sitdraw

ToolHive Explained: 2026 Stacklok Open-Source MCP Runtime

Help Net Security (7 Sep) covered ToolHive: Stacklok boxes MCP servers in containers. Runtime, registry, vMCP gateway, desktop app. A laptop gets isolation; governance needs an identity source.

Help Net Security wrote up ToolHive on 7 September 2026. Stacklok’s Apache 2.0 platform runs MCP servers in containers so clients such as Cursor and Claude Code can reach outside tools.

Decide a rollout by matching these names: ToolHive, MCP container runtime, and the command thv.

Sep 7Help Net Security write-up
4Runtime / registry / gateway / desktop
2.0Apache license

What the four parts do

Runtime lands first

Locally through Docker or Podman; in a cluster through the Kubernetes operator. Permissions, network filters, and secrets apply on the way in. A server with no image can still be pulled from a package manager and boxed.

Registry and gateway follow

The Registry Server implements the official MCP Registry API, signs servers, and checks provenance. Virtual MCP Server collapses backends behind one endpoint with OIDC or OAuth, OpenTelemetry, and Prometheus.

Building an MCP server is the easy half. The operational half is knowing which servers are running on which machines and what each one can touch. — Help Net Security, restating the platform

Where the numbers come from

Look atHand installToolHive
BoundaryHost credentials and networkOwn container, minimal permission file
EntryEach client configured by handDesktop app, CLI thv, Kubernetes operator
GovernanceAudit later, if at allPolicy and audit after an identity source; otherwise a sandbox
Cloud web UI—Browser cloud UI retired; roll out desktop and CLI

Should you adopt now

  1. 01
    Match the work

    Teams already hanging MCP off Cursor or Claude Code, and unable to say which machine touched which secret, are the audience. Do not treat an open catalog as governance.

  2. 02
    Read the retirement note

    Help Net Security marks the browser cloud UI retired. Design the rollout around the desktop app and CLI. Stacklok Enterprise is the paid line with Okta and Entra ID.

  3. 03
    Do not treat a runtime as a design review

    Isolated servers still leave module boundaries on one drawing. Open sitdraw when the meeting is the diagram.

Did ToolHive ship in September?
No. Help Net Security on 7 September is follow-up coverage. The project predates that write-up; the docs already list desktop, CLI, and Operator entry points.
Is this the same story as vlt 1.0?
No. That is a JavaScript package manager. This is a container runtime for MCP servers.

Start by splitting isolation from governance

A laptop install gives you a container boundary. Identity enforcement, audit, and policy filtering need an identity provider and a telemetry stack you already run.

# ToolHive CLI (official docs / Homebrew)
brew tap stacklok/tap
brew install thv
thv run toolhive-doc-mcp

Start the picture