From d5cc87e5f7b2af79ad5162d595ecdc42b4378ee3 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 10 Jun 2026 21:26:46 +0000 Subject: [PATCH 1/4] Update stacklok/toolhive to v0.29.3 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/upstream-projects.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/upstream-projects.yaml b/.github/upstream-projects.yaml index 34e27839..045cc86f 100644 --- a/.github/upstream-projects.yaml +++ b/.github/upstream-projects.yaml @@ -35,7 +35,7 @@ projects: - id: toolhive repo: stacklok/toolhive - version: v0.29.1 + version: v0.29.3 # toolhive is a monorepo covering the CLI, the Kubernetes # operator, and the vMCP gateway. It also introduces cross- # cutting features that land in concepts/, integrations/, From d9025d28e04991da9f556669a585a37382a871f3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 10 Jun 2026 21:27:37 +0000 Subject: [PATCH 2/4] Refresh reference assets for toolhive v0.29.3 --- static/api-specs/crds/index.json | 2 +- static/api-specs/crds/mcpexternalauthconfigs.schema.json | 2 +- static/api-specs/crds/mcpregistries.schema.json | 2 +- static/api-specs/crds/mcpremoteproxies.schema.json | 2 +- static/api-specs/crds/mcpservers.schema.json | 2 +- static/api-specs/crds/virtualmcpservers.schema.json | 2 +- static/api-specs/publisher-provided.schema.json | 5 +++++ static/api-specs/toolhive-api.yaml | 6 ++++++ 8 files changed, 17 insertions(+), 6 deletions(-) diff --git a/static/api-specs/crds/index.json b/static/api-specs/crds/index.json index c1cb578f..60e5ca1f 100644 --- a/static/api-specs/crds/index.json +++ b/static/api-specs/crds/index.json @@ -148,7 +148,7 @@ "registry" ], "scope": "Namespaced", - "description": "MCPRegistry is the Schema for the mcpregistries API", + "description": "MCPRegistry is the Schema for the mcpregistries API.\n\nThe MCPRegistry CRD is deprecated and will be removed in a future release.\nInstall the ToolHive registry server via the toolhive-registry-server Helm chart\ninstead: https://github.com/stacklok/toolhive-registry-server", "references": [], "referencedBy": [], "slug": "mcpregistry" diff --git a/static/api-specs/crds/mcpexternalauthconfigs.schema.json b/static/api-specs/crds/mcpexternalauthconfigs.schema.json index e9179049..accdd057 100644 --- a/static/api-specs/crds/mcpexternalauthconfigs.schema.json +++ b/static/api-specs/crds/mcpexternalauthconfigs.schema.json @@ -376,7 +376,7 @@ "type": "object" }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", diff --git a/static/api-specs/crds/mcpregistries.schema.json b/static/api-specs/crds/mcpregistries.schema.json index 0b464697..0e40e6ad 100644 --- a/static/api-specs/crds/mcpregistries.schema.json +++ b/static/api-specs/crds/mcpregistries.schema.json @@ -1,7 +1,7 @@ { "$schema": "http://json-schema.org/draft-07/schema#", "title": "MCPRegistry", - "description": "MCPRegistry is the Schema for the mcpregistries API", + "description": "MCPRegistry is the Schema for the mcpregistries API.\n\nThe MCPRegistry CRD is deprecated and will be removed in a future release.\nInstall the ToolHive registry server via the toolhive-registry-server Helm chart\ninstead: https://github.com/stacklok/toolhive-registry-server", "x-kubernetes-group": "toolhive.stacklok.dev", "x-kubernetes-kind": "MCPRegistry", "x-kubernetes-version": "v1beta1", diff --git a/static/api-specs/crds/mcpremoteproxies.schema.json b/static/api-specs/crds/mcpremoteproxies.schema.json index f9fc0c53..a1ad6ac3 100644 --- a/static/api-specs/crds/mcpremoteproxies.schema.json +++ b/static/api-specs/crds/mcpremoteproxies.schema.json @@ -228,7 +228,7 @@ "type": "object" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPRemoteProxy.