diff --git a/src/mcp_optimizer/toolhive/api_models/__init__.py b/src/mcp_optimizer/toolhive/api_models/__init__.py
index 087d470..49be486 100644
--- a/src/mcp_optimizer/toolhive/api_models/__init__.py
+++ b/src/mcp_optimizer/toolhive/api_models/__init__.py
@@ -1,3 +1,3 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
diff --git a/src/mcp_optimizer/toolhive/api_models/audit.py b/src/mcp_optimizer/toolhive/api_models/audit.py
index 6baeb2b..efc4b3e 100644
--- a/src/mcp_optimizer/toolhive/api_models/audit.py
+++ b/src/mcp_optimizer/toolhive/api_models/audit.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/auth.py b/src/mcp_optimizer/toolhive/api_models/auth.py
index 7c125dd..ac6c288 100644
--- a/src/mcp_optimizer/toolhive/api_models/auth.py
+++ b/src/mcp_optimizer/toolhive/api_models/auth.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -36,6 +36,11 @@ class TokenValidatorConfig(BaseModel):
         alias='clientSecret',
         description='ClientSecret is the optional OIDC client secret for introspection',
     )
+    insecure_allow_http: Optional[bool] = Field(
+        None,
+        alias='insecureAllowHTTP',
+        description='InsecureAllowHTTP allows HTTP (non-HTTPS) OIDC issuers for development/testing\nWARNING: This is insecure and should NEVER be used in production',
+    )
     introspection_url: Optional[str] = Field(
         None,
         alias='introspectionURL',
diff --git a/src/mcp_optimizer/toolhive/api_models/authz.py b/src/mcp_optimizer/toolhive/api_models/authz.py
index 4158a3c..2a42525 100644
--- a/src/mcp_optimizer/toolhive/api_models/authz.py
+++ b/src/mcp_optimizer/toolhive/api_models/authz.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/client.py b/src/mcp_optimizer/toolhive/api_models/client.py
index f9be820..cb9fc4d 100644
--- a/src/mcp_optimizer/toolhive/api_models/client.py
+++ b/src/mcp_optimizer/toolhive/api_models/client.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/core.py b/src/mcp_optimizer/toolhive/api_models/core.py
index 9b52b49..c3f209c 100644
--- a/src/mcp_optimizer/toolhive/api_models/core.py
+++ b/src/mcp_optimizer/toolhive/api_models/core.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -35,7 +35,7 @@ class Workload(BaseModel):
     )
     proxy_mode: Optional[str] = Field(
         None,
-        description='ProxyMode is the proxy mode for stdio transport (sse or streamable-http).',
+        description='ProxyMode is the proxy mode that clients should use to connect.\nFor stdio transports, this will be the proxy mode (sse or streamable-http).\nFor direct transports (sse/streamable-http), this will be the same as TransportType.',
     )
     remote: Optional[bool] = Field(
         None,
diff --git a/src/mcp_optimizer/toolhive/api_models/groups.py b/src/mcp_optimizer/toolhive/api_models/groups.py
index ad075df..5a0ad8b 100644
--- a/src/mcp_optimizer/toolhive/api_models/groups.py
+++ b/src/mcp_optimizer/toolhive/api_models/groups.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/ignore.py b/src/mcp_optimizer/toolhive/api_models/ignore.py
index 9ac7d18..325eed6 100644
--- a/src/mcp_optimizer/toolhive/api_models/ignore.py
+++ b/src/mcp_optimizer/toolhive/api_models/ignore.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/permissions.py b/src/mcp_optimizer/toolhive/api_models/permissions.py
index 0680128..4030d1e 100644
--- a/src/mcp_optimizer/toolhive/api_models/permissions.py
+++ b/src/mcp_optimizer/toolhive/api_models/permissions.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -9,6 +9,12 @@
 from pydantic import BaseModel, Field
 
 
+class InboundNetworkPermissions(BaseModel):
+    allow_host: Optional[list[str]] = Field(
+        None, description='AllowHost is a list of allowed hosts for inbound connections'
+    )
+
+
 class OutboundNetworkPermissions(BaseModel):
     allow_host: Optional[list[str]] = Field(
         None, description='AllowHost is a list of allowed hosts'
@@ -22,6 +28,11 @@ class OutboundNetworkPermissions(BaseModel):
 
 
 class NetworkPermissions(BaseModel):
+    inbound: Optional[InboundNetworkPermissions] = None
+    mode: Optional[str] = Field(
+        None,
+        description='Mode specifies the network mode for the container (e.g., "host", "bridge", "none")\nWhen empty, the default container runtime network mode is used',
+    )
     outbound: Optional[OutboundNetworkPermissions] = None
 
 
diff --git a/src/mcp_optimizer/toolhive/api_models/registry.py b/src/mcp_optimizer/toolhive/api_models/registry.py
index 403c916..3a7d108 100644
--- a/src/mcp_optimizer/toolhive/api_models/registry.py
+++ b/src/mcp_optimizer/toolhive/api_models/registry.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/runner.py b/src/mcp_optimizer/toolhive/api_models/runner.py
index 2a4b88a..8e19d4a 100644
--- a/src/mcp_optimizer/toolhive/api_models/runner.py
+++ b/src/mcp_optimizer/toolhive/api_models/runner.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -12,13 +12,13 @@
 
