governance:
  access:
    # An identity source is what raises the gateway's reachable trust ceiling
    # to `verified`. Without one the tool below never reaches tools/list.
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.amqp
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-amqp:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: jobs.enqueue
        title: "Enqueue job"
        description: Enqueue a background job on the work queue.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            task: { type: string }
            payload: { type: object }
          required: [task]
        backend:
          kind: amqp
          uri: "amqps://mcpg:${env.RABBIT_PASSWORD}@rabbit.internal:5671/%2f"
          op: publish
          routing_key: "jobs"
          content_type: application/json
          timeout_ms: 10000

gateway:
  server:
    # Raises the reachable trust ceiling to `header_asserted`. Without it the
    # ceiling is `unauthenticated` and the tool below is filtered out.
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.bigquery
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-bigquery:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: analytics.daily_signups
        title: "Daily signups"
        description: Daily signup counts since a given date.
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            since: { type: string }
          required: [since]
        backend:
          kind: bigquery
          project_id: "acme-analytics"
          dataset: "analytics"
          location: "EU"
          auth:
            mode: service_account
            credentials_json: "${env.BIGQUERY_SA_KEY}"
          query:
            read_only: true
            max_rows: 1000
            maximum_bytes_billed: 1073741824   # 1 GiB cost cap
            timeout_ms: 60000
          statement: "SELECT day, count(*) AS signups FROM `acme-analytics.analytics.events` WHERE day >= ? GROUP BY day ORDER BY day"
          params: ["arguments.since"]

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.clickhouse
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-clickhouse:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: events.by_user
        title: "Recent user events"
        description: Recent events for a user.
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            user_id: { type: string }
          required: [user_id]
        backend:
          kind: clickhouse
          url: "https://ch.internal:8443"
          database: analytics
          auth:
            username: reader
            password: "${env.CLICKHOUSE_READER_PASSWORD}"
          statement: "SELECT event, ts FROM events WHERE user_id = ? ORDER BY ts DESC LIMIT 100"
          params: ["arguments.user_id"]
          query:
            read_only: true
            max_execution_time_ms: 30000
            max_result_rows: 10000

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.command
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.command/plugin.so }

mcp:
  capabilities:
    tools:
      - name: docs.render
        title: "Render document"
        description: Render a document with the local renderer CLI.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            id: { type: string }
          required: [id]
        backend:
          kind: command
          command: /usr/local/bin/render
          args: ["--format", "json", "--id", "${arguments.id}"]
          timeout_ms: 5000
          max_output_bytes: 65536
          require_json_stdout: true

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.duckdb
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-duckdb:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: analytics.region_revenue
        title: "Region revenue"
        description: Quarterly revenue by region from the Parquet lake.
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            quarter: { type: string }
          required: [quarter]
        backend:
          kind: duckdb
          database: ":memory:"
          read_only: true
          allow_external_access: true
          init_sql:
            - "INSTALL httpfs; LOAD httpfs;"
            - "CREATE SECRET s3 (TYPE S3, KEY_ID '${env.AWS_LAKE_ACCESS_KEY_ID}', SECRET '${env.AWS_LAKE_SECRET_ACCESS_KEY}', REGION 'eu-west-1')"
          statement: "SELECT region, sum(amount) AS revenue FROM read_parquet('s3://acme-lake/sales/*.parquet') WHERE quarter = ? GROUP BY region"
          params: ["arguments.quarter"]
          query:
            statement_timeout_ms: 60000
            max_rows: 10000

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.dynamodb
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-dynamodb:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      # No hand-written input_schema: the plugin derives one that marks
      # `key_condition_expression` required, and a hand-written `required`
      # array would REPLACE that wholesale and advertise a call shape that
      # errors on every invocation.
      - name: orders.by_customer
        title: "Orders by customer"
        description: >-
          Query a customer's orders by status. Call with
          key_condition_expression: "customer_id = :cid AND #s = :status".
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: verified
        backend:
          kind: dynamodb
          region: us-east-1
          table: orders
          operation: query
          partition_key: { name: customer_id, type: S }
          sort_key: { name: status, type: S }
          # Operator-fixed placeholders; bound server-side, never interpolated.
          params:
            ":cid": "arguments.customer_id"
            ":status": "arguments.status"
          limits:
            max_page_size: 100
            timeout_ms: 8000

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.elasticsearch
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-elasticsearch:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: logs.search
        title: "Search logs"
        description: Full-text search over the application logs.
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: header_asserted
        backend:
          kind: elasticsearch
          urls: ["https://es.internal:9200"]
          operation: search
          index_allowlist: ["logs-*"]
          default_index: logs-app
          max_size: 200
          operation_timeout_ms: 30000
          auth:
            kind: api_key
            api_key: "${env.ES_API_KEY}"

      - name: logs.index_event
        title: "Index log event"
        description: Index a structured log document.
        governance:
          minimum_trust: verified
        backend:
          kind: elasticsearch
          urls: ["https://es.internal:9200"]
          operation: index
          index_allowlist: ["logs-app"]
          default_index: logs-app
          allow_writes: true
          auth:
            kind: basic
            username: ingest
            password: "${env.ES_INGEST_PASSWORD}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.email
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-email:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: alerts.notify
        title: "Send alert email"
        description: Send an alert email.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            to: { type: string }
            subject: { type: string }
            body: { type: string }
          required: [to, subject, body]
        backend:
          kind: email
          op: send
          host: "smtp.corp.example.com"
          port: 587
          tls: starttls
          username: "svc-mcpg"
          password: "${env.SMTP_PASSWORD}"
          from: "alerts@corp.example.com"
          timeout_ms: 15000

      - name: inbox.recent
        title: "Recent inbox mail"
        description: Read the most recent messages from the shared inbox.
        annotations: { read_only: true }
        governance:
          minimum_trust: verified
        backend:
          kind: email
          op: read
          host: "imap.corp.example.com"
          port: 993
          tls: implicit
          username: "shared-inbox@corp.example.com"
          password: "${env.IMAP_PASSWORD}"
          mailbox: INBOX
          limit: 20

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.ftp
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-ftp:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: dropbox.read
        title: "Read partner file"
        description: Read a file from the partner drop directory.
        annotations: { read_only: true }
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            path: { type: string }
          required: [path]
        backend:
          kind: ftp
          op: get
          host: "ftp.partner.example.com"
          port: 21
          user: "svc-mcpg"
          password: "${env.FTP_PASSWORD}"
          tls: true                 # require FTPS (default)
          path: "/outbound"
          max_bytes: 10485760
          timeout_ms: 15000

gateway:
  server:
    trust_subject_header: true

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities:
      - network_outbound

mcp:
  capabilities:
    tools:
      - name: catalog.list_products
        title: "List products"
        description: List products from the catalog service.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            limit: { type: integer }
        backend:
          kind: graphql
          url: "https://catalog.internal/graphql"
          operation: "query($limit: Int) { products(limit: $limit) { id name } }"
          timeout_ms: 2000
          max_response_bytes: 65536
          headers:
            authorization: "Bearer ${env.CATALOG_API_TOKEN}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.grpc
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.grpc/plugin.so }
    granted_capabilities:
      - network_outbound

mcp:
  capabilities:
    tools:
      - name: users.get
        title: "Get user"
        description: Look up a user record.
        annotations: { read_only: true }
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            id: { type: string }
          required: [id]
        backend:
          kind: grpc
          url: "https://users.internal:8443"
          service: user.v1.UserService
          method: GetUser
          timeout_ms: 2000
          max_response_bytes: 65536
          headers:
            authorization: "Bearer ${env.USERS_API_TOKEN}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.hana
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-hana:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: sap.order_lookup
        title: "Look up SAP order"
        description: Look up a sales order in SAP HANA by id.
        annotations: { read_only: true, open_world: false }
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            order_id: { type: string }
          required: [order_id]
        backend:
          kind: hana
          host: "hana.corp.example.com"
          port: 39015
          user: "MCPG_READER"
          password: "${env.HANA_READER_PASSWORD}"
          database: "HXE"
          use_tls: true
          tls_verify_peer: true
          operation: query
          read_only: true
          query: "SELECT ORDER_ID, CUSTOMER, TOTAL FROM SALES.ORDERS WHERE ORDER_ID = ?"
          params: ["arguments.order_id"]
          pool_max_size: 6
          timeout_ms: 5000
          max_rows: 1000

gateway:
  server:
    trust_subject_header: true

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities:
      - network_outbound

