Affected by GO-2026-5996
and 2 other vulnerabilities
GO-2026-5996 : ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive
GO-2026-6002 : ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive
GO-2026-6526 : ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive
Discover Packages
github.com/stacklok/toolhive
docs
server
package
Version:
v0.28.3
Opens a new window with list of versions in this module.
Published: May 22, 2026
License: Apache-2.0
Opens a new window with license information.
Imports: 1
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
README
README
¶
ToolHive uses OpenAPI 3.1.0 for API documentation. The documentation is generated using swag and served using Scalar .
Prerequisites
Install the required tools:
# Install swag for OpenAPI generation
go install github.com/swaggo/swag/v2/cmd/swag@v2.0.0-rc4
Generating Documentation
Add OpenAPI annotations to your code following the swag documentation
Generate the OpenAPI specification:
# at the root of the repository run:
swag init -g pkg/api/server.go --v3.1 -o docs/server
This will generate:
docs/swagger.json: OpenAPI 3.1.0 specification
docs/swagger.yaml: YAML version of the specification
docs/docs.go: Go code containing the specification
Viewing Documentation
Start the server with OpenAPI docs enabled:
thv serve --openapi
Access the documentation:
OpenAPI JSON spec: http://localhost:8080/api/openapi.json
Scalar UI: http://localhost:8080/api/doc
Best Practices
Always document:
Request/response schemas
Error responses
Authentication requirements
Query parameters
Path parameters
Use descriptive summaries and descriptions
Group related endpoints using tags
Keep the documentation up to date with code changes
Troubleshooting
If the documentation is not updating:
Check that your annotations are correct
Verify that you're using the correct version of swag
Make sure you're running swag init from the correct directory
Check that the generated files are being included in your build
Expand ▾
Collapse ▴
Documentation
¶
View Source
var SwaggerInfo = &swag .Spec {
Version: "1.0",
Title: "ToolHive API",
Description: "This is the ToolHive API server.",
InfoInstanceName: "swagger",
SwaggerTemplate: docTemplate,
LeftDelim: "{{",
RightDelim: "}}",
}
SwaggerInfo holds exported Swagger Info so clients can modify it
Source Files
¶
Click to show internal directories.
Click to hide internal directories.