config

Jul 7, 2026

Changes in this version

+ type EmbeddingHeaderValue string

type OptimizerConfig

+ EmbeddingHeaders map[string]EmbeddingHeaderValue

Jun 30, 2026

Changes in this version

type OptimizerConfig

+ EmbeddingModel string

+ EmbeddingProvider string

Jun 24, 2026

Changes in this version

+ type CodeModeConfig struct

+ Enabled bool

+ ParallelMaxConcurrency int

+ StepLimit int64

+ ToolCallTimeout Duration

+ func (in *CodeModeConfig) DeepCopy() *CodeModeConfig

+ func (in *CodeModeConfig) DeepCopyInto(out *CodeModeConfig)

type Config

+ CodeMode *CodeModeConfig

Jun 23, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 16, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ PassthroughHeaders []string

Jun 10, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 10, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 4, 2026 GO-2026-6002

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jun 3, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 22, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type AuthzConfig

+ EntitiesJSON string

+ GroupClaimName string

+ GroupEntityType string

+ RoleClaimName string

May 21, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 20, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 19, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ RateLimiting *ratelimittypes.RateLimitConfig

May 12, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 11, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

May 7, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 30, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 29, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 28, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 23, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 22, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 21, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 21, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 21, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 16, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 14, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 13, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 10, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Apr 9, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type StaticBackendConfig

+ CABundlePath string

+ Type string

Apr 8, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ func InjectSubjectProviderNames(cfg *Config, rc *authserver.RunConfig)

Apr 3, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type AuthzConfig

+ PrimaryUpstreamProvider string

type OIDCConfig

+ IntrospectionURL string

+ JWKSURL string

Mar 30, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 30, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 27, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ SessionStorage *SessionStorageConfig

+ type SessionStorageConfig struct

+ Address string

+ DB int32

+ KeyPrefix string

+ Provider string

+ func (in *SessionStorageConfig) DeepCopy() *SessionStorageConfig

+ func (in *SessionStorageConfig) DeepCopyInto(out *SessionStorageConfig)

Mar 26, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const MaxForEachIterations

+ const RedisPasswordEnvVar

+ const WorkflowStepTypeForEach

+ func ValidateAuthServerIntegration(cfg *Config, rc *authserver.RunConfig) error

+ func ValidateForEachStep(pathPrefix string, index int, step *WorkflowStepConfig) error

type OIDCConfig

+ JwksAllowPrivateIP bool

type WorkflowStepConfig

+ Collection string

+ InnerStep *WorkflowStepConfig

+ ItemVar string

+ MaxIterations int

+ MaxParallel int

Mar 24, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ type ToolAnnotationsOverride struct

+ DestructiveHint *bool

+ IdempotentHint *bool

+ OpenWorldHint *bool

+ ReadOnlyHint *bool

+ Title *string

+ func (in *ToolAnnotationsOverride) DeepCopy() *ToolAnnotationsOverride

+ func (in *ToolAnnotationsOverride) DeepCopyInto(out *ToolAnnotationsOverride)

type ToolOverride

+ Annotations *ToolAnnotationsOverride

Mar 19, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 19, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 17, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 13, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 13, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 12, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 9, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 6, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 4, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type OperationalConfig

+ SessionManagementV2 bool

Mar 2, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Mar 2, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type OptimizerConfig

+ EmbeddingServiceTimeout Duration

+ HybridSearchSemanticRatio string

+ MaxToolsToReturn int

+ SemanticDistanceThreshold string

Feb 18, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Feb 16, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Feb 9, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Feb 6, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type FailureHandlingConfig

+ HealthCheckTimeout Duration

Feb 4, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Feb 2, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jan 29, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type FailureHandlingConfig

+ StatusReportingInterval Duration

Jan 27, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jan 27, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jan 22, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const TransportSSE

+ const TransportStreamableHTTP

+ var StaticModeAllowedTransports = []string

type Config

+ Backends []StaticBackendConfig

+ Optimizer *OptimizerConfig

+ type OptimizerConfig struct

+ EmbeddingService string

+ func (in *OptimizerConfig) DeepCopy() *OptimizerConfig

+ func (in *OptimizerConfig) DeepCopyInto(out *OptimizerConfig)

