Update stacklok/toolhive to v0.31.0 by renovate[bot] · Pull Request #974 · stacklok/docs-website

renovate · 2026-06-24T22:36:45Z

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	`v0.30.1` → `v0.31.0`

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

Release Notes

stacklok/toolhive (stacklok/toolhive)

`v0.31.0`

Compare Source

What's Changed

Fix incorrect elicitation template paths in comment by @danbarr in #5610
Update module github.com/stacklok/toolhive-core to v0.0.26 by @renovate[bot] in #5604
Consolidate operator envtest suite bootstrap by @ChrisJBurns in #5602
Update core workflow actions to df4cb1c by @renovate[bot] in #5461
Index MCPOIDCConfig referencing-workload lookups by @ChrisJBurns in #5608
Document level-triggered operator reconciliation rules by @ChrisJBurns in #5609
Fix codespell failure: unparseable -> unparsable by @ChrisJBurns in #5612
Dedupe operator rules to single canonical homes by @ChrisJBurns in #5613
Fix vMCP Deployment update loop with embedded auth server by @danbarr in #5617
Migrate issue triage workflow to claude-code-action@v1 by @danbarr in #5620
Allow private IPs for in-cluster OIDC and OAuth2 upstream providers by @tgrunnagle in #5618
Remove dead legacy session-registration path by @tgrunnagle in #5622
Add opt-in code mode decorator for vMCP by @jerm-dro in #5606
Index referencing-workload lookups across config controllers by @ChrisJBurns in #5599
Fix multi-upstream authorization chain flows by @lorr1 in #5590
Remove dead session-factory aggregation and composite mirrors by @tgrunnagle in #5625
Release v0.31.0 by @toolhive-release-app[bot] in #5628

Full Changelog: stacklok/toolhive@v0.30.1...v0.31.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Docs update for `toolhive` v0.31.0

At a glance


Upstream	`stacklok/toolhive` `v0.30.1` → `v0.31.0`
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	1
Release contributors	6 auto-assigned (see sidebar)
Action required	Yes — resolve 1 gap(s), then spot-check prose

Summary of changes

Added new guide Run tool calls server-side with code mode at docs/toolhive/guides-vmcp/code-mode.mdx covering the execute_tool_script virtual tool, K8s + standalone-CLI enablement, tuning, security model, and composition with the optimizer.
Updated docs/toolhive/guides-vmcp/intro.mdx and docs/toolhive/concepts/vmcp.mdx to surface code mode in vMCP's core capabilities and cross-link the new guide.
Updated docs/toolhive/guides-vmcp/optimizer.mdx "Next steps" and "Related information" to cross-link code mode (the two compose).
Added toolhive/guides-vmcp/code-mode to sidebars.ts immediately after the optimizer entry.

Gaps needing human context

`allow_private_ips` on OIDC / OAuth2 upstream providers (PR stacklok/toolhive#5618 by @tgrunnagle)

PR stacklok/toolhive#5618 adds an AllowPrivateIPs boolean to OIDCUpstreamRunConfig and OAuth2UpstreamRunConfig in pkg/authserver/config.go so the embedded auth server can reach in-cluster IdPs (Dex, Keycloak, etc.) at private IPs. The flag is wired through the auth-server runtime path (pkg/authserver/upstream/{oidc,oauth2}.go, pkg/authserver/runner/embeddedauthserver.go) and shows up in static/api-specs/toolhive-api.yaml automatically.

However, the operator CRDs OIDCUpstreamConfig and OAuth2UpstreamConfig (cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go) do not yet expose allowPrivateIPs, and buildOIDCUpstreamRunConfig / buildOAuth2UpstreamRunConfig in cmd/thv-operator/pkg/controllerutil/authserver.go do not pass the field through to the generated RunConfig. End users on the Kubernetes operator path therefore cannot configure this in v0.31.0, so there is no user-prose doc surface to update for this release. No hand-written prose was added; the auto-synced swagger entry covers the runtime API surface.

A docs update for this field should follow once the operator CRD exposes it and the build path propagates it. The hand-written authentication guides (docs/toolhive/guides-vmcp/authentication.mdx, docs/toolhive/concepts/embedded-auth-server.mdx, docs/toolhive/integrations/vmcp-{entra-id,okta}.mdx) will then need a note alongside the existing jwksAllowPrivateIp / protectedResourceAllowPrivateIp pattern.

