-rbac-template-names
• fix/histogram-bucket-boundaries
• fix/honor-kubectl-rollout-restart
• fix/hop-by-hop-sigv4-mismatch
• fix/host-header-rewriting
• fix/imagepullsecrets-drift-detection
• fix/issue-1874-proxy-mode
• fix/issue-1957-oidc-issuer-mismatch
• fix/issue-2843
• fix/issue-4113-mcpremoteproxy-ca-bundle
• fix/issue-4170-remove-non-spec-progress-update
• fix/issue-4312
• fix/issue-5022
• fix/json-rpc-session-not-found-4425
• fix/jsonschema-v6-upgrade
• fix/jwks-fallback-rotation
• fix/key-signed-verification
• fix/keyctl-password-retry-3332
• fix/llm-client-type
• fix/localstore-path-traversal
• fix/log-middleware-names
• fix/mcp-backend-session-affinity-followup
• fix/mcp-embedded-auth-drift-4877
• fix/mcp-handler-interactive-oauth
• fix/mcp-handler-uses-config-new-provider
• fix/mcpgroup-proxies-column
• fix/mcpgroup-ready-column-label
• fix/mcpoidcconfig-printer-columns
• fix/mcpregistry-probe-port-and-image-bump
• fix/mcpremoteproxy-ready-column
• fix/mcpserver-auth-audit-persistence
• fix/mcpserver-crd-size-reduction
• fix/mcpserver-env-deterministic-ordering
• fix/mcpserver-redis-password-injection
• fix/mcpserver-remote-path
• fix/mcpserver-url-proxymode
• fix/middleware-flusher-interface
• fix/monitored-token-source-singleflight-test
• fix/move_vmcp_e2e_tests
• fix/nil-pointer-panic-protocol-scheme-3940
• fix/non-registry-server-policy-enforcement
• fix/oauth-authstyle-inparams
• fix/oauth-callback-loopback
• fix/oauth-callback-referrer-policy
• fix/oauth-refresh-include-scope
• fix/oauth-scope-refresh
• fix/oauth-token-refresh-context-cancellation
• fix/oauth-transient-error-classification
• fix/oidc-audience-resourceurl-validation
• fix/openshift-serviceaccount-secret-accumulation
• fix/operator-context-aware-logging
• fix/optional-secret-env-vars-5688
• fix/orphan-proxy-on-stop-rm-5393
• fix/otel-global-tracing-metrics-config
• fix/otel-insecure-config
• fix/otel-service-version-runtime
• fix/otel-workload-name-as-service-name
• fix/otlp-endpoint-path
• fix/otlp-headers-from-envvars
• fix/persist-dcr-credentials
• fix/persist-oauth-tokens
• fix/post-sse-progress-ordering
• fix/pr5993-review-followups
• fix/preload-yardstick-image-operator-e2e
• fix/priority-tool-unlisted-conflict
• fix/prm-scope-defaults
• fix/proposal-naming-validation-for-updates
• fix/proxy-connection-health-monitoring
• fix/proxy-e2e-batch-rejection
• fix/proxy-follow-redirects-4453
• fix/proxy-mode-sse-label
• fix/proxy-port-consistency
• fix/proxy-shutdown-followups
• fix/proxy-shutdown-mutex-3969
• fix/proxy-stale-connection-3179
• fix/proxy-token-expired-503-4721
• fix/proxyrunner-syncmap-oom-4062
• fix/proxyrunner-tools-override-middleware
• fix/quiet-streamable-http-non-jsonrpc-warn
• fix/recovery-abort-handler
• fix/recovery-middleware-errAbortHandler
• fix/recreate-deleted-mcpserver-sts
• fix/redis-storage-cel-has-guards
• fix/referencing-servers-status-2641
• fix/registry-error-type-in-error-message
• fix/registry-factory-bypass-config-provider
• fix/registry-login-allow-private-ip
• fix/registry-validate-endpoint-probe-4452
• fix/release-workflow-create-missing-release
• fix/remote-e2e-mock-mcp-server
• fix/remote-server-stability
• fix/remote-server-unhealhty-on-errors
• fix/remote-url-query-params
• fix/remote-workload-health-status-callback
• fix/remote-workload-url-population
• fix/remove-newmanagerwithregistry
• fix/remove-pointer-to-interface-2169
• fix/remove_header_value_env
• fix/remove_mixed_mode
• fix/remove_token_cache_config
• fix/rename-backend-auth-type-camelcase
• fix/renovate-dashboard-deps-561
• fix/renovate-kindest-node-patch-only
• fix/resource-metadata-discovery-fallthrough
• fix/response-filter-commit-recorded-status-on-flush
• fix/restore-server-builder-extension-methods
• fix/retry-4xx-token-refresh-5169
• fix/rfc8414-discovery-routing
• fix/run-flags-use-new-provider-for-otel-config
• fix/runtime-add-package-merge-defaults
• fix/runworkload-retry-counter-reset
• fix/sa-annotation-indent
• fix/sdk-verify-go-version
• fix/security-md-casing-local
• fix/session-manager-tool-annotations
• fix/set-correct-content-length
• fix/skill-install-resolve-local-store
• fix/slack-oauth-user-scope
• fix/spdx-headers-embeddingserver
• fix/speed_e2e_tests
• fix/squid-error-loop
• fix/sse-event-message
• fix/stale-config-in-registry-and-workload-service
• fix/staticcheck-sa5011-nil-pointer
• fix/status-condition-persistence-4511
• fix/status-file-pid-clobbering
• fix/streamable-session-lazy-channels
• fix/supervisor-alive-pid-zero-4429
• fix/telemetry-drop-noisy-warn-streamablehttp-4451
• fix/test-macos-symlinks-and-phonenumbers-vuln
• fix/test-nil-panic-no-runtime-4760
• fix/test_backend_health
• fix/token-exchange-allowmayact-cel
• fix/token-refresh-user-agent-5167
• fix/token-source-permanent-credential-errors
• fix/token_exchange_crds
• fix/tool-middleware-connection-hang
• fix/tool-middleware-json-buffer-flushes
• fix/upstream-token-cleanup-provider-scoped
• fix/upstream-token-refresh-cross-process-cas
• fix/userinfo-omitempty
• fix/validate-upstream-jsonrpc-responses
• fix/virtualmcp-inline-telemetry-metrics-6276
• fix/virtualmcpserver-missing-json-import
• fix/vmcp-authserver-reconcile-loop
• fix/vmcp-authz-followup-5290
• fix/vmcp-backend-capability-name-translation
• fix/vmcp-backend-init-timeout
• fix/vmcp-bound-initialize
• fix/vmcp-config-ergonomics
• fix/vmcp-embedded-resource-content
• fix/vmcp-health-optional-list-429
• fix/vmcp-inline-telemetry-warning
• fix/vmcp-list-changed-optout
• fix/vmcp-multiline-sse
• fix/vmcp-oidcconfighash-statusmanager-4504
• fix/vmcp-parameter-defaults
• fix/vmcp-passthrough-restricted-set
• fix/vmcp-podtemplatespec-infinite-reconcile
• fix/vmcp-server-versionpollinterval-race
• fix/vmcp-skip-noop-deployment-update
• fix/vmcp-trace-context-propagation