  # A `cred://` reference resolves per request against a registered
  # credential_issuer. Naming an issuer that no plugins[] entry declares
  # fails EVERY call with "unknown credential_issuer plugin".
  - id: dev.mcpg.credential.static
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-static:protocol-1" }
    config:
      targets:
        orders-api:
          value: "${env.ORDERS_API_TOKEN}"
          ttl_seconds: 3600

mcp:
  capabilities:
    tools:
      - name: orders.fetch
        title: "Fetch order"
        description: Fetch an order by id.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            id: { type: string }
          required: [id]
        backend:
          kind: http
          url: "https://orders.internal/v1/orders/${arguments.id}"
          method: get
          timeout_ms: 2000
          max_response_bytes: 65536
          expected_status_codes: [200]
          require_json_response: true
          headers:
            authorization: "Bearer ${cred://dev.mcpg.credential.static/orders-api}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.kafka
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-kafka:protocol-1" }
    granted_capabilities:
      - network_outbound
    config:
      bootstrap_servers: "kafka-1:9092,kafka-2:9092"
      group_id: mcpg

mcp:
  capabilities:
    tools:
      - name: events.enrich
        title: "Enrich event"
        description: Enrich an event through the enrichment worker.
        governance:
          minimum_trust: verified
        backend:
          kind: kafka
          request_topic: enrich.requests
          response_topic: enrich.responses
          timeout_ms: 10000
          max_response_bytes: 65536
          security_protocol: SASL_SSL
          sasl_mechanism: SCRAM-SHA-256
          sasl_username: "${env.KAFKA_USERNAME}"
          sasl_password: "${env.KAFKA_PASSWORD}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.ldap
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-ldap:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: directory.search_people
        title: "Search directory"
        description: Find people in the corporate directory.
        annotations: { read_only: true }
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            q: { type: string }
          required: [q]
        backend:
          kind: ldap
          url: "ldaps://dc1.corp.example.com:636"
          bind_dn: "cn=svc-mcpg,ou=svc,dc=corp,dc=example,dc=com"
          bind_password: "${env.LDAP_SVC_PASSWORD}"
          base_dn: "ou=people,dc=corp,dc=example,dc=com"
          scope: subtree
          filter: "(&(objectClass=person)(|(cn=*${arguments.q}*)(mail=*${arguments.q}*)))"
          attributes: [cn, mail, department, manager, memberOf]
          size_limit: 100
          timeout_ms: 10000

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.llm.anthropic
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-llm-anthropic:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: incident.summarize
        title: "Summarise incident"
        description: Summarise an incident report into a structured verdict.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            report: { type: string }
          required: [report]
        backend:
          kind: anthropic_chat
          api_key: "${env.ANTHROPIC_API_KEY}"
          model: claude-sonnet-4-5
          prompt:
            system: You are a terse incident analyst. Answer only as JSON.
            user: "Summarise this report:\n{{ input.report }}"
          sampling:
            temperature: 0
            max_completion_tokens: 1024
          response_format:
            mode: json_schema
            on_mismatch: retry_once
          budget:
            usd_daily_cap: 25
          output_schema:
            type: object
            properties:
              severity: { type: string }
              summary:  { type: string }
            required: [severity, summary]

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.llm.compat
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-llm-compat:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: local.chat
        title: "Local model chat"
        description: Chat with the in-cluster vLLM deployment.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            question: { type: string }
          required: [question]
        backend:
          kind: compat_chat
          base_url: "http://vllm.internal.svc:8000/v1"   # required
          # api_key omitted — this vLLM endpoint accepts unauthenticated requests
          model: meta-llama/Llama-3.1-8B-Instruct
          prompt:
            system: You are a concise assistant.
            user: "{{ input.question }}"
          response_format:
            mode: text
          sampling:
            temperature: 0.2
            max_completion_tokens: 1024

      - name: local.embed
        title: "Embed passages"
        description: Embed passages against the local inference server.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        backend:
          kind: compat_embedding
          base_url: "http://vllm.internal.svc:8000/v1"
          model: BAAI/bge-large-en-v1.5
          max_batch_size: 64
          cache: { enabled: true }

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.llm.gemini
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-llm-gemini:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: page.extract
        description: Extract structured order details from a screenshot.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            shot: { type: string, description: "image URL or mcpg-resource:// URI" }
          required: [shot]
        backend:
          kind: gemini_chat
          api_key: "${env.GEMINI_API_KEY}"
          model: gemini-2.0-flash
          prompt:
            system: You read screenshots and answer only as JSON.
            user: Extract the visible order details.
            image_inputs: [shot]
          sampling: { temperature: 0 }
          response_format: { mode: json_schema }
          output_schema:
            type: object
            properties:
              order_id: { type: string }
              total: { type: string }
            required: [order_id]
          budget: { usd_daily_cap: 25 }

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.llm.openai
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-llm-openai:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: ticket.classify
        description: Classify a support ticket into a category and urgency.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            body: { type: string }
          required: [body]
        backend:
          kind: openai_chat            # or azure_openai_chat with a full base_url
          api_key: "${env.OPENAI_API_KEY}"
          model: gpt-4o-mini
          prompt:
            system: You classify support tickets. Answer only as JSON.
            user: "{{ input.body }}"
          sampling: { temperature: 0 }
          response_format: { mode: json_schema }
          output_schema:
            type: object
            properties:
              category: { type: string }
              urgency: { type: string }
            required: [category, urgency]
          budget: { usd_daily_cap: 50 }

      - name: docs.embed
        description: Embed one or more passages.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: openai_embedding
          api_key: "${env.OPENAI_API_KEY}"
          model: text-embedding-3-small
          dimensions: 512
          cache: { enabled: true }

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.llm.stability
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-llm-stability:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: art.generate
        description: Generate an illustration from a prompt.
        annotations: { read_only: false, open_world: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            prompt: { type: string }
            size: { type: string, description: "WxH pixels or a W:H ratio" }
          required: [prompt]
        backend:
          kind: stability_image
          api_key: "${env.STABILITY_API_KEY}"
          model: core                 # core | sd3 | ultra
          timeout_ms: 60000
          defaults:
            size: "1024x1024"
            output_format: webp
            negative_prompt: "blurry, low quality"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.markdown
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-markdown:protocol-1" }
    # Declared because the opt-in `sources.url` mode can open a socket; the
    # grant is fail-closed, so the entry must carry it either way.
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: convert_to_markdown
        description: Convert a document (DOCX, PDF, XLSX, EPUB, .msg, ...) to Markdown.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: markdown
          limits:
            # Byte ceilings are plain integers — there is no human-size parser,
            # and a "20Mi" string fails registration. Omitted keys take the
            # engine defaults (20 MiB in, 4 MiB out, 200 MiB expanded).
            max_depth: 3
            max_embedded_documents: 64
            max_table_rows: 5000
            timeout_ms: 30000
          output:
            front_matter: yaml            # none | yaml | toml
            tables: gfm                   # gfm | html | csv
          formats:
            enable: [text, csv, json, ipynb, xml, feed, html,
                     docx, pptx, spreadsheet, epub, zip, pdf,
                     image, audio, msg]
          sources:
            inline: true                  # `content` (base64) or `text` argument
            resource: true                # mcpg-resource:// from the content store
            url: false                    # https:// fetch stays off unless opted in

