Skip to content

Add weekly product update for Apr 13#705

Merged
Derek2Tu merged 10 commits intomainfrom
weekly-product-updates-apr-13
Apr 13, 2026
Merged

Add weekly product update for Apr 13#705
Derek2Tu merged 10 commits intomainfrom
weekly-product-updates-apr-13

Conversation

@Derek2Tu
Copy link
Copy Markdown
Contributor

@Derek2Tu Derek2Tu commented Apr 13, 2026

Summary

  • ToolHive Studio v0.28.1: Threaded chat in the Playground, MCP Apps rendering interactive UI in chat, local builds tab for skills, bundled ToolHive v0.16.0 and MCP Optimizer v0.3.0, Hono CVE patches
  • Registry Server: Claim-based JWT authorization across all endpoints, per-entry access control for Kubernetes sources, immutable entry visibility, /me caller identity endpoint, skills sync from external sources, SIEM-compliant audit logging (merged, not yet released), immediate filter re-sync, fixed incomplete list pagination
  • Kubernetes Operator: Token-bucket rate limiting with shared and per-user scoping, Redis-backed counters, HTTP 429 with Retry-After
  • Embedded authorization server: OAuth authorization server in vMCP with upstream IdP support, Dynamic Client Registration (RFC 7591), upstream token injection and token exchange

Test plan

  • Verify the blog post renders correctly on the Vercel preview deployment
  • Confirm all internal links resolve (/toolhive/guides-k8s/rate-limiting, /toolhive/guides-vmcp/authentication#embedded-authorization-server)
  • Check that the post appears in the ToolHive updates blog feed

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 13, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs-website Ready Ready Preview, Comment Apr 13, 2026 9:52pm

Request Review

Rework section structure to use ## headers with bold lead-in bullet
points, remove version number from title, add product doc links, and
consolidate Registry Server subsections.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
for list endpoints that previously returned incomplete pages when access control
filtering removed rows.

## Kubernetes Operator: Token-bucket rate limiting
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: It doesn't really make sense to say "Kubernetes Operator" in this context. It would be more correct to say the "MCPServer in K8s support rate limiting"

## Kubernetes Operator: Token-bucket rate limiting

The [Kubernetes Operator](/toolhive/guides-k8s/) now supports
[token-bucket rate limiting](/toolhive/guides-k8s/rate-limiting) to prevent
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: "token bucket" is an implementation detail. I would lead with "per-user, per-tool call rate limiting"

Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
- Replace "ToolHive Studio" with "ToolHive desktop UI" throughout
- Remove MCP Optimizer mention (deprecated/removed in UI)
- Remove Sentry tracing and duplicate MCP Apps from under-the-hood
- Add "and skill" to per-entry access control for K8s sources
- Rename K8s section to "Per-user, per-tool call rate limiting"
- Rephrase to use "MCPServers in Kubernetes" instead of "Kubernetes Operator"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
- Reframe vMCP section as a feature highlight, not a docs update
- Add use cases for rate limiting: resource exhaustion, performance
  degradation, and data exfiltration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Derek Tu and others added 2 commits April 13, 2026 14:36
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@danbarr
Copy link
Copy Markdown
Collaborator

danbarr commented Apr 13, 2026

The post is in good shape overall — benefit-first framing throughout, clear technical language, no overselling. A few issues worth fixing:

1. Description and title omit vMCP

The description covers desktop UI, Registry Server, and Kubernetes but leaves out the vMCP embedded authorization server — which is one of the four main sections.

Current description:

The ToolHive desktop UI ships threaded chat and MCP Apps in the Playground, the Registry Server introduces claim-based authorization with per-entry access control, and MCPServers in Kubernetes gain per-user rate limiting.

Suggested fix — add a vMCP clause, e.g.:

...MCPServers in Kubernetes gain per-user rate limiting, and vMCP gains an embedded OAuth authorization server.

Similarly, the title lists three of the four stories but skips vMCP. Updating the description is more important; the title could optionally be broadened too (e.g., "Threaded chat, claim-based authorization, Kubernetes rate limiting, and embedded OAuth").

2. Unexplained spec reference in the desktop UI section

This implements the mcp-apps/2026-01-26 spec.

This is unexplained jargon — most readers won't know what mcp-apps/2026-01-26 refers to. Either drop it or add brief context, e.g.:

This implements the mcp-apps/2026-01-26 draft MCP specification for interactive UI resources.

3. Sidebar label covers only 2 of 4 topics

'Apr 13: Desktop UI Playground and registry auth' leaves out Kubernetes rate limiting and vMCP. Not a blocker, but given that both feature in the title, it's a bit misaligned. Something like 'Apr 13: Playground, registry auth, and rate limiting' would be more representative.

- Add vMCP to description and update sidebar label
- Clarify mcp-apps spec reference with context
- Broaden sidebar label to cover more topics

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comment thread blog/toolhive-updates/2026-04-13-updates.mdx Outdated
Co-authored-by: Dan Barr <danbarr@users.noreply.github.com>
@Derek2Tu Derek2Tu merged commit 9daf7e0 into main Apr 13, 2026
4 checks passed
@Derek2Tu Derek2Tu deleted the weekly-product-updates-apr-13 branch April 13, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants