cyber.hendryadrian.com
Security Insights · helpnetsecurity.com

ToolHive Isolates MCP Servers and Adds Policy and Provenance Controls

· Original article ↗

Summary

ToolHive runs MCP servers in isolated containers and offers policy controls, provenance checks, and gateway features. Identity enforcement and audit logging require integration with an identity provider; its browser-based cloud UI is retired.

Key points

  • ToolHive runs MCP servers in separate containers locally or through a Kubernetes operator.
  • The runtime supports permissions, network filtering, and secrets management; servers can also be containerized from package managers.
  • Identity and access policies and audit logs depend on connecting an authentication source.
  • The Registry Server curates approved servers, signs them, and verifies provenance.
  • The Gateway can consolidate backends behind one endpoint and supports OIDC or OAuth single sign-on, OpenTelemetry traces, and Prometheus metrics.
  • The browser-based cloud UI is retired; the article recommends the desktop app and CLI.
  • ToolHive is available for self-hosting under Apache 2.0.

Article Details

Topic
ToolHive, an open-source platform for running Model Context Protocol servers in isolated containers with access controls, provenance verification, and governance features.

Vendors

StacklokToolHive is an open-source platform from Stacklok that runs Model Context Protocol servers in containers, adding isolation, policy controls, and provenance checks for AI tool access.

Products

ToolHiveToolHive is an open-source platform from Stacklok that runs Model Context Protocol servers in containers, adding isolation, policy controls, and provenance checks for AI tool access.