Update ToolHive reference docs for v0.6.12 (#392)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

docs/toolhive/reference/cli/thv_config.md

@@ -32,13 +32,16 @@ The config command provides subcommands to manage application configuration sett
 ### SEE ALSO
 
 * [thv](thv.md)	 - ToolHive (thv) is a lightweight, secure, and fast manager for MCP servers
+* [thv config get-build-auth-file](thv_config_get-build-auth-file.md)	 - Get build auth file configuration
 * [thv config get-build-env](thv_config_get-build-env.md)	 - Get build environment variables
 * [thv config get-ca-cert](thv_config_get-ca-cert.md)	 - Get the currently configured CA certificate path
 * [thv config get-registry](thv_config_get-registry.md)	 - Get the currently configured registry
 * [thv config otel](thv_config_otel.md)	 - Manage OpenTelemetry configuration
+* [thv config set-build-auth-file](thv_config_set-build-auth-file.md)	 - Set an auth file for protocol builds
 * [thv config set-build-env](thv_config_set-build-env.md)	 - Set a build environment variable for protocol builds
 * [thv config set-ca-cert](thv_config_set-ca-cert.md)	 - Set the default CA certificate for container builds
 * [thv config set-registry](thv_config_set-registry.md)	 - Set the MCP server registry
+* [thv config unset-build-auth-file](thv_config_unset-build-auth-file.md)	 - Remove build auth file(s)
 * [thv config unset-build-env](thv_config_unset-build-env.md)	 - Remove build environment variable(s)
 * [thv config unset-ca-cert](thv_config_unset-ca-cert.md)	 - Remove the configured CA certificate
 * [thv config unset-registry](thv_config_unset-registry.md)	 - Remove the configured registry

docs/toolhive/reference/cli/thv_config_get-build-auth-file.md

@@ -0,0 +1,50 @@
+---
+title: thv config get-build-auth-file
+hide_title: true
+description: Reference for ToolHive CLI command `thv config get-build-auth-file`
+last_update:
+  author: autogenerated
+slug: thv_config_get-build-auth-file
+mdx:
+  format: md
+---
+
+## thv config get-build-auth-file
+
+Get build auth file configuration
+
+### Synopsis
+
+Display configured build auth files.
+If a name is provided, shows only that specific file.
+If no name is provided, shows all configured files.
+
+By default, file contents are hidden to prevent credential exposure.
+Use --show-content to display the actual content.
+
+Examples:
+  thv config get-build-auth-file                    # Show all files (content hidden)
+  thv config get-build-auth-file npmrc              # Show specific file (content hidden)
+  thv config get-build-auth-file npmrc --show-content  # Show with content
+
+```
+thv config get-build-auth-file [name] [flags]
+```
+
+### Options
+
+```
+  -h, --help           help for get-build-auth-file
+      --show-content   Show the actual file content (contains credentials)
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv config](thv_config.md)	 - Manage application configuration
+

docs/toolhive/reference/cli/thv_config_set-build-auth-file.md

@@ -0,0 +1,63 @@
+---
+title: thv config set-build-auth-file
+hide_title: true
+description: Reference for ToolHive CLI command `thv config set-build-auth-file`
+last_update:
+  author: autogenerated
+slug: thv_config_set-build-auth-file
+mdx:
+  format: md
+---
+
+## thv config set-build-auth-file
+
+Set an auth file for protocol builds
+
+### Synopsis
+
+Set authentication file content that will be injected into the container
+during protocol builds (npx://, uvx://, go://). This is useful for authenticating
+to private package registries.
+
+Supported file types:
+  npmrc  - NPM configuration (~/.npmrc) for npm/npx registries
+  netrc  - Netrc file (~/.netrc) for pip, Go, and other tools
+  yarnrc - Yarn configuration (~/.yarnrc)
+
+The file content is injected into the build stage only and is NOT included
+in the final container image.
+
+Examples:
+  # Set npmrc for private npm registry
+  thv config set-build-auth-file npmrc '//npm.corp.example.com/:_authToken=TOKEN'
+
+  # Set netrc for pip/Go authentication
+  thv config set-build-auth-file netrc 'machine github.com login git password TOKEN'
+
+  # Read content from stdin (avoids exposing secrets in shell history)
+  cat ~/.npmrc | thv config set-build-auth-file npmrc --stdin
+  thv config set-build-auth-file npmrc --stdin < ~/.npmrc
+
+Note: For multi-line content, use quotes, heredoc syntax, or --stdin.
+
+```
+thv config set-build-auth-file <name> [content] [flags]
+```
+
+### Options
+
+```
+  -h, --help    help for set-build-auth-file
+      --stdin   Read file content from stdin instead of command line argument
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv config](thv_config.md)	 - Manage application configuration
+