File(s): (none yet — pending operator CRD work upstream)

Helper prompt for local Claude:

Once stacklok/toolhive adds allowPrivateIPs to the operator CRDs OIDCUpstreamConfig and OAuth2UpstreamConfig (currently in cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go) and wires it through buildOIDCUpstreamRunConfig / buildOAuth2UpstreamRunConfig in cmd/thv-operator/pkg/controllerutil/authserver.go, add a documentation note for the new field. PR stacklok/toolhive#5618 (v0.31.0) introduced the flag on the standalone auth-server RunConfig. The relevant docs are docs/toolhive/guides-vmcp/authentication.mdx (under the "Embedded authorization server" section where upstream providers are configured) and the related integration guides for Entra ID and Okta. Match the style of the existing jwksAllowPrivateIp and protectedResourceAllowPrivateIp references on adjacent OIDC config blocks: a brief mention with a security caveat (use only for trusted internal IdPs, HTTPS still required for non-localhost hosts).

Run cost

Session	Turns	Cost (USD)
Generation	95	$10.3435
Editorial review	35	$2.3751
Total	130	$12.7186

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

static/api-specs/
docs/toolhive/reference/cli/ (toolhive only)
docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

vercel · 2026-06-24T22:36:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	Jun 24, 2026 10:54pm

claude · 2026-06-24T22:37:49Z

Claude finished @renovate[bot]'s task in 10m 31s —— View job

Upstream release docs: toolhive v0.31.0

Completed /upstream-release-docs stacklok/toolhive v0.31.0 in unattended mode.

Phase 1: Discovery — fetch release + categorize PRs
Phase 2: Deep dive — verify each doc-relevant PR against source at v0.31.0
Phase 3: Audit existing docs + build impact map
Phase 4: Implement edits
Phase 5: Validate (formatter clean, eslint clean; npm run build blocked by thv: not found in the runner sandbox — unrelated to edits)
Phase 6: Write SUMMARY.md + GAPS.md artifacts at repo root

Summary of hand-written changes (in commit `314c688`)

Added new guide Run tool calls server-side with code mode at docs/toolhive/guides-vmcp/code-mode.mdx covering the execute_tool_script virtual tool, K8s + standalone-CLI enablement, tuning, security model, and composition with the optimizer.
Updated docs/toolhive/guides-vmcp/intro.mdx and docs/toolhive/concepts/vmcp.mdx to surface code mode in vMCP's core capabilities and cross-link the new guide.
Updated docs/toolhive/guides-vmcp/optimizer.mdx "Next steps" and "Related information" to cross-link code mode (the two compose).
Added toolhive/guides-vmcp/code-mode to sidebars.ts immediately after the optimizer entry.

Notes

PR stacklok/toolhive#5606 (vMCP code mode) — documented in full.
PR stacklok/toolhive#5618 (allow_private_ips on OIDC/OAuth2 upstream) — lands on the standalone auth-server RunConfig but is not yet exposed by the operator CRDs (OIDCUpstreamConfig / OAuth2UpstreamConfig) or wired through the operator's RunConfig builder. End users on the operator path cannot configure it in v0.31.0, so no user-prose docs were added. A GAPS.md entry @-mentions @tgrunnagle with a paste-ready prompt for the follow-up once the operator wires it through.
All other PRs in the release (#5610, #5604, #5602, #5461, #5608, #5609, #5612, #5613, #5617, #5620, #5622, #5599, #5590, #5625, #5628) are internal/infra/bug fixes with no doc surface.
· branch renovate/stacklok-toolhive-0.x

Add a new guide covering the execute_tool_script virtual tool, surface it from the vMCP intro/concept pages, and cross-link with the optimizer.

claude · 2026-06-24T22:48:35Z

Claude finished @renovate[bot]'s task in 5m 5s —— View job

Editorial review of v0.31.0 docs

Identify hand-written files changed in HEAD
Read each file + relevant context
Run editorial review and apply fixes
Format with prettier + eslint
Commit and push (a5d7944)

Review summary

The new code-mode.mdx page is well-structured: a clear lede frames the problem, the comparison table cleanly separates code mode from composite tools and the optimizer, and the page covers both K8s and local-CLI enablement, the security/authorization model, composition with the optimizer, and limitations. Cross-links from intro.mdx, concepts/vmcp.mdx, and optimizer.mdx give it solid inbound link coverage. The codeMode field documentation (stepLimit, parallelMaxConcurrency, toolCallTimeout, enabled) lines up with virtualmcpservers.schema.json.

