Update stacklok/toolhive to v0.54.0

[renovate]

This PR contains the following updates:

Package	Update	Change
stacklok/toolhive	minor	v0.53.0 → v0.54.0

After this PR opens, .github/workflows/upstream-release-docs.yml adds source-verified content edits for the new release. For stacklok/toolhive, the same workflow also syncs reference assets (CLI help, Swagger) and regenerates the CRD MDX pages.

---

Release Notes

stacklok/toolhive

v0.54.0

Compare Source

What's Changed

• Update module github.com/stacklok/toolhive-catalog to v0.20261013.0 by @​renovate[bot] in #​6816
• Extract exact-ID decode from DecodeMessage by @​jhrozek in #​6820
• Add Pi coding agent as a supported MCP client by @​danbarr in #​6819
• Add SPIFFE file bundle source by @​jhrozek in #​6759
• Refresh upstream tokens when the ID token expires by @​tgrunnagle in #​6773
• Narrow OIDC referrer watches to ref changes by @​Sriram-PR in #​6706
• Fix lint in RSA client key validation by @​rdimitrov in #​6824
• Release v0.54.0 by @​toolhive-release-app[bot] in #​6823

New Contributors

• @​Sriram-PR made their first contribution in #​6706

Full Changelog: stacklok/toolhive@v0.53.0...v0.54.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Docs update for toolhive v0.54.0

Note

Silent run — skill produced no content commits. The docs are
likely already up-to-date (e.g. main ahead of pin, or a re-run
after a previous PR for this tag merged). Only the version bump
and refreshed reference assets are included.

At a glance

Upstream	stacklok/toolhive v0.53.0 → v0.54.0
Hand-written changes	0 commit(s)
Reference assets	refreshed (separate commit)
Gaps	0
Owner	@rdimitrov - identified from merged release PR stacklok/toolhive#6823
Release contributors	4 review requested (see sidebar) · 2 not requested (no docs impact)
Action required	None — approve and merge if the silent-run signal is expected

Who does what

@rdimitrov cut this release and owns this PR: review your own changes, chase the remaining approvals, and merge once they're in. You don't need to wait on a review from anyone listed as having no docs impact below.

Everyone with a review request: the target is a review and approval within 2 business days.

Summary of changes

• Added the Pi coding agent (Add Pi coding agent as a supported MCP client toolhive#6819) to the supported clients table and a Pi configuration section at docs/toolhive/reference/client-compatibility.mdx
• Updated the automatic token refresh section to cover refresh on upstream ID token expiry (Refresh upstream tokens when the ID token expires toolhive#6773) in docs/toolhive/concepts/embedded-auth-server.mdx
• Updated the private_key_jwt registration section with client key limits and re-registration behavior in docs/toolhive/guides-vmcp/delegate-agent-identity.mdx
• Skipped the SPIFFE file bundle source (Add SPIFFE file bundle source toolhive#6759): source initialization isn't wired into SPIFFE authentication at this tag, per the SPIFFEBundleSourceRunConfig description
• No doc changes for Extract exact-ID decode from DecodeMessage toolhive#6820, Narrow OIDC referrer watches to ref changes toolhive#6706, Fix lint in RSA client key validation toolhive#6824, or the security hardening commits for MCP params decoding, telemetry env-var filtering, JWT assertion replay, and auth server storage races (internal or no documented surface affected)

No docs impact identified

2 contributor(s) had no-docs-impact commits in this release. No review was requested, and the workflow did not auto-notify them.

Run cost

Session	Turns	Cost (USD)
Generation	37	$1.4545
Editorial review	23	$0.6724
Total	60	$2.1269

How this PR was built

Two Claude Opus sessions run per release: a generation pass
(upstream-release-docs skill, 6 phases) followed by a fresh-
context editorial pass (docs-review). Prettier/ESLint
auto-fixes are applied after.

Auto-synced paths — do not hand-edit these in review:

• static/api-specs/
• docs/toolhive/reference/cli/ (toolhive only)
• docs/toolhive/reference/crds/

If a "Gaps needing human context" section is present above,
each entry includes a paste-ready Helper prompt for local
Claude a reviewer can use to resolve the gap.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-website	Ready	Preview	Oct 15, 2026 1:02pm UTC

[claude]

Claude finished @renovate[bot]'s task in 2m 31s —— View job

---

Release docs for stacklok/toolhive v0.54.0

• Discovery
• Deep dive (verified against source at v0.54.0)
• Audit docs, including a check for stale claims the release makes false
• Implement
• Validate (prettier:fix and eslint:fix pass)
• Write SUMMARY.md and REVIEWERS.json. The workflow's next step commits and pushes them.

