[toolhive-release-app]

Release v0.59.0

Version Bump

minor release

Files Updated

• VERSION
• deploy/charts/operator-crds/Chart.yaml (path: version)
• deploy/charts/operator-crds/Chart.yaml (path: appVersion)
• deploy/charts/operator/Chart.yaml (path: version)
• deploy/charts/operator/Chart.yaml (path: appVersion)
• deploy/charts/operator/values.yaml (path: operator.image)
• deploy/charts/operator/values.yaml (path: operator.toolhiveRunnerImage)
• deploy/charts/operator/values.yaml (path: operator.vmcpImage)
• Helm chart docs (via helm-docs)

Next Steps

1. Review this PR
2. Merge to main
3. Release automation will handle the rest

Checklist

• Version bump is correct
• All CI checks pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.22%. Comparing base (3a2246c) to head (80d0443).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6977   +/-   ##
=======================================
  Coverage   80.22%   80.22%           
=======================================
  Files         847      847           
  Lines       86097    86097           
=======================================
+ Hits        69071    69074    +3     
+ Misses      17021    17018    -3     
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📝 Generated release notes for v0.59.0

Auto-generated by the release-notes skill. Review and, if good, apply with:

gh release edit v0.59.0 --notes-file <paste-below>.md

Click to expand release notes

🚀 Toolhive v0.59.0 is live!

This release adds TLS support for the operator-wide default Redis, lets the embedded auth server re-check upstream DCR registrations while it runs, and makes thv llm setup --client claude-desktop work on Windows. It also lays more groundwork for token-exchange delegation.

🆕 New Features

• Workloads that fall back to the operator-wide defaultRedis can now connect to TLS-only Redis endpoints with certificate verification. Set operator.defaultRedis.tls.enabled in the Helm values, and optionally operator.defaultRedis.tls.caCertSecretRef. If you omit the CA reference, system roots are used. TLS is off by default. Any password or CA Secret must exist in each workload's namespace. Invalid TLS settings now stop the operator at startup instead of quietly falling back to plaintext (#6838, closes #6827)
• New opt-in dcrConfig.registrationProbeInterval field (minimum 1m) on MCPExternalAuthConfig and the inline VirtualMCPServer auth config. When set, each replica re-checks its upstream DCR registration on that interval and switches to a replacement without a restart. Sign-ins recover within about one interval after an upstream drops a registration, and replicas no longer drift apart. 5m to 15m suits most upstreams. Without the field, nothing changes (#6948, related to #6821 and #6496)
• In the auth server RunConfig, delegate_clients[] entries now accept and validate five optional fields: token_endpoint_auth_method, token_endpoint_auth_signing_alg, jwks_file, grant_types and redirect_uris. Combinations that don't make sense, such as refresh_token without authorization_code, now fail validation at startup. Note: the runner wiring for these fields (Wire configured delegate clients into the runner #6953) is not in this release. Until it ships, grant_types, redirect_uris and the auth-method pin are ignored, and the client stays token-exchange-only. A private_key_jwt delegate client fails at startup with resolved client secret is empty (#6952, refs #6893)
• Adds the storage layer for RFC 8693 token-exchange grants, with an in-memory backend. These grant records make refresh tokens issued through token exchange revocable and prevent the same access token from being exchanged twice. Nothing uses this storage yet (#6968, part of #6895)

🐛 Bug Fixes

• thv llm setup --client claude-desktop no longer fails on Windows. It now writes a claude-desktop-helper.cmd credential helper that calls thv by its absolute path (#6516, fixes #6507)
• Fixes a stale Windows-only assertion in the credential-helper shim test and corrects the comment explaining why the shim uses an absolute path (#6958)

🧹 Misc

• The CLI help for thv run, logs, rm and stop, and the toolhive-cli-user skill docs, now use fetch in their examples. The filesystem server they used before was removed from the catalog (#6976)
• Creating a release tag now requires approval from a reviewer on the release environment (#6961)
• Release workflow jobs now wait for the verify-release check to pass before running (#6959)
• Adds a context7.json file to prove ownership of the ToolHive library on Context7, then expands it with a description, exclusions and usage rules (#6962, #6963)

📦 Dependencies

Module	Version
github.com/stacklok/toolhive-core	v0.0.58 (#6971)
github.com/stacklok/toolhive-core/redisconn	v0.0.58
golang.org/x/net	v0.62.0 (CVE fix)

Full commit log

What's Changed

• Add Windows Claude Desktop credential helper by @stantheman0128 in Add Windows Claude Desktop credential helper #6516
• Fix stale Windows shim test and PATH comment by @aponcedeleonch in Fix stale Windows shim test and PATH comment #6958
• Run release jobs after verify-release by @eleftherias in Run release jobs after verify-release #6959
• Add Context7 ownership verification by @danbarr in Add Context7 ownership verification #6962
• Enable TLS for operator-wide Redis defaults by @Sanskarzz in Enable TLS for operator-wide Redis defaults #6838
• Expand Context7 library configuration by @danbarr in Expand Context7 library configuration #6963
• Require approval before creating a release tag by @eleftherias in Require approval before creating a release tag #6961
• Re-check upstream DCR registrations while running by @aron-muon in Re-check upstream DCR registrations while running #6948
• Add exchange grant storage with memory backend by @jhrozek in Add exchange grant storage with memory backend #6968
• Bump toolhive-core to v0.0.58 by @jerm-dro in Bump toolhive-core to v0.0.58 #6971
• Add configured delegate client metadata by @jhrozek in Add configured delegate client metadata #6952
• Replace removed catalog servers in examples by @danbarr in Replace removed catalog servers in examples #6976
• Release v0.59.0 by @toolhive-release-app[bot] in Release v0.59.0 #6977

Full Changelog: v0.58.0...v0.59.0

🔗 Full changelog: v0.58.0...v0.59.0