[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	v0.55.2 → v0.56.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive

v0.56.0

Compare Source

What's Changed

• Add OSS Scanner audit configuration by @​rdimitrov in #​6874
• Make unit tests pass as root and without a container runtime by @​rdimitrov in #​6875
• Cover the embedded auth server in threat model by @​jhrozek in #​6879
• Add native Go fuzz targets for untrusted parsers by @​rdimitrov in #​6877
• Decode IPv4 in IPv4-compatible and SIIT addresses by @​rdimitrov in #​6878
• Let embedders skip consent for preauthorized clients by @​jhrozek in #​6882
• Cap DCR clients and expire unused ones after 24h by @​tgrunnagle in #​6863
• Expose DCR client cap and register rate limit in CRD by @​tgrunnagle in #​6867
• Enable Claude Code gateway model discovery by @​jerm-dro in #​6862
• Answer 401 when a token session holds no upstream access token by @​alex-feel in #​6846
• Verify row ownership in Redis upstream token read by @​hellouz818 in #​6876
• Add coverage for -32601 under HTTP error statuses by @​hellouz818 in #​6873
• Test client response posts across handlers by @​jstar0 in #​5885
• Fix field names in external-auth examples by @​3nesdeniz in #​6330
• Add auth server TLS listener and SPIFFE middleware by @​jhrozek in #​6843
• Start auth server TLS listener in vMCP by @​jhrozek in #​6891
• Explain LLM gateway model-discovery failures by @​jerm-dro in #​6884
• Fix Claude Desktop paths and managed check on Linux by @​jerm-dro in #​6883
• Release v0.56.0 by @​toolhive-release-app[bot] in #​6917

New Contributors

• @​3nesdeniz made their first contribution in #​6330

Full Changelog: stacklok/toolhive@v0.55.2...v0.56.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.56.0

At a glance

Upstream	stacklok/toolhive v0.55.2 → v0.56.0
Hand-written changes	2 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	Unresolved - no human found for this release; a docs maintainer needs to adopt this PR
Release contributors	4 review requested (see sidebar) · 5 not requested (no docs impact) · 1 review routing issue(s)
Action required	Yes — manually route 1 unresolved review(s)

Who does what

No release owner could be resolved automatically, so this PR has no assignee. A docs maintainer needs to adopt it, collect approvals, and merge.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Added a "Limit Dynamic Client Registration" section (24-hour unused-client expiry, storage.maxDCRClients cap, registrationRateLimit) at docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx
• Updated the confidential DCR expiry note in docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx: expiry now applies to every storage backend, not only Redis
• Added a matching "Limit Dynamic Client Registration" section with a VirtualMCPServer example at docs/toolhive/guides-vmcp/embedded-auth-server-vmcp.mdx
• Updated the DCR feature bullet in docs/toolhive/concepts/embedded-auth-server.mdx to mention the client cap and rate limit
• Updated the Claude Desktop managed-configuration warning (Linux /etc/claude-desktop/managed-settings.json, invalid managed files) in docs/toolhive/guides-cli/client-configuration.mdx
• Skipped the auth server TLS listener and SPIFFE X.509 client authentication (Add auth server TLS listener and SPIFFE middleware toolhive#6843, Start auth server TLS listener in vMCP toolhive#6891): the operator doesn't configure tls_listener in this release, so it's reachable only through the raw RunConfig
• Skipped consent bypass for preauthorized clients (Let embedders skip consent for preauthorized clients toolhive#6882): Go library option for embedders, with no CLI or CRD surface
• Left thv llm setup --bedrock-compat gateway model discovery and the Fable tier (Enable Claude Code gateway model discovery toolhive#6862, Explain LLM gateway model-discovery failures toolhive#6884) to the auto-generated CLI reference; no hand-written guide covers Bedrock compatibility today

No docs impact identified

5 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Review routing

GitHub could not request the upstream contributor directly, so review went to the human merger of each relevant upstream PR:

• @ChrisJBurns (merged Answer 401 when a token session holds no upstream access token toolhive#6846)

These reviews require manual routing:

• No release owner could be resolved. A docs maintainer must adopt this PR and route its reviews.