• fix/vmcp-unauthenticated-backends-routable
• fix/vscode-llm-gateway-6294
• fix/wait-for-initialize-before-client-update
• fix/waitforpodsready-logic-bug
• fix/webhook-api-group-mismatch
• fix/well-known-handler-no-auth
• fix/workflow-auditor-close-file
• fix/workload-port-reuse-test
• fix/www-authenticate-scope
• fix/yaml-unmarshal-embedded-structs
• fix/zombie-process-detection
• fix/zombie-supervisor-processes
• fix_anonymous_auth
• fix_audit_user
• fix_ci
• fix_ci_oauth
• fix_e2e_lifecycle_tests
• fix_git_clone
• fix_gitpath
• fix_logging
• fix_registy_api
• fix_used_port
• fixes
• fixes-e2e-tests
• fixes-flaky-order-assertion
• fixes-flaky-test
• fixes-mocks
• fixes-release
• fixes-test-port
• fixes-tests
• fixtype
• flag-shorthands
• flaky-e2e-workload-readiness
• flaky-state
• fn-open-api-registry
• followup-5260-error-helper
• followup/updateconfig-review-comments
• foreach-step-type
• furtive-appendix
• gautam/D8-stacklok-attrs
• gautam/metrics-dual-emit-legacy-names
• gautam/metrics-std-toolhive
• git-resolver
• github-issue-resolution-request
• github-issue-toolhive-5546-implementation
• github-issue-toolhive-investigation
• github_mcp_header
• gives-claude-permissions-write
• global-redis-default-config
• go-24-dev-guide
• go-mod-tidy
• golang-build-ubi
• google-oauth
• goose
• goreleaser-cosign-v3
• great-handstand
• groups-crd-storage
• groups-integration-for-skills-3654
• groups-registry-alt
• groups-registry-proposal
• hack/fix-mcp-port-host-network-linux
• harden-actions-workflows-zizmor
• harden-checkout-credentials
• harden-ci-agent-workflows
• harden-ci-expressions
• harden-claude-workflow-gate
• harden-helm-publish-logins
• harden-ipv6-transition-addresses
• harden-pr-size-labeling
• harden-release-pr-token
• harden-release-tag-token
• harden-releaser-workflow
• header-pass-1-middleware
• header-pass-2-runconfig
• header-pass-3-cli
• header-pass-4-crds
• header-pass-5-crds
• header-set
• health-monitor-authconfig-change
• healthy-gem
• helm-chart-contributing
• helm-chart-unit-tests-for-operator-using-agents
• helm-crd-wrapper-integration-for-operator-manifest
• helm-operator-chart-more-tests
• helm-operator-chart-scenario-tests
• helm-operator-sa-name-consistency
• hide-coverage
• hide-vmcp-cli
• identity-unify
• idiomatic-async-handling
• ignore-coverage
• ignore-dottask
• ignore-stdlib-vulns-pending-go1264
• imageignore
• implement-helm-unittests-for-toolhive-following-ll
• implement-proper-health-checks
• implements-providers-strategies
• improve-build-errors
• improve-code-review-assist-skill
• improve-doc-discoverability
• improve-e2e-debuggability
• improve-optimizer-tool-descriptions
• improve-secrets-decrypt-error-logging
• improve-test-coverage-and-fix-label-validation
• includes-vmcp-renovate
• incorrecttransport
• inherit-secret-codecov
• inline-crds
• installs-go-claude
• int-tests
• integration-tests-fix
• iss-3599_upstream-token-exchange
• issue-1638-add-configmap-flag
• issue-1638-add-proxymode
• issue-1638-configmap-add-audit
• issue-1638-configmap-add-authn
• issue-1638-configmap-add-authz
• issue-1638-configmap-use
• issue-1638-use-configmap
• issue-1696-v1
• issue-1700
• issue-1717
• issue-1871
• issue-1873
• issue-1873-v1
• issue-1898
• issue-1941
• issue-1947
• issue-2114
• issue-2114-telemetry
• issue-2117
• issue-2166
• issue-2623-alternate
• issue-2640
• issue-2660
• issue-2680
• issue-2772
• issue-2781-vmcp-debug-level
• issue-2784
• issue-2784-followup
• issue-2786-centralize-e2e-images
• issue-2831
• issue-2838
• issue-2854-status-reporter
• issue-2873-vmcp-default-resources
• issue-2941
• issue-2985
• issue-3003
• issue-3003-v1
• issue-3016
• issue-3018
• issue-3036
• issue-3036-v1
• issue-3036-v1-fix
• issue-3036-v1-fix1
• issue-3036-v1-new
• issue-3036-v2
• issue-3062
• issue-3097
• issue-3109
• issue-3147
• issue-3147-status-reporter
• issue-3147-v1
• issue-3149
• issue-3149-v1
• issue-3149-v2
• issue-3149-v3
• issue-3149-v4
• issue-3168
• issue-3360
• issue-3360-remove-webhooks
• issue-3676-runtime-image-api
• issue-3691
• issue-3691-v1
• issue-3731/sqlite-fts5-store
• issue-3731/toolstore-interface
• issue-3732/semantic-search-store
• issue-3733/pr1-auto-deploy-embedding-v2
• issue-3733/pr2-real-tei-client
• issue-3762/search-config-params
• issue-3865
• issue-3865-v1
• issue-3866
• issue-3866-v1
• issue-3867
• issue-3867-v1
• issue-3867-v2
• issue-3867-v3
• issue-3867-v4
• issue-3869
• issue-3870
• issue-3871
• issue-3872
• issue-3872-v1
• issue-3872-v2
• issue-3872-v3
• issue-3874
• issue-3875
• issue-3876
• issue-3985
• issue-4101
• issue-4103
• issue-4203
• issue-4205
• issue-4207
• issue-4208
• issue-4209
• issue-4210
• issue-4211
• issue-4212
• issue-4213
• issue-4214
• issue-4215
• issue-4216
• issue-4217
• issue-4218
• issue-4220
• issue-4220-v1
• issue-4220-v3
• issue-4222
• issue-4278
• issue-4278-v1
• issue-4287
• issue-4320
• issue-4420-sm-migration
• issue-4420-sm-migration-v1
• issue-4420-v2
• issue-4494
• issue-4547
• issue-4573
• issue-4575
• issue-4575-v1
• issue-4612
• issue-4667
• issue-4725
• issue-4726
• issue-4729
• issue-4836
• issue-4879
• issue-4881
• issue-4882
• issue-4883
• issue-4884
• issue-4885
• issue-4886
• issue-4887
• issue-4888
• issue-4889
• issue-4890
• issue-4937
• issue-4944
• issue-4975
• issue-5030
• issue-5031
• issue-5047-callback-preserve-rt
• issue-5050
• issue-772-remove-none-secrets-provider
• issue_156_2025-11-13
• issue_156_docs_2025-11-14
• issue_176_2025-11-20
• issue_2503_2025-11-17
• issue_2623_2025-11-17
• issue_2714_2025-11-25
• issue_2771_2025-12-01
• issue_3628_as-redis-token-storage
• issue_3629_as-redis-integration-tests
• issue_3630_as-controller
• issue_3790_as-redis-docs
• issue_3792_as-crd
• issue_4408_cedar-on-upstream
• issue_4466_self-ref-jwksurl
• issue_4466_self-ref-jwksurl-vmcp
• issue_4485_jwksurl-oidcconfig