+ type StaticBackendConfig struct

+ Metadata map[string]string

+ Name string

+ Transport string

+ URL string

+ func (in *StaticBackendConfig) DeepCopy() *StaticBackendConfig

+ func (in *StaticBackendConfig) DeepCopyInto(out *StaticBackendConfig)

Jan 19, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jan 15, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Jan 15, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const ElicitationResponseActionAbort

+ const ElicitationResponseActionContinue

+ const ElicitationResponseActionSkipRemaining

+ const ErrorActionAbort

+ const ErrorActionContinue

+ const ErrorActionRetry

+ const WorkflowStepTypeElicitation

+ const WorkflowStepTypeToolCall

+ func IsValidToolReference(tool string) bool

+ func ValidateCompositeToolConfig(pathPrefix string, tool *CompositeToolConfig) error

+ func ValidateDefaultResultsForSteps(pathPrefix string, steps []WorkflowStepConfig, output *OutputConfig) error

+ func ValidateDependencyCycles(pathPrefix string, steps []WorkflowStepConfig) error

+ func ValidateElicitationResponseHandler(pathPrefix string, index int, handlerName string, ...) error

+ func ValidateJSONSchema(schemaBytes []byte) error

+ func ValidateParameters(pathPrefix string, params thvjson.Map) error

+ func ValidateStepDependencies(pathPrefix string, index int, step *WorkflowStepConfig, ...) error

+ func ValidateStepErrorHandling(pathPrefix string, index int, onError *StepErrorHandling) error

+ func ValidateStepTemplates(pathPrefix string, index int, step *WorkflowStepConfig) error

+ func ValidateStepType(pathPrefix string, index int, step *WorkflowStepConfig) error

+ func ValidateTemplate(tmpl string) error

+ func ValidateWorkflowStep(pathPrefix string, index int, step *WorkflowStepConfig, ...) error

+ func ValidateWorkflowSteps(pathPrefix string, steps []WorkflowStepConfig) error

+ type CompositeToolRef struct

+ Name string

+ func (in *CompositeToolRef) DeepCopy() *CompositeToolRef

+ func (in *CompositeToolRef) DeepCopyInto(out *CompositeToolRef)

type Config

+ CompositeToolRefs []CompositeToolRef

type OperationalConfig

+ LogLevel string

+ type ToolConfigRef struct

+ Name string

+ func (in *ToolConfigRef) DeepCopy() *ToolConfigRef

+ func (in *ToolConfigRef) DeepCopyInto(out *ToolConfigRef)

type WorkloadToolConfig

+ ToolConfigRef *ToolConfigRef

Jan 8, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const IncomingAuthTypeAnonymous

+ const IncomingAuthTypeLocal

+ const IncomingAuthTypeOIDC

type AggregationConfig

+ func (in *AggregationConfig) DeepCopy() *AggregationConfig

+ func (in *AggregationConfig) DeepCopyInto(out *AggregationConfig)

type AuthzConfig

+ func (in *AuthzConfig) DeepCopy() *AuthzConfig

+ func (in *AuthzConfig) DeepCopyInto(out *AuthzConfig)

type CircuitBreakerConfig

+ func (in *CircuitBreakerConfig) DeepCopy() *CircuitBreakerConfig

+ func (in *CircuitBreakerConfig) DeepCopyInto(out *CircuitBreakerConfig)

type CompositeToolConfig

+ func (in *CompositeToolConfig) DeepCopy() *CompositeToolConfig

+ func (in *CompositeToolConfig) DeepCopyInto(out *CompositeToolConfig)

type Config

+ func (in *Config) DeepCopy() *Config

+ func (in *Config) DeepCopyInto(out *Config)

type ConflictResolutionConfig

+ func (in *ConflictResolutionConfig) DeepCopy() *ConflictResolutionConfig

+ func (in *ConflictResolutionConfig) DeepCopyInto(out *ConflictResolutionConfig)

