Skip to content

Commit ebd2cd8

Browse files
github-actions[bot]github-actions[bot]
authored
Update ToolHive reference docs for v0.8.2
1 parent 4480327 commit ebd2cd8

3 files changed

Lines changed: 151 additions & 114 deletions

File tree

‎docs/toolhive/reference/cli/thv_proxy.md‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -97,40 +97,42 @@ thv proxy [flags] SERVER_NAME
9797
### Options
9898

9999
```
100-
-h, --help help for proxy
101-
--host string Host for the HTTP proxy to listen on (IP or hostname) (default "127.0.0.1")
102-
--oidc-audience string Expected audience for the token
103-
--oidc-client-id string OIDC client ID
104-
--oidc-client-secret string OIDC client secret (optional, for introspection)
105-
--oidc-introspection-url string URL for token introspection endpoint
106-
--oidc-issuer string OIDC issuer URL (e.g., https://accounts.google.com)
107-
--oidc-jwks-url string URL to fetch the JWKS from
108-
--oidc-scopes strings OAuth scopes to advertise in the well-known endpoint (RFC 9728, defaults to 'openid' if not specified)
109-
--port int Port for the HTTP proxy to listen on (host port)
110-
--remote-auth Enable OAuth/OIDC authentication to remote MCP server (default false)
111-
--remote-auth-authorize-url string OAuth authorization endpoint URL (alternative to --remote-auth-issuer for non-OIDC OAuth)
112-
--remote-auth-bearer-token string Bearer token for remote server authentication (alternative to OAuth)
113-
--remote-auth-bearer-token-file string Path to file containing bearer token (alternative to --remote-auth-bearer-token)
114-
--remote-auth-callback-port int Port for OAuth callback server during remote authentication (default 8666)
115-
--remote-auth-client-id string OAuth client ID for remote server authentication (optional if the authorization server supports dynamic client registration (RFC 7591))
116-
--remote-auth-client-secret string OAuth client secret for remote server authentication (optional if the authorization server supports dynamic client registration (RFC 7591) or if using PKCE)
117-
--remote-auth-client-secret-file string Path to file containing OAuth client secret (alternative to --remote-auth-client-secret) (optional if the authorization server supports dynamic client registration (RFC 7591) or if using PKCE)
118-
--remote-auth-issuer string OAuth/OIDC issuer URL for remote server authentication (e.g., https://accounts.google.com)
119-
--remote-auth-resource string OAuth 2.0 resource indicator (RFC 8707)
120-
--remote-auth-scopes strings OAuth scopes to request for remote server authentication (defaults: OIDC uses 'openid,profile,email')
121-
--remote-auth-skip-browser Skip opening browser for remote server OAuth flow (default false)
122-
--remote-auth-timeout duration Timeout for OAuth authentication flow (e.g., 30s, 1m, 2m30s) (default 30s)
123-
--remote-auth-token-url string OAuth token endpoint URL (alternative to --remote-auth-issuer for non-OIDC OAuth)
124-
--resource-url string Explicit resource URL for OAuth discovery endpoint (RFC 9728)
125-
--target-uri string URI for the target MCP server (e.g., http://localhost:8080) (required)
126-
--token-exchange-audience string Target audience for exchanged tokens
127-
--token-exchange-client-id string OAuth client ID for token exchange operations
128-
--token-exchange-client-secret string OAuth client secret for token exchange operations
129-
--token-exchange-client-secret-file string Path to file containing OAuth client secret for token exchange (alternative to --token-exchange-client-secret)
130-
--token-exchange-header-name string Custom header name for injecting exchanged token (default: replaces Authorization header)
131-
--token-exchange-scopes strings Scopes to request for exchanged tokens
132-
--token-exchange-subject-token-type string Type of subject token to exchange. Accepts: access_token (default), id_token (required for Google STS)
133-
--token-exchange-url string OAuth 2.0 token exchange endpoint URL (enables token exchange when provided)