• issue_4486_vmcp-upstreamtokenreader
• issue_4528_default-token-exchange-subjectprovidername-vmcp
• issue_4640_authServerRef
• issue_4641_authServerRef-e2e
• issue_4642_authServerRef-docs
• issue_4874_default-redirectUri
• issue_5037_dcr-2a
• issue_5038_dcr-2b
• issue_5039_dcr-2c
• issue_5040_dcr-2d
• issue_5231
• issue_5323_vmcp-stale-identity
• issue_5344
• issuer-mistmatch
• issues/4351
• issues/4370
• issues/4392
• issues/4647
• issues/4681
• issues/5203
• issues/5259
• itestoidc
• jaormx/mcpserverentry-controller
• jaormx/mcpserverentry-types
• jaormx/skill-concurrency-protection
• jaormx/skill-md-parser-validator
• jaormx/skill-state-management
• jaormx/skills-api-e2e-tests
• jaosorior/add-elicitation-complete-notification
• jaosorior/add-toolhive-release-skill
• jaosorior/claude-md-taskfile-guidance
• jaosorior/custom-package-mirrors-proposal
• jaosorior/harden-runtime-config-inputs
• jaosorior/mcpauthzconfig-crd
• jaosorior/mcpauthzconfig-wiring
• jaosorior/skill-api-contract-changes
• jaosorior/skill-default-group
• jaosorior/skill-install-e2e-registry-lookup
• jaosorior/skill-install-registry-lookup
• jaosorior/skill-service-api-handlers
• jaosorior/skills-http-client
• jaosorior/sqlite-skill-store-factory-wiring
• jaosorior/vmcp-composition-workflow-engine
• jd/annotation-overrides
• jd/log-authz-denials
• jd/vmcp-default-resource-limits
• jdrouillard/add-deflake-skill
• jdrouillard/deflake-workload-lifecycle
• jdrouillard/pr-template-implementation-plan
• jerm-aud-fix-nits
• jerm-dro/01KXH2R7Z0XC6209KY653NC0TG
• jerm-dro/01KYWE0KFZ800M7E2A70KM54XM
• jerm-dro/01KZC3KFHXEXXZ38MX5RGZP25N
• jerm-dro/01KZT0PZF6Z1V1YVWFEJJA8E9X
• jerm-dro/01M08M6CJJYZ3GJPD7ZC3XQTV1
• jerm-dro/01M0X4AKVD2MW0E2T938A3SD37
• jerm-dro/code-review-session-planning
• jerm-dro/deflake-backend-routing-test
• jerm-dro/e2e-testutil
• jerm-dro/fix-llm-setup-windows-path
• jerm-dro/gate-session-init-on-backend-health
• jerm-dro/global-rate-limits
• jerm-dro/per-user-rate-limit-middleware
• jerm-dro/per-user-rate-limits
• jerm-dro/pin-optimizer-store-connection
• jerm-dro/rate-limit-middleware
• jerm-dro/remove-rfc-draft
• jerm-dro/script-engine-package
• jerm-dro/script-middleware
• jerm-dro/skill-and-rule-updates
• jerm/2025-12-16-fix-docs
• jerm/2025-12-17-docs-for-errors
• jerm/2025-12-18-fix-config-plumbing
• jerm/2025-12-22-fix-typing
• jerm/2025-12-23-delete-raw-config
• jerm/2025-12-23-fix-annotation-patching
• jerm/2025-12-23-remove-large-file
• jerm/2026-01-05-camelCaseConfig
• jerm/2026-01-06-add-vmcp-config-to-spec
• jerm/2026-01-06-migrate-audit
• jerm/2026-01-06-migrate-basic-config
• jerm/2026-01-06-migrate-telemetry
• jerm/2026-01-07-api-error-handler
• jerm/2026-01-07-recovery-middleware
• jerm/2026-01-08-fix-doc-gen
• jerm/2026-01-08-fix-generate-all-types
• jerm/2026-01-09-remaining-migrations
• jerm/2026-01-12-fix-samplingRate
• jerm/2026-01-13-config-for-optimizer
• jerm/2026-01-13-optimizer-in-vmcp
• jerm/2026-01-14-config-todo-cleanup
• jerm/2026-01-15-vmcp-optimizer-integration
• jerm/2026-01-16-telem-migrate-2
• jerm/2026-01-21-fix-3383
• jerm/2026-01-21-test-failures
• jerm/2026-01-22-fix-wait-for-sts
• jerm/2026-01-26-fix-deployment-loop
• jerm/2026-01-27-fix-authz-dropped
• jerm/2026-01-28-deploy-vmcp-locally-skill
• jerm/2026-01-28-fix-composite-tool-validate
• jerm/2026-02-05-fix-3636
• jerm/2026-02-06-add-tool-call-labels
• jerm/2026-03-09-testing-optimizer-composite-tools
• jerm/2026-03-16-vmcp-anti-pattern-review-skill
• jerm/arguments-supports-types
• jerm/code-review-skill-improvements
• jerm/composite-tools-default-results
• jerm/debugging-flakes
• jerm/fix-2761
• jerm/fix-foreground-shutdown
• jerm/fix-graceful-shutdown
• jerm/fix-upstreamswap-custom-header-leak
• jerm/fromjson
• jerm/implement-story-skill
• jerm/improve-code-review-assist-skill-v2
• jerm/improving-asserting
• jerm/jerm/refactor-telemetry-conversion
• jerm/maybe-deflake-tests
• jerm/support-structured-content
• jerm/vmcp-o11y
• jesseo.colima-runtime-support
• jhrozek/role-claim-name
• jhrozek/store-server-name
• jhrozek/variadic-parents
• json-escape-issue
• jsonrpc-error-contract-followups
• k8s-ca-certs
• k8s-groups_2025-10-15
• k8s-util-digest
• k8s_and
• k8s_registry
• kill-patch-coverage
• kimi-cli
• kind-dns-issues
• kiro-skill-client
• labels-workflow
• lazy_discovery
• light-apparel
• lint-cache
• lint-fix
• linux-docker-desktop
• list-filtering
• llm-proxy-login-ctx-minimal
• llm-setup-anthropic-path-prefix
• llm/strengthen-tool-detection-binary-check
• lock-file-cleanup
• log-api-response-limit
• log-limit-take-ii
• logger
• logging-guidelines
• lorr-discovery-block
• macos-test-fail
• main
• maintainers
• make-remote-healthcheck-optional
• mani/authserver-renew-public-client-ttl
• mcp-auto-transport-fallback
• mcp-conformance-ci
• mcp-optimizer-hide
• mcp-remote-proxy-int-tests
• mcpoidcconfig-use
• mcpregistry-configmap-label-selector-proposal
• mcpremoteproxy-group-discovery
• mcpremoteproxy-status-conditions
• melted-akubra
• merge-integration-tests
• meta-mcp-in-registry
• metrics-move-discoverability
• metrics-separate-listener
• metrics-transport-port-deprecation
• metrics-transport-port-optin
• migrate-externalauthconfig-referencing-workloads
• migrate-issue-triage-action
• migrate-pid-files
• migrate-pid-files-iii
• migrate-proposals-to-rfcs-repo
• migrate-secret-empty
• migrate-telemetryconfig-referencing-workloads
• migrate-toolconfig-referencing-workloads
• migrate_oauth_config
• mirror-xmcp-header-on-modern-egress
• misc
• missed-main-test
• mockgen-install
• mocks-for-skills
• more-claude-rules
• more-clients-for-skills
• move-crds-to-crds-directory
• move-packages
• move-verifier
• move-workload-update-logic-into-manager
• moves-configmap-retrieval
• moves-e2e-ext-auth-test-to-int-test
• moves-tool-config