type ElicitationResponseConfig

+ func (in *ElicitationResponseConfig) DeepCopy() *ElicitationResponseConfig

+ func (in *ElicitationResponseConfig) DeepCopyInto(out *ElicitationResponseConfig)

type FailureHandlingConfig

+ func (in *FailureHandlingConfig) DeepCopy() *FailureHandlingConfig

+ func (in *FailureHandlingConfig) DeepCopyInto(out *FailureHandlingConfig)

type IncomingAuthConfig

+ func (in *IncomingAuthConfig) DeepCopy() *IncomingAuthConfig

+ func (in *IncomingAuthConfig) DeepCopyInto(out *IncomingAuthConfig)

type OIDCConfig

+ func (in *OIDCConfig) DeepCopy() *OIDCConfig

+ func (in *OIDCConfig) DeepCopyInto(out *OIDCConfig)

type OperationalConfig

+ func (in *OperationalConfig) DeepCopy() *OperationalConfig

+ func (in *OperationalConfig) DeepCopyInto(out *OperationalConfig)

type OutgoingAuthConfig

+ func (in *OutgoingAuthConfig) DeepCopy() *OutgoingAuthConfig

+ func (in *OutgoingAuthConfig) DeepCopyInto(out *OutgoingAuthConfig)

type OutputConfig

+ func (in *OutputConfig) DeepCopy() *OutputConfig

+ func (in *OutputConfig) DeepCopyInto(out *OutputConfig)

type OutputProperty

+ func (in *OutputProperty) DeepCopy() *OutputProperty

+ func (in *OutputProperty) DeepCopyInto(out *OutputProperty)

type StepErrorHandling

+ func (in *StepErrorHandling) DeepCopy() *StepErrorHandling

+ func (in *StepErrorHandling) DeepCopyInto(out *StepErrorHandling)

type TimeoutConfig

+ func (in *TimeoutConfig) DeepCopy() *TimeoutConfig

+ func (in *TimeoutConfig) DeepCopyInto(out *TimeoutConfig)

type ToolOverride

+ func (in *ToolOverride) DeepCopy() *ToolOverride

+ func (in *ToolOverride) DeepCopyInto(out *ToolOverride)

type WorkflowStepConfig

+ func (in *WorkflowStepConfig) DeepCopy() *WorkflowStepConfig

+ func (in *WorkflowStepConfig) DeepCopyInto(out *WorkflowStepConfig)

type WorkloadToolConfig

+ func (in *WorkloadToolConfig) DeepCopy() *WorkloadToolConfig

+ func (in *WorkloadToolConfig) DeepCopyInto(out *WorkloadToolConfig)

Jan 2, 2026 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Dec 17, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Dec 17, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Dec 15, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type WorkflowStepConfig

+ DefaultResults map[string]any

Dec 12, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ Audit *audit.Config

+ Telemetry *telemetry.Config

Dec 3, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Dec 2, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ func (c *Config) EnsureOperationalDefaults()

type OperationalConfig

+ func DefaultOperationalConfig() *OperationalConfig

Nov 28, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type AggregationConfig

+ ExcludeAllTools bool

type WorkloadToolConfig

+ ExcludeAll bool

Nov 27, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 25, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type CompositeToolConfig

+ Output *OutputConfig

type OIDCConfig

+ InsecureAllowHTTP bool

+ ProtectedResourceAllowPrivateIP bool

+ type OutputConfig struct

+ Properties map[string]OutputProperty

+ Required []string

+ type OutputProperty struct

+ Default any

+ Description string

+ Properties map[string]OutputProperty

+ Type string

+ Value string

Nov 19, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 13, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 13, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 13, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 10, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 10, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Nov 10, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type Config

+ Group string

+ type Duration time.Duration

+ func (d *Duration) UnmarshalJSON(data []byte) error

+ func (d *Duration) UnmarshalYAML(unmarshal func(interface{}) error) error

+ func (d Duration) MarshalJSON() ([]byte, error)