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.mock
    class: backend
    kind: native
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.mock/plugin.so }
    # No granted_capabilities: the plugin declares no required capabilities.

mcp:
  capabilities:
    tools:
      - name: dev.echo
        description: Returns a fixed fixture response for local development.
        input_schema:
          type: object
          properties:
            query: { type: string }
        backend:
          kind: mock
          response: { status: ok, items: [{ id: item-1, label: First item }] }
          delay_ms: 0
          error: false
          passthrough: false
        governance:
          minimum_trust: unauthenticated

      - name: dev.error_scenario
        description: Simulates an upstream failure so error handling can be tested.
        backend:
          kind: mock
          response: null
          error: true
          error_message: "simulated upstream timeout"
        governance:
          minimum_trust: unauthenticated

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.mssql
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-mssql:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: directory.find_employee
        description: Look up an employee by id.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { id: { type: integer } }
          required: [id]
        backend:
          kind: mssql
          host: "sql1.corp.example.com"
          port: 1433
          database: "HR"
          user: "svc_mcpg"
          password: "${env.MSSQL_HR_PASSWORD}"
          encryption: required
          trust_server_certificate: true
          op: query
          query: "SELECT id, full_name, email FROM dbo.employees WHERE id = @P1"
          params: ["arguments.id"]       # bound to @P1 as a TDS parameter
          size_limit: 100
          pool_max_size: 8
          timeout_ms: 10000

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.nats
    class: backend
    kind: native
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-nats:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: pricing.quote
        description: Request a price quote from the pricing worker over NATS.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { sku: { type: string } }
          required: [sku]
        backend:
          kind: nats
          url: "nats://nats.internal:4222"
          subject: pricing.quote
          timeout_ms: 2000
          max_response_bytes: 65536
          # credentials_path: /etc/mcpg/nats.creds

    resources:
      # The same artifact ships the `nats_topic` watch strategy, so a resource
      # can be invalidated by a message on a subject.
      - name: catalog.snapshot
        description: The product catalog.
        uri: "catalog://snapshot"
        governance:
          minimum_trust: header_asserted
        backend: { kind: nats, url: "nats://nats.internal:4222", subject: catalog.read }
        watch:
          strategy:
            type: nats_topic
            subject: catalog.changed

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.odbc
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-odbc:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: orders.by_customer
        description: Recent orders for a customer, from the Teradata warehouse.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { customer_id: { type: integer } }
          required: [customer_id]
        backend:
          kind: odbc
          connection_string: "Driver={Teradata};DBCName=tdprod;UID=svc;PWD=${env.TERADATA_PASSWORD}"
          driver_label: teradata
          query: "SELECT order_id, total FROM orders WHERE customer_id = ? ORDER BY order_id"
          params: ["arguments.customer_id"]   # bound via SQLBindParameter
          read_only: true
          max_rows: 500
          timeout_ms: 15000

      # Schema discovery without writing SQL: the filters are passed as
      # arguments to the SQLTables catalog function, never interpolated.
      - name: db.list_tables
        description: List the tables an agent may query.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        backend:
          kind: odbc
          connection_string: "Driver={Teradata};DBCName=tdprod;UID=svc;PWD=${env.TERADATA_PASSWORD}"
          driver_label: teradata
          operation: list_tables
          schema_arg: schema
          table_type: "TABLE,VIEW"

gateway:
  server:
    trust_subject_header: true

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.backend.openapi
    class: backend
    kind: native
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.openapi/plugin.so }
    granted_capabilities: [network_outbound]
    # Unusually for a backend, the spec registry lives on the PLUGIN entry;
    # a binding then names only the source and the operation.
    config:
      sources:
        - name: petstore
          spec: "file:///etc/mcpg/specs/petstore.yaml"
          base_url: https://api.petstore.example.com
          headers:
            User-Agent: mcpg-gateway
          auth:
            # Key is the securityScheme name declared in the spec.
            api_key: "${cred://dev.mcpg.credential.static/petstore}"
          response:
            max_response_bytes: 1048576
            timeout_ms: 8000

  # The issuer the auth block above names. Without this entry every call
  # fails with "unknown credential_issuer plugin".
  - id: dev.mcpg.credential.static
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-static:protocol-1" }
    config:
      targets:
        petstore:
          value: "${env.PETSTORE_API_KEY}"
          ttl_seconds: 3600

mcp:
  capabilities:
    tools:
      # inputSchema / outputSchema are derived from the operation — no
      # hand-written schema, no hand-written URL.
      - name: petstore.adopt
        description: Adopt a pet.
        governance:
          minimum_trust: header_asserted
        backend: { kind: openapi, source: petstore, operation: adoptPet }

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.oracle
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-oracle:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: directory.find_employee
        description: Look up an employee by id.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { id: { type: integer } }
          required: [id]
        backend:
          kind: oracle
          dsn: "//ora1.corp.example.com:1521/HRPDB1"
          username: "svc_mcpg"
          password: "${env.ORACLE_HR_PASSWORD}"
          op: query
          query: "SELECT id, full_name, email FROM employees WHERE id = :1"
          params: ["arguments.id"]        # bound to :1 as an Oracle bind variable

      # Data-dictionary discovery through ALL_TAB_COLUMNS — no DBA_* grant.
      - name: directory.list_columns
        description: List the columns of a table in the HR schema.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        backend:
          kind: oracle
          dsn: "//ora1.corp.example.com:1521/HRPDB1"
          username: "svc_mcpg"
          password: "${env.ORACLE_HR_PASSWORD}"
          operation: list_columns
          owner: "HR"                     # bound as :owner
          table_arg: "table"              # arguments.table bound as :tbl

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.sftp
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-sftp:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: dropbox.read
        description: Read a file from the partner drop directory.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { path: { type: string } }
          required: [path]
        backend:
          kind: sftp
          op: get                              # list | get | put
          host: "sftp.partner.example.com"
          port: 22
          username: "svc-mcpg"
          password: "${env.SFTP_PASSWORD}"
          host_key_sha256: "SHA256:2xUBM/..."  # host-key check fails closed
          root: "/outbound"                    # caller paths join under this; `..` rejected
          max_bytes: 10485760
          timeout_ms: 15000

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.smb
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-smb:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: fileshare.read
        description: Read a file from the corporate SMB share.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { path: { type: string } }
          required: [path]
        backend:
          kind: smb
          op: get                       # list | get | put
          host: "fileserver.corp"
          share: "shared"
          user: "svc-mcpg"
          password: "${env.SMB_PASSWORD}"
          domain: "CORP"
          path: "/outbound"             # caller paths join under this; `..` rejected

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.snowflake
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-snowflake:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: analytics.daily_signups
        description: Daily signup counts for the last 30 days.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        input_schema: { type: object, properties: {} }
        backend:
          kind: snowflake
          account: "xy12345.eu-central-1"
          warehouse: "ANALYTICS_WH"
          database: "PROD"
          schema: "PUBLIC"
          role: "REPORTER"
          auth:
            mode: key_pair              # key_pair | password
            username: "svc_mcpg"
            private_key_pem: "${env.SNOWFLAKE_PRIVATE_KEY}"
          query:
            read_only: true             # rejects anything but SELECT/WITH/SHOW/DESCRIBE/EXPLAIN
            max_rows: 1000
          statement: >
            SELECT day, count(*) AS signups
            FROM events WHERE day >= dateadd(day, -30, current_date())
            GROUP BY day ORDER BY day