• mrtr-modern-vmcp
• multi-cm-source
• multi-ds-operator
• multiple-client-for-skills
• multiple-rm-arguments
• multiple-rm-stop-arguments
• nashon/telemetry-method-label-allowlist
• network-isolation-default-on
• network-isolation-e2e
• network-isolation-review-followups
• no-auth-redis-6550
• no_best_effort
• no_local_auth_in_k8s
• no_pass_through
• normalize-multivalued-claims
• normalize-proxy-mode-3296
• oauth-params-refresh
• oauth-proxy-simple-redirect-check
• oauth-refactor-prep-1
• oauth-refactor-prep-2
• oauth-refactor-prep-3
• oauth-refactor-prep-4
• oauth-refactor-prep-5
• oauth/mcp-wellknown-uri-fallback
• obo-impl-5
• obo-impl-5b
• obo-impl-issue_5623
• obo_issue_5537
• oci-local-resolver
• oci-pull-install
• oidc-private-ips-issue_5614
• oidc-registration-endpoint-fallback
• oidc-subject-claim
• oidc-upstream-flow-fixes
• oidc_refactor
• oops-docs
• op-img-micro-to-minimal
• opencode-client
• openmeta/3131-add-default-resource-limits-to-mcpremoteproxy-1785037451518
• operator-bearer-token-crd-types
• operator-build-epel10-golang-update
• operator-crds-optional-virtualmcp
• operator-feature-flags
• operator-image-discovery-airgap
• operator-registry-spec
• operator-surface-reconcile-errors
• operator-zap-init
• optimize-e2e-workflow-binary-build
• optimizer-embedding-headers
• optimizer-embedding-reuse-5847
• optimizer-enablers
• optimizer-examples-and-nits
• optimizer-implementation
• optimizer-integration
• optimizer-metrics-and-logs
• optimizer-pr3-docs
• optimizer-token-metrics
• optimizer/add-logging
• optimizer/remove-score-field
• orchid-nose
• origin-header-validation
• osc/2485-volume-mount-validation
• osc/4540-standardize-secretkeyref
• osc/4582-mcpport-naming
• osc/4874-default-redirect-uri
• osc/4874-oidc-redirect-uri-default
• oss-obo-1_issue_5326
• oss-obo-2_issue_5327
• oss-obo-3_issue_5328
• oss-obo-4_issue_5347
• oss-obo-5_issue_5329
• otel-custom-attributes
• otel-defaults
• otel-example
• otel-skill
• otel/add-standard-metrics
• otel/add-use-legacy-attributes-flag
• otel/client-spans-trace-injection
• otel/code-quality-b3-b6-b10-t1
• otel/fix-telemetry-bugs-b1-b2-b4
• otel/meta-trace-context-s1
• otel/pr1-span-attributes
• otel/pr2a-attribute-rename
• otel/pr2a-attribute-rename-v2
• otel/pr2a-feature-flag-legacy
• otel/pr2b-new-attributes
• otel/pr2b-new-attributes-v2
• otel/propagation-foundation
• otel/redact-config-headers
• otel/spec-compliance-s2-s4-s5-s6
• otel/standard-metrics-attributes
• otel/vmcp-client-spec-compliance
• path-clean-windows-destination
• pgpass-improvements
• phase-scoped-fallback
• phase1-checksum-gate-ssa
• phase2-factory-helpers
• phase3-wire-callers
• phase4-migration
• pid-file-private
• pid-in-state-file
• pid-in-state-file-ii
• pin-actions-and-fix-version-comments
• pin-golangci-lint-2.12.2
• pin-helm-crd-wrapper-v0.0.1
• pin-time-e2e-image
• pins-envtest
• pins-registry-server-image
• plan-mode-fix-5797
• platform-userid-token-storage
• plugins-lock/01-schema
• plugins-lock/02-lock-service
• plugins-lock/03-install-hooks
• plugins-lock/04-sync
• plugins-lock/05-upgrade
• plugins-sig/06-bundle
• plugins-sig/07-install-verify
• plugins-sig/08-sync-reverify
• plugins-sig/09-upgrade-signer-guard
• plugins-sig/10-push-ungate
• plugins/phase-2-core-service
• plugins/phase3-thv-0077-5527
• plugins/phase4-thv-0077-5528
• poc
• poc-faster-build
• poc-thv-skills-lock
• podtemplate-registry
• podtemplate-spec-registry
• podtemplate-user
• port-auth-cm-e2e-test
• port-authz-cm-ref-e2e-test
• port-examples
• port-validation
• post_review
• pr-3272
• pr-5794-feedback
• pr/webhook-error-redaction
• pr/webhook-request-size-limit
• pr/webhook-ssrf-fix
• pr1-annotation-context-authorizer
• pr2-annotation-cache
• pr2-secret-aware-hash-and-watching
• pr3-vmcp-annotation-flow
• prepull-time-image-e2e
• preserve-release-actor
• printcolumnfix
• printcolumnfix1
• printcolumnfix3
• prm_discovery
• prm_no_jwks_uri
• prm_with_path
• prompt-cache
• propagate-trace-context-meta-5758
• proposal-mcp-registry-upstream-support
• proposal/deployment-architecture-k8s
• proposal/dynamic-webhook-middleware
• proposal/kubernetes-registry-source
• proposal/operator-registry-gateway-api-integration
• proposal/operator-valkey-integration
• proposal/remote-mcp-proxy
• proposal/shared-key-auth-localhost
• proposal/virtual-mcp-server
• proxy-header
• proxy-log-context-cancel
• proxy-refactor-shared-logic
• proxy-startup-probe
• proxymode-direct-transports
• pullpolicy
• pvc-source
• quarantine-arxiv-uvx-e2e
• quarantine-conformance-sampling
• race-condition
• ratelimiting-olly
• ratelimiting-olly-1
• ratelimiting-olly-3
• ratelimitingVMCP
• ratelimitingVMCP2
• ratelimitingVMCP3
• rdimitrov/cancel-outdated-actions
• rdimitrov/cancel-outdated-main-runs
• rdimitrov/check-main-ci
• rdimitrov/investigate-issue-561
• rdimitrov/mcpregistry-v2-crd-types
• rdimitrov/migrate-docker-docker-to-moby
• rdimitrov/operator-e2e-pr-matrix
• rdimitrov/registry-cleanup
• rdimitrov/registry-convert-cmd
• rdimitrov/rightsize-ci-runners
• rdimitrov/update-registry-api-v1.1.1
• re-export-toolhive-core-schemas
• re-run-sizer
• readiness-probe-protocol-version-5764
• reallocate-rate-limit-error-code
• rebalance-e2e-test-matrix
• redis-acl-doc_2026-04-20
• redis-vmcp-dual-era-e2e
• ref/updateconfig-error-return
• refactor-atomic-write-to-fileutils
• refactor-config-editor-file-locking
• refactor-config-map
• refactor-rbac
• refactor-rbac-operator
• refactor-remoteproxy-int-tests
• refactor-skillvc
• refactor-sse-processor
• refactor-status-collector
• refactor-telemetry
• refactor-telemetry-runconfog
• refactor/auth-resolution-logic
• refactor/ca-cert-config-pattern
• refactor/consolidate-k8s-client
• refactor/consolidate-oauth-package
• refactor/docker-api-adapter-tests
• refactor/extract-common-controller-helpers
