Almost every "install this MCP server" instruction ends with an npx or uvx command. That command downloads and runs whatever code the author shipped, on your machine, with your shell environment and whatever API keys are sitting in your dotfiles. The Model Context Protocol gave us a slick distribution model and quietly skipped the threat model. ToolHive, an Apache 2.0 project from Stacklok with 1.8k GitHub stars, treats that omission as the security problem it actually is.
The premise is blunt: never run an MCP server naked on your host. ToolHive wraps every server in an isolated container with a minimal permission profile and no access to your local credentials. On top of that it manages encrypted secrets and lets you lock down network isolation with local tooling, so a server that only needs to read one API cannot quietly open a socket to somewhere else. As a bonus, its semantic tool search trims token usage by up to 85 percent, which matters once you have a dozen servers attached to one agent.
It is written almost entirely in Go (99.7 percent of the repo) and ships three ways to drive it: a desktop UI, the thv command-line tool, and a Kubernetes operator. The operator is where the enterprise story lives: OIDC/OAuth SSO, secure token exchange, audit logging, OpenTelemetry traces and Prometheus metrics, all declared through custom resources. The latest release, v0.28.3, landed on 2026-05-22, so this is shipping software, not a manifesto.
Comparison data
| Container isolation | Encrypted secrets | Network isolation | Audit logging | |
|---|---|---|---|---|
| Raw npx/uvx install | No | No | No | No |
| ToolHive | Yes | Yes | Yes | Yes |
Now the part the landing page will not lead with. A container is not a sandbox in the strict sense. Containers share the host kernel, so a container-escape bug still reaches your machine.
And the deeper limit is conceptual: ToolHive isolates the server, but it does not vet it. You still pull an image and trust whoever built it and the registry it came from. A malicious tool inside the box can abuse exactly the network and secrets you granted it, and prompt injection against the model works the same as it does anywhere else. The permission profile is only as tight as you bother to make it.
That is not a reason to skip it. A minimal-permission container with audit logs beats a raw process running with your full identity, every time. Just price it correctly: ToolHive shrinks the blast radius of a hostile MCP server. It does not remove the bomb. Curate the registry you pull from, then put it in the box.