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.soap
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-soap:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: GetWeather
        description: Current weather for a city via the legacy SOAP service.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties: { city: { type: string } }
          required: [city]
        backend:
          kind: soap
          endpoint: https://weather.example.com/ws/WeatherService
          soap_version: "1.1"
          soap_action: "http://weather.example.com/GetWeather"
          body_template: |
            <wsx:GetWeather xmlns:wsx="http://weather.example.com/">
              <City>${arguments.city}</City>
            </wsx:GetWeather>
          headers:
            Authorization: "Bearer ${env.WEATHER_API_TOKEN}"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.backend.sql
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-sql:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: orders.lookup_by_tenant
        title: Lookup Orders by Tenant
        description: Return recent orders for a tenant.
        annotations: { read_only: true }
        governance:
          minimum_trust: header_asserted
        backend:
          kind: sql
          driver: postgres                 # postgres | mysql | mariadb | sqlite
          url: "postgres://app:${env.ORDERS_DB_PW}@db:5432/orders"
          pool: { max_connections: 10, min_idle: 1 }
          query:
            sql: "SELECT id, total, placed_at FROM orders WHERE tenant_id = :tenant ORDER BY placed_at DESC LIMIT :effective_limit"
            params: ["tenant", "effective_limit"]
            param_exprs:
              # Server-side cap: param_exprs override caller values of the same
              # name, so the ceiling is not spoofable by the client.
              effective_limit: "arguments.limit < 200 ? arguments.limit : 200"
            row_mode: many                 # single | many | scalar | affected_rows | resource_contents | stream | result_sets
            timeout_ms: 3000
          schema: { derive: input }

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.backend.twilio
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-twilio:protocol-1" }
    # The grant is fail-closed and must cover every capability the descriptor
    # requires — the http_route entity below opens a listener.
    granted_capabilities: [network_outbound, http_route_serve]
    # This `config:` block belongs to the http_route entity that receives
    # Twilio's inbound webhooks. It is resolved at CONFIG LOAD, where only
    # `${env.X}` and bound secret-provider URIs expand — a `cred://` ref
    # would arrive as a literal string and break every signature check.
    config:
      account_sid: "${env.TWILIO_ACCOUNT_SID}"
      # Webhook signatures are ALWAYS keyed by the Account Auth Token.
      auth_token: "${env.TWILIO_AUTH_TOKEN}"
      public_base_url: "https://mcpg.example.com"
      validate_signature: true
      max_body_bytes: 65536
      inbound_sms:
        auto_reply: "Thanks - an agent will follow up shortly."

mcp:
  capabilities:
    tools:
      - name: twilio.send_sms
        title: "Send SMS"
        description: "Send an SMS (or MMS via media_url) from the configured number."
        annotations: { read_only: false, idempotent: false }
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          required: [to, body]
          properties:
            to: { type: string, description: "E.164 destination, e.g. +14155551212" }
            body: { type: string }
            media_url: { type: array, items: { type: string } }
          additionalProperties: false
        backend:
          kind: twilio
          operation: send_sms
          account_sid: "${env.TWILIO_ACCOUNT_SID}"
          # Prefer a scoped, revocable API Key over the root Auth Token.
          api_key_sid: "${env.TWILIO_API_KEY_SID}"
          api_key_secret: "${env.TWILIO_API_KEY_SECRET}"
          from: "+14155550100"

plugins:
  - id: dev.mcpg.cache.memory
    class: cache
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cache-memory:protocol-1"
    config:
      max_capacity: 50000

plugins:
  - id: dev.mcpg.cache.redis
    class: cache
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cache-redis:protocol-1"
    granted_capabilities:
      - network_outbound
    config:
      url: ${env.REDIS_URL}      # redis://user:pass@redis-primary.internal:6379/0
      key_prefix: mcpg
      connection:
        pool_size: 16
        connect_timeout_ms: 1000
        operation_timeout_ms: 5000

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.catalog.builtin
    class: catalog_provider
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/catalog-builtin:protocol-1"
    config:
      tools:
        orders.search:
          owner: platform-team <platform@example.com>
          tags: [read-only, orders]
          doc_url: https://docs.example.com/tools/orders-search
          maturity: stable
          trust_required: verified
          sample_arguments:
            query: "status:open"
        internal.health:
          hide: true
      defaults:
        hide_unknown: false
        require_verified_for_unknown: false
      global_defaults:
        owner: platform-team
        maturity: stable

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: orders.search
        description: Search open orders.
        governance:
          minimum_trust: verified
        backend:
          kind: http
          url: https://orders.internal/search
          method: get

cluster:
  kind: consul
  address: https://consul.service.internal:8501
  service_name: mcpg-gateway
  kv_prefix: mcpg/prod/
  token: ${env.CONSUL_TOKEN}
  datacenter: eu-west-1
  node_id: ${env.HOSTNAME}
  subscribe_wait_sec: 30
  lease_renew_before_expiry_percent: 30

plugins:
  # No `config:` block — the `cluster:` block above is the single source
  # of truth for this coordinator's runtime config.
  - id: dev.mcpg.cluster.consul
    class: cluster
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cluster-consul:protocol-1"
    granted_capabilities:
      - network_outbound

cluster:
  kind: etcd
  endpoints:
    - https://etcd-0.internal:2379
    - https://etcd-1.internal:2379
  key_prefix: /mcpg/           # must end in '/'
  tls:
    # Transport is fail-closed: an https:// endpoint with no tls: block,
    # mixed schemes, or auth over plaintext is rejected at boot.
    ca_cert: /etc/mcpg/certs/etcd-ca.pem
  node_id: ${env.HOSTNAME}
  event_ttl_secs: 60
  lease_renew_before_expiry_percent: 30

plugins:
  - id: dev.mcpg.cluster.etcd
    class: cluster
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cluster-etcd:protocol-1"
    granted_capabilities:
      - network_outbound

cluster:
  kind: nats
  servers:
    - tls://nats-0.internal:4222
    - tls://nats-1.internal:4222
  node:
    id: ${env.HOSTNAME}
    heartbeat_interval_sec: 10
    peer_expiry_sec: 30
  auth:
    method: credentials_file
    path: /etc/mcpg/nats.creds
  tls:
    ca_cert: /etc/mcpg/certs/nats-ca.pem
    require_tls: true
  jetstream:
    replicas: 3
    storage: file
  lease:
    default_ttl_sec: 30
    renew_before_expiry_percent: 50

plugins:
  - id: dev.mcpg.cluster.nats
    class: cluster
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cluster-nats:protocol-1"
    granted_capabilities:
      - network_outbound

cluster:
  kind: redis
  url: ${env.REDIS_URL}             # rediss:// in production
  password: ${env.REDIS_PASSWORD}
  key_prefix: "mcpg:cluster:"       # one namespace per deployment
  lease_ttl_ms: 30000
  peer_ttl_ms: 60000
  service_name: mcpg
  lease_renew_before_expiry_percent: 80

plugins:
  - id: dev.mcpg.cluster.redis
    class: cluster
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/cluster-redis:protocol-1"
    granted_capabilities:
      - network_outbound

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.aws-sts
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-aws-sts:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      region: us-east-1
      # base_credentials omitted in production: run as an IAM principal (IRSA / instance role)
      targets:
        per-team:                         # -> cred://dev.mcpg.credential.aws-sts/per-team
          identity_mapping: template
          role_arn_template: "arn:aws:iam::123456789012:role/mcpg-${identity.attributes.team}"
          allowed_role_arns:
            - "arn:aws:iam::123456789012:role/mcpg-data"
            - "arn:aws:iam::123456789012:role/mcpg-platform"
          session_name_prefix: mcpg
          duration_seconds: 3600
          max_cache_ttl_ms: 3600000