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the remote MCP server under a synthetic local-user identity, with no\ntoken or credential check. Set this field to enforce identity-based access control\nper request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/static/api-specs/crds/mcpservers.schema.json b/static/api-specs/crds/mcpservers.schema.json index 61ef8899..a0fe1a42 100644 --- a/static/api-specs/crds/mcpservers.schema.json +++ b/static/api-specs/crds/mcpservers.schema.json @@ -224,7 +224,7 @@ "type": "integer" }, "oidcConfigRef": { - "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.", + "description": "OIDCConfigRef references a shared MCPOIDCConfig resource for OIDC authentication.\nThe referenced MCPOIDCConfig must exist in the same namespace as this MCPServer.\nPer-server overrides (audience, scopes) are specified here; shared provider config\nlives in the MCPOIDCConfig resource.\n\nSECURITY: if this field is omitted and no other authentication source is configured,\nthe proxy runs UNAUTHENTICATED. It accepts every request that can reach its port and\nforwards it to the MCP server under a synthetic local-user identity, with no token or\ncredential check. Set this field to enforce identity-based access control per request.", "properties": { "audience": { "description": "Audience is the expected audience for token validation.\nThis MUST be unique per server to prevent token replay attacks.", diff --git a/static/api-specs/crds/virtualmcpservers.schema.json b/static/api-specs/crds/virtualmcpservers.schema.json index 8a70f97f..dcd537c0 100644 --- a/static/api-specs/crds/virtualmcpservers.schema.json +++ b/static/api-specs/crds/virtualmcpservers.schema.json @@ -267,7 +267,7 @@ "type": "object" }, "tls": { - "description": "TLS configures TLS for connections to the Redis/Valkey master.\nPresence of this field enables TLS. Omit to use plaintext.", + "description": "TLS configures TLS for connections to the Redis/Valkey master or cluster nodes.\nPresence of this field enables TLS. Omit to use plaintext.", "properties": { "caCertSecretRef": { "description": "CACertSecretRef references a Secret containing a PEM-encoded CA certificate\nfor verifying the server. When not specified, system root CAs are used.", diff --git a/static/api-specs/publisher-provided.schema.json b/static/api-specs/publisher-provided.schema.json index 1e99dd3e..f3748447 100644 --- a/static/api-specs/publisher-provided.schema.json +++ b/static/api-specs/publisher-provided.schema.json @@ -105,6 +105,11 @@ "minimum": 1, "maximum": 65535 }, + "stateless": { + "type": "boolean", + "description": "Whether the server only supports POST requests (no SSE/GET).", + "default": false + }, "oauth_config": { "description": "OAuth/OIDC configuration for remote servers", "$ref": "#/$defs/oauth_config" diff --git a/static/api-specs/toolhive-api.yaml b/static/api-specs/toolhive-api.yaml index e0b26c2f..771abb7b 100644 --- a/static/api-specs/toolhive-api.yaml +++ b/static/api-specs/toolhive-api.yaml @@ -3321,6 +3321,9 @@ components: description: RepositoryURL is the URL to the source code repository for the server type: string + stateless: + description: Stateless indicates the server only supports POST (no SSE/GET) + type: boolean status: description: Status indicates whether the server is currently active or deprecated @@ -3525,6 +3528,9 @@ components: description: RepositoryURL is the URL to the source code repository for the server type: string + stateless: + description: Stateless indicates the server only supports POST (no SSE/GET) + type: boolean status: description: Status