v1alpha1

package

Go to main page

Versions in this module

v0

v0.40.1

Jul 20, 2026

v0.40.0

Jul 17, 2026

v0.39.0

Jul 16, 2026

v0.38.0

Jul 15, 2026

v0.37.0

Jul 15, 2026

v0.36.0

Jul 14, 2026

v0.35.0

Jul 13, 2026

v0.34.0

Jul 7, 2026

v0.33.0

Jul 1, 2026

v0.32.0

Jun 30, 2026

v0.31.0

Jun 24, 2026

v0.30.1

Jun 23, 2026 GO-2026-6002

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.30.0

Jun 16, 2026 GO-2026-6002

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type MCPAuthzConfig struct

+ Spec v1beta1.MCPAuthzConfigSpec

+ Status v1beta1.MCPAuthzConfigStatus

+ func (in *MCPAuthzConfig) DeepCopy() *MCPAuthzConfig

+ func (in *MCPAuthzConfig) DeepCopyInto(out *MCPAuthzConfig)

+ func (in *MCPAuthzConfig) DeepCopyObject() runtime.Object

+ type MCPAuthzConfigList struct

+ Items []MCPAuthzConfig

+ func (in *MCPAuthzConfigList) DeepCopy() *MCPAuthzConfigList

+ func (in *MCPAuthzConfigList) DeepCopyInto(out *MCPAuthzConfigList)

+ func (in *MCPAuthzConfigList) DeepCopyObject() runtime.Object

v0.29.3

Jun 10, 2026 GO-2026-6002

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.29.2

Jun 10, 2026 GO-2026-6002

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.29.1

Jun 4, 2026 GO-2026-6002

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.29.0

Jun 3, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.28.3

May 22, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.28.2

May 21, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.28.1

May 20, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.28.0

May 19, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.27.2

May 12, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.27.1

May 11, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.27.0

May 7, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type MCPWebhookConfig struct

+ Spec v1beta1.MCPWebhookConfigSpec

+ Status v1beta1.MCPWebhookConfigStatus

+ func (in *MCPWebhookConfig) DeepCopy() *MCPWebhookConfig

+ func (in *MCPWebhookConfig) DeepCopyInto(out *MCPWebhookConfig)

+ func (in *MCPWebhookConfig) DeepCopyObject() runtime.Object

+ type MCPWebhookConfigList struct

+ Items []MCPWebhookConfig

+ func (in *MCPWebhookConfigList) DeepCopy() *MCPWebhookConfigList

+ func (in *MCPWebhookConfigList) DeepCopyInto(out *MCPWebhookConfigList)

+ func (in *MCPWebhookConfigList) DeepCopyObject() runtime.Object

v0.26.1

Apr 30, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.26.0

Apr 29, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.25.0

Apr 28, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.24.1

Apr 23, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.24.0

Apr 22, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.23.1

Apr 21, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.23.0

Apr 21, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.22.0

Apr 21, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const BackendStatusUnauthenticated

+ func ValidateAdditionalAuthorizationParams(prefix string, params map[string]string) error

type OAuth2UpstreamConfig

+ AdditionalAuthorizationParams map[string]string

type OIDCUpstreamConfig

+ AdditionalAuthorizationParams map[string]string

type UpstreamProviderConfig

+ func (p *UpstreamProviderConfig) AdditionalAuthorizationParams() map[string]string

v0.21.0

Apr 16, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPOIDCConfigReference

+ ResourceURL string

v0.20.0

Apr 14, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonVirtualMCPServerTelemetryConfigRefFetchError

+ const ConditionReasonVirtualMCPServerTelemetryConfigRefInvalid

+ const ConditionReasonVirtualMCPServerTelemetryConfigRefNotFound

+ const ConditionReasonVirtualMCPServerTelemetryConfigRefValid

+ const ConditionTypeVirtualMCPServerTelemetryConfigRefValidated

+ type MCPGroupRef struct

+ Name string

+ func (in *MCPGroupRef) DeepCopy() *MCPGroupRef

+ func (in *MCPGroupRef) DeepCopyInto(out *MCPGroupRef)

+ func (r *MCPGroupRef) GetName() string

type VirtualMCPServer

+ func (r *VirtualMCPServer) ResolveGroupName() string

type VirtualMCPServerSpec

+ TelemetryConfigRef *MCPTelemetryConfigReference

type VirtualMCPServerStatus

+ TelemetryConfigHash string

v0.19.0

Apr 13, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonMCPRemoteProxyTelemetryConfigRefFetchError

+ const ConditionReasonMCPRemoteProxyTelemetryConfigRefInvalid

+ const ConditionReasonMCPRemoteProxyTelemetryConfigRefNotFound

+ const ConditionReasonMCPRemoteProxyTelemetryConfigRefValid

+ const ConditionTypeMCPRemoteProxyTelemetryConfigRefValidated

+ const DeprecatedBackendAuthTypeExternalAuthConfigRef

type MCPRemoteProxySpec

+ TelemetryConfigRef *MCPTelemetryConfigReference

type MCPRemoteProxyStatus

+ TelemetryConfigHash string

v0.18.0

Apr 10, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionRateLimitConfigValid

+ const ConditionReasonRateLimitConfigValid

+ const ConditionReasonRateLimitNotApplicable

+ const ConditionReasonRateLimitPerUserRequiresAuth

type MCPServer

+ func (m *MCPServer) GetMCPPort() int32

type MCPServerSpec

+ MCPPort int32

type RateLimitConfig

+ PerUser *RateLimitBucket

type ToolRateLimitConfig

+ PerUser *RateLimitBucket

v0.17.0

Apr 9, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonAuthServerRefFetchError

+ const ConditionReasonAuthServerRefInvalidKind

+ const ConditionReasonAuthServerRefInvalidType

+ const ConditionReasonAuthServerRefMultiUpstream

+ const ConditionReasonAuthServerRefNotFound

+ const ConditionReasonAuthServerRefValid

+ const ConditionReasonMCPRemoteProxyAuthServerRefFetchError

+ const ConditionReasonMCPRemoteProxyAuthServerRefInvalidKind

+ const ConditionReasonMCPRemoteProxyAuthServerRefInvalidType

+ const ConditionReasonMCPRemoteProxyAuthServerRefMultiUpstream

+ const ConditionReasonMCPRemoteProxyAuthServerRefNotFound

+ const ConditionReasonMCPRemoteProxyAuthServerRefValid

+ const ConditionReasonMCPServerEntryRemoteURLInvalid

+ const ConditionReasonMCPServerEntryRemoteURLValid

+ const ConditionReasonRegistryNotReady

+ const ConditionReasonRegistryReady

+ const ConditionTypeAuthServerRefValidated

+ const ConditionTypeMCPRemoteProxyAuthServerRefValidated

+ const ConditionTypeMCPServerEntryRemoteURLValidated

+ type AuthServerRef struct

+ Kind string

+ Name string

+ func (in *AuthServerRef) DeepCopy() *AuthServerRef

+ func (in *AuthServerRef) DeepCopyInto(out *AuthServerRef)

type EmbeddingServerPhase

+ const EmbeddingServerPhaseReady

+ type KubernetesSource struct

+ Namespaces []string

+ func (in *KubernetesSource) DeepCopy() *KubernetesSource

+ func (in *KubernetesSource) DeepCopyInto(out *KubernetesSource)

+ type MCPRegistryAWSRDSIAMConfig struct

+ Region string

+ func (in *MCPRegistryAWSRDSIAMConfig) DeepCopy() *MCPRegistryAWSRDSIAMConfig

+ func (in *MCPRegistryAWSRDSIAMConfig) DeepCopyInto(out *MCPRegistryAWSRDSIAMConfig)

type MCPRegistryAuthConfig

+ Authz *MCPRegistryAuthzConfig

+ PublicPaths []string

+ type MCPRegistryAuthzConfig struct

+ Roles MCPRegistryRolesConfig

+ func (in *MCPRegistryAuthzConfig) DeepCopy() *MCPRegistryAuthzConfig

+ func (in *MCPRegistryAuthzConfig) DeepCopyInto(out *MCPRegistryAuthzConfig)

type MCPRegistryDatabaseConfig

+ DynamicAuth *MCPRegistryDynamicAuthConfig

+ MaxMetaSize *int32

+ type MCPRegistryDynamicAuthConfig struct

+ AWSRDSIAM *MCPRegistryAWSRDSIAMConfig

+ func (in *MCPRegistryDynamicAuthConfig) DeepCopy() *MCPRegistryDynamicAuthConfig

+ func (in *MCPRegistryDynamicAuthConfig) DeepCopyInto(out *MCPRegistryDynamicAuthConfig)

+ type MCPRegistryMetricsConfig struct

+ Enabled bool

+ func (in *MCPRegistryMetricsConfig) DeepCopy() *MCPRegistryMetricsConfig

+ func (in *MCPRegistryMetricsConfig) DeepCopyInto(out *MCPRegistryMetricsConfig)

+ type MCPRegistryRolesConfig struct

+ ManageEntries []apiextensionsv1.JSON

+ ManageRegistries []apiextensionsv1.JSON

+ ManageSources []apiextensionsv1.JSON

+ SuperAdmin []apiextensionsv1.JSON

+ func (in *MCPRegistryRolesConfig) DeepCopy() *MCPRegistryRolesConfig

+ func (in *MCPRegistryRolesConfig) DeepCopyInto(out *MCPRegistryRolesConfig)

+ type MCPRegistrySourceConfig struct

+ API *APISource

+ Claims *apiextensionsv1.JSON

+ ConfigMapRef *corev1.ConfigMapKeySelector

+ Filter *RegistryFilter

+ Format string

+ Git *GitSource

+ Kubernetes *KubernetesSource

+ Managed *ManagedSource

+ Name string

+ SyncPolicy *SyncPolicy

+ URL *URLSource

+ func (in *MCPRegistrySourceConfig) DeepCopy() *MCPRegistrySourceConfig

+ func (in *MCPRegistrySourceConfig) DeepCopyInto(out *MCPRegistrySourceConfig)

type MCPRegistrySpec

+ ConfigYAML string

+ PGPassSecretRef *corev1.SecretKeySelector

+ Sources []MCPRegistrySourceConfig

+ TelemetryConfig *MCPRegistryTelemetryConfig

+ VolumeMounts []apiextensionsv1.JSON

+ Volumes []apiextensionsv1.JSON

+ func (s *MCPRegistrySpec) ParseVolumeMounts() ([]corev1.VolumeMount, error)

+ func (s *MCPRegistrySpec) ParseVolumes() ([]corev1.Volume, error)

type MCPRegistryStatus

+ ReadyReplicas int32

+ URL string

+ type MCPRegistryTelemetryConfig struct

+ Enabled bool

+ Endpoint string

+ Insecure bool

+ Metrics *MCPRegistryMetricsConfig

+ ServiceName string

+ ServiceVersion string

+ Tracing *MCPRegistryTracingConfig

+ func (in *MCPRegistryTelemetryConfig) DeepCopy() *MCPRegistryTelemetryConfig

+ func (in *MCPRegistryTelemetryConfig) DeepCopyInto(out *MCPRegistryTelemetryConfig)

+ type MCPRegistryTracingConfig struct

+ Enabled bool

+ Sampling *string

+ func (in *MCPRegistryTracingConfig) DeepCopy() *MCPRegistryTracingConfig

+ func (in *MCPRegistryTracingConfig) DeepCopyInto(out *MCPRegistryTracingConfig)