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: datalake.query
        description: Query the internal data lake with the caller's own assumed AWS role.
        governance:
          minimum_trust: verified        # identity-derived role ARNs require Verified
        backend:
          kind: http
          method: post
          url: https://datalake.internal/query
          headers:
            X-Amz-Access-Key-Id: "${cred://dev.mcpg.credential.aws-sts/per-team#access_key_id}"
            X-Amz-Secret-Access-Key: "${cred://dev.mcpg.credential.aws-sts/per-team#secret_access_key}"
            X-Amz-Security-Token: "${cred://dev.mcpg.credential.aws-sts/per-team#session_token}"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.credential.azure-identity
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-azure-identity:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      targets:
        graph:                            # -> cred://dev.mcpg.credential.azure-identity/graph
          base_auth: { mode: workload_identity }   # reads AZURE_FEDERATED_TOKEN_FILE
          tenant_id: contoso.onmicrosoft.com
          client_id: "00000000-0000-0000-0000-000000000000"
          scope: "https://graph.microsoft.com/.default"
          max_cache_ttl_ms: 1800000
        storage:
          base_auth: { mode: managed_identity }    # IMDS
          resource: "https://storage.azure.com"

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: directory.find_user
        description: Look up a user in Microsoft Graph by user principal name.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            upn: { type: string, description: User principal name }
          required: [upn]
        backend:
          kind: http
          method: get
          url: "https://graph.microsoft.com/v1.0/users/${arguments.upn}"
          headers:
            Authorization: "Bearer ${cred://dev.mcpg.credential.azure-identity/graph}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.gcp-impersonation
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-gcp-impersonation:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      # base_auth defaults to the GKE Workload Identity metadata server
      targets:
        bq-reader:                        # -> cred://dev.mcpg.credential.gcp-impersonation/bq-reader
          token_kind: access_token
          service_account: "bq-reader@my-proj.iam.gserviceaccount.com"
          scopes: ["https://www.googleapis.com/auth/bigquery.readonly"]
          lifetime_seconds: 3600
        per-team:
          identity_mapping: template
          service_account_template: "mcpg-${identity.attributes.team}@my-proj.iam.gserviceaccount.com"
          allowed_service_accounts:
            - "mcpg-data@my-proj.iam.gserviceaccount.com"
          scopes: ["https://www.googleapis.com/auth/cloud-platform"]

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: bq.run_query
        description: Run a BigQuery job as the impersonated read-only service account.
        governance:
          minimum_trust: verified
        backend:
          kind: http
          method: post
          url: "https://bigquery.googleapis.com/bigquery/v2/projects/my-proj/queries"
          headers:
            Authorization: "Bearer ${cred://dev.mcpg.credential.gcp-impersonation/bq-reader}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.jwt-mint
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-jwt-mint:protocol-1" }
    config:
      targets:
        partner-api:                      # -> cred://dev.mcpg.credential.jwt-mint/partner-api
          algorithm: EdDSA
          signing_key: "${env.PARTNER_JWT_ED25519_PEM}"
          issuer: https://gateway.example.com
          audience: ["https://partner.example/api"]
          ttl_seconds: 300
          kid: partner-2026
          claim_mappings:
            roles: roles
            tenant: attributes.tenant
          authorize: { kind: roles, roles: ["partner"] }

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: partner.create_order
        description: Create an order at the partner API, asserting the caller in a minted JWT.
        governance:
          minimum_trust: verified        # roles/groups/subjects rules require a Verified identity
        backend:
          kind: http
          method: post
          url: https://partner.example/api/orders
          headers:
            Authorization: "Bearer ${cred://dev.mcpg.credential.jwt-mint/partner-api}"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.credential.oauth-client-credentials
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-oauth-client-credentials:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      providers:
        billing-api:                      # -> cred://dev.mcpg.credential.oauth-client-credentials/billing-api
          token_url: https://auth.example.com/oauth/token
          client_id: mcpg-gateway
          client_secret: "${env.BILLING_CLIENT_SECRET}"
          scopes: ["invoices.read", "invoices.write"]
          refresh_buffer_ms: 60000
          timeout_ms: 5000

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: billing.get_invoice
        description: Fetch an invoice from the billing API.
        governance:
          minimum_trust: header_asserted
        input_schema:
          type: object
          properties:
            invoice_id: { type: string }
          required: [invoice_id]
        backend:
          kind: http
          method: get
          url: "https://api.example.com/invoices/${arguments.invoice_id}"
          headers:
            Authorization: "Bearer ${cred://dev.mcpg.credential.oauth-client-credentials/billing-api}"

plugins:
  # An identity_provider entry is what makes callers Verified — ID-JAG
  # issuance refuses anything less.
  - id: dev.mcpg.identity.oidc
    class: identity_provider
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.identity.oidc/plugin.so }
    granted_capabilities: [network_outbound]
    config:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

  - id: dev.mcpg.credential.oauth-id-jag
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-oauth-id-jag:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      providers:
        drive:
          idp_token_url: https://idp.example.com/oauth2/token          # hop 1 (enterprise IdP)
          client_id: mcpg-gateway
          client_secret: "${env.IDP_CLIENT_SECRET}"
          audience: https://drive-mcp.example.com                      # upstream AS
          resource: https://drive-mcp.example.com/mcp
          scopes: [read]
          redeem_token_url: https://drive-mcp.example.com/oauth2/token  # hop 2 (upstream AS)

mcp:
  federations:
    - name: drive
      upstream:
        url: https://drive-mcp.example.com/mcp
        auth:
          mode: oauth_impersonation
          credential: "cred://dev.mcpg.credential.oauth-id-jag/drive"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.oauth-token-exchange
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-oauth-token-exchange:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      providers:
        search:                           # -> cred://dev.mcpg.credential.oauth-token-exchange/search
          token_url: https://sts.example.com/oauth/token
          client_id: mcpg-gateway
          client_secret: "${env.STS_CLIENT_SECRET}"
          audience: https://search.example.com
          scopes: ["search.read"]
          timeout_ms: 5000

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: search.query
        description: Query the search service on behalf of the calling user.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            index: { type: string }
          required: [index]
        backend:
          kind: http
          method: post
          url: "https://search.example.com/v1/${arguments.index}/query"
          headers:
            Authorization: "Bearer ${cred://dev.mcpg.credential.oauth-token-exchange/search}"

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.static
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-static:protocol-1" }
    config:
      targets:
        orders-pg:                        # -> .../orders-pg#username, .../orders-pg#password
          parts:
            username: orders_ro
            password: "${env.ORDERS_PG_PASSWORD}"
          ttl_seconds: 600
          authorize: { kind: roles, roles: ["analyst"] }

  # The binding below names `kind: sql`, so the SQL backend artifact has to
  # be declared. Boot fails outright on a binding whose backend kind has no
  # registered plugin.
  - id: dev.mcpg.backend.sql
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-sql:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: orders.recent
        description: List the most recent orders.
        governance:
          minimum_trust: verified        # the roles rule requires a Verified identity
        backend:
          kind: sql
          driver: postgres
          url: "postgres://${cred://dev.mcpg.credential.static/orders-pg#username}:${cred://dev.mcpg.credential.static/orders-pg#password}@db.internal/orders?sslmode=require"
          query:
            sql: "SELECT id, total FROM orders ORDER BY created_at DESC LIMIT 20"
            params: []
            row_mode: many

