What it is
ToolHive runs every MCP server in an isolated container with a minimal permission profile and no local credentials, controls its network access and, when connected to an identity provider, enforces identity and access policy per request. It also offers semantic tool search, which Stacklok says cuts token use by up to 85%.
It comes as a CLI (thv), a desktop app and a Kubernetes operator that emits OpenTelemetry traces. Some enterprise features sit in Stacklok's paid tier. It needs Docker, Podman or Colima. v0.56.0 shipped on 22 October 2026, and the repo has over 4,400 commits.
Our review
Most teams have no idea which MCP servers their developers have connected, and each one runs with whatever access the developer has. ToolHive changes the default: every server runs in its own container with almost no permissions and none of your local credentials.
From there it adds the things a security team asks for. Network access per server, identity and access policy per request through your identity provider, audit logs, and a Kubernetes operator so the same setup runs in production. Semantic tool search, which Stacklok says can cut token use by up to 85%, is a welcome side effect for anyone with a long list of tools.
The catch: you need Docker, Podman or Colima, and some of the enterprise identity and management features are in Stacklok's paid tier, priced on request. Containing a server also does not stop it misusing the access you deliberately give it.
Our take: for one developer with three servers, a sandbox around the agent may be enough. Once a company is trying to end shadow MCP use, ToolHive is the kind of central control point that makes the problem visible.
Where it earns its place
A security team at a 500-developer company
End shadow MCP servers and log what agents call
Run approved servers through the ToolHive Kubernetes operator with the company IdP; enterprise features are priced on request.
A developer trying a community MCP server
Run it without exposing local credentials
brew install thv, thv run <server>, then thv client setup to connect Claude Code.
Before you commit
- Setup
- macOS and Linux: brew tap stacklok/tap and brew install thv; Windows: winget install stacklok.thv. Needs Docker, Podman or Colima.
- Integrations
- Claude Code, Cursor, VS Code and other MCP clients; Kubernetes operator; identity providers; OpenTelemetry.
- Data and privacy
- Self-hosted; servers run without local credentials by default. Apache 2.0.
- Cost at scale
- Free open source; Stacklok Enterprise pricing is not published.
- Limits
- Containment does not stop a server misusing access you grant it.
What's good
- Each MCP server isolated in a minimal container
- Per-request identity and access policy
- Kubernetes operator with OpenTelemetry
- Very active development
What's not
- Needs a container runtime
- Some enterprise features are paid
- Fast release cadence means frequent upgrades
Best for
Platform and security teams that need to run, contain and audit MCP servers across a company.
Alternatives
ToolHive: common questions
- Is ToolHive worth it?
- Scanners tell you whether an MCP server looks dangerous; ToolHive limits what it can do if it is. We rate it 4.1 out of 5.
- How much does ToolHive cost?
- Open source under Apache 2.0; Stacklok Enterprise adds features and support, priced on request.
- What are the downsides of ToolHive?
- Needs a container runtime; some enterprise features are paid; fast release cadence means frequent upgrades.
- Who is ToolHive best for?
- Platform and security teams that need to run, contain and audit MCP servers across a company.
- How much does ToolHive cost for a team or in production?
- Free open source; Stacklok Enterprise pricing is not published.
- Is ToolHive safe for company data?
- Self-hosted; servers run without local credentials by default. Apache 2.0.
- What are the best ToolHive alternatives?
- The closest alternatives we have reviewed are NVIDIA OpenShell and Snyk Agent Scan.
Answers checked Oct 24, 2026.
Make ToolHive? Show this rating on your site