• refactor/llm-pkg-setup-teardown
• refactor/move-git-package
• refactor/move-remote-auth-to-auth-package
• refactor/optimizer-extract-internal-packages
• refactor/phase1-extract-common-helpers
• refactor/rename-mcp-client-config
• refactor/rename-mcp-client-to-ai-client
• refactor/typed-backend-auth-strategy
• refactor/use-defaultAuthzKey-constant
• refactor_proposal
• refines-helm-chart-process
• refines-helm-publish
• reg-server-configmap
• reg-server-configmap-operator
• reg-server-git-auth
• registry-auth-proposal
• registry-docs
• registry-e2e-test-updates
• registry-groups-updated
• registry-health-check-fix
• registry-md-configyaml-alignment
• registry-openapi
• registry-pr1-core-types
• registry-pr2-source-impls
• registry-server-config
• registry-server-config-type
• registry-service-and-error-handling
• registry-updates
• registry-validation-and-errors
• registry/drop-groups
• registry/image-verification-consistency
• registry/v01-server-endpoints
• registry/workload-from-registry
• registry_apisource
• registry_cm
• registry_crds
• registry_filter
• registry_fix_sync
• registry_githandler
• registry_no_serverCount
• registry_promote
• registry_sync
• registry_tests
• regression-gate-in-repo-pins
• regression-gate-session-security
• reinstate-stale-config-fix
• reject-jsonrpc-batches
• release-workflow-cosign-and-rerun
• release/v0.10.1
• release/v0.10.2
• release/v0.11.0
• release/v0.11.1
• release/v0.11.2
• release/v0.11.3
• release/v0.12.0
• release/v0.12.1
• release/v0.12.2
• release/v0.12.3
• release/v0.12.4
• release/v0.12.5
• release/v0.13.0
• release/v0.13.1
• release/v0.14.0
• release/v0.14.1
• release/v0.15.0
• release/v0.16.0
• release/v0.17.0
• release/v0.18.0
• release/v0.19.0
• release/v0.20.0
• release/v0.21.0
• release/v0.22.0
• release/v0.23.0
• release/v0.23.1
• release/v0.24.0
• release/v0.24.1
• release/v0.25.0
• release/v0.26.0
• release/v0.26.1
• release/v0.27.0
• release/v0.27.1
• release/v0.27.2
• release/v0.28.0
• release/v0.28.1
• release/v0.28.2
• release/v0.28.3
• release/v0.29.0
• release/v0.29.1
• release/v0.29.2
• release/v0.29.3
• release/v0.30.0
• release/v0.30.1
• release/v0.30.2
• release/v0.31.0
• release/v0.32.0
• release/v0.33.0
• release/v0.34.0
• release/v0.35.0
• release/v0.36.0
• release/v0.37.0
• release/v0.38.0
• release/v0.39.0
• release/v0.40.0
• release/v0.40.1
• release/v0.41.0
• release/v0.42.0
• release/v0.42.1
• release/v0.42.2
• release/v0.43.0
• release/v0.44.0
• release/v0.45.0
• release/v0.46.0
• release/v0.47.0
• release/v0.47.1
• release/v0.48.0
• release/v0.49.0
• release/v0.8.3
• release/v0.9.0
• release/v0.9.1
• release/v0.9.2
• release/v0.9.3
• release/v0.9.4
• releaser-thv-fix
• relocate-monitor-errors
• remote-health-checks
• remote-mcp-server-health-check-failure
• remote-mcp-server-restart-fix
• remote-server-apis
• remote-server-proxy-url-in-list
• remote-workload-proxy-stuck
• remote-workload-restart-port-bind
• remote-workload-spurious-warning
• remove-background-context
• remove-deprecated-inline-oidcconfig
• remove-deprecated-inline-telemetry
• remove-experimental-mcp-control-plane
• remove-flag-driven-oidc
• remove-get-claims-from-context
• remove-helm-chart-skill
• remove-invalid-apply-rbac-verb
• remove-legacy-converters
• remove-old-converter
• remove-old-status-methods
• remove-openshift-values
• remove-orphaned-registry-api-helm-templates
• remove-registry-api
• remove-run-from-interface
• remove-secret-provider-depdendency
• remove-startup-migrations
• remove-steptype-conditional
• remove-vmcp-modern-kill-switch
• remove-yrobla-from-codeowners-and-repository-files
• removes-auto-sync-operator
• removes-binary
• removes-datasources
• removes-duplicated-configmap
• removes-e2e-test-configmap
• removes-e2e-tests-authz-configmap
• removes-filters
• removes-flag-driven-config-more
• removes-flag-driven-config-patch
• removes-flags-proxyrunner
• removes-not-allowed-item
• removes-otel-test
• removes-registry-server-image-loading
• removes-retryo-on-conflict
• removes-test-integartion-verbosity
• removes-unused-flags
• removes-unused-functions
• rename
• rename-registry-type
• renames-test-suites
• reno
• renovate-go-mod-tags
• renovate-vulnerability-alerts
• renovate/actions-cache-5.x
• renovate/actions-cache-digest
• renovate/actions-checkout-6.x
• renovate/actions-checkout-digest
• renovate/actions-create-github-app-token-3.x
• renovate/actions-download-artifact-digest
• renovate/actions-github-script-8.x
• renovate/actions-setup-go-6.x
• renovate/actions-setup-go-digest
• renovate/actions-setup-node-7.x
• renovate/actions-setup-python-6.x
• renovate/actions-setup-python-digest
• renovate/actions-upload-artifact-digest
• renovate/add-kindest-node-patch-updates
• renovate/alpine-3.x
• renovate/anchore-sbom-action-0.x
• renovate/anchore-scan-action-7.x
• renovate/anthropics-claude-code-action-1.x
• renovate/anthropics-claude-code-action-digest
• renovate/aquasecurity-trivy-action-0.x
• renovate/auth-and-security-libraries
• renovate/aws-sdk-go-v2-monorepo
• renovate/cli-and-ui-libraries
• renovate/codespell-project-actions-codespell-2.x
• renovate/container-and-docker-libraries
• renovate/container-build-actions
• renovate/core-workflow-actions
• renovate/docker-build-push-action-6.x
• renovate/docker-login-action-3.x
• renovate/docker-metadata-action-5.x
• renovate/docker-setup-buildx-action-3.x
• renovate/dockerfile-template-base-images
• renovate/ghcr.io-stacklok-thv-registry-api-0.x
• renovate/ghcr.io-stacklok-thv-registry-api-1.x
• renovate/ghcr.io-zizmorcore-zizmor-1.x
• renovate/github-codeql-action-4.x
• renovate/github-codeql-action-digest
• renovate/github.com-1password-onepassword-sdk-go-0.x
• renovate/github.com-alicebob-miniredis-v2-2.x
• renovate/github.com-cedar-policy-cedar-go-1.x
• renovate/github.com-cenkalti-backoff-v5-7.x