+ type MCPRegistryViewConfig struct

+ Claims *apiextensionsv1.JSON

+ Name string

+ Sources []string

+ func (in *MCPRegistryViewConfig) DeepCopy() *MCPRegistryViewConfig

+ func (in *MCPRegistryViewConfig) DeepCopyInto(out *MCPRegistryViewConfig)

type MCPRemoteProxySpec

+ AuthServerRef *AuthServerRef

type MCPRemoteProxyStatus

+ AuthServerConfigHash string

type MCPServerPhase

+ const MCPServerPhaseReady

type MCPServerSpec

+ AuthServerRef *AuthServerRef

type MCPServerStatus

+ AuthServerConfigHash string

type MCPTelemetryOTelConfig

+ CABundleRef *CABundleSource

+ type ManagedSource struct

+ func (in *ManagedSource) DeepCopy() *ManagedSource

+ func (in *ManagedSource) DeepCopyInto(out *ManagedSource)

+ type URLSource struct

+ Endpoint string

+ Timeout string

+ func (in *URLSource) DeepCopy() *URLSource

+ func (in *URLSource) DeepCopyInto(out *URLSource)

v0.16.0

Apr 8, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const AllowInsecureAnnotation

+ const ConditionReasonMCPServerEntryAuthConfigNotConfigured

+ const ConditionReasonMCPServerEntryAuthConfigNotFound

+ const ConditionReasonMCPServerEntryAuthConfigValid

+ const ConditionReasonMCPServerEntryCABundleRefNotConfigured

+ const ConditionReasonMCPServerEntryCABundleRefNotFound

+ const ConditionReasonMCPServerEntryCABundleRefValid

+ const ConditionReasonMCPServerEntryGroupRefNotFound

+ const ConditionReasonMCPServerEntryGroupRefNotReady

+ const ConditionReasonMCPServerEntryGroupRefValidated

+ const ConditionReasonMCPServerEntryInvalid

+ const ConditionReasonMCPServerEntryValid

+ const ConditionTypeDeletionBlocked

+ const ConditionTypeMCPServerEntryAuthConfigValidated

+ const ConditionTypeMCPServerEntryCABundleRefValidated

+ const ConditionTypeMCPServerEntryGroupRefValidated

+ const ConditionTypeMCPServerEntryValid

+ const ConditionTypeOIDCConfigValid

+ const ConditionTypeValid

type MCPGroupStatus

+ Entries []string

+ EntryCount int32

type MCPRemoteProxySpec

+ OIDCConfigRef *MCPOIDCConfigReference

type MCPRemoteProxyStatus

+ OIDCConfigHash string

+ type MCPServerEntry struct

+ Spec MCPServerEntrySpec

+ Status MCPServerEntryStatus

+ func (in *MCPServerEntry) DeepCopy() *MCPServerEntry

+ func (in *MCPServerEntry) DeepCopyInto(out *MCPServerEntry)

+ func (in *MCPServerEntry) DeepCopyObject() runtime.Object

+ type MCPServerEntryList struct

+ Items []MCPServerEntry

+ func (in *MCPServerEntryList) DeepCopy() *MCPServerEntryList

+ func (in *MCPServerEntryList) DeepCopyInto(out *MCPServerEntryList)

+ func (in *MCPServerEntryList) DeepCopyObject() runtime.Object

+ type MCPServerEntryPhase string

+ const MCPServerEntryPhaseFailed

+ const MCPServerEntryPhasePending

+ const MCPServerEntryPhaseValid

+ type MCPServerEntrySpec struct

+ CABundleRef *CABundleSource

+ ExternalAuthConfigRef *ExternalAuthConfigRef

+ GroupRef string

+ HeaderForward *HeaderForwardConfig

+ RemoteURL string

+ Transport string

+ func (in *MCPServerEntrySpec) DeepCopy() *MCPServerEntrySpec

+ func (in *MCPServerEntrySpec) DeepCopyInto(out *MCPServerEntrySpec)

+ type MCPServerEntryStatus struct

+ Conditions []metav1.Condition

+ ObservedGeneration int64

+ Phase MCPServerEntryPhase

+ func (in *MCPServerEntryStatus) DeepCopy() *MCPServerEntryStatus

+ func (in *MCPServerEntryStatus) DeepCopyInto(out *MCPServerEntryStatus)

type MCPServerSpec

+ RateLimiting *RateLimitConfig

+ type RateLimitBucket struct

+ MaxTokens int32

+ RefillPeriod metav1.Duration

+ func (in *RateLimitBucket) DeepCopy() *RateLimitBucket

+ func (in *RateLimitBucket) DeepCopyInto(out *RateLimitBucket)

+ type RateLimitConfig struct

+ Shared *RateLimitBucket

+ Tools []ToolRateLimitConfig

+ func (in *RateLimitConfig) DeepCopy() *RateLimitConfig

+ func (in *RateLimitConfig) DeepCopyInto(out *RateLimitConfig)

+ type ToolRateLimitConfig struct

+ Name string

+ Shared *RateLimitBucket

+ func (in *ToolRateLimitConfig) DeepCopy() *ToolRateLimitConfig

+ func (in *ToolRateLimitConfig) DeepCopyInto(out *ToolRateLimitConfig)

v0.15.0

Apr 3, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionOIDCConfigRefValidated

+ const ConditionReasonNotReady

+ const ConditionReasonOIDCConfigInvalid

+ const ConditionReasonOIDCConfigRefError

+ const ConditionReasonOIDCConfigRefNotFound

+ const ConditionReasonOIDCConfigRefNotValid

+ const ConditionReasonOIDCConfigRefValid

+ const ConditionReasonOIDCConfigValid

+ const ConditionReasonReady

+ const ConditionReasonTelemetryConfigRefError

+ const ConditionReasonTelemetryConfigRefInvalid

+ const ConditionReasonTelemetryConfigRefNotFound

+ const ConditionReasonTelemetryConfigRefValid

+ const ConditionReasonToolConfigValidationFailed

+ const ConditionReasonToolConfigValidationSucceeded

+ const ConditionTelemetryConfigRefValidated

+ const ConditionToolConfigValid

+ const ConditionTypeOIDCConfigReady

+ const WorkloadKindMCPRemoteProxy

+ const WorkloadKindMCPServer

+ const WorkloadKindVirtualMCPServer

type IncomingAuthConfig

+ OIDCConfigRef *MCPOIDCConfigReference

+ type InlineOIDCSharedConfig struct

+ CABundleRef *CABundleSource

+ ClientID string

+ ClientSecretRef *SecretKeyRef

+ InsecureAllowHTTP bool

+ IntrospectionURL string

+ Issuer string

+ JWKSAllowPrivateIP bool

+ JWKSAuthTokenPath string

+ JWKSURL string

+ ProtectedResourceAllowPrivateIP bool

+ func (in *InlineOIDCSharedConfig) DeepCopy() *InlineOIDCSharedConfig

+ func (in *InlineOIDCSharedConfig) DeepCopyInto(out *InlineOIDCSharedConfig)

+ type KubernetesServiceAccountOIDCConfig struct

+ IntrospectionURL string

+ Issuer string

+ JWKSURL string

+ Namespace string

+ ServiceAccount string

+ UseClusterAuth *bool

+ func (in *KubernetesServiceAccountOIDCConfig) DeepCopy() *KubernetesServiceAccountOIDCConfig

+ func (in *KubernetesServiceAccountOIDCConfig) DeepCopyInto(out *KubernetesServiceAccountOIDCConfig)

type MCPExternalAuthConfigStatus

+ ReferencingWorkloads []WorkloadReference

type MCPGroupStatus

+ ObservedGeneration int64

+ type MCPOIDCConfig struct

+ Spec MCPOIDCConfigSpec

+ Status MCPOIDCConfigStatus

+ func (in *MCPOIDCConfig) DeepCopy() *MCPOIDCConfig

+ func (in *MCPOIDCConfig) DeepCopyInto(out *MCPOIDCConfig)

+ func (in *MCPOIDCConfig) DeepCopyObject() runtime.Object

+ func (r *MCPOIDCConfig) Validate() error

+ type MCPOIDCConfigList struct

+ Items []MCPOIDCConfig

+ func (in *MCPOIDCConfigList) DeepCopy() *MCPOIDCConfigList

+ func (in *MCPOIDCConfigList) DeepCopyInto(out *MCPOIDCConfigList)

+ func (in *MCPOIDCConfigList) DeepCopyObject() runtime.Object

+ type MCPOIDCConfigReference struct

+ Audience string

+ Name string

+ Scopes []string

+ func (in *MCPOIDCConfigReference) DeepCopy() *MCPOIDCConfigReference

+ func (in *MCPOIDCConfigReference) DeepCopyInto(out *MCPOIDCConfigReference)

+ type MCPOIDCConfigSourceType string

+ const MCPOIDCConfigTypeInline

+ const MCPOIDCConfigTypeKubernetesServiceAccount

+ type MCPOIDCConfigSpec struct

+ Inline *InlineOIDCSharedConfig

+ KubernetesServiceAccount *KubernetesServiceAccountOIDCConfig

+ Type MCPOIDCConfigSourceType

+ func (in *MCPOIDCConfigSpec) DeepCopy() *MCPOIDCConfigSpec

+ func (in *MCPOIDCConfigSpec) DeepCopyInto(out *MCPOIDCConfigSpec)

+ type MCPOIDCConfigStatus struct

+ Conditions []metav1.Condition

+ ConfigHash string

+ ObservedGeneration int64

+ ReferencingWorkloads []WorkloadReference

+ func (in *MCPOIDCConfigStatus) DeepCopy() *MCPOIDCConfigStatus

+ func (in *MCPOIDCConfigStatus) DeepCopyInto(out *MCPOIDCConfigStatus)

type MCPRegistryStatus

+ ObservedGeneration int64

type MCPServerSpec

+ OIDCConfigRef *MCPOIDCConfigReference

+ TelemetryConfigRef *MCPTelemetryConfigReference

type MCPServerStatus

+ OIDCConfigHash string

+ ObservedGeneration int64

+ TelemetryConfigHash string

+ type MCPTelemetryConfig struct

+ Spec MCPTelemetryConfigSpec

+ Status MCPTelemetryConfigStatus

+ func (in *MCPTelemetryConfig) DeepCopy() *MCPTelemetryConfig

+ func (in *MCPTelemetryConfig) DeepCopyInto(out *MCPTelemetryConfig)

+ func (in *MCPTelemetryConfig) DeepCopyObject() runtime.Object

+ func (r *MCPTelemetryConfig) Validate() error

+ type MCPTelemetryConfigList struct

+ Items []MCPTelemetryConfig

+ func (in *MCPTelemetryConfigList) DeepCopy() *MCPTelemetryConfigList

+ func (in *MCPTelemetryConfigList) DeepCopyInto(out *MCPTelemetryConfigList)

+ func (in *MCPTelemetryConfigList) DeepCopyObject() runtime.Object

+ type MCPTelemetryConfigReference struct

+ Name string

+ ServiceName string

+ func (in *MCPTelemetryConfigReference) DeepCopy() *MCPTelemetryConfigReference

+ func (in *MCPTelemetryConfigReference) DeepCopyInto(out *MCPTelemetryConfigReference)

+ type MCPTelemetryConfigSpec struct

+ OpenTelemetry *MCPTelemetryOTelConfig

+ Prometheus *PrometheusConfig

+ func (in *MCPTelemetryConfigSpec) DeepCopy() *MCPTelemetryConfigSpec

+ func (in *MCPTelemetryConfigSpec) DeepCopyInto(out *MCPTelemetryConfigSpec)

