Issues

• vMCP: memory grows by several MB per session and is not released after DELETE or session TTL expiry (OOMKilled under session churn)

  needs-triage
  stacklok/toolhive#6932 · Filter by author nilsberberich opened on Oct 23, 2026

• Expose the upstream refresh guard opt-out in RunConfig and CRDs

  needs-triage
  stacklok/toolhive#6931 · Filter by author tgrunnagle opened on Oct 23, 2026

• Auth server CA bundle reference change does not roll MCPServer/MCPRemoteProxy pods

  kubernetesneeds-triage
  stacklok/toolhive#6928 · Filter by author jhrozek opened on Oct 23, 2026

• VirtualMCPServer rolls out when backend workload status changes

  bugkubernetesneeds-triage
  stacklok/toolhive#6927 · Filter by author danbarr opened on Oct 23, 2026

• tools/list is not filtered on the SSE transport

  stacklok/toolhive#6926 · Filter by author rkb32 opened on Oct 22, 2026
  2

  

• Filter vMCP tools/list with tool:read, as the single-server path does

  stacklok/toolhive#6925 · Filter by author rkb32 opened on Oct 22, 2026
  1

• Add a read_tool action so Cedar can grant tools/list visibility without invocation

  stacklok/toolhive#6924 · Filter by author rkb32 opened on Oct 22, 2026
  1

• Show a display name for upstreams on the embedded auth server consent page

  authenticationenhancementsize/S
  Task 📋

  stacklok/toolhive#6922 · Filter by author tgrunnagle opened on Oct 22, 2026
  1

  

• Advertise authorization_details types in metadata and DCR

  needs-triage
  stacklok/toolhive#6915 · Filter by author jhrozek opened on Oct 22, 2026

• Accept authorization_details at the authorization endpoint

  needs-triage
  stacklok/toolhive#6914 · Filter by author jhrozek opened on Oct 22, 2026

• Persist granted authorization_details and carry them through refresh

  needs-triage
  stacklok/toolhive#6913 · Filter by author jhrozek opened on Oct 22, 2026

• Narrow authorization_details on token exchange and refresh

  needs-triage
  stacklok/toolhive#6912 · Filter by author jhrozek opened on Oct 22, 2026

• Let Cedar policies use authorization_details

  needs-triage
  stacklok/toolhive#6911 · Filter by author jhrozek opened on Oct 22, 2026

• Convey granted authorization_details to resource servers

  needs-triage
  stacklok/toolhive#6910 · Filter by author jhrozek opened on Oct 22, 2026

• General RFC 9396 support in the authorization server

  needs-triage
  stacklok/toolhive#6909 · Filter by author jhrozek opened on Oct 22, 2026

• Editing a SPIFFE client association on Redis storage leaves the new pod never ready

  needs-triage
  stacklok/toolhive#6907 · Filter by author jhrozek opened on Oct 22, 2026

• authserver: let embedders validate refresh-token grants, and type upstream refresh rejections

  stacklok/toolhive#6901 · Filter by author tgrunnagle opened on Oct 21, 2026
  1

  

• Pluggable actor-token validation at ID-JAG issuance

  needs-triage
  stacklok/toolhive#6899 · Filter by author jhrozek opened on Oct 21, 2026

• ID-JAG issuance through token exchange

  needs-triage
  stacklok/toolhive#6898 · Filter by author jhrozek opened on Oct 21, 2026

• Session refresh tokens through token exchange

  needs-triage
  stacklok/toolhive#6897 · Filter by author jhrozek opened on Oct 21, 2026

• Schedule refresh tokens through token exchange

  needs-triage
  stacklok/toolhive#6896 · Filter by author jhrozek opened on Oct 21, 2026

• Storage for refresh tokens issued by token exchange

  needs-triage
  stacklok/toolhive#6895 · Filter by author jhrozek opened on Oct 21, 2026

• Stable pre-provisioned broker client for token exchange and ID-JAG redemption

  stacklok/toolhive#6893 · Filter by author jhrozek opened on Oct 21, 2026
  

• ID-JAG redemption: compare the requested resource with the assertion's resource claim, and decide the default when it is omitted

  needs-triage
  stacklok/toolhive#6892 · Filter by author jhrozek opened on Oct 21, 2026

• vMCP embedded auth server: support Redis Sentinel authentication (sentinel username/password)

  needs-triage
  stacklok/toolhive#6889 · Filter by author nilsberberich opened on Oct 21, 2026