• renovate/github.com-charmbracelet-bubbletea-1.x
• renovate/github.com-charmbracelet-lipgloss-2.x
• renovate/github.com-docker-docker-28.x
• renovate/github.com-getsentry-sentry-go-0.x
• renovate/github.com-getsentry-sentry-go-otel-0.x
• renovate/github.com-go-chi-chi-v5-5.x
• renovate/github.com-go-git-go-billy-v5-5.x
• renovate/github.com-go-git-go-git-v5-5.x
• renovate/github.com-go-jose-go-jose-v3-4.x
• renovate/github.com-gofrs-flock-0.x
• renovate/github.com-golang-jwt-jwt-v5-5.x
• renovate/github.com-google-cel-go-0.x
• renovate/github.com-google-go-containerregistry-0.x
• renovate/github.com-lestrrat-go-httprc-v3-3.x
• renovate/github.com-lestrrat-go-jwx-v3-3.x
• renovate/github.com-lestrrat-go-jwx-v3-4.x
• renovate/github.com-mark3labs-mcp-go-0.x
• renovate/github.com-moby-moby-api-1.x
• renovate/github.com-moby-moby-client-0.x
• renovate/github.com-modelcontextprotocol-registry-1.x
• renovate/github.com-olekukonko-tablewriter-1.x
• renovate/github.com-onsi-ginkgo-v2-2.x
• renovate/github.com-onsi-gomega-1.x
• renovate/github.com-ory-x-0.x
• renovate/github.com-pelletier-go-toml-v2-2.x
• renovate/github.com-pressly-goose-v3-3.x
• renovate/github.com-prometheus-client_golang-1.x
• renovate/github.com-redis-go-redis-v9-9.x
• renovate/github.com-santhosh-tekuri-jsonschema-v5-6.x
• renovate/github.com-shirou-gopsutil-v4-4.x
• renovate/github.com-sigstore-sigstore-go-1.x
• renovate/github.com-sigstore-sigstore-go-digest
• renovate/github.com-spf13-cobra-1.x
• renovate/github.com-spf13-pflag-1.x
• renovate/github.com-spf13-viper-1.x
• renovate/github.com-spiffe-go-spiffe-v2-2.x
• renovate/github.com-stacklok-toolhive-catalog-0.x
• renovate/github.com-stacklok-toolhive-core-0.x
• renovate/github.com-swaggo-swag-v2-2.x
• renovate/github.com-tailscale-hujson-digest
• renovate/github.com-tidwall-gjson-1.x
• renovate/github.com-zalando-go-keyring-0.x
• renovate/go-github.com-go-git-go-git-v5-vulnerability
• renovate/go-github.com-go-jose-go-jose-v3-vulnerability
• renovate/go-github.com-go-jose-go-jose-v4-vulnerability
• renovate/go-github.com-modelcontextprotocol-registry-vulnerability
• renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlpmetric-otlpmetrichttp-vulnerability
• renovate/go-go.opentelemetry.io-otel-exporters-otlp-otlptrace-otlptracehttp-vulnerability
• renovate/go-go.opentelemetry.io-otel-sdk-vulnerability
• renovate/go-google.golang.org-grpc-vulnerability
• renovate/go.starlark.net-digest
• renovate/go.uber.org-zap-1.x
• renovate/golang-1.x
• renovate/golang.ngrok.com-ngrok-v2-2.x
• renovate/golang.org-x-crypto-0.x
• renovate/golang.org-x-exp-jsonrpc2-digest
• renovate/golang.org-x-mod-0.x
• renovate/golang.org-x-net-0.x
• renovate/golang.org-x-oauth2-0.x
• renovate/golang.org-x-sync-0.x
• renovate/golang.org-x-sys-0.x
• renovate/golang.org-x-term-0.x
• renovate/golang.org-x-time-0.x
• renovate/golangci-golangci-lint-action-9.x
• renovate/goreleaser-goreleaser-action-7.x
• renovate/helm-3.x
• renovate/helm-4.x
• renovate/helm-chart-testing-action-2.x
• renovate/helm-helm-3.x
• renovate/helm-kind-action-1.x
• renovate/helm-kind-action-digest
• renovate/k8s.io-utils-digest
• renovate/kindest-node-1.x
• renovate/kindestnode-patch-versions
• renovate/kubernetes-dependencies
• renovate/kubernetes-go
• renovate/kubernetes-sigs-kind-0.x
• renovate/kyverno-action-install-chainsaw-0.x
• renovate/kyverno-chainsaw-0.x
• renovate/major-cli-and-ui-libraries
• renovate/major-core-workflow-actions
• renovate/major-dockerfile-template-base-images
• renovate/major-github-artifact-actions
• renovate/major-release-and-publishing-actions
• renovate/major-setup-and-language-actions
• renovate/mcp-and-protocol-libraries
• renovate/migrate-config
• renovate/modernc.org-sqlite-1.x
• renovate/node-24.x
• renovate/opentelemetry-and-observability
• renovate/opentelemetry-go-monorepo
• renovate/peter-evans-create-pull-request-8.x
• renovate/peter-evans-create-pull-request-digest
• renovate/pin-dependencies
• renovate/python-3.x
• renovate/registry-3.x
• renovate/registry.access.redhat.com-ubi10-go-toolset-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-micro-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-minimal-10.x
• renovate/release-and-publishing-actions
• renovate/security-scanning-and-signing-actions
• renovate/setup-and-language-actions
• renovate/sigs.k8s.io-controller-runtime-0.x
• renovate/sigstore-cosign-installer-3.x
• renovate/sigstore-cosign-installer-4.x
• renovate/slackapi-slack-github-action-2.x
• renovate/slackapi-slack-github-action-4.x
• renovate/stacklok-releaseo-0.x
• renovate/testcontainers-go-monorepo
• renovate/testing-libraries
• renovate/zizmorcore-zizmor-action-0.x
• replace-condition-string-literals
• replace-retest-action-with-inline-script
• replace-webhook-principal-with-auth-identity
• research-141
• research-67
• resources-prompts-list-changed-5969
• restore-go-mod-patch-version-lint
• restructure-mcptelemetryconfig-nested-spec
• retry-transient-token-refresh-errors
• retrydelay_harden
• revert-2882-renovate/alpine-3.x
• revert-3711-release/v0.9.3
• revert-4669-issue-4494
• revert-4730-issue-4494
• revert-accidental-merge
• revert-signal-handler
• revert_py3.14
• reverts-cosign-installer-bump
• reverts-mocks
• review_model
• reyortiz3/no-patch-version-in-go-mod
• reyortiz3/policy-stopped-status
• rfc8707
• rm-dependabot
• rm-docker-img-manager
• rmredundant
• rotate-kindest-images
• route-claude-workflows-through-gateway
• runner-bearer-token-secret-resolution
• runtime-tagged-images
• runtimeconfig-api-fields
• sa-m5h8_allow-docker-gateway
• samuv/api-reject-remote-key-signing
• samuv/plugins-install-public-key
• samuv/plugins-push-key
• samuv/plugins-sync-upgrade-public-key
• samuv/skills-upgrade-keyed-verdict
• samuv/upgrade-unsigned-arm
• schema/add-tool-definitions