+ type MCPTelemetryConfigStatus struct

+ Conditions []metav1.Condition

+ ConfigHash string

+ ObservedGeneration int64

+ ReferencingWorkloads []WorkloadReference

+ func (in *MCPTelemetryConfigStatus) DeepCopy() *MCPTelemetryConfigStatus

+ func (in *MCPTelemetryConfigStatus) DeepCopyInto(out *MCPTelemetryConfigStatus)

+ type MCPTelemetryOTelConfig struct

+ Enabled bool

+ Endpoint string

+ Headers map[string]string

+ Insecure bool

+ Metrics *OpenTelemetryMetricsConfig

+ ResourceAttributes map[string]string

+ SensitiveHeaders []SensitiveHeader

+ Tracing *OpenTelemetryTracingConfig

+ UseLegacyAttributes bool

+ func (in *MCPTelemetryOTelConfig) DeepCopy() *MCPTelemetryOTelConfig

+ func (in *MCPTelemetryOTelConfig) DeepCopyInto(out *MCPTelemetryOTelConfig)

type MCPToolConfigStatus

+ Conditions []metav1.Condition

+ ReferencingWorkloads []WorkloadReference

+ type SensitiveHeader struct

+ Name string

+ SecretKeyRef SecretKeyRef

+ func (in *SensitiveHeader) DeepCopy() *SensitiveHeader

+ func (in *SensitiveHeader) DeepCopyInto(out *SensitiveHeader)

type VirtualMCPServerStatus

+ OIDCConfigHash string

+ type WorkloadReference struct

+ Kind string

+ Name string

+ func (in *WorkloadReference) DeepCopy() *WorkloadReference

+ func (in *WorkloadReference) DeepCopyInto(out *WorkloadReference)

v0.14.1

Mar 30, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type ExternalAuthType

+ const ExternalAuthTypeUpstreamInject

type MCPExternalAuthConfigSpec

+ UpstreamInject *UpstreamInjectSpec

type TokenExchangeConfig

+ SubjectProviderName string

+ type UpstreamInjectSpec struct

+ ProviderName string

+ func (in *UpstreamInjectSpec) DeepCopy() *UpstreamInjectSpec

+ func (in *UpstreamInjectSpec) DeepCopyInto(out *UpstreamInjectSpec)

v0.14.0

Mar 30, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.13.1

Mar 27, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type EmbeddedAuthServerConfig

+ AuthorizationEndpointBaseURL string

v0.13.0

Mar 26, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonAuthServerConfigInvalid

+ const ConditionReasonAuthServerConfigValid

+ const ConditionReasonExternalAuthConfigMultiUpstream

+ const ConditionReasonMCPRemoteProxyExternalAuthConfigMultiUpstream

+ const ConditionReasonSessionStorageConfigured

+ const ConditionReasonSessionStorageMissing

+ const ConditionReasonSessionStorageNotApplicable

+ const ConditionReasonStdioReplicaCapNotActive

+ const ConditionReasonStdioReplicaCapped

+ const ConditionSessionStorageWarning

+ const ConditionStdioReplicaCapped

+ const ConditionTypeAuthServerConfigValidated

+ const ConditionTypeExternalAuthConfigValidated

+ const SessionStorageProviderRedis

type MCPServerSpec

+ BackendReplicas *int32

+ Replicas *int32

+ SessionStorage *SessionStorageConfig

+ type SessionStorageConfig struct

+ Address string

+ DB int32

+ KeyPrefix string

+ PasswordRef *SecretKeyRef

+ Provider string

+ func (in *SessionStorageConfig) DeepCopy() *SessionStorageConfig

+ func (in *SessionStorageConfig) DeepCopyInto(out *SessionStorageConfig)

type VirtualMCPServerSpec

+ AuthServerConfig *EmbeddedAuthServerConfig

+ Replicas *int32

+ SessionStorage *SessionStorageConfig

v0.12.5

Mar 24, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type ToolAnnotationsOverride struct

+ DestructiveHint *bool

+ IdempotentHint *bool

+ OpenWorldHint *bool

+ ReadOnlyHint *bool

+ Title *string

+ func (in *ToolAnnotationsOverride) DeepCopy() *ToolAnnotationsOverride

+ func (in *ToolAnnotationsOverride) DeepCopyInto(out *ToolAnnotationsOverride)

type ToolOverride

+ Annotations *ToolAnnotationsOverride

v0.12.4

Mar 19, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.12.3

Mar 19, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.12.2

Mar 17, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonAuthzConfigMapNotFound

+ const ConditionReasonAuthzPolicySyntaxInvalid

+ const ConditionReasonHeaderSecretNotFound

+ const ConditionReasonJWKSURLInvalid

+ const ConditionReasonRemoteURLInvalid

v0.12.1

Mar 13, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.12.0

Mar 13, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type RedisStorageConfig

+ SentinelTLS *RedisTLSConfig

+ TLS *RedisTLSConfig

+ type RedisTLSConfig struct

+ CACertSecretRef *SecretKeyRef

+ InsecureSkipVerify bool

+ func (in *RedisTLSConfig) DeepCopy() *RedisTLSConfig

+ func (in *RedisTLSConfig) DeepCopyInto(out *RedisTLSConfig)

v0.11.3

Mar 12, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.11.2

Mar 9, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type OAuth2UpstreamConfig

+ TokenResponseMapping *TokenResponseMapping

+ type TokenResponseMapping struct

+ AccessTokenPath string

+ ExpiresInPath string

+ RefreshTokenPath string

+ ScopePath string

+ func (in *TokenResponseMapping) DeepCopy() *TokenResponseMapping

+ func (in *TokenResponseMapping) DeepCopyInto(out *TokenResponseMapping)

v0.11.1

Mar 6, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonConfigurationValid

+ const ConditionReasonOIDCIssuerInsecure

+ const ConditionReasonOIDCIssuerInvalid

+ const ConditionTypeConfigurationValid

v0.11.0

Mar 4, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRemoteProxySpec

+ SessionAffinity string

type MCPServerSpec

+ SessionAffinity string

type VirtualMCPServerSpec

+ SessionAffinity string

v0.10.2

Mar 2, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.10.1

Mar 2, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonEmbeddingServerNotFound

+ const ConditionReasonEmbeddingServerNotReady

+ const ConditionReasonEmbeddingServerReady

+ const ConditionTypeEmbeddingServerReady

+ type EmbeddingServerRef struct

+ Name string

+ func (in *EmbeddingServerRef) DeepCopy() *EmbeddingServerRef

+ func (in *EmbeddingServerRef) DeepCopyInto(out *EmbeddingServerRef)

type MCPServerPhase

+ const MCPServerPhaseStopped

type MCPServerStatus

+ ReadyReplicas int32

type VirtualMCPServerSpec

+ EmbeddingServerRef *EmbeddingServerRef

v0.10.0

Feb 18, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPExternalAuthConfig

+ func (r *MCPExternalAuthConfig) Validate() error

type MCPExternalAuthConfigStatus

+ Conditions []metav1.Condition

v0.9.4

Feb 16, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type AWSStsConfig struct

+ FallbackRoleArn string

+ Region string

+ RoleClaim string

+ RoleMappings []RoleMapping

+ Service string

+ SessionDuration *int32

+ SessionNameClaim string

+ func (in *AWSStsConfig) DeepCopy() *AWSStsConfig

+ func (in *AWSStsConfig) DeepCopyInto(out *AWSStsConfig)

+ type AuthServerStorageConfig struct

+ Redis *RedisStorageConfig

+ Type AuthServerStorageType

+ func (in *AuthServerStorageConfig) DeepCopy() *AuthServerStorageConfig

+ func (in *AuthServerStorageConfig) DeepCopyInto(out *AuthServerStorageConfig)

+ type AuthServerStorageType string

+ const AuthServerStorageTypeMemory

+ const AuthServerStorageTypeRedis

type EmbeddedAuthServerConfig

+ Storage *AuthServerStorageConfig

type ExternalAuthType

+ const ExternalAuthTypeAWSSts

type MCPExternalAuthConfigSpec

+ AWSSts *AWSStsConfig

type OpenTelemetryConfig

+ UseLegacyAttributes bool

+ type RedisACLUserConfig struct

+ PasswordSecretRef *SecretKeyRef

+ UsernameSecretRef *SecretKeyRef

+ func (in *RedisACLUserConfig) DeepCopy() *RedisACLUserConfig

+ func (in *RedisACLUserConfig) DeepCopyInto(out *RedisACLUserConfig)

+ type RedisSentinelConfig struct

+ DB int32

+ MasterName string

+ SentinelAddrs []string

+ SentinelService *SentinelServiceRef

+ func (in *RedisSentinelConfig) DeepCopy() *RedisSentinelConfig

+ func (in *RedisSentinelConfig) DeepCopyInto(out *RedisSentinelConfig)

+ type RedisStorageConfig struct

+ ACLUserConfig *RedisACLUserConfig

+ DialTimeout string

+ ReadTimeout string

+ SentinelConfig *RedisSentinelConfig

+ WriteTimeout string

+ func (in *RedisStorageConfig) DeepCopy() *RedisStorageConfig

+ func (in *RedisStorageConfig) DeepCopyInto(out *RedisStorageConfig)

+ type RoleMapping struct

+ Claim string

+ Matcher string

+ Priority *int32

+ RoleArn string

+ func (in *RoleMapping) DeepCopy() *RoleMapping

+ func (in *RoleMapping) DeepCopyInto(out *RoleMapping)

+ type SentinelServiceRef struct

+ Name string

+ Namespace string

+ Port int32

+ func (in *SentinelServiceRef) DeepCopy() *SentinelServiceRef

+ func (in *SentinelServiceRef) DeepCopyInto(out *SentinelServiceRef)

v0.9.3

Feb 9, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonMCPRemoteProxyExternalAuthConfigFetchError

+ const ConditionReasonMCPRemoteProxyExternalAuthConfigNotFound

+ const ConditionReasonMCPRemoteProxyExternalAuthConfigValid

+ const ConditionReasonMCPRemoteProxyToolConfigFetchError

+ const ConditionReasonMCPRemoteProxyToolConfigNotFound

+ const ConditionReasonMCPRemoteProxyToolConfigValid

+ const ConditionTypeMCPRemoteProxyExternalAuthConfigValidated

+ const ConditionTypeMCPRemoteProxyToolConfigValidated

type ProxyDeploymentOverrides

+ ImagePullSecrets []corev1.LocalObjectReference

v0.9.2

Feb 6, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type GitAuthConfig struct

+ PasswordSecretRef corev1.SecretKeySelector

+ Username string

+ func (in *GitAuthConfig) DeepCopy() *GitAuthConfig

+ func (in *GitAuthConfig) DeepCopyInto(out *GitAuthConfig)

type GitSource

+ Auth *GitAuthConfig

type MCPRemoteProxySpec

+ ProxyPort int32

v0.9.1

Feb 4, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.9.0

Feb 2, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type EmbeddedAuthServerConfig struct

