Document audit, k8s export, and image verification CLI flags

[danbarr]

Description

This fills three high-priority CLI flag gaps from issue #654 in the Run MCP servers guide. It documents audit logging on thv run (explaining the difference between --enable-audit for built-in defaults and --audit-config for a custom config file, what events are captured, where they go, and the audit config fields), adds the thv export --format k8s option alongside the existing JSON export (including the generated MCPServer manifest and the secrets, OIDC, and telemetry settings that must be configured separately when deploying with the operator), and documents the --image-verification flag with its warn/enabled/disabled values, warn default, and behavior for servers with and without provenance information. Every flag name, accepted value, default, field name, and described behavior was verified against the ToolHive source and the auto-generated CLI reference.

Type of change

• Documentation update

Related issues/PRs

Addresses #654 (high-priority gaps # 2 audit logging, # 5 export to Kubernetes, # 6 image verification)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-website	Ready	Preview, Comment	Jun 12, 2026 4:08am

[Copilot]

Pull request overview

Updates the ToolHive CLI “Run MCP servers” guide to close documentation gaps around three high-priority thv flags/options: audit logging on thv run, Kubernetes YAML export via thv export --format k8s, and container image verification behavior via --image-verification.

Changes:

• Added a new “Enable audit logging” section documenting --enable-audit and --audit-config, including an example audit config file and guidance on payload capture.
• Added a new “Verify container image signatures” section documenting --image-verification modes (warn|enabled|disabled) and expected behavior.
• Expanded the “Export a server configuration” section to cover --format (json|k8s), including a sample MCPServer manifest and operator-related follow-ups (secrets/OIDC/telemetry).

[danbarr]

Thanks @copilot-pull-request-reviewer, all seven comments were addressed in 38a55c9:

• Named the eventTypes / excludeEventTypes audit fields and added eventTypes to the example.
• Changed the example logFile to a writable relative path and noted it must be writable by the user running thv.
• Reworded the audit note to "use either flag" and clarified --audit-config enables auditing on its own.
• Fixed the image-verification note: missing provenance is now framed as a verification failure, so warn and enabled diverge without the earlier "applies only" contradiction.
• Clarified that thv export operates on an existing workload's saved run configuration.
• Reframed the Kubernetes export caveat around what thv export doesn't populate (not what the CRD can express), and added that secrets must be referenced via spec.secrets (name, key, optional targetEnvName).