indicates whether the server is currently active or deprecated From f43ede53f14208e1ce24f166e29ded0b8871475e Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 10 Jun 2026 21:38:08 +0000 Subject: [PATCH 3/4] Flag MCPRegistry CRD deprecation in v0.29.2 docs Surface the MCPRegistry CRD deprecation (stacklok/toolhive#5470) in: - Registry Server quickstart, steering new long-lived deployments to the toolhive-registry-server Helm chart - MCPRegistry CRD reference intro and landing-page summary - Operator deploy guide's crds.install.registry row The unauthenticated-proxy SECURITY note (stacklok/toolhive#5488) and the Redis Cluster TLS description tweak surface automatically via the regenerated CRD schemas; no hand-edit needed. Co-Authored-By: Claude Opus 4.7 --- docs/toolhive/guides-k8s/deploy-operator.mdx | 2 +- docs/toolhive/guides-registry/quickstart.mdx | 11 +++++++++++ docs/toolhive/reference/crds/index.mdx | 2 +- docs/toolhive/reference/crds/mcpregistry.mdx | 6 ++++++ scripts/lib/crd-intros.mjs | 4 ++-- 5 files changed, 21 insertions(+), 4 deletions(-) diff --git a/docs/toolhive/guides-k8s/deploy-operator.mdx b/docs/toolhive/guides-k8s/deploy-operator.mdx index c0edd104..74ab1570 100644 --- a/docs/toolhive/guides-k8s/deploy-operator.mdx +++ b/docs/toolhive/guides-k8s/deploy-operator.mdx @@ -72,7 +72,7 @@ groups using these values: | Value | Description | Default | | ------------------------- | ----------------------------------------------------- | ------- | | `crds.install.server` | Install server CRDs (MCPServer, MCPRemoteProxy, etc.) | `true` | -| `crds.install.registry` | Install registry CRDs (MCPRegistry) | `true` | +| `crds.install.registry` | Install registry CRDs (MCPRegistry, deprecated) | `true` | | `crds.install.virtualMcp` | Install vMCP CRDs (VirtualMCPServer, etc.) | `true` | | `crds.keep` | Preserve CRDs when uninstalling the chart | `true` | diff --git a/docs/toolhive/guides-registry/quickstart.mdx b/docs/toolhive/guides-registry/quickstart.mdx index 5c9f5878..0c8fee9a 100644 --- a/docs/toolhive/guides-registry/quickstart.mdx +++ b/docs/toolhive/guides-registry/quickstart.mdx @@ -16,6 +16,17 @@ This quickstart covers the standalone Registry Server that you host and curate yourself. If you're looking for the built-in catalog that ships with the ToolHive CLI and UI, see the [Introduction](./intro.mdx) for a comparison. +:::warning[MCPRegistry CRD is deprecated] + +This quickstart uses the `MCPRegistry` CRD, which is deprecated and will be +removed in a future release. The CRD remains fully functional and is the fastest +path to a running Registry Server for experimentation. For new long-lived +deployments, use the [toolhive-registry-server Helm chart](./deploy-helm.mdx) +instead. See [Deployment options](./deployment.mdx) for a comparison of the +available methods. + +::: + ## What you'll learn - How to install the ToolHive Operator, which bundles the `MCPRegistry` CRD diff --git a/docs/toolhive/reference/crds/index.mdx b/docs/toolhive/reference/crds/index.mdx index a583d676..5043c033 100644 --- a/docs/toolhive/reference/crds/index.mdx +++ b/docs/toolhive/reference/crds/index.mdx @@ -57,7 +57,7 @@ references. type: 'link', href: '/toolhive/reference/crds/mcpregistry', label: 'MCPRegistry', - description: 'Deploy a ToolHive Registry Server.', + description: 'Deploy a ToolHive Registry Server (deprecated).', }} /> diff --git a/docs/toolhive/reference/crds/mcpregistry.mdx b/docs/toolhive/reference/crds/mcpregistry.mdx index 65d494ed..06867de2 100644 --- a/docs/toolhive/reference/crds/mcpregistry.mdx +++ b/docs/toolhive/reference/crds/mcpregistry.mdx @@ -8,6 +8,12 @@ toc_max_heading_level: 