+ HMACSecretRefs []SecretKeyRef

+ Issuer string

+ SigningKeySecretRefs []SecretKeyRef

+ TokenLifespans *TokenLifespanConfig

+ UpstreamProviders []UpstreamProviderConfig

+ func (in *EmbeddedAuthServerConfig) DeepCopy() *EmbeddedAuthServerConfig

+ func (in *EmbeddedAuthServerConfig) DeepCopyInto(out *EmbeddedAuthServerConfig)

type ExternalAuthType

+ const ExternalAuthTypeEmbeddedAuthServer

type MCPExternalAuthConfigSpec

+ EmbeddedAuthServer *EmbeddedAuthServerConfig

+ type OAuth2UpstreamConfig struct

+ AuthorizationEndpoint string

+ ClientID string

+ ClientSecretRef *SecretKeyRef

+ RedirectURI string

+ Scopes []string

+ TokenEndpoint string

+ UserInfo *UserInfoConfig

+ func (in *OAuth2UpstreamConfig) DeepCopy() *OAuth2UpstreamConfig

+ func (in *OAuth2UpstreamConfig) DeepCopyInto(out *OAuth2UpstreamConfig)

+ type OIDCUpstreamConfig struct

+ ClientID string

+ ClientSecretRef *SecretKeyRef

+ IssuerURL string

+ RedirectURI string

+ Scopes []string

+ UserInfoOverride *UserInfoConfig

+ func (in *OIDCUpstreamConfig) DeepCopy() *OIDCUpstreamConfig

+ func (in *OIDCUpstreamConfig) DeepCopyInto(out *OIDCUpstreamConfig)

+ type TokenLifespanConfig struct

+ AccessTokenLifespan string

+ AuthCodeLifespan string

+ RefreshTokenLifespan string

+ func (in *TokenLifespanConfig) DeepCopy() *TokenLifespanConfig

+ func (in *TokenLifespanConfig) DeepCopyInto(out *TokenLifespanConfig)

+ type UpstreamProviderConfig struct

+ Name string

+ OAuth2Config *OAuth2UpstreamConfig

+ OIDCConfig *OIDCUpstreamConfig

+ Type UpstreamProviderType

+ func (in *UpstreamProviderConfig) DeepCopy() *UpstreamProviderConfig

+ func (in *UpstreamProviderConfig) DeepCopyInto(out *UpstreamProviderConfig)

+ type UpstreamProviderType string

+ const UpstreamProviderTypeOAuth2

+ const UpstreamProviderTypeOIDC

+ type UserInfoConfig struct

+ AdditionalHeaders map[string]string

+ EndpointURL string

+ FieldMapping *UserInfoFieldMapping

+ HTTPMethod string

+ func (in *UserInfoConfig) DeepCopy() *UserInfoConfig

+ func (in *UserInfoConfig) DeepCopyInto(out *UserInfoConfig)

+ type UserInfoFieldMapping struct

+ EmailFields []string

+ NameFields []string

+ SubjectFields []string

+ func (in *UserInfoFieldMapping) DeepCopy() *UserInfoFieldMapping

+ func (in *UserInfoFieldMapping) DeepCopyInto(out *UserInfoFieldMapping)

v0.8.3

Jan 29, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type HeaderForwardConfig struct

+ AddHeadersFromSecret []HeaderFromSecret

+ AddPlaintextHeaders map[string]string

+ func (in *HeaderForwardConfig) DeepCopy() *HeaderForwardConfig

+ func (in *HeaderForwardConfig) DeepCopyInto(out *HeaderForwardConfig)

+ type HeaderFromSecret struct

+ HeaderName string

+ ValueSecretRef *SecretKeyRef

+ func (in *HeaderFromSecret) DeepCopy() *HeaderFromSecret

+ func (in *HeaderFromSecret) DeepCopyInto(out *HeaderFromSecret)

type MCPRemoteProxySpec

+ HeaderForward *HeaderForwardConfig

v0.8.2

Jan 27, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.8.1

Jan 27, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionCABundleRefValidated

+ const ConditionModelReady

+ const ConditionReasonCABundleRefInvalid

+ const ConditionReasonCABundleRefNotFound

+ const ConditionReasonCABundleRefValid

+ const ConditionReasonModelDownloading

+ const ConditionReasonModelFailed

+ const ConditionReasonModelReady

+ const ConditionReasonVolumeCreating

+ const ConditionReasonVolumeFailed

+ const ConditionReasonVolumeReady

+ const ConditionVolumeReady

+ type BearerTokenConfig struct

+ TokenSecretRef *SecretKeyRef

+ func (in *BearerTokenConfig) DeepCopy() *BearerTokenConfig

+ func (in *BearerTokenConfig) DeepCopyInto(out *BearerTokenConfig)

+ type CABundleSource struct

+ ConfigMapRef *corev1.ConfigMapKeySelector

+ func (in *CABundleSource) DeepCopy() *CABundleSource

+ func (in *CABundleSource) DeepCopyInto(out *CABundleSource)

type ConfigMapOIDCRef

+ CABundleRef *CABundleSource

+ type EmbeddingResourceOverrides struct

+ PersistentVolumeClaim *ResourceMetadataOverrides

+ Service *ResourceMetadataOverrides

+ StatefulSet *EmbeddingStatefulSetOverrides

+ func (in *EmbeddingResourceOverrides) DeepCopy() *EmbeddingResourceOverrides

+ func (in *EmbeddingResourceOverrides) DeepCopyInto(out *EmbeddingResourceOverrides)

+ type EmbeddingServer struct

+ Spec EmbeddingServerSpec

+ Status EmbeddingServerStatus

+ func (e *EmbeddingServer) GetImagePullPolicy() string

+ func (e *EmbeddingServer) GetName() string

+ func (e *EmbeddingServer) GetNamespace() string

+ func (e *EmbeddingServer) GetPort() int32

+ func (e *EmbeddingServer) GetReplicas() int32

+ func (e *EmbeddingServer) IsModelCacheEnabled() bool

+ func (in *EmbeddingServer) DeepCopy() *EmbeddingServer

+ func (in *EmbeddingServer) DeepCopyInto(out *EmbeddingServer)

+ func (in *EmbeddingServer) DeepCopyObject() runtime.Object

+ type EmbeddingServerList struct

+ Items []EmbeddingServer

+ func (in *EmbeddingServerList) DeepCopy() *EmbeddingServerList

+ func (in *EmbeddingServerList) DeepCopyInto(out *EmbeddingServerList)

+ func (in *EmbeddingServerList) DeepCopyObject() runtime.Object

+ type EmbeddingServerPhase string

+ const EmbeddingServerPhaseDownloading

+ const EmbeddingServerPhaseFailed

+ const EmbeddingServerPhasePending

+ const EmbeddingServerPhaseRunning

+ const EmbeddingServerPhaseTerminating

+ type EmbeddingServerSpec struct

+ Args []string

+ Env []EnvVar

+ HFTokenSecretRef *SecretKeyRef

+ Image string

+ ImagePullPolicy string

+ Model string

+ ModelCache *ModelCacheConfig

+ PodTemplateSpec *runtime.RawExtension

+ Port int32

+ Replicas *int32

+ ResourceOverrides *EmbeddingResourceOverrides

+ Resources ResourceRequirements

+ func (in *EmbeddingServerSpec) DeepCopy() *EmbeddingServerSpec

+ func (in *EmbeddingServerSpec) DeepCopyInto(out *EmbeddingServerSpec)

+ type EmbeddingServerStatus struct

+ Conditions []metav1.Condition

+ Message string

+ ObservedGeneration int64

+ Phase EmbeddingServerPhase

+ ReadyReplicas int32

+ URL string

+ func (in *EmbeddingServerStatus) DeepCopy() *EmbeddingServerStatus

+ func (in *EmbeddingServerStatus) DeepCopyInto(out *EmbeddingServerStatus)

+ type EmbeddingStatefulSetOverrides struct

+ PodTemplateMetadataOverrides *ResourceMetadataOverrides

+ func (in *EmbeddingStatefulSetOverrides) DeepCopy() *EmbeddingStatefulSetOverrides

+ func (in *EmbeddingStatefulSetOverrides) DeepCopyInto(out *EmbeddingStatefulSetOverrides)

type ExternalAuthType

+ const ExternalAuthTypeBearerToken

type InlineOIDCConfig

+ CABundleRef *CABundleSource

type MCPExternalAuthConfigSpec

+ BearerToken *BearerTokenConfig

type MCPRemoteProxySpec

+ ServiceAccount *string

+ type ModelCacheConfig struct

+ AccessMode string

+ Enabled bool

+ Size string

+ StorageClassName *string

+ func (in *ModelCacheConfig) DeepCopy() *ModelCacheConfig

+ func (in *ModelCacheConfig) DeepCopyInto(out *ModelCacheConfig)

type VirtualMCPServerSpec

+ ServiceAccount *string

v0.8.0

Jan 22, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.7.2

Jan 19, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.7.1

Jan 15, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.7.0

Jan 15, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.6.17

Jan 8, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRemoteProxySpec

+ EndpointPrefix string

type MCPServerSpec

+ EndpointPrefix string

type VirtualMCPServerSpec

+ Config config.Config

v0.6.16

Jan 2, 2026 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type VirtualMCPServerSpec

+ Audit *AuditConfig

v0.6.15

Dec 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type MCPRegistryAuthConfig struct

+ Mode MCPRegistryAuthMode

+ OAuth *MCPRegistryOAuthConfig

+ func (in *MCPRegistryAuthConfig) DeepCopy() *MCPRegistryAuthConfig

+ func (in *MCPRegistryAuthConfig) DeepCopyInto(out *MCPRegistryAuthConfig)

+ type MCPRegistryAuthMode string

+ const MCPRegistryAuthModeAnonymous

+ const MCPRegistryAuthModeOAuth

+ type MCPRegistryOAuthConfig struct

+ Providers []MCPRegistryOAuthProviderConfig

+ Realm string

+ ResourceURL string

+ ScopesSupported []string

+ func (in *MCPRegistryOAuthConfig) DeepCopy() *MCPRegistryOAuthConfig

+ func (in *MCPRegistryOAuthConfig) DeepCopyInto(out *MCPRegistryOAuthConfig)

+ type MCPRegistryOAuthProviderConfig struct

+ AllowPrivateIP bool

+ Audience string

+ AuthTokenFile string

+ AuthTokenRef *corev1.SecretKeySelector

+ CACertRef *corev1.ConfigMapKeySelector

+ CaCertPath string

+ ClientID string

+ ClientSecretRef *corev1.SecretKeySelector

+ IntrospectionURL string

+ IssuerURL string

+ JwksUrl string

+ Name string

+ func (in *MCPRegistryOAuthProviderConfig) DeepCopy() *MCPRegistryOAuthProviderConfig

+ func (in *MCPRegistryOAuthProviderConfig) DeepCopyInto(out *MCPRegistryOAuthProviderConfig)

type MCPRegistrySpec

+ AuthConfig *MCPRegistryAuthConfig

v0.6.14

Dec 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRegistry

+ func (r *MCPRegistry) BuildPGPassSecretName() string

+ func (r *MCPRegistry) GetDatabaseConfig() *MCPRegistryDatabaseConfig

+ func (r *MCPRegistry) GetDatabasePort() int

+ func (r *MCPRegistry) HasDatabaseConfig() bool

type MCPRegistryDatabaseConfig

+ DBAppUserPasswordSecretRef corev1.SecretKeySelector

+ DBMigrationUserPasswordSecretRef corev1.SecretKeySelector

v0.6.13

Dec 15, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type WorkflowStep

+ DefaultResults map[string]runtime.RawExtension

v0.6.12

Dec 12, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const BackendStatusDegraded