100+
-h, --help help for proxy
101+
--host string Host for the HTTP proxy to listen on (IP or hostname) (default "127.0.0.1")
102+
--oidc-audience string Expected audience for the token
103+
--oidc-client-id string OIDC client ID
104+
--oidc-client-secret string OIDC client secret (optional, for introspection)
105+
--oidc-introspection-url string URL for token introspection endpoint
106+
--oidc-issuer string OIDC issuer URL (e.g., https://accounts.google.com)
107+
--oidc-jwks-url string URL to fetch the JWKS from
108+
--oidc-scopes strings OAuth scopes to advertise in the well-known endpoint (RFC 9728, defaults to 'openid' if not specified)
109+
--port int Port for the HTTP proxy to listen on (host port)
110+
--remote-auth Enable OAuth/OIDC authentication to remote MCP server (default false)
111+
--remote-auth-authorize-url string OAuth authorization endpoint URL (alternative to --remote-auth-issuer for non-OIDC OAuth)
112+
--remote-auth-bearer-token string Bearer token for remote server authentication (alternative to OAuth)
113+
--remote-auth-bearer-token-file string Path to file containing bearer token (alternative to --remote-auth-bearer-token)
114+
--remote-auth-callback-port int Port for OAuth callback server during remote authentication (default 8666)
115+
--remote-auth-client-id string OAuth client ID for remote server authentication (optional if the authorization server supports dynamic client registration (RFC 7591))
116+
--remote-auth-client-secret string OAuth client secret for remote server authentication (optional if the authorization server supports dynamic client registration (RFC 7591) or if using PKCE)
117+
--remote-auth-client-secret-file string Path to file containing OAuth client secret (alternative to --remote-auth-client-secret) (optional if the authorization server supports dynamic client registration (RFC 7591) or if using PKCE)
118+
--remote-auth-issuer string OAuth/OIDC issuer URL for remote server authentication (e.g., https://accounts.google.com)
119+
--remote-auth-resource string OAuth 2.0 resource indicator (RFC 8707)
120+
--remote-auth-scopes strings OAuth scopes to request for remote server authentication (defaults: OIDC uses 'openid,profile,email')
121+
--remote-auth-skip-browser Skip opening browser for remote server OAuth flow (default false)
122+
--remote-auth-timeout duration Timeout for OAuth authentication flow (e.g., 30s, 1m, 2m30s) (default 30s)
123+
--remote-auth-token-url string OAuth token endpoint URL (alternative to --remote-auth-issuer for non-OIDC OAuth)
124+
--remote-forward-headers stringArray Headers to inject into requests to remote server (format: Name=Value, can be repeated)
125+
--remote-forward-headers-secret stringArray Headers with secret values from ToolHive secrets manager (format: Name=secret-name, can be repeated)
126+
--resource-url string Explicit resource URL for OAuth discovery endpoint (RFC 9728)
127+
--target-uri string URI for the target MCP server (e.g., http://localhost:8080) (required)
128+
--token-exchange-audience string Target audience for exchanged tokens
129+
--token-exchange-client-id string OAuth client ID for token exchange operations
130+
--token-exchange-client-secret string OAuth client secret for token exchange operations
131+
--token-exchange-client-secret-file string Path to file containing OAuth client secret for token exchange (alternative to --token-exchange-client-secret)
132+
--token-exchange-header-name string Custom header name for injecting exchanged token (default: replaces Authorization header)
133+
--token-exchange-scopes strings Scopes to request for exchanged tokens
134+
--token-exchange-subject-token-type string Type of subject token to exchange. Accepts: access_token (default), id_token (required for Google STS)
135+
--token-exchange-url string OAuth 2.0 token exchange endpoint URL (enables token exchange when provided)
134136
```
135137

136138
### Options inherited from parent commands

0 commit comments

Comments
 (0)