Issues

• Failed workload setup leaves its network and DNS container behind

  bugneeds-triage
  stacklok/toolhive#7045 · Filter by author tgrunnagle opened on Nov 3, 2026

• Removing a starting or updating workload leaks its Docker network

  needs-triage
  stacklok/toolhive#7043 · Filter by author tgrunnagle opened on Nov 3, 2026

• Authorization server: require the issuer as the only aud of a private_key_jwt client assertion

  needs-triage
  stacklok/toolhive#7039 · Filter by author jhrozek opened on Nov 3, 2026

• Add real-client integration tests for mcpcompat protocol-status handling

  stacklok/toolhive#7034 · Filter by author jhrozek opened on Nov 3, 2026

• Adopt mcpcompat MetaKeyServerInfo and remove modernServerInfoKey

  stacklok/toolhive#7033 · Filter by author jhrozek opened on Nov 3, 2026
  1

• Authorization server: reason codes in error_description for ID-JAG redemption refusals

  stacklok/toolhive#7030 · Filter by author ChrisJBurns opened on Nov 3, 2026
  

• Return invalid_target when token exchange refuses an audience parameter

  needs-triage
  stacklok/toolhive#7027 · Filter by author jhrozek opened on Nov 2, 2026

• vMCP: render -32042 on Legacy sessions that declared URL-mode elicitation

  enhancementneeds-triagesize/Svmcp
  stacklok/toolhive#7023 · Filter by author tgrunnagle opened on Nov 2, 2026

• vMCP drops the instructions of backend servers

  stacklok/toolhive#7020 · Filter by author Viphava280444 opened on Nov 2, 2026
  2

  

• Follow-ups from the exchange refresh token review

  needs-triage
  stacklok/toolhive#7011 · Filter by author jhrozek opened on Oct 30, 2026

• vMCP multi-upstream auth: scope refresh failures per provider, let headless callers reach xaa backends

  needs-triage
  stacklok/toolhive#7009 · Filter by author aron-muon opened on Oct 30, 2026

• Support CIMD for embedded auth server upstream registration

  kubernetes
  stacklok/toolhive#6997 · Filter by author danbarr opened on Oct 29, 2026
  2

  

• Reconsider public-client redemption of ID-JAG assertions in the embedded AS

  authenticationenhancementneeds-triageoauth
  stacklok/toolhive#6984 · Filter by author jhrozek opened on Oct 28, 2026

• ID-JAG grant ignores the assertion's resource claim and requires a form resource

  authenticationbugneeds-triageoauth
  stacklok/toolhive#6983 · Filter by author jhrozek opened on Oct 28, 2026

• Device-code tokens carry every client audience and ignore client audience limits

  authenticationbugneeds-triageoauth
  stacklok/toolhive#6982 · Filter by author jhrozek opened on Oct 28, 2026
  1

• Test that one upstream identity never maps to two authorization-server users

  needs-triage
  stacklok/toolhive#6980 · Filter by author jhrozek opened on Oct 28, 2026

• Record the operation and attempt IDs a client reports, at the authorization server and the vMCP

  needs-triage
  stacklok/toolhive#6979 · Filter by author jhrozek opened on Oct 28, 2026

• Re-check the user's upstream refresh token when issuing an ID-JAG

  needs-triage
  stacklok/toolhive#6978 · Filter by author jhrozek opened on Oct 28, 2026

• Kubernetes stdio MCPServer: proxy and backend pod lifecycles are decoupled, so a restart of either breaks the initialize handshake

  bugneeds-triage
  stacklok/toolhive#6974 · Filter by author reefland opened on Oct 28, 2026

• Revoke the grant a reused subject token created

  needs-triage
  stacklok/toolhive#6973 · Filter by author jhrozek opened on Oct 28, 2026

• Per-user revocation time for grants issued by token exchange

  needs-triage
  stacklok/toolhive#6972 · Filter by author jhrozek opened on Oct 28, 2026
  1

• vMCP: answer a tools/call with an MCP URL-mode elicitation

  enhancementneeds-triagevmcp
  stacklok/toolhive#6970 · Filter by author tgrunnagle opened on Oct 28, 2026

• Document the profile for refresh tokens issued by token exchange

  needs-triage
  stacklok/toolhive#6967 · Filter by author jhrozek opened on Oct 27, 2026

• RFC 7009 token revocation endpoint

  needs-triage
  stacklok/toolhive#6966 · Filter by author jhrozek opened on Oct 27, 2026

• Authorization server: allow clock skew on private_key_jwt client assertions

  needs-triage
  stacklok/toolhive#6954 · Filter by author jhrozek opened on Oct 27, 2026