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.credential.vault-dynamic-db
    class: credential_issuer
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/credential-vault-dynamic-db:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      url: "https://vault.example.com:8200"
      db_mount: database
      auth:
        method: token                    # token | approle
        token: "${env.VAULT_TOKEN}"
      targets:
        orders:                          # -> cred://dev.mcpg.credential.vault-dynamic-db/orders
          identity_mapping: from_role    # identity.roles[0] selects the Vault role
          vault_role: orders-readonly    # fallback when the caller carries no role
          max_cache_ttl_ms: 3600000
          revoke_on_evict: true
      connection:
        connect_timeout_ms: 5000
        operation_timeout_ms: 10000

  - id: dev.mcpg.backend.sql
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-sql:protocol-1" }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: orders.lookup
        description: Look up an order using a per-caller Vault-issued database credential.
        governance:
          minimum_trust: verified
        input_schema:
          type: object
          properties:
            order_id: { type: string }
          required: [order_id]
        backend:
          kind: sql
          driver: postgres
          url: "postgres://${cred://dev.mcpg.credential.vault-dynamic-db/orders#username}:${cred://dev.mcpg.credential.vault-dynamic-db/orders#password}@db.internal/orders?sslmode=require"
          query:
            sql: "SELECT id, status, total FROM orders WHERE id = :order_id"
            params: [order_id]
            row_mode: single

plugins:
  - id: dev.mcpg.identity.aauth
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-aauth:protocol-1" }
    granted_capabilities:
      - network_outbound
    config:
      # Agent Providers this gateway trusts (exact `iss` match). An empty list
      # without `allow_any_issuer` refuses to load.
      trusted_issuers:
        - https://ap.example
      signature_window_secs: 60
      expected_authority: gw.example       # pin @authority when a proxy rewrites Host
      person_tokens:
        enabled: true
        resource_identifier: https://gw.example
        trusted_person_servers:
          - https://sandbox.personserver.dev
      auth_tokens:
        enabled: true
      resolution:
        trust_level: verified
        auth_provider_label: aauth

plugins:
  - id: dev.mcpg.identity.api-key
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-api-key:protocol-1" }
    config:
      token_sources:
        - { kind: bearer }                       # Authorization: Bearer <token>
        - { kind: header, header: X-Api-Key }
      keys:
        - key_id: service-orders                 # becomes subject_id
          secret: "${env.MCPG_APIKEY_ORDERS}"    # >= 16 bytes after resolution
          roles: ["service"]
          groups: ["internal-services"]
          scopes: ["orders.read", "orders.write"]
          attributes: { tenant_id: acme }
        - key_id: partner-acme
          secret: "vault://secret/data/api-keys#acme"
          enabled: true                          # false soft-revokes
          expires_at: "2026-12-31T00:00:00Z"
          roles: ["partner"]
      resolution:
        trust_level: verified
        auth_provider_label: api-key

plugins:
  - id: dev.mcpg.identity.basic
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-basic:protocol-1" }
    config:
      username_case: insensitive
      users:
        - username: alice
          password_hash: "${env.ALICE_PASSWORD_HASH}"   # argon2 or bcrypt PHC string
          roles: ["operator"]
          groups: ["sre"]
          scopes: ["admin.read"]
          attributes: { tenant: acme }
          enabled: true
          expires_at: "2027-01-01T00:00:00Z"
      resolution:
        trust_level: verified
        auth_provider_label: basic

plugins:
  - id: dev.mcpg.identity.jwt
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-jwt:protocol-1" }
    config:
      token_source:
        kind: authorization_bearer
      issuers:
        - issuer: https://auth.partner.example
          audiences: ["https://gateway.mcpg.dev"]
          algorithms: ["EdDSA"]
          clock_skew_secs: 60
          key:
            kind: ed_pem
            pem: ${env.PARTNER_JWT_ED25519_PUBLIC_PEM}
          claim_mappings:
            subject_claim: sub
            role_claim_paths: ["realm_access.roles"]
            scope_claim_paths: ["scope"]
            attribute_claim_mappings: { tenant: "tenant" }
      resolution:
        trust_level: verified
        auth_provider_label: jwt

plugins:
  - id: dev.mcpg.identity.kerberos
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-kerberos:protocol-1" }
    config:
      keytab: "${env.MCPG_KEYTAB}"                      # e.g. /etc/mcpg/http.keytab
      service_name: "HTTP@gateway.corp.example.com"     # omit to accept any principal in the keytab
      strip_realm: true                                 # alice@CORP.EXAMPLE.COM -> alice
      resolution:
        trust_level: verified
        auth_provider_label: kerberos

plugins:
  - id: dev.mcpg.identity.ldap
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-ldap:protocol-1" }
    granted_capabilities:
      - network_outbound
    config:
      url: "ldaps://dc1.corp.example.com:636"
      bind:
        mode: search
        bind_dn: "cn=svc-mcpg,ou=svc,dc=corp,dc=example,dc=com"
        bind_password: "${env.LDAP_SVC_PASSWORD}"
        base_dn: "ou=people,dc=corp,dc=example,dc=com"
        user_filter: "(sAMAccountName={username})"
      subject_attribute: sAMAccountName
      group_attribute: memberOf
      roles_from_group_cn: true
      attributes: [mail, displayName, department]
      timeout_ms: 10000
      resolution:
        trust_level: verified
        auth_provider_label: ldap

plugins:
  - id: dev.mcpg.identity.mtls
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-mtls:protocol-1" }
    config:
      sources:
        - { kind: xfcc, header: X-Forwarded-Client-Cert, chain_position: first }
        - { kind: dn_string, header: X-SSL-Client-S-DN }
        - { kind: custom_header, header: X-Client-Fingerprint, extraction_hint: fingerprint }
      extraction:
        mode: subject_cn
        case_sensitive: false
      identities:
        orders-svc:
          roles: ["service"]
          scopes: ["orders.read"]
          attributes: { tenant: acme }
      resolution:
        # Raise to `verified` only when a trusted proxy terminates mTLS AND
        # strips any inbound copy of these headers before injecting its own.
        trust_level: header_asserted
        auth_provider_label: mtls

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.identity.oidc
    class: identity_provider
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.identity.oidc/plugin.so }
    granted_capabilities:
      - network_outbound
    config:
      token_source:
        kind: authorization_bearer
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg"]
          clock_skew_secs: 60
          allow_private_issuer: false
          verification:
            kind: oidc_jwks
            allowed_algs: ["RS256"]
            refresh_interval_secs: 300
            timeout_ms: 2000
            allow_hmac: false
          claim_mappings:
            subject_claim: sub
            group_claim_paths: ["groups"]
            role_claim_paths: ["realm_access/roles"]
            scope_claim_paths: ["scope", "scp"]
            attribute_claim_mappings: { tenant: "tenant_id" }

plugins:
  - id: dev.mcpg.identity.paseto
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-paseto:protocol-1" }
    config:
      token_source:
        kind: authorization_bearer
      issuers:
        - issuer: https://auth.partner.example
          audiences: ["https://gateway.mcpg.dev"]
          key:
            kind: public_hex                            # v4.public (Ed25519)
            hex: ${env.PARTNER_PASETO_V4_PUBLIC_HEX}
          claim_mappings:
            subject_claim: sub
            role_claim_paths: ["roles"]
            attribute_claim_mappings: { tenant: "tenant" }
      resolution:
        trust_level: verified
        auth_provider_label: paseto