docs/toolhive/reference/cli/thv_config_unset-build-auth-file.md

@@ -0,0 +1,44 @@
+---
+title: thv config unset-build-auth-file
+hide_title: true
+description: Reference for ToolHive CLI command `thv config unset-build-auth-file`
+last_update:
+  author: autogenerated
+slug: thv_config_unset-build-auth-file
+mdx:
+  format: md
+---
+
+## thv config unset-build-auth-file
+
+Remove build auth file(s)
+
+### Synopsis
+
+Remove a specific build auth file or all files.
+
+Examples:
+  thv config unset-build-auth-file npmrc  # Remove specific file
+  thv config unset-build-auth-file --all  # Remove all files
+
+```
+thv config unset-build-auth-file [name] [flags]
+```
+
+### Options
+
+```
+      --all    Remove all build auth files
+  -h, --help   help for unset-build-auth-file
+```
+
+### Options inherited from parent commands
+
+```
+      --debug   Enable debug mode
+```
+
+### SEE ALSO
+
+* [thv config](thv_config.md)	 - Manage application configuration
+

docs/toolhive/reference/cli/thv_proxy.md

@@ -105,6 +105,7 @@ thv proxy [flags] SERVER_NAME
       --oidc-introspection-url string              URL for token introspection endpoint
       --oidc-issuer string                         OIDC issuer URL (e.g., https://accounts.google.com)
       --oidc-jwks-url string                       URL to fetch the JWKS from
+      --oidc-scopes strings                        OAuth scopes to advertise in the well-known endpoint (RFC 9728, defaults to 'openid' if not specified)
       --port int                                   Port for the HTTP proxy to listen on (host port)
       --remote-auth                                Enable OAuth/OIDC authentication to remote MCP server
       --remote-auth-authorize-url string           OAuth authorization endpoint URL (alternative to --remote-auth-issuer for non-OIDC OAuth)

docs/toolhive/reference/cli/thv_run.md

@@ -114,6 +114,7 @@ thv run [flags] SERVER_OR_IMAGE_OR_PROTOCOL [-- ARGS...]
       --oidc-introspection-url string              URL for token introspection endpoint
       --oidc-issuer string                         OIDC issuer URL (e.g., https://accounts.google.com)
       --oidc-jwks-url string                       URL to fetch the JWKS from
+      --oidc-scopes strings                        OAuth scopes to advertise in the well-known endpoint (RFC 9728, defaults to 'openid' if not specified)
       --otel-custom-attributes string              Custom resource attributes for OpenTelemetry in key=value format (e.g., server_type=prod,region=us-east-1,team=platform)
       --otel-enable-prometheus-metrics-path        Enable Prometheus-style /metrics endpoint on the main transport port
       --otel-endpoint string                       OpenTelemetry OTLP endpoint URL (e.g., https://api.honeycomb.io)

docs/toolhive/reference/cli/thv_serve.md

@@ -35,6 +35,7 @@ thv serve [flags]
       --oidc-introspection-url string   URL for token introspection endpoint
       --oidc-issuer string              OIDC issuer URL (e.g., https://accounts.google.com)
       --oidc-jwks-url string            URL to fetch the JWKS from
+      --oidc-scopes strings             OAuth scopes to advertise in the well-known endpoint (RFC 9728, defaults to 'openid' if not specified)
       --openapi                         Enable OpenAPI documentation endpoints (/api/openapi.json and /api/doc)
       --port int                        Port to bind the server to (default 8080)
       --socket string                   UNIX socket path to bind the server to (overrides host and port if provided)

static/api-specs/toolhive-api.yaml

@@ -80,6 +80,13 @@ components:
           description: ResourceURL is the explicit resource URL for OAuth discovery
             (RFC 9728)
           type: string
+        scopes:
+          description: |-
+            Scopes is the list of OAuth scopes to advertise in the well-known endpoint (RFC 9728)
+            If empty, defaults to ["openid"]
+          items:
+            type: string
+          type: array
       type: object
     authz.CedarConfig:
       description: |-
@@ -228,11 +235,6 @@ components:
             StatusContext provides additional context about the workload's status.
             The exact meaning is determined by the status and the underlying runtime.
           type: string
-        tool_type:
-          description: |-
-            ToolType is the type of tool this workload represents.
-            For now, it will always be "mcp" - representing an MCP server.
-          type: string
         tools:
           description: ToolsFilter is the filter on tools applied to the workload.
           items:
@@ -1457,6 +1459,12 @@ components:
         jwks_url:
           description: JWKS URL for key verification
           type: string
+        scopes:
+          description: OAuth scopes to advertise in well-known endpoint (RFC 9728)
+          items:
+            type: string
+          type: array
+          uniqueItems: false
       type: object
     v1.providerCapabilitiesResponse:
       description: Capabilities of the secrets provider

static/api-specs/toolhive-legacy-registry.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/stacklok/toolhive/main/pkg/registry/data/schema.json",
+  "$id": "https://raw.githubusercontent.com/stacklok/toolhive/main/pkg/registry/data/toolhive-legacy-registry.schema.json",
   "title": "ToolHive MCP Server Registry Schema",
   "description": "JSON Schema for the ToolHive MCP server registry. This schema validates the structure and content of registry.json entries for MCP servers. See docs/registry/management.md and docs/registry/heuristics.md for inclusion criteria and management processes.",
   "type": "object",