4 `MCPRegistry` deploys a [ToolHive Registry Server](../../guides-registry/intro.mdx) in the cluster. The operator watches `MCPRegistry` resources and provisions the Registry Server, its PostgreSQL backing, and the configured sources (Git, ConfigMap, URL, or Kubernetes discovery) that populate its catalog of MCP server definitions. +:::warning[Deprecated] + +The `MCPRegistry` CRD is deprecated and will be removed in a future release. The CRD remains fully functional, but `kubectl` now prints a deprecation warning on apply or get and the operator emits a `Warning` event recommending the [`toolhive-registry-server` Helm chart](https://github.com/stacklok/toolhive-registry-server). For new deployments, see [Deploy with Helm](../../guides-registry/deploy-helm.mdx). + +::: + **API:** `toolhive.stacklok.dev/v1beta1` · **Scope:** Namespaced · **Short names:** `mcpreg`, `registry` diff --git a/scripts/lib/crd-intros.mjs b/scripts/lib/crd-intros.mjs index be13306d..23e34f47 100644 --- a/scripts/lib/crd-intros.mjs +++ b/scripts/lib/crd-intros.mjs @@ -82,11 +82,11 @@ export const intros = { MCPRegistry: { slug: 'mcpregistry', group: 'core', - summary: 'Deploy a ToolHive Registry Server.', + summary: 'Deploy a ToolHive Registry Server (deprecated).', description: 'Schema reference for MCPRegistry, which declares a ToolHive Registry Server deployment managed by the operator.', intro: - '`MCPRegistry` deploys a [ToolHive Registry Server](../../guides-registry/intro.mdx) in the cluster. The operator watches `MCPRegistry` resources and provisions the Registry Server, its PostgreSQL backing, and the configured sources (Git, ConfigMap, URL, or Kubernetes discovery) that populate its catalog of MCP server definitions.', + '`MCPRegistry` deploys a [ToolHive Registry Server](../../guides-registry/intro.mdx) in the cluster. The operator watches `MCPRegistry` resources and provisions the Registry Server, its PostgreSQL backing, and the configured sources (Git, ConfigMap, URL, or Kubernetes discovery) that populate its catalog of MCP server definitions.\n\n:::warning[Deprecated]\n\nThe `MCPRegistry` CRD is deprecated and will be removed in a future release. The CRD remains fully functional, but `kubectl` now prints a deprecation warning on apply or get and the operator emits a `Warning` event recommending the [`toolhive-registry-server` Helm chart](https://github.com/stacklok/toolhive-registry-server). For new deployments, see [Deploy with Helm](../../guides-registry/deploy-helm.mdx).\n\n:::', }, // Shared configuration - grouping, then auth, then observability/behavior, From 261ba599fc43a883a0dec2bbf380cf907ce96b1f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 10 Jun 2026 21:41:54 +0000 Subject: [PATCH 4/4] Match link title in MCPRegistry deprecation note --- docs/toolhive/guides-registry/quickstart.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/toolhive/guides-registry/quickstart.mdx b/docs/toolhive/guides-registry/quickstart.mdx index 0c8fee9a..e89736d9 100644 --- a/docs/toolhive/guides-registry/quickstart.mdx +++ b/docs/toolhive/guides-registry/quickstart.mdx @@ -22,8 +22,8 @@ This quickstart uses the `MCPRegistry` CRD, which is deprecated and will be removed in a future release. The CRD remains fully functional and is the fastest path to a running Registry Server for experimentation. For new long-lived deployments, use the [toolhive-registry-server Helm chart](./deploy-helm.mdx) -instead. See [Deployment options](./deployment.mdx) for a comparison of the -available methods. +instead. See [Deploy the Registry Server](./deployment.mdx) for a comparison of +the deployment methods. :::