• scope-inherited-secrets
• scope_strategy
• scoped-secret-providers
• scopes-cli
• scopes-k8s
• scopes-vmcp
• scopes_advertising
• secret-system-flag
• secrets-k8s-helpers
• security-advisory-review-for-toolhive
• security/scan-redact-tool-call-secrets
• sentry-api
• sentry-otel-api
• sep-2640-skills-direct-proxy
• serve-skill-md
• session-dial-control-resolver
• shared-helpers
• ship-crd-manifests-as-release-asset
• ship-crd-schemas-as-release-asset
• sign-macos-thv-binary
• signing-key-alg_2026-02-06
• simplify-verifier
• simplify-yardstick-1.2.0
• single-workload-list
• skill-cli-lifecycle-commands
• skill-cli-packaging-commands
• skill-cli-read-commands
• skill-install-all-fix
• skill-install-fallback
• skill-install-fix
• skill-local-build
• skill-local-build-2
• skill-swagger
• skill-tweak
• skill-uninstall
• skills-api-handlers-3651
• skills-build-deletion
• skills-catalog-provenance
• skills-ci/no-sign-push
• skills-clients-list
• skills-cursor
• skills-install-multi-client
• skills-keyless/01-core-signer
• skills-keyless/02-push-token-plumbing
• skills-keyless/03-cli-token-acquisition
• skills-keyless/04-ci-and-staging-e2e
• skills-local-builds
• skills-lock/01-lockfile
• skills-lock/02-lock-service
• skills-lock/03-install-hooks
• skills-lock/04-sync
• skills-lock/05-upgrade
• skills-lock/06-cli-exitcodes
• skills-lock/fresh-sync-upgrade
• skills-mcp
• skills-nits/httperr-codes
• skills-nits/source-dispatch
• skills-refpin/01-schema-and-dto
• skills-refpin/02-extract-and-enforce
• skills-sig/07-provenance-schema
• skills-sig/08-verifier
• skills-sig/09-signer
• skills-sig/10-git-and-storage
• skills-sig/10b-gitsign-verify
• skills-sig/11-install-verify
• skills-sig/12-sync-reverify
• skills-sig/13-upgrade-guard
• skills-sig/13b-provenance-display
• skills-sig/14-push-signing-ungate
• skills-vscode
• skip-mocks
• skip-update
• skip-update-check-env-var
• slog-api
• slog-auth-authz
• slog-authserver
• slog-container-config
• slog-final-cmd-cleanup
• slog-leaf-packages
• slog-runner
• slog-services
• slog-transport
• slog-vmcp
• smarter-codeowners-implementation
• socker-windows
• sort-aggregated-tools
• spdx-headers-middleware
• spec-generation
• speed-up-ci-unit-tests
• speeding-up-e2e-core-tests-over-11-minutes
• speeds-e2e-tests
• speeds-e2e-tests-operator
• spiffe-integration-6203
• spiffe-integration-clientauth
• spiffe-integration-split3-1
• spiffe-integration-split3-2
• spiffe-integration-split3-3
• spiffe-integration-split3-4
• spiffe-integration-split3-5
• spiffe-integration-split3-6
• spiffe-integration-split3-7
• spiffe-integration-split3-9
• split_out_podtemplate
• spring-lint
• squashed-oauth-refactor
• sse-channel-full
• sse-event-based-filtering
• ssrf-fix
• state-management-bug
• stateless-transparent-proxy-5831
• status-endpoint
• steady-hadrosaurus
• stop-pinning-go-patch-version
• stop-reading-pid-files-tests
• stop-writing-to-pids
• streamable-proxy-initialize-cache
• streamable-server-to-client-sse
• strict-mcp-protocol-validation-5764
• strip-endpoint-prefix-from-request-paths
• strip-reserved-response-meta
• suppResourceLink
• support-colima
• support_orbstack
• suppress-mitigated-zizmor-findings
• swagger-docgen-pin
• swagger-update-registry
• swap-zap-for-slog
• t3code/fix-nilness-linter-panic
• t3code/key-verify/01-classify-key-signed
• t3code/key-verify/02-lock-public-key
• t3code/key-verify/03-skills-install-public-key
• t3code/key-verify/04-skills-sync-upgrade-key
• talsh/proxy-deployment-scheduling-overrides
• task-docs-helm
• task-test-fail-only
• te-audience-containment
• te-token
• telemetry-providers
• telemetry-refactor
• temp-disable-e2e-test
• test-filtering
• test/5742-tools-list-pagination
• test/5992-forwarding-cached-legacy
• test/add-testkit
• test/conformant-dual-era-accept
• test/docker-high-roi
• test/regression-mcp-go-migration
• test/token-exchange-integration
• test/vmcp-client-response-accepted
• test_timeout
• testing-envoy-proxy-with-gofetch
• tests/docker-runtime-query-coverage
• thirsty-beanie
• thv-k8s-rework
• thv-proxy-remote-bearer-file
• thv-proxy-swap
• thv-registry-api
• thv-registry-api-file
• thv-registry-deploy-from-controller
• thv-registry-enforce
• thv-server-sigterm
• thv-server-timeout
• thv-te-cli
• thv-te-iface
• thv-te-mware
• thv-te-proposal
• thv-vmcp-minor
• thv-vmcp-te
• tmp/release-notes-v0.45.0-fix
• token-delegation-1-te-handler
• token-delegation-2-fosite-wiring
• token-delegation-3-multi-issuer-validator
• token-delegation-4-actor-token
• token_claim_mapping-1-identity-extractor
• token_claim_mapping-2-externalauthconfig
• token_claim_mapping-3-provider-swap
• token_claim_mapping-4-translation
• tokenexchange-followups
• toml-array-of-tables
• toml-client-configs
• toml-nested-tables
• toml-support
• tool-annotations-propagation
• tool-filter-jsonrpc-error-5764
• toxic-flow-audit
• tracing-operatpr
• trae-ide-client
• transparent-proxy-initialize-session-id
• transport-interface-methods
• transport-mock
• trigger-docs
• trusted-issuer-private-ca
• typo
• unhide-skill-commands-and-update-docs
• unified-workload-manager
• unit-test-failure-client
• unit-test-race-condition-auth-server
• unpins-registry-server
• unused-registry-message
• update-alpine-base
• update-claude-code-action
• update-codeowners
• update-codeowners-active-contributors
• update-codeowners-missing-contributors
• update-converters
• update-diagrams
• update-docs-workflow
• update-error-levels-client
• update-error-levels-group-build
• update-error-levels-workload
• update-inspector
• update-issue-triage-model
• update-k8s-examples
• update-k8s-test-versions
• update-maintainers
• update-mcp-agent-spec-2025-11-25
• update-mcp-protocol-expert-2025-11-25
• update-mcp-protocol-expert-agent
• update-operator-crds
• update-readme
• update-readmes
• update-registry-from-release
