Stacklok

Every tool call carries the identity of the person who made it. Administrators register MCP servers as connectors in the Connector Gateway, an identity aware endpoint for MCP tool calls, and grant them to directory groups, and the gateway brokers each connector's credentials on the caller's behalf. ToolHive runs each MCP server in an isolated container with its own permissions and secrets, and a Virtual MCP Server aggregates backends into one endpoint with tool filtering for a given agent. Together they form an authenticated action framework.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

A Virtual MCP Server aggregates backend MCP servers behind one endpoint with static backend selection, tool filtering and renaming, and the Connector Gateway exposes a group-scoped toolset; both route a call to the right server rather than running work. Stacklok's documented platform runs no workflow or agent loop of its own, and no sequencing, branching or retries across deterministic workflow steps and autonomous agent steps are documented.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

The vMCP optimizer searches tool descriptions to surface only relevant tools per request and cut token use, and the registry catalogs MCP servers and skills; neither is a retrieval structure over the customer's own knowledge. No maintained index, graph or embeddings layer over the customer's documents is documented.

Sourcedocs.stacklok.com/toolhive/guides-vmcp/optimizerread 2026-09-22

Stacklok constrains what an agent may do rather than putting a person in the loop: administrators decide which MCP servers are registered as connectors and which directory groups may use them, Enterprise Manager policies can block servers that are not in the approved registry, authorization policies limit each role's tools, and the AI Gateway screens prompts for injection and scans requests and responses for card and personal data. These are constraints the customer controls; no mechanism where a person reviews, approves or validates an agent action before it commits is documented.

Sourcedocs.stacklok.com/connector-gatewayread 2026-09-22

The access surface is deep: identity providers (Okta, Microsoft Entra ID) with SCIM provisioning, directory users, groups and subgroups, virtual API keys bound to a user's identity, enterprise authorization expressed as fleet-wide MCP roles in RBAC custom resources with namespace-level delegation, Cedar policies on MCP servers, and connector credentials stored encrypted at rest in the directory.

The distribution itself carries Sigstore signatures, SLSA provenance and SBOMs the customer can verify. No third party attestation of Stacklok's own operations is published; its Security Center says none applies to a self hosted product that holds no customer data.

Sourcestacklok.com/security-centerread 2026-09-22

The AI Gateway records structured audit events for model requests, detections and key actions and forwards them to the customer's SIEM, the Connector Gateway's tool usage view shows traffic by time range, connector and tool, and an Enterprise Manager telemetry policy enforces OpenTelemetry settings across Stacklok clients so tool calls are traced into the customer's own stack. A customer can inspect what an agent sent and received, keep audit events apart from traces, and export both to its own tools.

Sourcedocs.stacklok.com/ai-gateway/forward-audit-logsread 2026-09-22

Memory sits outside what Stacklok does. It runs and governs MCP servers, skills and model traffic, and none of its documented components (the ToolHive runtime, Registry Server, vMCP, Connector Gateway, AI Gateway and Enterprise Manager) persists an agent's state or a user's context across runs.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

Everything runs inside the customer's own infrastructure. Stacklok Enterprise deploys as a single umbrella Helm chart into the customer's Kubernetes cluster, with distributed deployments across clusters and an air gapped install that mirrors the chart from a private registry, and the Security Center states that Stacklok neither hosts nor processes customer data.

Sourcedocs.stacklok.com/platformread 2026-09-22

Agent skills ship with ToolHive: reusable bundles of tools, permissions and secrets that a buyer browses in a registry and installs into its AI clients, builds from a local folder as an OCI artifact, and publishes, lists or deletes through the Registry Server's admin API, with CLI and desktop UI paths for installing, distributing and managing them.

Sourcedocs.stacklok.com/toolhive/guides-registryread 2026-09-22

Work reaches an agent through Stacklok when a client or agent calls a tool or a model: ToolHive runs the servers, the gateways broker the calls, and both are invoked by the caller. No schedule, event, webhook or inbound queue that starts an agent run is documented. Nothing wakes an agent without a person or client initiating the work.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

Customers and admins decide which model serves a request. The AI Gateway is a self hosted control point between AI clients and model providers: the customer connects OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Vertex AI and OpenAI compatible providers, then maps model names onto them with a default route, weighted load balancing, priority failover, retries and timeouts, declared as AIGateway and AIPolicy resources.

Sourcedocs.stacklok.com/ai-gatewayread 2026-09-22

Builders get an Apache 2.0 open source platform in ToolHive, with a CLI, desktop UI and Kubernetes operator, and a Registry Server implementing the MCP registry API for servers, skills and plugins. Stacklok Enterprise publishes a REST API reference for the Enterprise Manager, Connector Gateway and AI Gateway, custom resource definitions for authorization, and a management API for budgets, so the platform itself carries a documented API and SDK surface.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22

Before an MCP server goes to production, ToolHive's CLI can test and validate it, and the registry applies review criteria before a server is listed. That validates a deployment rather than evaluating a change: no scored test cases, pass rate or judge verdict that gives a readable, comparable result is documented.

Sourcedocs.stacklok.com/toolhive/guides-cli/test-mcp-serversread 2026-09-22

The product governs and runs MCP servers and model traffic, and drives no interface itself. No browser, desktop or remote computer session operated for an agent is documented, and no headless fetch or third party browsing engine is wired in.

Sourcedocs.stacklok.com/toolhiveread 2026-09-22