+ const BackendStatusReady

+ const BackendStatusUnavailable

+ const BackendStatusUnknown

+ const ConditionReasonCompositeToolRefInvalid

+ const ConditionReasonCompositeToolRefNotFound

+ const ConditionReasonCompositeToolRefsValid

+ const ConditionReasonMCPRemoteProxyGroupRefNotFound

+ const ConditionReasonMCPRemoteProxyGroupRefNotReady

+ const ConditionReasonMCPRemoteProxyGroupRefValidated

+ const ConditionReasonVirtualMCPServerBackendDiscoveryFailed

+ const ConditionReasonVirtualMCPServerBackendsDiscoveredSuccessfully

+ const ConditionReasonVirtualMCPServerDeploymentFailed

+ const ConditionReasonVirtualMCPServerDeploymentNotReady

+ const ConditionReasonVirtualMCPServerDeploymentReady

+ const ConditionReasonVirtualMCPServerPodTemplateSpecInvalid

+ const ConditionReasonVirtualMCPServerPodTemplateSpecValid

+ const ConditionTypeCompositeToolRefsValidated

+ const ConditionTypeMCPRemoteProxyGroupRefValidated

+ const ConditionTypeVirtualMCPServerBackendsDiscovered

+ const ConditionTypeVirtualMCPServerPodTemplateSpecValid

+ type ElicitationResponseHandler struct

+ Action string

+ func (in *ElicitationResponseHandler) DeepCopy() *ElicitationResponseHandler

+ func (in *ElicitationResponseHandler) DeepCopyInto(out *ElicitationResponseHandler)

type ExternalAuthType

+ const ExternalAuthTypeUnauthenticated

type InlineOIDCConfig

+ Scopes []string

type MCPExternalAuthConfig

+ func (*MCPExternalAuthConfig) ValidateDelete(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (r *MCPExternalAuthConfig) SetupWebhookWithManager(mgr ctrl.Manager) error

+ func (r *MCPExternalAuthConfig) ValidateCreate(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (r *MCPExternalAuthConfig) ValidateUpdate(_ context.Context, _ runtime.Object, _ runtime.Object) (admission.Warnings, error)

type MCPGroupStatus

+ RemoteProxies []string

+ RemoteProxyCount int

type MCPRemoteProxySpec

+ GroupRef string

type OperationalConfig

+ LogLevel string

type VirtualMCPServerSpec

+ Telemetry *TelemetryConfig

type WorkflowStep

+ OnCancel *ElicitationResponseHandler

+ OnDecline *ElicitationResponseHandler

v0.6.11

Dec 3, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type VirtualMCPServer

+ func (*VirtualMCPServer) GetProxyPort() int32

+ func (v *VirtualMCPServer) GetOIDCConfig() *OIDCConfigRef

v0.6.10

Dec 2, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type CompositeToolSpec

+ Output *OutputSpec

type MCPRegistryConfig

+ PVCRef *PVCSource

+ type OutputPropertySpec struct

+ Default *runtime.RawExtension

+ Description string

+ Properties map[string]OutputPropertySpec

+ Type string

+ Value string

+ func (in *OutputPropertySpec) DeepCopy() *OutputPropertySpec

+ func (in *OutputPropertySpec) DeepCopyInto(out *OutputPropertySpec)

+ type OutputSpec struct

+ Properties map[string]OutputPropertySpec

+ Required []string

+ func (in *OutputSpec) DeepCopy() *OutputSpec

+ func (in *OutputSpec) DeepCopyInto(out *OutputSpec)

+ type PVCSource struct

+ ClaimName string

+ Path string

+ func (in *PVCSource) DeepCopy() *PVCSource

+ func (in *PVCSource) DeepCopyInto(out *PVCSource)

type VirtualMCPCompositeToolDefinitionSpec

+ Output *OutputSpec

v0.6.9

Nov 28, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonRegistryPodTemplateInvalid

+ const ConditionReasonRegistryPodTemplateValid

+ const ConditionRegistryPodTemplateValid

+ const ErrorActionAbort

+ const ErrorActionContinue

+ const ErrorActionRetry

type ErrorHandling

+ RetryDelay string

type MCPRegistry

+ func (r *MCPRegistry) GetPodTemplateSpecRaw() *runtime.RawExtension

+ func (r *MCPRegistry) HasPodTemplateSpec() bool

+ type MCPRegistryDatabaseConfig struct

+ ConnMaxLifetime string

+ Database string

+ Host string

+ MaxIdleConns int

+ MaxOpenConns int

+ MigrationUser string

+ Port int

+ SSLMode string

+ User string

+ func (in *MCPRegistryDatabaseConfig) DeepCopy() *MCPRegistryDatabaseConfig

+ func (in *MCPRegistryDatabaseConfig) DeepCopyInto(out *MCPRegistryDatabaseConfig)

type MCPRegistrySpec

+ DatabaseConfig *MCPRegistryDatabaseConfig

+ PodTemplateSpec *runtime.RawExtension

v0.6.8

Nov 27, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type ExternalAuthType string

+ const ExternalAuthTypeHeaderInjection

+ type HeaderInjectionConfig struct

+ HeaderName string

+ ValueSecretRef *SecretKeyRef

+ func (in *HeaderInjectionConfig) DeepCopy() *HeaderInjectionConfig

+ func (in *HeaderInjectionConfig) DeepCopyInto(out *HeaderInjectionConfig)

type MCPExternalAuthConfigSpec

+ HeaderInjection *HeaderInjectionConfig

v0.6.7

Nov 25, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type InlineOIDCConfig

+ ProtectedResourceAllowPrivateIP bool

+ type MCPRegistryConfig struct

+ API *APISource

+ ConfigMapRef *corev1.ConfigMapKeySelector

+ Filter *RegistryFilter

+ Format string

+ Git *GitSource

+ Name string

+ SyncPolicy *SyncPolicy

+ func (in *MCPRegistryConfig) DeepCopy() *MCPRegistryConfig

+ func (in *MCPRegistryConfig) DeepCopyInto(out *MCPRegistryConfig)

type MCPRegistrySpec

+ Registries []MCPRegistryConfig

v0.6.6

Nov 19, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRegistry

+ func (r *MCPRegistry) GetConfigMapSourceName() string

+ func (r *MCPRegistry) IsConfigMapRegistrySource() bool

type MCPRegistrySource

+ ConfigMapRef *corev1.ConfigMapKeySelector

type VirtualMCPServerStatus

+ BackendCount int

v0.6.5

Nov 13, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.6.4

Nov 13, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.6.3

Nov 13, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type TokenExchangeConfig

+ SubjectTokenType string

v0.6.2

Nov 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.6.1

Nov 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.6.0

Nov 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type IncomingAuthConfig

+ Type string

type VirtualMCPServerSpec

+ ServiceType string

v0.5.2

Nov 3, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const BackendAuthTypeDiscovered

+ const BackendAuthTypeExternalAuthConfigRef

+ const BackendAuthTypePassThrough

+ const BackendAuthTypeServiceAccount

+ const ConditionReasonAllBackendsReady

+ const ConditionReasonDependencyCycle

+ const ConditionReasonDiscoveryComplete

+ const ConditionReasonDiscoveryFailed

+ const ConditionReasonIncomingAuthInvalid

+ const ConditionReasonIncomingAuthValid

+ const ConditionReasonNoBackends

+ const ConditionReasonSchemaInvalid

+ const ConditionReasonSomeBackendsUnavailable

+ const ConditionReasonTemplateInvalid

+ const ConditionReasonToolNotFound

+ const ConditionReasonValidationFailed

+ const ConditionReasonValidationSuccess

+ const ConditionReasonVirtualMCPServerGroupRefNotFound

+ const ConditionReasonVirtualMCPServerGroupRefNotReady

+ const ConditionReasonVirtualMCPServerGroupRefValid

+ const ConditionReasonWorkflowNotReady

+ const ConditionReasonWorkflowReady

+ const ConditionTypeBackendsDiscovered

+ const ConditionTypeVirtualMCPServerGroupRefValidated

+ const ConditionTypeVirtualMCPServerReady

+ const ConditionTypeWorkflowValidated

+ const ConflictResolutionManual

+ const ConflictResolutionPrefix

+ const ConflictResolutionPriority

+ const WorkflowStepTypeElicitation

+ const WorkflowStepTypeToolCall

+ type AdvancedWorkflowStep struct

+ CacheKey string

+ RetryPolicy *RetryPolicy

+ Transform string

+ func (in *AdvancedWorkflowStep) DeepCopy() *AdvancedWorkflowStep

+ func (in *AdvancedWorkflowStep) DeepCopyInto(out *AdvancedWorkflowStep)

+ type AggregationConfig struct

+ ConflictResolution string

+ ConflictResolutionConfig *ConflictResolutionConfig

+ Tools []WorkloadToolConfig

+ func (in *AggregationConfig) DeepCopy() *AggregationConfig

+ func (in *AggregationConfig) DeepCopyInto(out *AggregationConfig)

+ type BackendAuthConfig struct

+ ExternalAuthConfigRef *ExternalAuthConfigRef

+ ServiceAccount *ServiceAccountAuth

+ Type string

+ func (in *BackendAuthConfig) DeepCopy() *BackendAuthConfig

+ func (in *BackendAuthConfig) DeepCopyInto(out *BackendAuthConfig)

+ type CapabilitiesSummary struct

+ CompositeToolCount int

+ PromptCount int

+ ResourceCount int

+ ToolCount int

+ func (in *CapabilitiesSummary) DeepCopy() *CapabilitiesSummary

+ func (in *CapabilitiesSummary) DeepCopyInto(out *CapabilitiesSummary)

+ type CircuitBreakerConfig struct

+ Enabled bool

+ FailureThreshold int

+ Timeout string

+ func (in *CircuitBreakerConfig) DeepCopy() *CircuitBreakerConfig

+ func (in *CircuitBreakerConfig) DeepCopyInto(out *CircuitBreakerConfig)

+ type CompositeToolDefinitionRef struct

+ Name string

+ func (in *CompositeToolDefinitionRef) DeepCopy() *CompositeToolDefinitionRef

+ func (in *CompositeToolDefinitionRef) DeepCopyInto(out *CompositeToolDefinitionRef)

+ type CompositeToolSpec struct

+ Description string

+ Name string

+ Parameters map[string]ParameterSpec

+ Steps []WorkflowStep

+ Timeout string

+ func (in *CompositeToolSpec) DeepCopy() *CompositeToolSpec

+ func (in *CompositeToolSpec) DeepCopyInto(out *CompositeToolSpec)

+ type ConflictResolutionConfig struct

+ PrefixFormat string

+ PriorityOrder []string

+ func (in *ConflictResolutionConfig) DeepCopy() *ConflictResolutionConfig

+ func (in *ConflictResolutionConfig) DeepCopyInto(out *ConflictResolutionConfig)

+ type DiscoveredBackend struct

+ AuthConfigRef string

+ AuthType string

+ LastHealthCheck *metav1.Time

+ Name string

+ Status string

+ URL string

+ func (in *DiscoveredBackend) DeepCopy() *DiscoveredBackend

+ func (in *DiscoveredBackend) DeepCopyInto(out *DiscoveredBackend)

+ type ElicitationStep struct

+ DefaultResponse *runtime.RawExtension

+ Message string

+ Schema *runtime.RawExtension

+ Timeout string

+ func (in *ElicitationStep) DeepCopy() *ElicitationStep

+ func (in *ElicitationStep) DeepCopyInto(out *ElicitationStep)