Run cost

Session	Turns	Cost (USD)
Generation	37	$1.5236
Editorial review	16	$0.5839
Total	53	$2.1075

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)
• docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 22, 2026 4:02pm UTC

[claude]

Claude finished @renovate[bot]'s task in 2m 55s —— View job

---

Upstream release docs: stacklok/toolhive v0.56.0

• Phase 1: Discovery
• Phase 2: Deep dive / verify against source
• Phase 3: Audit existing docs
• Phase 4: Implementation
• Phase 5: Validation (prettier:fix, eslint:fix; site build not run here, CI covers it)
• Artifacts (SUMMARY.md / REVIEWERS.json)

Changes (commit 369fe44)

• guides-k8s/embedded-auth-server-k8s.mdx: new section, Limit Dynamic Client Registration. It covers:

  • Unused clients expire after 24 hours; the first token exchange extends a client to 30 days.
  • storage.maxDCRClients caps live clients (default 10000). At the cap, registration returns 503 with Retry-After.
  • registrationRateLimit limits registrations per replica (default 1/s, burst 5). Over the limit, registration returns 429.
  • Sizing guidance, plus the risk of setting maxDCRClients: 0.

  I also fixed the old confidential-DCR note that said only Redis expires idle clients. Both storage backends expire clients now (Cap DCR clients and expire unused ones after 24h toolhive#6863, Expose DCR client cap and register rate limit in CRD toolhive#6867).

• guides-vmcp/embedded-auth-server-vmcp.mdx: matching section with a spec.authServerConfig example that links to the K8s guide.

• concepts/embedded-auth-server.mdx: the DCR bullet now mentions the client cap and rate limit.

• guides-cli/client-configuration.mdx: the Claude Desktop connector warning now names the Linux managed file /etc/claude-desktop/managed-settings.json and covers invalid managed files (Fix Claude Desktop paths and managed check on Linux toolhive#6883).

Deliberately not documented

• Auth server TLS listener and spiffe_x509 client auth (Add auth server TLS listener and SPIFFE middleware toolhive#6843, Start auth server TLS listener in vMCP toolhive#6891): the operator doesn't configure the listener in this release, so the only way to turn it on is the raw RunConfig.
• Skipping consent for preauthorized clients (Let embedders skip consent for preauthorized clients toolhive#6882): a Go option for code that embeds the auth server. There's no CLI or CRD setting for it.
• thv llm setup --bedrock-compat model discovery and the Fable tier (Enable Claude Code gateway model discovery toolhive#6862, Explain LLM gateway model-discovery failures toolhive#6884): only the auto-generated CLI reference covers these, because no hand-written page documents Bedrock compatibility today.
• 401 when a session has no upstream access token (Answer 401 when a token session holds no upstream access token toolhive#6846): no page described the old behavior, so nothing needed fixing.

[claude]

Claude finished @renovate[bot]'s task in 1m 3s —— View job

---

Editorial review of the v0.56.0 content commit

• Identify files changed by the previous commit (369fe44)
• Run /docs-review over the 4 changed pages
• Verify factual claims against upstream source
• Apply fixes, format, lint, commit, push

Summary

The content from the previous commit is accurate and placed well. I made two small wording fixes on one page (commit 25a555b); the other three pages needed no changes.

Checked against the source, all correct:

• Default cap of 10000 live clients; HTTP 503 at the cap, with no existing client evicted; operator-configured and CIMD clients don't count toward the cap; Redis replicas share the count, in-memory replicas each keep their own.
• Default rate limit of 1 registration per second with a burst of 5, applied per replica.
• The maxTokens/refillPeriod example (3 and 18s).
• Clients that never complete a token exchange expire after 24 hours (DefaultUnusedDCRClientTTL); registrations otherwise expire after 30 days (DefaultDCRClientTTL).
• The 2.8-hour sizing estimate and the guidance on maxDCRClients: 0.
• The Claude Desktop Linux path /etc/claude-desktop/managed-settings.json (pkg/client/config.go).

Changes applied

File	Change
docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx	Rewrote the intro sentence for client registration. The old sentence said the server "always" accepts DCR requests "within configurable registration limits", which reads as contradictory.
docs/toolhive/guides-k8s/embedded-auth-server-k8s.mdx	Replaced the inline formula "rate x replicas x 86,400" with prose and explained what 86,400 is (the seconds in a day).

No changes needed

• concepts/embedded-auth-server.mdx: the one-sentence summary of the limits is short and accurate.
• guides-cli/client-configuration.mdx: the explanation of managed configuration on macOS and Linux is clear.
• guides-vmcp/embedded-auth-server-vmcp.mdx: a short section with a YAML example that links to the full Kubernetes section, so the details live in one place.

I ran npm run prettier:fix and npm run eslint:fix; ESLint reported nothing. I didn't edit any auto-generated files.
• Branch: renovate/stacklok-toolhive-0.x

[tgrunnagle]

Auth server/DCR rate limiting changes LGTM