plugins:
  - id: dev.mcpg.identity.saml
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-saml:protocol-1" }
    config:
      idp_certificate: "file:///etc/mcpg/idp.crt"          # PEM trust anchor
      idp_entity_id: "https://idp.corp.example.com/saml2"
      audience: "mcpg-gateway"
      assertion_header: X-SAML-Assertion
      role_attribute: "http://schemas.example.com/role"
      group_attribute: "memberOf"
      clock_skew_secs: 120
      resolution:
        trust_level: verified
        auth_provider_label: saml

plugins:
  - id: dev.mcpg.identity.workload
    class: identity_provider
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/identity-workload:protocol-1" }
    granted_capabilities:
      - transport_listen
      - network_outbound
    config:
      trust_domain: example.org
      bundle:
        kind: workload_api
        socket_path: unix:/run/spire/sockets/agent.sock
      sources:
        - { kind: x509_svid }
        - { kind: jwt_svid_bearer }
      audiences: ["https://gateway.example.org"]
      mode: allowlist
      allowlist:
        - "spiffe://example.org/ns/payments/sa/orders"
      identities:
        "spiffe://example.org/ns/payments/sa/orders":
          roles: ["service"]
          scopes: ["orders.read", "orders.write"]
      resolution:
        trust_level: verified
        auth_provider_label: spiffe-workload

plugins:
  - id: dev.mcpg.webhook
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/webhook:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      max_retries: 3
      retry_backoff_ms: 1000
      timeout_ms: 5000
      buffer_size: 1024
      circuit_breaker:
        consecutive_5xx_threshold: 5
        open_duration_ms: 30000
        half_open_probe_count: 1
      endpoints:
        - url: https://hooks.example.com/mcpg
          events: ["error", "slow_response"]   # completed | error | slow_response | all
          slow_threshold_ms: 2000
          headers:
            Authorization: "Bearer ${env.HOOK_TOKEN}"

plugins:
  - id: dev.mcpg.audit.s3-worm
    kind: native
    class: audit_sink
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/audit-s3-worm:protocol-1"
    granted_capabilities:
      - network_outbound
    config:
      bucket: acme-mcpg-audit-worm   # must be created with Object Lock enabled
      region: us-east-1
      prefix: gateway-prod
      retention_mode: compliance     # governance | compliance
      retention_days: 2555           # 7 years
      request_timeout_ms: 10000
      # credentials omitted: run as an IAM principal (IRSA / instance role)

# Listing the id under governance.audit.sinks[] is what routes events to
# it; replacing the default entry retires the built-in local-file sink.
governance:
  audit:
    enabled: true
    required: true          # refuse to start with no audit sink
    on_failure: fail_closed
    sinks:
      - kind: dev.mcpg.audit.s3-worm

plugins:
  - id: dev.mcpg.audit
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/audit:protocol-1" }
    config:
      sink:
        kind: file                       # stdout (default) | file
        path: /var/log/mcpg/audit.jsonl  # rotate externally, e.g. logrotate
      include_arguments: false
      include_arguments_hash: true
      include_results: false
      include_result_summary: true
      include_result_meta: true
      tools_filter: ["orders.*", "admin.*"]
      buffer_size: 8192

plugins:
  - id: dev.mcpg.call-logger
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/call-logger:protocol-1" }
    config:
      sample_rate: 1.0                 # 1.0 logs both halves of every call
      log_arguments: true
      log_results: true
      max_argument_bytes: 4096
      max_result_bytes: 8192
      redact_fields: ["ssn", "date_of_birth"]

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.observability.otlp
    kind: native
    class: telemetry_sink
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.observability.otlp/plugin.so }
    granted_capabilities:
      - network_outbound
    config:
      url: http://otel-collector:4317
      service_name: mcpg
      service_version: "2.4.0"
      resource_attributes:
        deployment.environment: prod
      batch_export_timeout_ms: 30000

observability:
  enabled: true
  traces:
    # traces.enabled defaults to FALSE — the signal triad is not symmetrical.
    enabled: true
    service_name: mcpg
    propagate_context: true
    sinks:
      - kind: dev.mcpg.observability.otlp

plugins:
  # Baked into the published image, so no registry pull is needed.
  - id: dev.mcpg.observability.prometheus
    kind: native
    class: metrics_sink
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.observability.prometheus/plugin.so }
    config:
      namespace: mcpg
      global_labels:
        env: production
        region: us-east-1

# The plugins[] entry loads the artifact and holds the config block.
# The sinks list is the routing allow-list: without the id here the
# signal goes nowhere. This plugin is already the default entry, so
# the block below is only needed to run it alongside another sink.
observability:
  enabled: true
  metrics:
    enabled: true
    sinks:
      - kind: dev.mcpg.observability.prometheus

plugins:
  - id: dev.mcpg.metrics.statsd
    kind: native
    class: metrics_sink
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/metrics-statsd:protocol-1"
    granted_capabilities:
      - network_outbound
    config:
      destination:
        kind: udp            # udp | stdout | stderr
        address: "127.0.0.1:8125"
      prefix: mcpg
      emit_tags: true
      histogram_type: distribution   # histogram | timing | distribution

observability:
  enabled: true
  metrics:
    enabled: true
    sinks:
      - kind: dev.mcpg.metrics.statsd

plugins:
  - id: dev.mcpg.log.syslog
    kind: native
    class: log_sink
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/log-syslog:protocol-1"
    granted_capabilities:
      - network_outbound
    config:
      destination:
        kind: udp            # udp | tcp | stdout | stderr
        address: "10.0.0.5:514"
      format: rfc5424        # rfc5424 | rfc3164
      facility: 1            # 0-23; 1 = user-level
      app_name: mcpg-gateway
      hostname: gw-1
      min_level: info
      include_fields: true

observability:
  enabled: true
  logs:
    enabled: true
    level: info
    sinks:
      - kind: stderr
        config:
          format: json
      - kind: dev.mcpg.log.syslog

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.payment.acp
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/payment-acp:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      config:
        default_api_version: "2026-01-30"
        session_ttl_ms: 3600000         # 1 hour (the default is 3600 ms)
        http_timeout_ms: 30000          # the default is 30 ms — always set this
      tools:
        store.buy:
          merchant_base_url: https://merchant.example/agentic_commerce
          auth_token: ${env.ACP_MERCHANT_TOKEN}
          agent_capabilities:
            interventions:
              supported: ["3ds"]
              display_context: webview

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: store.buy
        description: Purchase an item from the merchant catalogue.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://orders.internal/confirm
          method: post
          timeout_ms: 10000

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.payment.mpp
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/payment-mpp:protocol-1" }
    config:
      enabled: true
      secret_key: ${env.MPP_SECRET_KEY}     # HMAC secret for challenge integrity
      realm: mcpg-gateway
      recipient: "acct:platform"
      challenge_timeout_seconds: 300
      # Ed25519 settlement-authority public key (64 hex chars).
      # Unset => the gate fails closed and denies every paid call.
      settlement_public_key: ${env.MPP_SETTLEMENT_PUBKEY}
      tools:
        ai.premium_query:
          charge: "0.10"
          currency: USDC

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: ai.premium_query
        description: Run a premium inference query.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://inference.internal/query
          method: post
          timeout_ms: 30000

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.payment.ucp
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/payment-ucp:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      config:
        platform_profile_url: https://gateway.example/.well-known/ucp
        session_ttl_ms: 3600000         # 1 hour (the default is 3600 ms)
        discovery_cache_ttl_ms: 3600000
        http_timeout_ms: 30000          # the default is 30 ms — always set this
      tools:
        store.checkout:
          merchant_url: https://merchant.example
          capabilities: ["dev.ucp.shopping.checkout"]
          transport: rest               # mcp | rest
          allowed_endpoint_origins:     # empty = same-origin only
            - https://api.merchant.example
          auth_token: ${env.UCP_MERCHANT_TOKEN}