+ type ErrorHandling struct

+ Action string

+ MaxRetries int

+ func (in *ErrorHandling) DeepCopy() *ErrorHandling

+ func (in *ErrorHandling) DeepCopyInto(out *ErrorHandling)

+ type FailureHandlingConfig struct

+ CircuitBreaker *CircuitBreakerConfig

+ HealthCheckInterval string

+ PartialFailureMode string

+ UnhealthyThreshold int

+ func (in *FailureHandlingConfig) DeepCopy() *FailureHandlingConfig

+ func (in *FailureHandlingConfig) DeepCopyInto(out *FailureHandlingConfig)

+ type GroupRef struct

+ Name string

+ func (in *GroupRef) DeepCopy() *GroupRef

+ func (in *GroupRef) DeepCopyInto(out *GroupRef)

+ type IncomingAuthConfig struct

+ AuthzConfig *AuthzConfigRef

+ OIDCConfig *OIDCConfigRef

+ func (in *IncomingAuthConfig) DeepCopy() *IncomingAuthConfig

+ func (in *IncomingAuthConfig) DeepCopyInto(out *IncomingAuthConfig)

+ type MemoryCacheConfig struct

+ MaxEntries int

+ TTLOffset string

+ func (in *MemoryCacheConfig) DeepCopy() *MemoryCacheConfig

+ func (in *MemoryCacheConfig) DeepCopyInto(out *MemoryCacheConfig)

+ type OperationalConfig struct

+ FailureHandling *FailureHandlingConfig

+ Timeouts *TimeoutConfig

+ func (in *OperationalConfig) DeepCopy() *OperationalConfig

+ func (in *OperationalConfig) DeepCopyInto(out *OperationalConfig)

+ type OutgoingAuthConfig struct

+ Backends map[string]BackendAuthConfig

+ Default *BackendAuthConfig

+ Source string

+ func (in *OutgoingAuthConfig) DeepCopy() *OutgoingAuthConfig

+ func (in *OutgoingAuthConfig) DeepCopyInto(out *OutgoingAuthConfig)

+ type ParameterSpec struct

+ Default string

+ Description string

+ Required bool

+ Type string

+ func (in *ParameterSpec) DeepCopy() *ParameterSpec

+ func (in *ParameterSpec) DeepCopyInto(out *ParameterSpec)

+ type RedisCacheConfig struct

+ Address string

+ DB int

+ KeyPrefix string

+ PasswordRef *SecretKeyRef

+ TLS bool

+ func (in *RedisCacheConfig) DeepCopy() *RedisCacheConfig

+ func (in *RedisCacheConfig) DeepCopyInto(out *RedisCacheConfig)

+ type RetryPolicy struct

+ BackoffStrategy string

+ InitialDelay string

+ MaxDelay string

+ MaxRetries int

+ RetryableErrors []string

+ func (in *RetryPolicy) DeepCopy() *RetryPolicy

+ func (in *RetryPolicy) DeepCopyInto(out *RetryPolicy)

+ type ServiceAccountAuth struct

+ CredentialsRef SecretKeyRef

+ HeaderFormat string

+ HeaderName string

+ func (in *ServiceAccountAuth) DeepCopy() *ServiceAccountAuth

+ func (in *ServiceAccountAuth) DeepCopyInto(out *ServiceAccountAuth)

+ type TimeoutConfig struct

+ Default string

+ PerWorkload map[string]string

+ func (in *TimeoutConfig) DeepCopy() *TimeoutConfig

+ func (in *TimeoutConfig) DeepCopyInto(out *TimeoutConfig)

+ type TokenCacheConfig struct

+ Memory *MemoryCacheConfig

+ Provider string

+ Redis *RedisCacheConfig

+ func (in *TokenCacheConfig) DeepCopy() *TokenCacheConfig

+ func (in *TokenCacheConfig) DeepCopyInto(out *TokenCacheConfig)

+ type ValidationStatus string

+ const ValidationStatusInvalid

+ const ValidationStatusUnknown

+ const ValidationStatusValid

+ type VirtualMCPCompositeToolDefinition struct

+ Spec VirtualMCPCompositeToolDefinitionSpec

+ Status VirtualMCPCompositeToolDefinitionStatus

+ func (*VirtualMCPCompositeToolDefinition) ValidateDelete(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (in *VirtualMCPCompositeToolDefinition) DeepCopy() *VirtualMCPCompositeToolDefinition

+ func (in *VirtualMCPCompositeToolDefinition) DeepCopyInto(out *VirtualMCPCompositeToolDefinition)

+ func (in *VirtualMCPCompositeToolDefinition) DeepCopyObject() runtime.Object

+ func (r *VirtualMCPCompositeToolDefinition) GetValidationErrors() []string

+ func (r *VirtualMCPCompositeToolDefinition) SetupWebhookWithManager(mgr ctrl.Manager) error

+ func (r *VirtualMCPCompositeToolDefinition) Validate() error

+ func (r *VirtualMCPCompositeToolDefinition) ValidateCreate(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (r *VirtualMCPCompositeToolDefinition) ValidateUpdate(_ context.Context, _ runtime.Object, _ runtime.Object) (admission.Warnings, error)

+ type VirtualMCPCompositeToolDefinitionList struct

+ Items []VirtualMCPCompositeToolDefinition

+ func (in *VirtualMCPCompositeToolDefinitionList) DeepCopy() *VirtualMCPCompositeToolDefinitionList

+ func (in *VirtualMCPCompositeToolDefinitionList) DeepCopyInto(out *VirtualMCPCompositeToolDefinitionList)

+ func (in *VirtualMCPCompositeToolDefinitionList) DeepCopyObject() runtime.Object

+ type VirtualMCPCompositeToolDefinitionSpec struct

+ Description string

+ FailureMode string

+ Name string

+ Parameters map[string]ParameterSpec

+ Steps []WorkflowStep

+ Timeout string

+ func (in *VirtualMCPCompositeToolDefinitionSpec) DeepCopy() *VirtualMCPCompositeToolDefinitionSpec

+ func (in *VirtualMCPCompositeToolDefinitionSpec) DeepCopyInto(out *VirtualMCPCompositeToolDefinitionSpec)

+ type VirtualMCPCompositeToolDefinitionStatus struct

+ Conditions []metav1.Condition

+ ObservedGeneration int64

+ ReferencingVirtualServers []string

+ ValidationErrors []string

+ ValidationStatus ValidationStatus

+ func (in *VirtualMCPCompositeToolDefinitionStatus) DeepCopy() *VirtualMCPCompositeToolDefinitionStatus

+ func (in *VirtualMCPCompositeToolDefinitionStatus) DeepCopyInto(out *VirtualMCPCompositeToolDefinitionStatus)

+ type VirtualMCPServer struct

+ Spec VirtualMCPServerSpec

+ Status VirtualMCPServerStatus

+ func (*VirtualMCPServer) ValidateDelete(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (in *VirtualMCPServer) DeepCopy() *VirtualMCPServer

+ func (in *VirtualMCPServer) DeepCopyInto(out *VirtualMCPServer)

+ func (in *VirtualMCPServer) DeepCopyObject() runtime.Object

+ func (r *VirtualMCPServer) SetupWebhookWithManager(mgr ctrl.Manager) error

+ func (r *VirtualMCPServer) Validate() error

+ func (r *VirtualMCPServer) ValidateCreate(_ context.Context, _ runtime.Object) (admission.Warnings, error)

+ func (r *VirtualMCPServer) ValidateUpdate(_ context.Context, _ runtime.Object, _ runtime.Object) (admission.Warnings, error)

+ type VirtualMCPServerList struct

+ Items []VirtualMCPServer

+ func (in *VirtualMCPServerList) DeepCopy() *VirtualMCPServerList

+ func (in *VirtualMCPServerList) DeepCopyInto(out *VirtualMCPServerList)

+ func (in *VirtualMCPServerList) DeepCopyObject() runtime.Object

+ type VirtualMCPServerPhase string

+ const VirtualMCPServerPhaseDegraded

+ const VirtualMCPServerPhaseFailed

+ const VirtualMCPServerPhasePending

+ const VirtualMCPServerPhaseReady

+ type VirtualMCPServerSpec struct

+ Aggregation *AggregationConfig

+ CompositeToolRefs []CompositeToolDefinitionRef

+ CompositeTools []CompositeToolSpec

+ GroupRef GroupRef

+ IncomingAuth *IncomingAuthConfig

+ Operational *OperationalConfig

+ OutgoingAuth *OutgoingAuthConfig

+ PodTemplateSpec *runtime.RawExtension

+ TokenCache *TokenCacheConfig

+ func (in *VirtualMCPServerSpec) DeepCopy() *VirtualMCPServerSpec

+ func (in *VirtualMCPServerSpec) DeepCopyInto(out *VirtualMCPServerSpec)

+ type VirtualMCPServerStatus struct

+ Capabilities *CapabilitiesSummary

+ Conditions []metav1.Condition

+ DiscoveredBackends []DiscoveredBackend

+ Message string

+ ObservedGeneration int64

+ Phase VirtualMCPServerPhase

+ URL string

+ func (in *VirtualMCPServerStatus) DeepCopy() *VirtualMCPServerStatus

+ func (in *VirtualMCPServerStatus) DeepCopyInto(out *VirtualMCPServerStatus)

+ type WorkflowStep struct

+ Arguments map[string]string

+ Condition string

+ DependsOn []string

+ ID string

+ Message string

+ OnError *ErrorHandling

+ Schema *runtime.RawExtension

+ Timeout string

+ Tool string

+ Type string

+ func (in *WorkflowStep) DeepCopy() *WorkflowStep

+ func (in *WorkflowStep) DeepCopyInto(out *WorkflowStep)

+ type WorkloadToolConfig struct

+ Filter []string

+ Overrides map[string]ToolOverride

+ ToolConfigRef *ToolConfigRef

+ Workload string

+ func (in *WorkloadToolConfig) DeepCopy() *WorkloadToolConfig

+ func (in *WorkloadToolConfig) DeepCopyInto(out *WorkloadToolConfig)

v0.5.1

Oct 30, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRemoteProxy

+ func (m *MCPRemoteProxy) GetProxyPort() int32

type MCPServer

+ func (m *MCPServer) GetMcpPort() int32

+ func (m *MCPServer) GetProxyPort() int32

type MCPServerSpec

+ McpPort int32

+ ProxyPort int32

v0.5.0

Oct 27, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type InlineOIDCConfig

+ ClientSecretRef *SecretKeyRef

v0.4.2

Oct 23, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type InlineOIDCConfig

+ InsecureAllowHTTP bool

v0.4.1

Oct 23, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionPodTemplateValid

+ const ConditionReasonPodTemplateInvalid

+ const ConditionReasonPodTemplateValid

+ const RegistrySourceTypeAPI

+ type APISource struct

+ Endpoint string

+ func (in *APISource) DeepCopy() *APISource

+ func (in *APISource) DeepCopyInto(out *APISource)

type MCPRegistrySource

+ API *APISource

type NetworkPermissions

+ Mode string

v0.4.0

Oct 22, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionGroupRefValidated

+ const ConditionReasonGroupRefNotFound

+ const ConditionReasonGroupRefNotReady

+ const ConditionReasonGroupRefValidated

+ const ConditionReasonListMCPServersFailed

+ const ConditionReasonListMCPServersSucceeded

+ const ConditionTypeMCPServersChecked

+ type MCPGroup struct

+ Spec MCPGroupSpec

+ Status MCPGroupStatus

+ func (in *MCPGroup) DeepCopy() *MCPGroup

+ func (in *MCPGroup) DeepCopyInto(out *MCPGroup)