+ func (d Duration) MarshalYAML() (interface{}, error)

type OIDCConfig

+ ClientSecretEnv string

type OutgoingAuthConfig

+ func (c *OutgoingAuthConfig) ResolveForBackend(backendID string) (string, map[string]any)

Nov 3, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

type OIDCConfig

+ Resource string

Oct 30, 2025 GO-2026-5996 +1 more

  GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

  GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

Changes in this version

+ const CacheProviderMemory

+ const CacheProviderRedis

+ type AggregationConfig struct

+ ConflictResolution vmcp.ConflictResolutionStrategy

+ ConflictResolutionConfig *ConflictResolutionConfig

+ Tools []*WorkloadToolConfig

+ type AuthzConfig struct

+ Policies []string

+ Type string

+ type BackendAuthStrategy struct

+ Metadata map[string]any

+ Type string

+ type CircuitBreakerConfig struct

+ Enabled bool

+ FailureThreshold int

+ Timeout time.Duration

+ type CompositeToolConfig struct

+ Description string

+ Name string

+ Parameters map[string]ParameterSchema

+ Steps []*WorkflowStepConfig

+ Timeout time.Duration

+ type Config struct

+ Aggregation *AggregationConfig

+ CompositeTools []*CompositeToolConfig

+ GroupRef string

+ IncomingAuth *IncomingAuthConfig

+ Metadata map[string]string

+ Name string

+ Operational *OperationalConfig

+ OutgoingAuth *OutgoingAuthConfig

+ TokenCache *TokenCacheConfig

+ type ConflictResolutionConfig struct

+ PrefixFormat string

+ PriorityOrder []string

+ type DefaultValidator struct

+ func NewValidator() *DefaultValidator

+ func (v *DefaultValidator) Validate(cfg *Config) error

+ type ElicitationResponseConfig struct

+ Action string

+ type FailureHandlingConfig struct

+ CircuitBreaker *CircuitBreakerConfig

+ HealthCheckInterval time.Duration

+ PartialFailureMode string

+ UnhealthyThreshold int

+ type IncomingAuthConfig struct

+ Authz *AuthzConfig

+ OIDC *OIDCConfig

+ Type string

+ type Loader interface

+ Load func() (*Config, error)

+ type MemoryCacheConfig struct

+ MaxEntries int

+ TTLOffset time.Duration

+ type OIDCConfig struct

+ Audience string

+ ClientID string

+ ClientSecret string

+ Issuer string

+ Scopes []string

+ type OperationalConfig struct

+ FailureHandling *FailureHandlingConfig

+ Timeouts *TimeoutConfig

+ type OutgoingAuthConfig struct

+ Backends map[string]*BackendAuthStrategy

+ Default *BackendAuthStrategy

+ Source string

+ type ParameterSchema struct

+ Default any

+ Type string

+ type RedisCacheConfig struct

+ Address string

+ DB int

+ KeyPrefix string

+ Password string

+ TTLOffset time.Duration

+ type StepErrorHandling struct

+ Action string

+ RetryCount int

+ RetryDelay time.Duration

+ type TimeoutConfig struct

+ Default time.Duration

+ PerWorkload map[string]time.Duration

+ type TokenCacheConfig struct

+ Memory *MemoryCacheConfig

+ Provider string

+ Redis *RedisCacheConfig

+ type ToolOverride struct

+ Description string

+ Name string

+ type Validator interface

+ Validate func(cfg *Config) error

+ type WorkflowStepConfig struct

+ Arguments map[string]any

+ Condition string

+ DependsOn []string

+ ID string

+ Message string

+ OnCancel *ElicitationResponseConfig

+ OnDecline *ElicitationResponseConfig

+ OnError *StepErrorHandling

+ Schema map[string]any

+ Timeout time.Duration

+ Tool string

+ Type string

+ type WorkloadToolConfig struct

+ Filter []string

+ Overrides map[string]*ToolOverride

+ Workload string

+ type YAMLLoader struct

+ func NewYAMLLoader(filePath string) *YAMLLoader

+ func (l *YAMLLoader) Load() (*Config, error)