Table of Contents
🌏 中文版
Tool Info
| Field | Value |
|---|---|
| Name | ToolHive |
| Type | CLI (also ships a Kubernetes Operator) |
| GitHub | stacklok/toolhive |
| Stars | 2,152 |
| Language | Go |
| License | Apache-2.0 |
| Install | brew tap stacklok/tap && brew install thv |
What Problem It Solves
When you install an MCP server for Claude Code, Cursor, or VS Code, the usual move is to copy the one-liner from the README — an npx or pip install — and just run it. That means the server process inherits your machine's own permissions: it can read your filesystem, reach your network, and touch whatever credentials sit in your environment variables. There's no easy way to know which external hosts it's actually calling, and it's hard to enforce any team-wide control over who installed which MCP server and what that server can touch.
ToolHive drops every MCP server into its own container (via Docker, Podman, or Kubernetes) and launches it with a minimal permission profile that carries no local credentials. If the author never shipped a container image, ToolHive will build one on the fly straight from a package manager (npm, pip, etc.). Wire it to an identity provider (OIDC/OAuth) and it starts enforcing identity and access policy per request, with audit logs to match. The CLI, thv, manages the whole lifecycle — discovering servers, running them, listing status, stopping them.
Good fit for: individual developers who want an isolation boundary around their MCP servers without hand-rolling Docker Compose; platform teams who want a self-hosted, auditable MCP registry and gateway to control which servers a team is allowed to run; and organizations deploying MCP servers at scale on Kubernetes via the Operator, wired into existing identity governance.
Quick Start
Install
# macOS / Linux (Homebrew)
brew tap stacklok/tap
brew install thv
# Verify the install
thv versionWindows users can install via WinGet, or download a pre-compiled binary from the GitHub Release page. Running containerized MCP servers requires Docker, Podman, or Colima to be installed.
Basic Usage
# See what MCP servers are available in the built-in registry
thv registry list
# Inspect one server in detail (what tools it exposes, what config it needs)
thv registry info toolhive-doc-mcp
# Launch that server inside an isolated container
thv run toolhive-doc-mcp
# Confirm what's running and which proxy port it's on
thv list
# Stop it, or remove it entirely, when you're done
thv stop toolhive-doc-mcp
thv rm toolhive-doc-mcpAdvanced Usage
# Have ToolHive auto-configure supported clients (VS Code, Cursor, Claude Code, etc.)
thv client setup
thv client status
# Pin a specific proxy port to avoid conflicts
thv run --proxy-port 8081 toolhive-doc-mcp
# Don't want to run a container? Connect to ToolHive's hosted endpoint instead
thv run toolhive-doc-mcp-remoteComparison with Existing Tools
| ToolHive | Manually running npx/pip | Hand-rolled Docker Compose | |
|---|---|---|---|
| Container isolation + minimal permission profile (no local credentials) | ✅ | ❌ | Partial (you design it yourself) |
| Built-in curated registry with signing/provenance verification | ✅ | ❌ | ❌ |
| Auto-configures clients (VS Code/Cursor/Claude Code) | ✅ | ❌ | ❌ |
| Kubernetes Operator for enterprise-scale deployment | ✅ | ❌ | You build it yourself |
| Identity/access policy (OIDC/OAuth) + audit logs | ✅ (requires an IdP) | ❌ | You build it yourself |
Things to Watch Out For
- Requires a container runtime: running containerized servers needs Docker, Podman, or Colima installed. If you'd rather skip that, you're limited to the official
-remotevariants that connect to ToolHive's hosted endpoints — and not every server has one. - Identity governance is the enterprise story: ToolHive Community (open source, free) covers isolation and the basic registry. Wiring in Okta/Entra ID SSO, centralized governance, and hardened production-ready servers is where the paid Stacklok Enterprise tier comes in.
- The cloud browser UI is retired: the project has marked its browser-based cloud UI as retired, so plan a rollout around the desktop app and the CLI rather than that web surface.
Today's Takeaway
I used to think "is this MCP server safe" was purely a judgment call — read the README, check the issue tracker for complaints, trust your gut. ToolHive turns that into something you can actually verify: safety no longer hinges on how carefully you read the server's source code, but on whether it ever gets a chance to touch your real credentials in the first place. A container boundary and a permission profile downgrade "trusting a stranger's server" from a moral judgment to an engineering configuration.
References
- stacklok/toolhive GitHub repo: README, stars, language, and license (Apache-2.0) are from the official repo.
- ToolHive CLI Quickstart: source for the install commands,
thvcommand examples, and workflow description. - ToolHive: The open-source way to run any MCP server securely — Help Net Security: source for the four architecture components (Runtime/Registry Server/Gateway/Portal) and the cloud UI retirement detail.
- Model Context Protocol official docs: introduction to the MCP protocol.
Loading...