+ func (in *MCPGroup) DeepCopyObject() runtime.Object

+ type MCPGroupList struct

+ Items []MCPGroup

+ func (in *MCPGroupList) DeepCopy() *MCPGroupList

+ func (in *MCPGroupList) DeepCopyInto(out *MCPGroupList)

+ func (in *MCPGroupList) DeepCopyObject() runtime.Object

+ type MCPGroupPhase string

+ const MCPGroupPhaseFailed

+ const MCPGroupPhasePending

+ const MCPGroupPhaseReady

+ type MCPGroupSpec struct

+ Description string

+ func (in *MCPGroupSpec) DeepCopy() *MCPGroupSpec

+ func (in *MCPGroupSpec) DeepCopyInto(out *MCPGroupSpec)

+ type MCPGroupStatus struct

+ Conditions []metav1.Condition

+ Phase MCPGroupPhase

+ ServerCount int

+ Servers []string

+ func (in *MCPGroupStatus) DeepCopy() *MCPGroupStatus

+ func (in *MCPGroupStatus) DeepCopyInto(out *MCPGroupStatus)

type MCPServerSpec

+ GroupRef string

v0.3.11

Oct 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.3.10

Oct 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionReasonAuthInvalid

+ const ConditionReasonAuthValid

+ const ConditionReasonDeploymentNotReady

+ const ConditionReasonDeploymentReady

+ const ConditionReasonMissingOIDCConfig

+ const ConditionReasonRemoteURLReachable

+ const ConditionReasonRemoteURLUnreachable

+ const ConditionTypeAuthConfigured

+ const ConditionTypeReady

+ const ConditionTypeRemoteAvailable

+ type MCPRemoteProxy struct

+ Spec MCPRemoteProxySpec

+ Status MCPRemoteProxyStatus

+ func (in *MCPRemoteProxy) DeepCopy() *MCPRemoteProxy

+ func (in *MCPRemoteProxy) DeepCopyInto(out *MCPRemoteProxy)

+ func (in *MCPRemoteProxy) DeepCopyObject() runtime.Object

+ func (m *MCPRemoteProxy) GetName() string

+ func (m *MCPRemoteProxy) GetNamespace() string

+ func (m *MCPRemoteProxy) GetOIDCConfig() *OIDCConfigRef

+ func (m *MCPRemoteProxy) GetPort() int32

+ type MCPRemoteProxyList struct

+ Items []MCPRemoteProxy

+ func (in *MCPRemoteProxyList) DeepCopy() *MCPRemoteProxyList

+ func (in *MCPRemoteProxyList) DeepCopyInto(out *MCPRemoteProxyList)

+ func (in *MCPRemoteProxyList) DeepCopyObject() runtime.Object

+ type MCPRemoteProxyPhase string

+ const MCPRemoteProxyPhaseFailed

+ const MCPRemoteProxyPhasePending

+ const MCPRemoteProxyPhaseReady

+ const MCPRemoteProxyPhaseTerminating

+ type MCPRemoteProxySpec struct

+ Audit *AuditConfig

+ AuthzConfig *AuthzConfigRef

+ ExternalAuthConfigRef *ExternalAuthConfigRef

+ OIDCConfig OIDCConfigRef

+ Port int32

+ RemoteURL string

+ ResourceOverrides *ResourceOverrides

+ Resources ResourceRequirements

+ Telemetry *TelemetryConfig

+ ToolConfigRef *ToolConfigRef

+ Transport string

+ TrustProxyHeaders bool

+ func (in *MCPRemoteProxySpec) DeepCopy() *MCPRemoteProxySpec

+ func (in *MCPRemoteProxySpec) DeepCopyInto(out *MCPRemoteProxySpec)

+ type MCPRemoteProxyStatus struct

+ Conditions []metav1.Condition

+ ExternalAuthConfigHash string

+ ExternalURL string

+ Message string

+ ObservedGeneration int64

+ Phase MCPRemoteProxyPhase

+ ToolConfigHash string

+ URL string

+ func (in *MCPRemoteProxyStatus) DeepCopy() *MCPRemoteProxyStatus

+ func (in *MCPRemoteProxyStatus) DeepCopyInto(out *MCPRemoteProxyStatus)

type MCPServer

+ func (m *MCPServer) GetName() string

+ func (m *MCPServer) GetNamespace() string

+ func (m *MCPServer) GetOIDCConfig() *OIDCConfigRef

+ func (m *MCPServer) GetPort() int32

v0.3.9

Oct 16, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ExternalAuthTypeTokenExchange

+ type ExternalAuthConfigRef struct

+ Name string

+ func (in *ExternalAuthConfigRef) DeepCopy() *ExternalAuthConfigRef

+ func (in *ExternalAuthConfigRef) DeepCopyInto(out *ExternalAuthConfigRef)

+ type MCPExternalAuthConfig struct

+ Spec MCPExternalAuthConfigSpec

+ Status MCPExternalAuthConfigStatus

+ func (in *MCPExternalAuthConfig) DeepCopy() *MCPExternalAuthConfig

+ func (in *MCPExternalAuthConfig) DeepCopyInto(out *MCPExternalAuthConfig)

+ func (in *MCPExternalAuthConfig) DeepCopyObject() runtime.Object

+ type MCPExternalAuthConfigList struct

+ Items []MCPExternalAuthConfig

+ func (in *MCPExternalAuthConfigList) DeepCopy() *MCPExternalAuthConfigList

+ func (in *MCPExternalAuthConfigList) DeepCopyInto(out *MCPExternalAuthConfigList)

+ func (in *MCPExternalAuthConfigList) DeepCopyObject() runtime.Object

+ type MCPExternalAuthConfigSpec struct

+ TokenExchange *TokenExchangeConfig

+ Type string

+ func (in *MCPExternalAuthConfigSpec) DeepCopy() *MCPExternalAuthConfigSpec

+ func (in *MCPExternalAuthConfigSpec) DeepCopyInto(out *MCPExternalAuthConfigSpec)

+ type MCPExternalAuthConfigStatus struct

+ ConfigHash string

+ ObservedGeneration int64

+ ReferencingServers []string

+ func (in *MCPExternalAuthConfigStatus) DeepCopy() *MCPExternalAuthConfigStatus

+ func (in *MCPExternalAuthConfigStatus) DeepCopyInto(out *MCPExternalAuthConfigStatus)

type MCPServerSpec

+ ExternalAuthConfigRef *ExternalAuthConfigRef

type MCPServerStatus

+ ExternalAuthConfigHash string

+ type SecretKeyRef struct

+ Key string

+ Name string

+ func (in *SecretKeyRef) DeepCopy() *SecretKeyRef

+ func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef)

+ type TokenExchangeConfig struct

+ Audience string

+ ClientID string

+ ClientSecretRef SecretKeyRef

+ ExternalTokenHeaderName string

+ Scopes []string

+ TokenURL string

+ func (in *TokenExchangeConfig) DeepCopy() *TokenExchangeConfig

+ func (in *TokenExchangeConfig) DeepCopyInto(out *TokenExchangeConfig)

v0.3.8

Oct 13, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRegistryStatus

+ LastAppliedFilterHash string

v0.3.7

Oct 6, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ TrustProxyHeaders bool

v0.3.6

Sep 30, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionImageValidated

+ const ConditionReasonImageValidationError

+ const ConditionReasonImageValidationFailed

+ const ConditionReasonImageValidationSkipped

+ const ConditionReasonImageValidationSuccess

+ const RegistrySourceTypeGit

+ type APIPhase string

+ const APIPhaseDeploying

+ const APIPhaseError

+ const APIPhaseNotStarted

+ const APIPhaseReady

+ const APIPhaseUnhealthy

+ type APIStatus struct

+ Endpoint string

+ Message string

+ Phase APIPhase

+ ReadySince *metav1.Time

+ func (in *APIStatus) DeepCopy() *APIStatus

+ func (in *APIStatus) DeepCopyInto(out *APIStatus)

+ type GitSource struct

+ Branch string

+ Commit string

+ Path string

+ Repository string

+ Tag string

+ func (in *GitSource) DeepCopy() *GitSource

+ func (in *GitSource) DeepCopyInto(out *GitSource)

type MCPRegistry

+ func (r *MCPRegistry) DeriveOverallPhase() MCPRegistryPhase

+ func (r *MCPRegistry) GetAPIResourceName() string

+ func (r *MCPRegistry) GetStorageName() string

type MCPRegistrySource

+ Git *GitSource

type MCPRegistrySpec

+ EnforceServers bool

type MCPRegistryStatus

+ APIStatus *APIStatus

+ SyncStatus *SyncStatus

+ type SyncPhase string

+ const SyncPhaseComplete

+ const SyncPhaseFailed

+ const SyncPhaseIdle

+ const SyncPhaseSyncing

+ type SyncStatus struct

+ AttemptCount int

+ LastAttempt *metav1.Time

+ LastSyncHash string

+ LastSyncTime *metav1.Time

+ Message string

+ Phase SyncPhase

+ ServerCount int

+ func (in *SyncStatus) DeepCopy() *SyncStatus

+ func (in *SyncStatus) DeepCopyInto(out *SyncStatus)

v0.3.5

Sep 18, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.3.4

Sep 18, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.3.3

Sep 18, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.3.2

Sep 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.3.1

Sep 16, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPRegistryStatus

+ LastManualSyncTrigger string

v0.3.0

Sep 14, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ ProxyMode string

+ ToolConfigRef *ToolConfigRef

type MCPServerStatus

+ ToolConfigHash string

+ type MCPToolConfig struct

+ Spec MCPToolConfigSpec

+ Status MCPToolConfigStatus

+ func (in *MCPToolConfig) DeepCopy() *MCPToolConfig

+ func (in *MCPToolConfig) DeepCopyInto(out *MCPToolConfig)

+ func (in *MCPToolConfig) DeepCopyObject() runtime.Object

+ type MCPToolConfigList struct

+ Items []MCPToolConfig

+ func (in *MCPToolConfigList) DeepCopy() *MCPToolConfigList

+ func (in *MCPToolConfigList) DeepCopyInto(out *MCPToolConfigList)

+ func (in *MCPToolConfigList) DeepCopyObject() runtime.Object

+ type MCPToolConfigSpec struct

+ ToolsFilter []string

+ ToolsOverride map[string]ToolOverride

+ func (in *MCPToolConfigSpec) DeepCopy() *MCPToolConfigSpec

+ func (in *MCPToolConfigSpec) DeepCopyInto(out *MCPToolConfigSpec)

+ type MCPToolConfigStatus struct

+ ConfigHash string

+ ObservedGeneration int64

+ ReferencingServers []string

+ func (in *MCPToolConfigStatus) DeepCopy() *MCPToolConfigStatus

+ func (in *MCPToolConfigStatus) DeepCopyInto(out *MCPToolConfigStatus)

+ type ToolConfigRef struct

+ Name string

+ func (in *ToolConfigRef) DeepCopy() *ToolConfigRef

+ func (in *ToolConfigRef) DeepCopyInto(out *ToolConfigRef)

