Release v0.35.0

[toolhive-release-app]

Release v0.35.0

Version Bump

minor release

Files Updated

• VERSION
• deploy/charts/operator-crds/Chart.yaml (path: version)
• deploy/charts/operator-crds/Chart.yaml (path: appVersion)
• deploy/charts/operator/Chart.yaml (path: version)
• deploy/charts/operator/Chart.yaml (path: appVersion)
• deploy/charts/operator/values.yaml (path: operator.image)
• deploy/charts/operator/values.yaml (path: operator.toolhiveRunnerImage)
• deploy/charts/operator/values.yaml (path: operator.vmcpImage)
• Helm chart docs (via helm-docs)

Next Steps

1. Review this PR
2. Merge to main
3. Release automation will handle the rest

Checklist

• Version bump is correct
• All CI checks pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.76%. Comparing base (8e45112) to head (33d5e54).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5788      +/-   ##
==========================================
+ Coverage   70.74%   70.76%   +0.02%     
==========================================
  Files         684      684              
  Lines       69355    69355              
==========================================
+ Hits        49064    49078      +14     
+ Misses      16699    16686      -13     
+ Partials     3592     3591       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

📝 Generated release notes for v0.35.0

Auto-generated by the release-notes skill. Review and, if good, apply with:

gh release edit v0.35.0 --notes-file <paste-below>.md

Click to expand release notes

🚀 Toolhive v0.35.0 is live!

A focused release that deepens observability and the embedder-facing Virtual MCP API, unblocks in-cluster OIDC dev setups, and tidies up docs and security tooling.

🆕 New Features

• Virtual MCP embedders can now enumerate backends directly through the core API with the new ListBackends and LookupBackend methods — an admin view over all group-scoped backends and an identity-scoped discovery view — instead of lossily reverse-engineering them from the tool list (#5763).
• Operators with telemetry enabled can now observe rate limiting via three new OpenTelemetry metrics — toolhive_rate_limit_decisions, toolhive_rate_limit_redis_errors, and toolhive_rate_limit_check_latency — emitted from the shared limiter used by both MCPServer and VirtualMCPServer (#5701).

🐛 Bug Fixes

• OIDC upstream federation to a plain-HTTP in-cluster dev IdP (e.g. Dex over HTTP in kind/k8s) now works via a per-upstream opt-in insecure_allow_http field; HTTPS remains required by default (#5787).

🧹 Misc

• Documentation is easier to navigate: architecture docs are now reachable from prominent entry points, standalone READMEs are reconnected to their hubs, and related architecture documents cross-link to each other (#5739).
• Suppressed the govulncheck advisory GO-2026-5932 (x/crypto/openpgp, deprecated-by-design with no fix available, pulled in transitively via sigstore) with documented justification (#5781).

📦 Dependencies

Module	Version
github.com/stacklok/toolhive-core	v0.0.27

Full commit log

What's Changed

• Update module github.com/stacklok/toolhive-core to v0.0.27 by @renovate[bot] in Update module github.com/stacklok/toolhive-core to v0.0.27 #5736
• Improve documentation discoverability and cross-linking by @JAORMX in Improve documentation discoverability and cross-linking #5739
• Add ListBackends/LookupBackend to the vMCP core interface by @ChrisJBurns in Add ListBackends/LookupBackend to the vMCP core interface #5763
• Rate limiting observability (metrics and tracing) PR A by @Sanskarzz in Rate limiting observability (metrics and tracing) PR A #5701
• Suppress GO-2026-5932 (x/crypto/openpgp deprecated-by-design, no fix available) by @JAORMX in Suppress GO-2026-5932 (x/crypto/openpgp deprecated-by-design, no fix available) #5781
• Allow HTTP upstream OIDC issuers for in-cluster dev environments by @ChrisJBurns in Allow HTTP upstream OIDC issuers for in-cluster dev environments #5787
• Release v0.35.0 by @toolhive-release-app[bot] in Release v0.35.0 #5788

Full Changelog: v0.34.0...v0.35.0

🔗 Full changelog: v0.34.0...v0.35.0