Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/toolhive/reference/cli/thv_client_register.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ Valid clients:
- claude-code: Claude Code CLI
- cline: Cline extension for VS Code
- cursor: Cursor editor
- lm-studio: LM Studio application
- roo-code: Roo Code extension for VS Code
- vscode: Visual Studio Code
- vscode-insider: Visual Studio Code Insiders edition
Expand Down
1 change: 1 addition & 0 deletions docs/toolhive/reference/cli/thv_client_remove.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ Valid clients:
- claude-code: Claude Code CLI
- cline: Cline extension for VS Code
- cursor: Cursor editor
- lm-studio: LM Studio application
- roo-code: Roo Code extension for VS Code
- vscode: Visual Studio Code
- vscode-insider: Visual Studio Code Insiders edition
Expand Down
15 changes: 15 additions & 0 deletions docs/toolhive/reference/cli/thv_proxy.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ This command starts a standalone proxy without creating a workload, providing:
- Automatic authentication detection via WWW-Authenticate headers
- OIDC-based access control for incoming proxy requests
- Secure credential handling via files or environment variables
- Dynamic client registration (RFC 7591) for automatic OAuth client setup

#### Authentication modes

Expand All @@ -42,6 +43,15 @@ OAuth client secrets can be provided via (in order of precedence):
2. --remote-auth-client-secret-file flag (secure file-based approach)
3. TOOLHIVE_REMOTE_OAUTH_CLIENT_SECRET environment variable

#### Dynamic client registration

When no client credentials are provided, the proxy automatically registers an OAuth client
with the authorization server using RFC 7591 dynamic client registration:

- No need to pre-configure client ID and secret
- Automatically discovers registration endpoint via OIDC
- Supports PKCE flow for enhanced security

#### Examples

Basic transparent proxy:
Expand Down Expand Up @@ -75,6 +85,11 @@ Auto-detect authentication requirements:
thv proxy my-server --target-uri https://protected-api.com \
--remote-auth-client-id my-client-id

Dynamic client registration (automatic OAuth client setup):

thv proxy my-server --target-uri https://protected-api.com \
--remote-auth --remote-auth-issuer https://auth.example.com

```
thv proxy [flags] SERVER_NAME
```
Expand Down
9 changes: 9 additions & 0 deletions docs/toolhive/reference/cli/thv_run.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,15 @@ ToolHive supports five ways to run an MCP server:
This allows remote MCP servers to be managed like local workloads with full
support for client configuration, tool filtering, import/export, etc.

#### Dynamic client registration

When no client credentials are provided, ToolHive automatically registers an OAuth client
with the authorization server using RFC 7591 dynamic client registration:

- No need to pre-configure client ID and secret
- Automatically discovers registration endpoint via OIDC
- Supports PKCE flow for enhanced security

The container will be started with the specified transport mode and
permission profile. Additional configuration can be provided via flags.

Expand Down
13 changes: 11 additions & 2 deletions static/api-specs/toolhive-api.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ components:
- AmpCursor
- AmpVSCodeInsider
- AmpWindsurf
- LMStudio
client.MCPClientStatus:
properties:
client_type:
Expand All @@ -142,6 +143,7 @@ components:
- AmpCursor
- AmpVSCodeInsider
- AmpWindsurf
- LMStudio
installed:
description: Installed indicates whether the client is installed on the
system
Expand Down Expand Up @@ -634,8 +636,6 @@ components:
type: string
clientSecretFile:
type: string
enableRemoteAuth:
type: boolean
envVars:
description: Environment variables for the client
items:
Expand Down Expand Up @@ -967,6 +967,7 @@ components:
- AmpCursor
- AmpVSCodeInsider
- AmpWindsurf
- LMStudio
type: array
uniqueItems: false
type: object
Expand Down Expand Up @@ -1015,6 +1016,7 @@ components:
- AmpCursor
- AmpVSCodeInsider
- AmpWindsurf
- LMStudio
type: object
v1.createClientResponse:
properties:
Expand All @@ -1041,6 +1043,7 @@ components:
- AmpCursor
- AmpVSCodeInsider
- AmpWindsurf
- LMStudio
type: object
v1.createGroupRequest:
properties:
Expand Down Expand Up @@ -1071,6 +1074,9 @@ components:
type: string
description: Environment variables to set in the container
type: object
group:
description: Group name this workload belongs to
type: string
host:
description: Host to bind to
type: string
Expand Down Expand Up @@ -1355,6 +1361,9 @@ components:
type: string
description: Environment variables to set in the container
type: object
group:
description: Group name this workload belongs to
type: string
host:
description: Host to bind to
type: string
Expand Down