 
 class RemoteAuthConfig(BaseModel):
-    authorize_url: Optional[str] = Field(None, alias='authorizeURL')
-    callback_port: Optional[int] = Field(None, alias='callbackPort')
-    client_id: Optional[str] = Field(None, alias='clientID')
-    client_secret: Optional[str] = Field(None, alias='clientSecret')
-    client_secret_file: Optional[str] = Field(None, alias='clientSecretFile')
+    authorize_url: Optional[str] = None
+    callback_port: Optional[int] = None
+    client_id: Optional[str] = None
+    client_secret: Optional[str] = None
+    client_secret_file: Optional[str] = None
     env_vars: Optional[list[registry.EnvVar]] = Field(
-        None, alias='envVars', description='Environment variables for the client'
+        None, description='Environment variables for the client'
     )
     headers: Optional[list[registry.Header]] = Field(
         None, description='Headers for HTTP requests'
@@ -27,14 +27,13 @@ class RemoteAuthConfig(BaseModel):
         None, description='OAuth endpoint configuration (from registry)'
     )
     oauth_params: Optional[dict[str, str]] = Field(
-        None,
-        alias='oauthParams',
-        description='OAuth parameters for server-specific customization',
+        None, description='OAuth parameters for server-specific customization'
     )
     scopes: Optional[list[str]] = None
-    skip_browser: Optional[bool] = Field(None, alias='skipBrowser')
+    skip_browser: Optional[bool] = None
     timeout: Optional[str] = Field(None, examples=['5m'])
-    token_url: Optional[str] = Field(None, alias='tokenURL')
+    token_url: Optional[str] = None
+    use_pkce: Optional[bool] = None
 
 
 class ToolOverride(BaseModel):
@@ -153,6 +152,10 @@ class RunConfig(BaseModel):
         None,
         description='Transport is the transport mode (stdio, sse, or streamable-http)',
     )
+    trust_proxy_headers: Optional[bool] = Field(
+        None,
+        description='TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies',
+    )
     volumes: Optional[list[str]] = Field(
         None,
         description='Volumes are the directory mounts to pass to the container\nFormat: "host-path:container-path[:ro]"',
diff --git a/src/mcp_optimizer/toolhive/api_models/secrets.py b/src/mcp_optimizer/toolhive/api_models/secrets.py
index 9a7870b..fdd255b 100644
--- a/src/mcp_optimizer/toolhive/api_models/secrets.py
+++ b/src/mcp_optimizer/toolhive/api_models/secrets.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/telemetry.py b/src/mcp_optimizer/toolhive/api_models/telemetry.py
index 05526aa..22baef1 100644
--- a/src/mcp_optimizer/toolhive/api_models/telemetry.py
+++ b/src/mcp_optimizer/toolhive/api_models/telemetry.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -10,6 +10,11 @@
 
 
 class Config(BaseModel):
+    custom_attributes: Optional[dict[str, str]] = Field(
+        None,
+        alias='customAttributes',
+        description="CustomAttributes contains custom resource attributes to be added to all telemetry signals.\nThese are parsed from CLI flags (--otel-custom-attributes) or environment variables\n(OTEL_RESOURCE_ATTRIBUTES) as key=value pairs.\nWe use map[string]string for proper JSON serialization instead of []attribute.KeyValue\nwhich doesn't marshal/unmarshal correctly.",
+    )
     enable_prometheus_metrics_path: Optional[bool] = Field(
         None,
         alias='enablePrometheusMetricsPath',
diff --git a/src/mcp_optimizer/toolhive/api_models/types.py b/src/mcp_optimizer/toolhive/api_models/types.py
index c250838..1cb259d 100644
--- a/src/mcp_optimizer/toolhive/api_models/types.py
+++ b/src/mcp_optimizer/toolhive/api_models/types.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
diff --git a/src/mcp_optimizer/toolhive/api_models/v1.py b/src/mcp_optimizer/toolhive/api_models/v1.py
index c9f2261..1abc279 100644
--- a/src/mcp_optimizer/toolhive/api_models/v1.py
+++ b/src/mcp_optimizer/toolhive/api_models/v1.py
@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  http://127.0.0.1:8080/api/openapi.json
-#   timestamp: 2025-09-30T12:49:55+00:00
+#   timestamp: 2025-11-02T00:37:46+00:00
 
 from __future__ import annotations
 
@@ -262,6 +262,9 @@ class CreateRequest(BaseModel):
         None, description='Tools override'
     )
     transport: Optional[str] = Field(None, description='Transport configuration')
+    trust_proxy_headers: Optional[bool] = Field(
+        None, description='Whether to trust X-Forwarded-* headers from reverse proxies'
+    )
     url: Optional[str] = Field(None, description='Remote server specific fields')
     volumes: Optional[list[str]] = Field(None, description='Volume mounts')
 
@@ -316,6 +319,9 @@ class UpdateRequest(BaseModel):
         None, description='Tools override'
     )
     transport: Optional[str] = Field(None, description='Transport configuration')
+    trust_proxy_headers: Optional[bool] = Field(
+        None, description='Whether to trust X-Forwarded-* headers from reverse proxies'
+    )
     url: Optional[str] = Field(None, description='Remote server specific fields')
     volumes: Optional[list[str]] = Field(None, description='Volume mounts')