• update-size-labeler-workflow
• update-swaggo
• update-task-helm-deployment
• update-to-patch-1-mcpserver
• update-to-patch-1b-status-helper
• update-to-patch-spec-helper
• update-toolhive-catalog-v0.20260316.0
• update-toolhive-core-v0.0.24
• update-toolhive-expert-agent
• update-upstream-registry-schema
• update-workload-context-cancellation
• updates-registry-int-tests
• upgrade-1-detection
• upgrade-2-check-api
• upgrade-3-cli-check
• upgrade-4-applier
• upgrade-5-apply
• upgrade-6-e2e-docs
• upgrade-go
• upgrade-go-1-27
• upgrade-golang-1.26
• upgrade-golang-x-crypto
• upgrade-node-24
• upgrade-python-3.14
• upgrades-golang
• upstream-expiring-issues
• upstream-private-ca
• upstream-refresh/0-middleware-401
• upstream-refresh/integration-tests-v2
• upstream-refresh/token-service
• upstream_registry
• use-extension-types
• use-new-update-url
• use-package-distribution
• use-status-file-for-pids
• use-ubuntu-slim-runners
• use_thv_client_secret
• uvx-build-constraints
• validate-composite-tool-ref-status
• validate-group-case
• validate-xmcp-header-annotations
• validate_headers
• vault-annotations
• vault-te-proposal
• vault_fix
• version-file
• vmcp-add-as-scaffolding-1
• vmcp-add-as-scaffolding-2
• vmcp-add-as-scaffolding-3
• vmcp-add-as-scaffolding-4
• vmcp-add-as-scaffolding-5
• vmcp-add-as-scaffolding-6a
• vmcp-add-as-scaffolding-6b
• vmcp-add-as-scaffolding-7
• vmcp-aggregation-default-visibility
• vmcp-allow-credential-header-passthrough
• vmcp-assembly-issue_5581
• vmcp-auth-issue_5507
• vmcp-authz-wiring
• vmcp-capability-merging-routing
• vmcp-composite-workflow-integration
• vmcp-conflict-resolution
• vmcp-conformance-fixes
• vmcp-conformance-target
• vmcp-core-p1-1_issue_5434
• vmcp-core-p1-2_issue_5435
• vmcp-core-p1-3_issue_5436
• vmcp-core-p1-4_issue_5437
• vmcp-core-p1-5_issue_5438
• vmcp-core-p2-1_issue_5439
• vmcp-core-p2-2_issue_5440
• vmcp-core-p2-3_issue_5441
• vmcp-core-p2-4_issue_5442
• vmcp-core-p2-4b_issue_5493
• vmcp-core-p2-5_issue_5443
• vmcp-core-p3-1_issue_5444
• vmcp-core-p3-2_issue_5445
• vmcp-core-p3-2b-stage2_issue_5621
• vmcp-core-p3-2b-stage3_issue_5621
• vmcp-core-p3-2b_issue_5445
• vmcp-core_issue_5538
• vmcp-core_issue_5541
• vmcp-core_issue_5560
• vmcp-diagnostics-listener
• vmcp-dual-era-bridge
• vmcp-external-auth-discovery
• vmcp-follow-list-pagination
• vmcp-gate-hardening
• vmcp-handler-extract
• vmcp-headerforward-move
• vmcp-insecureallowhttp-issue_5668
• vmcp-integration
• vmcp-local-deploy
• vmcp-modern-logging-meta
• vmcp-optimizer-list-changed
• vmcp-partial-capabilities
• vmcp-passthrough-list-changed
• vmcp-rbac-mcpremoteproxies
• vmcp-restoresession-e2e-issue_5658
• vmcp-restoresession-identity-issue_5336
• vmcp-revision-oscillation
• vmcp-serve-prompts
• vmcp-server-shutdown-error
• vmcp-session-dial-control
• vmcp-stateless-classify-decode-seam
• vmcp-telemetry-followup
• vmcp/add-cache-and-registry-tests
• vmcp/capability-discovery
• vmcp/cli-serve-command-and-session-management
• vmcp_auth
• vmcp_no_req_client_secret_env
• vmcp_operational_fix
• vmcp_out_strategies
• vscode-server-config
• vuln
• vuln-resolve
• warn-secret-users-on-update
• webhook-marker
• windows-pipe-dacl
• windows-pipe-net-url
• windows-pipe-test-hardening
• wire-git-resolver-into-skill-install
• wire-mcpoidcconfig-into-mcpremoteproxy
• wire-mcpserver-telemetryconfig-ref
• wire-registry-skills-discovery
• wire-server-discovery-protocol
• wire-tool-keywords-search
• work-around-stale-config
• workaround-session-mcp-go
• workload-log-cleanup
• workload-manager-tests
• workload-name-validation
• worktree-5321-dcr-client-secret
• worktree-5686-dedup-validator
• worktree-5910-server-stateless
• worktree-5911-vmcp-per-backend
• worktree-6543-revert
• worktree-agent-a1f9c7fe
• worktree-agent-a692c1e3
• worktree-as-dcr-scopes
• worktree-as-stdio-fail
• worktree-bump-toolhive-core
• worktree-bumpt-toolhive-core-auth-server-use-shared-redis-client
• worktree-ci-job
• worktree-deflake-api-workloads
• worktree-deflake-operator-race
• worktree-deflake-singleflight
• worktree-e2e-cleanup-sweep
• worktree-falky-test-operator
• worktree-fix+runtime-ownership-status
• worktree-fix+skill-install-error-message
• worktree-fix-dcr-non-root-issuer
• worktree-fix-lint-issues
• worktree-fix-main-lint
• worktree-fix-zizmor-ref-version
• worktree-flaky-e2e-tests
• worktree-followup-redis-cluster-mode
• worktree-go-container-dep-bump
• worktree-graduate-crds
• worktree-hmac-trim-handover
• worktree-image-minlength
• worktree-issue-4657-vmcp-entry-discovery
• worktree-issue-4695
• worktree-issue-4930-elicitation-hook
• worktree-issue-5072-cedar-configurable
• worktree-issue_4977
• worktree-mcp-request-method-authz
• worktree-mcp-streamable-stateless
• worktree-mcpserver-readycondition
• worktree-mvpc-cedar-fix
• worktree-no-auto-nacks
• worktree-operator-annotations-fix
• worktree-ozz-handoff
• worktree-pr-template
• worktree-redis-cluster-support-to-auth-server-storage
• worktree-registry-crd-refactor
• worktree-registry-server-name
• worktree-remoteURL
• worktree-remove-orphaned
• worktree-session-binding
• worktree-squid-ingress-standby
• worktree-stale-config-when-oauth-fails
• worktree-storage-version-controler
• worktree-toctou-port
• worktree-use-thv-core-redis-package-for-session-storage
• worktree-vmcp-custom-datastorage-4928
• worktree-vmcp-telemetry
• worktree-wondrous-questing-dragonfly
• wrap-crds
• wrong-place
• xaa-1-oauth-constants
• xaa-2-jwt-bearer-grant
• xaa-crd-rename-step-ab
• xaa-test-crd-support
• xaa-test-outgoing-strategy
• xaa-test-upstream-id-tokens
• xaa-validate-aud-resource
• yaml-v3
• yolanda/issue-5180
• yolanda/llm-followup-cleanups-5048
• yolanda/llm-tls-fixes
• yrobla/fix-5051-preemptive-refresh
• yrobla/thv-5029-llm-proxy
• yrobla/thv-llm-foundation
• yrobla/thv-llm-token
• zed