Fix applied (in `a5d7944`)

code-mode.mdx:29 - replaced em dash with a comma per the style guide ("Avoid em dashes... Instead, rephrase naturally").

Considered and skipped

Em dashes in optimizer.mdx (Tier 1 — keyword search, etc.) are pre-existing in the file, not introduced by this PR.
**not** for emphasis on code-mode.mdx:34 follows established precedent (e.g. backend-discovery.mdx:301).
on-the-fly in concepts/vmcp.mdx:82 mirrors existing usage in guides-ui/run-mcp-servers.mdx:359.
· branch renovate/stacklok-toolhive-0.x

Per style guide, em dashes should be rephrased naturally.

danbarr

My PRs on this release were fix or internal only, nothing user/docs-facing.

Update stacklok/toolhive to v0.31.0

453e6b1

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the autogen-docs Pull requests generated by automated release workflows label Jun 24, 2026

github-actions Bot marked this pull request as draft June 24, 2026 22:36

Refresh reference assets for toolhive v0.31.0

473e862

vercel Bot deployed to Preview June 24, 2026 22:39 View deployment

Document vMCP code mode for toolhive v0.31.0

314c688

Add a new guide covering the execute_tool_script virtual tool, surface it from the vMCP intro/concept pages, and cross-link with the optimizer.

vercel Bot deployed to Preview June 24, 2026 22:49 View deployment

Replace em dash in code mode guide

a5d7944

Per style guide, em dashes should be rephrased naturally.

github-actions Bot requested review from ChrisJBurns, danbarr, jerm-dro, jhrozek, lorr1 and tgrunnagle June 24, 2026 22:54

github-actions Bot marked this pull request as ready for review June 24, 2026 22:54

vercel Bot deployed to Preview June 24, 2026 22:54 View deployment

danbarr approved these changes Jun 24, 2026

View reviewed changes

jhrozek approved these changes Jun 25, 2026

View reviewed changes

jerm-dro approved these changes Jun 25, 2026

View reviewed changes

eleftherias approved these changes Jun 25, 2026

View reviewed changes

tgrunnagle approved these changes Jun 25, 2026

View reviewed changes

ChrisJBurns approved these changes Jun 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update stacklok/toolhive to v0.31.0#974

Update stacklok/toolhive to v0.31.0#974
renovate[bot] wants to merge 4 commits into
mainfrom
renovate/stacklok-toolhive-0.x

renovate Bot commented Jun 24, 2026 •

edited by github-actions Bot

Loading

Uh oh!

vercel Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

claude Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

danbarr left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

renovate Bot commented Jun 24, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.31.0

What's Changed

Configuration

Docs update for toolhive v0.31.0

At a glance

Summary of changes

Gaps needing human context

allow_private_ips on OIDC / OAuth2 upstream providers (PR stacklok/toolhive#5618 by @tgrunnagle)

Run cost

Uh oh!

vercel Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upstream release docs: toolhive v0.31.0

Summary of hand-written changes (in commit 314c688)

Notes

Uh oh!

claude Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Editorial review of v0.31.0 docs

Review summary

Fix applied (in a5d7944)

Considered and skipped

Uh oh!

danbarr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

renovate Bot commented Jun 24, 2026 •

edited by github-actions Bot

Loading

`v0.31.0`

Docs update for `toolhive` v0.31.0

`allow_private_ips` on OIDC / OAuth2 upstream providers (PR stacklok/toolhive#5618 by @tgrunnagle)

vercel Bot commented Jun 24, 2026 •

edited

Loading

claude Bot commented Jun 24, 2026 •

edited

Loading

Summary of hand-written changes (in commit `314c688`)

claude Bot commented Jun 24, 2026 •

edited

Loading

Fix applied (in `a5d7944`)

danbarr left a comment •

edited

Loading