+ type ToolOverride struct

+ Description string

+ Name string

+ func (in *ToolOverride) DeepCopy() *ToolOverride

+ func (in *ToolOverride) DeepCopyInto(out *ToolOverride)

v0.2.17

Sep 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ConditionAPIReady

+ const ConditionDataValid

+ const ConditionSourceAvailable

+ const ConditionSyncSuccessful

+ const RegistryFormatToolHive

+ const RegistryFormatUpstream

+ const RegistrySourceTypeConfigMap

+ type AuditConfig struct

+ Enabled bool

+ func (in *AuditConfig) DeepCopy() *AuditConfig

+ func (in *AuditConfig) DeepCopyInto(out *AuditConfig)

+ type ConfigMapSource struct

+ Key string

+ Name string

+ func (in *ConfigMapSource) DeepCopy() *ConfigMapSource

+ func (in *ConfigMapSource) DeepCopyInto(out *ConfigMapSource)

+ type MCPRegistry struct

+ Spec MCPRegistrySpec

+ Status MCPRegistryStatus

+ func (in *MCPRegistry) DeepCopy() *MCPRegistry

+ func (in *MCPRegistry) DeepCopyInto(out *MCPRegistry)

+ func (in *MCPRegistry) DeepCopyObject() runtime.Object

+ type MCPRegistryList struct

+ Items []MCPRegistry

+ func (in *MCPRegistryList) DeepCopy() *MCPRegistryList

+ func (in *MCPRegistryList) DeepCopyInto(out *MCPRegistryList)

+ func (in *MCPRegistryList) DeepCopyObject() runtime.Object

+ type MCPRegistryPhase string

+ const MCPRegistryPhaseFailed

+ const MCPRegistryPhasePending

+ const MCPRegistryPhaseReady

+ const MCPRegistryPhaseSyncing

+ const MCPRegistryPhaseTerminating

+ type MCPRegistrySource struct

+ ConfigMap *ConfigMapSource

+ Format string

+ Type string

+ func (in *MCPRegistrySource) DeepCopy() *MCPRegistrySource

+ func (in *MCPRegistrySource) DeepCopyInto(out *MCPRegistrySource)

+ type MCPRegistrySpec struct

+ DisplayName string

+ Filter *RegistryFilter

+ Source MCPRegistrySource

+ SyncPolicy *SyncPolicy

+ func (in *MCPRegistrySpec) DeepCopy() *MCPRegistrySpec

+ func (in *MCPRegistrySpec) DeepCopyInto(out *MCPRegistrySpec)

+ type MCPRegistryStatus struct

+ APIEndpoint string

+ Conditions []metav1.Condition

+ DeployedServerCount int32

+ LastSyncHash string

+ LastSyncTime *metav1.Time

+ Message string

+ Phase MCPRegistryPhase

+ ServerCount int32

+ StorageRef *StorageReference

+ SyncAttempts int32

+ func (in *MCPRegistryStatus) DeepCopy() *MCPRegistryStatus

+ func (in *MCPRegistryStatus) DeepCopyInto(out *MCPRegistryStatus)

type MCPServerSpec

+ Audit *AuditConfig

+ type NameFilter struct

+ Exclude []string

+ Include []string

+ func (in *NameFilter) DeepCopy() *NameFilter

+ func (in *NameFilter) DeepCopyInto(out *NameFilter)

type OpenTelemetryConfig

+ Tracing *OpenTelemetryTracingConfig

+ type OpenTelemetryTracingConfig struct

+ Enabled bool

+ SamplingRate string

+ func (in *OpenTelemetryTracingConfig) DeepCopy() *OpenTelemetryTracingConfig

+ func (in *OpenTelemetryTracingConfig) DeepCopyInto(out *OpenTelemetryTracingConfig)

type ProxyDeploymentOverrides

+ PodTemplateMetadataOverrides *ResourceMetadataOverrides

+ type RegistryFilter struct

+ NameFilters *NameFilter

+ Tags *TagFilter

+ func (in *RegistryFilter) DeepCopy() *RegistryFilter

+ func (in *RegistryFilter) DeepCopyInto(out *RegistryFilter)

+ type StorageReference struct

+ ConfigMapRef *corev1.LocalObjectReference

+ Type string

+ func (in *StorageReference) DeepCopy() *StorageReference

+ func (in *StorageReference) DeepCopyInto(out *StorageReference)

+ type SyncPolicy struct

+ Interval string

+ func (in *SyncPolicy) DeepCopy() *SyncPolicy

+ func (in *SyncPolicy) DeepCopyInto(out *SyncPolicy)

+ type TagFilter struct

+ Exclude []string

+ Include []string

+ func (in *TagFilter) DeepCopy() *TagFilter

+ func (in *TagFilter) DeepCopyInto(out *TagFilter)

v0.2.16

Sep 4, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.15

Sep 2, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.14

Sep 2, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ Telemetry *TelemetryConfig

+ type OpenTelemetryConfig struct

+ Enabled bool

+ Endpoint string

+ Headers []string

+ Insecure bool

+ Metrics *OpenTelemetryMetricsConfig

+ ServiceName string

+ func (in *OpenTelemetryConfig) DeepCopy() *OpenTelemetryConfig

+ func (in *OpenTelemetryConfig) DeepCopyInto(out *OpenTelemetryConfig)

+ type OpenTelemetryMetricsConfig struct

+ Enabled bool

+ func (in *OpenTelemetryMetricsConfig) DeepCopy() *OpenTelemetryMetricsConfig

+ func (in *OpenTelemetryMetricsConfig) DeepCopyInto(out *OpenTelemetryMetricsConfig)

+ type PrometheusConfig struct

+ Enabled bool

+ func (in *PrometheusConfig) DeepCopy() *PrometheusConfig

+ func (in *PrometheusConfig) DeepCopyInto(out *PrometheusConfig)

+ type TelemetryConfig struct

+ OpenTelemetry *OpenTelemetryConfig

+ Prometheus *PrometheusConfig

+ func (in *TelemetryConfig) DeepCopy() *TelemetryConfig

+ func (in *TelemetryConfig) DeepCopyInto(out *TelemetryConfig)

v0.2.13

Aug 26, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.12

Aug 26, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.11

Aug 22, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.10

Aug 21, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.9

Aug 20, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.8

Aug 18, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ ServiceAccount *string

type OIDCConfigRef

+ ResourceURL string

v0.2.7

Aug 13, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.6

Aug 12, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.5

Aug 8, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.4

Aug 7, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type InlineOIDCConfig

+ ClientSecret string

+ IntrospectionURL string

type KubernetesOIDCConfig

+ IntrospectionURL string

v0.2.3

Aug 5, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.2

Aug 1, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.2.1

Jul 29, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ ToolsFilter []string

v0.2.0

Jul 23, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.9

Jul 17, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.8

Jul 15, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type InlineOIDCConfig

+ JWKSAllowPrivateIP bool

+ JWKSAuthTokenPath string

+ ThvCABundlePath string

type KubernetesOIDCConfig

+ UseClusterAuth *bool

+ type ProxyDeploymentOverrides struct

+ Env []EnvVar

+ func (in *ProxyDeploymentOverrides) DeepCopy() *ProxyDeploymentOverrides

+ func (in *ProxyDeploymentOverrides) DeepCopyInto(out *ProxyDeploymentOverrides)

v0.1.7

Jul 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.6

Jul 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.5

Jul 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.4

Jul 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.3

Jul 8, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.2

Jul 2, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const AuthzConfigTypeConfigMap

+ const AuthzConfigTypeInline

+ type AuthzConfigRef struct

+ ConfigMap *ConfigMapAuthzRef

+ Inline *InlineAuthzConfig

+ Type string

+ func (in *AuthzConfigRef) DeepCopy() *AuthzConfigRef

+ func (in *AuthzConfigRef) DeepCopyInto(out *AuthzConfigRef)

+ type ConfigMapAuthzRef struct

+ Key string

+ Name string

+ func (in *ConfigMapAuthzRef) DeepCopy() *ConfigMapAuthzRef

+ func (in *ConfigMapAuthzRef) DeepCopyInto(out *ConfigMapAuthzRef)

+ type InlineAuthzConfig struct

+ EntitiesJSON string

+ Policies []string

+ func (in *InlineAuthzConfig) DeepCopy() *InlineAuthzConfig

+ func (in *InlineAuthzConfig) DeepCopyInto(out *InlineAuthzConfig)

type MCPServerSpec

+ AuthzConfig *AuthzConfigRef

v0.1.1

Jun 30, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.1.0

Jun 26, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.48

Jun 24, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.47

Jun 12, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.46

Jun 10, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.45

Jun 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.44

Jun 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.43

Jun 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.42

Jun 5, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.41

Jun 5, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.40

Jun 5, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const OIDCConfigTypeConfigMap

+ const OIDCConfigTypeInline

+ const OIDCConfigTypeKubernetes

+ type ConfigMapOIDCRef struct

+ Key string

+ Name string

+ func (in *ConfigMapOIDCRef) DeepCopy() *ConfigMapOIDCRef

+ func (in *ConfigMapOIDCRef) DeepCopyInto(out *ConfigMapOIDCRef)

+ type InlineOIDCConfig struct

+ Audience string

+ ClientID string

+ Issuer string

+ JWKSURL string

+ func (in *InlineOIDCConfig) DeepCopy() *InlineOIDCConfig

+ func (in *InlineOIDCConfig) DeepCopyInto(out *InlineOIDCConfig)

+ type KubernetesOIDCConfig struct

+ Audience string

+ Issuer string

+ JWKSURL string

+ Namespace string

+ ServiceAccount string

+ func (in *KubernetesOIDCConfig) DeepCopy() *KubernetesOIDCConfig

+ func (in *KubernetesOIDCConfig) DeepCopyInto(out *KubernetesOIDCConfig)

type MCPServerSpec

+ OIDCConfig *OIDCConfigRef

+ ResourceOverrides *ResourceOverrides

+ type OIDCConfigRef struct

+ ConfigMap *ConfigMapOIDCRef

+ Inline *InlineOIDCConfig

+ Kubernetes *KubernetesOIDCConfig

+ Type string

+ func (in *OIDCConfigRef) DeepCopy() *OIDCConfigRef

+ func (in *OIDCConfigRef) DeepCopyInto(out *OIDCConfigRef)

+ type ResourceMetadataOverrides struct

+ Annotations map[string]string

+ Labels map[string]string

+ func (in *ResourceMetadataOverrides) DeepCopy() *ResourceMetadataOverrides

+ func (in *ResourceMetadataOverrides) DeepCopyInto(out *ResourceMetadataOverrides)

+ type ResourceOverrides struct

+ ProxyDeployment *ResourceMetadataOverrides

+ ProxyService *ResourceMetadataOverrides

+ func (in *ResourceOverrides) DeepCopy() *ResourceOverrides

+ func (in *ResourceOverrides) DeepCopyInto(out *ResourceOverrides)

v0.0.39

Jun 2, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type MCPServerSpec

+ TargetPort int32

v0.0.38

May 29, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.37

May 27, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.36

May 23, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.35

May 22, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.34

May 20, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.33

May 12, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

v0.0.32

May 9, 2025 GO-2026-5996 +1 more

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const PermissionProfileTypeBuiltin

+ const PermissionProfileTypeConfigMap

+ var AddToScheme = SchemeBuilder.AddToScheme

+ var GroupVersion = schema.GroupVersion

+ var SchemeBuilder = &scheme.Builder

+ type EnvVar struct

+ Name string

+ Value string

+ func (in *EnvVar) DeepCopy() *EnvVar

+ func (in *EnvVar) DeepCopyInto(out *EnvVar)