Changes

• Pi coding agent (Add Pi coding agent as a supported MCP client toolhive#6819): added a row (v0.99.0+) to the supported clients table and a new Pi section in reference/client-compatibility.mdx. The section gives the config path ~/.pi/agent/mcp.json and the skills paths. It also says Pi supports Streamable HTTP only: ToolHive writes SSE servers without a type field, and Pi can't connect to them.

• Token refresh when the ID token expires (Refresh upstream tokens when the ID token expires toolhive#6773): concepts/embedded-auth-server.mdx said ToolHive refreshes only when the access token expires, which is no longer true. It now explains that ToolHive also refreshes when the upstream ID token expires (for example with Entra ID). It also covers what happens when the provider leaves out a new ID token and when that refresh fails.

• private_key_jwt client key limits (security fix): guides-vmcp/delegate-agent-identity.mdx now lists the limits:

  • RSA modulus of 2048-8192 bits
  • odd public exponent between 3 and 65537
  • at most 10 JWKS keys

  It also says a stored client with a key outside these limits gets invalid_client and must register again.

Skipped

• SPIFFE file bundle source (Add SPIFFE file bundle source toolhive#6759): at this tag, SPIFFE authentication doesn't use bundle sources yet.
• No doc changes for Extract exact-ID decode from DecodeMessage toolhive#6820, Narrow OIDC referrer watches to ref changes toolhive#6706, or Fix lint in RSA client key validation toolhive#6824, or for the security hardening commits (MCP params decoding, telemetry env-var filtering, JWT replay keys, storage race). They're internal or don't change anything the docs describe.

For reviewers

• The note about pi-mcp-adapter comes from Add Pi coding agent as a supported MCP client toolhive#6735 and describes how Pi behaves, not ToolHive, so I couldn't check it in ToolHive source. @danbarr, please confirm it.
• I didn't run npm run build; PR CI will build the site.

[claude]

Claude finished @renovate[bot]'s task in 1m 45s —— View job

---

Editorial review of v0.54.0 content edits

• Find the changed content files
• Run docs-review on the changed pages
• Apply fixes
• Run Prettier and ESLint

The release commit (f236968) only changed auto-generated reference files, and I left those alone as instructed. The content edits from the generation pass haven't been committed yet: they're in the working tree, in three files. I reviewed those three and fixed them in place. The workflow's later "Commit and push" step will commit them along with the rest, so I didn't push a commit of my own.

What I checked against upstream v0.54.0

• RSA key limits (delegate-agent-identity.mdx): the numbers match pkg/authserver/server/crypto/keys.go and registration/dcr.go.
  • Modulus is 2048 to 8192 bits.
  • The public exponent must be odd, at least 3, and at most 65537.
  • The inline jwks holds at most 10 keys.
• Pi client (client-compatibility.mdx): the config path .pi/agent and the skills paths .pi/agent/skills and .pi/skills match pkg/client/config.go.

Edits

File	Change
guides-vmcp/delegate-agent-identity.mdx	Moved the key-limits block to the end of the "Register and authenticate with a keypair" section. Before, it sat between the registration request and "The response carries a client_id…", so it broke the request-then-response flow. I also replaced "when it loads them", which describes code internals, with a plain statement that stored clients are checked against the same limits.
concepts/embedded-auth-server.mdx	Changed "This matters for providers such as…" to "This keeps the ID token current for providers like…", so the sentence says what the refresh actually does. "Consume" is now "use".
reference/client-compatibility.mdx	Removed a repeated idea in the Pi extension note: "ignores mcp.json and doesn't see the servers ToolHive configures" is now "ignores mcp.json, including the servers ToolHive configures".

Everything else holds up. The Pi table row, anchor link, example config, and the note about SSE servers follow the patterns used for the other clients. The ID-token refresh paragraph describes current behavior without framing it as a change. npm run prettier:fix rewrapped two files, and npm run eslint:fix finished without errors.