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: store.checkout
        description: Place an order with the merchant.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://orders.internal/place
          method: post
          timeout_ms: 10000

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.payment.x402
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/payment-x402:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      config:
        facilitator_url: https://x402.org/facilitator
        recipient_address: "0x5f3a9C1b7E2d48Aa10bC93f4e6D75B802a1cE9F4"
        http_timeout_ms: 10000        # the default is 10 ms — always set this
      tools:
        premium.query:
          charge: "0.10"              # per call
          currency: USDC
          chain_id: "eip155:8453"     # Base mainnet

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: premium.query
        description: Run a premium inference query.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://inference.internal/query
          method: post
          timeout_ms: 30000

plugins:
  - id: dev.mcpg.circuit-breaker
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/circuit-breaker:protocol-1" }
    config:
      failure_threshold: 5            # consecutive failures that trip the circuit
      cooldown_ms: 30000              # open -> half-open delay
      half_open_max_inflight: 1       # concurrent probes while half-open
      per_tool:
        - tool: "billing.charge"      # exact tool name, not a glob
          failure_threshold: 2
          cooldown_ms: 60000

plugins:
  - id: dev.mcpg.rate-limit
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/rate-limit:protocol-1" }
    config:
      default_limit: 100              # tokens per window for unmatched tools
      default_window_ms: 60000
      default_burst: 150              # headroom above the steady rate
      cleanup_interval_ms: 300000     # idle threshold for bucket eviction
      rules:
        - tools: ["expensive.*", "admin.*"]   # globs, first match wins
          scope: per_principal                 # per_principal | per_tool | per_principal_tool | per_session | global
          limit: 10
          window_ms: 60000
          burst: 20

plugins:
  - id: dev.mcpg.response-cache
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/response-cache:protocol-1" }
    config:
      default_ttl_ms: 300000          # 5 minutes
      max_entries: 10000
      cache_scope: shared             # shared | per_identity
      per_tool:
        - tools: ["catalog.*"]        # glob patterns
          ttl_ms: 60000
        - tools: ["live.*", "*.stream"]
          ttl_ms: 0                   # never cache these

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  # Registering the entry binds the `vault://` scheme — there is no
  # separate binding block.
  - id: dev.mcpg.secret.vault
    class: secret_provider
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/secret-vault:protocol-1"
    granted_capabilities:
      - network_outbound
    config:
      url: https://vault.example:8200
      auth:
        method: approle
        role_id: ${env.VAULT_ROLE_ID}
        secret_id: ${env.VAULT_SECRET_ID}
      default_field: value
      watch:
        strategy: poll
        poll_interval_ms: 30000
      connection:
        connect_timeout_ms: 5000
        operation_timeout_ms: 10000

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: billing.charge
        description: Charge a customer.
        governance:
          minimum_trust: verified
        backend:
          kind: http
          url: https://billing.internal/charge
          method: post
          headers:
            authorization: vault://secret/data/billing#token

plugins:
  - id: dev.mcpg.tool-gate.dlp
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/tool-gate-dlp:protocol-1" }
    config:
      pre_execution: true
      post_execution: true
      action: redact                  # block | redact
      detectors: [aws_access_key, jwt, email, credit_card, url_credentials]
      custom_patterns:
        - { name: employee_id, regex: "EMP-[0-9]{6}" }
      redact_placeholder: "[REDACTED]"
      validate_credit_card_luhn: true
      tools: ["*"]
      exclude_tools: ["debug.*"]

plugins:
  - id: dev.mcpg.tool-gate.field-crypto
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/tool-gate-field-crypto:protocol-1" }
    config:
      key_hex: ${env.MCPG_FIELD_CRYPTO_KEY_HEX}   # 64 hex chars = 32 bytes
      encrypt_fields: ["/ssn", "/card/number"]
      decrypt_fields: ["/ssn"]
      fail_closed: true
      tools: ["records.*"]

plugins:
  - id: dev.mcpg.guardrails
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/guardrails:protocol-1" }
    granted_capabilities: ["network_outbound"]
    config:
      apply_to_non_tool_surfaces: false
      allow_private_backends: false
      pre_execution:
        - name: pii-scanner
          url: https://scanner.svc/scan
          timeout_ms: 5000
          max_response_bytes: 65536
          on_error: deny                # deny (fail-closed) | allow
          allow_mutation: true
          tools: ["orders.*"]
          exclude_tools: ["orders.debug_*"]
          trigger_cel: 'trust_level == "verified"'
          headers: { Authorization: "Bearer ${env.SCANNER_TOKEN}" }
      post_execution: []

plugins:
  - id: dev.mcpg.ip-allowlist
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/ip-allowlist:protocol-1" }
    config:
      allow:
        - "10.0.0.0/8"
        - "192.168.1.0/24"
        - "::1/128"
      ip_header: x-forwarded-for
      tools: []          # empty = gate every tool

plugins:
  - id: dev.mcpg.policy.casbin
    class: policy_engine
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/policy-casbin:protocol-1" }
    config:
      model_path: /etc/mcpg/casbin/model.conf     # r = sub, obj, act
      policy_path: /etc/mcpg/casbin/policy.csv    # p, alice, billing.charge, tool.call.pre
      translation:
        request_fields:                           # one entry per model request column, in order
          - { source: identity_subject_id, fallback: anonymous }
          - { source: context, field: tool_name }
          - { source: decision_point }
      evaluation:
        on_default_deny: not_applicable
      reload:
        enabled: true
        check_interval_sec: 60

governance:
  policy:
    engine:
      - kind: casbin       # short alias for dev.mcpg.policy.casbin

plugins:
  - id: dev.mcpg.policy.cedar
    class: policy_engine
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/policy-cedar:protocol-1" }
    config:
      policy_dir: /etc/mcpg/cedar/policies          # required; walked recursively
      schema_path: /etc/mcpg/cedar/schema.cedarschema
      entities_path: /etc/mcpg/cedar/entities.json
      include_input_as_context: true
      translation:
        principal_type: User
        action_namespace: Action
        anonymous_principal_id: anonymous
        resource_types:
          - { decision_point: "tool.call.pre", resource_type: Tool, resource_id_path: "/tool" }
          - { decision_point: "*", resource_type: Resource, resource_id_path: "/id" }
      evaluation:
        on_default_deny: not_applicable            # "deny" makes this the sole authority
      reload:
        enabled: true
        check_interval_sec: 60

governance:
  policy:
    engine:
      - kind: cedar        # short alias for dev.mcpg.policy.cedar

plugins:
  - id: dev.mcpg.policy.opa
    class: policy_engine
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/policy-opa:protocol-1" }
    granted_capabilities: ["network_outbound"]     # remote mode only
    config:
      mode: remote
      remote:
        url: "https://opa.svc.cluster.local:8181"
        package: "mcpg/allow"                      # POSTs to /v1/data/mcpg/allow
        timeout_ms: 500
        tls:
          ca_cert: /etc/mcpg/opa-ca.pem
          verify_peer: true

  # Air-gapped alternative — same plugin, no egress:
  # config:
  #   mode: embedded
  #   policy_bundle:
  #     source_path: /etc/mcpg/policy.wasm
  #     sha256: "3f5a..."
  #     entrypoint: "mcpg/allow"
  #     reload: { enabled: true, check_interval_sec: 60 }

governance:
  policy:
    engine:
      - kind: opa          # short alias for dev.mcpg.policy.opa

plugins:
  - id: dev.mcpg.tool-gate.business-hours
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/tool-gate-business-hours:protocol-1" }
    config:
      timezone: America/New_York
      windows:
        - { days: [mon, tue, wed, thu, fri], start: "09:00", end: "12:00" }
        - { days: [mon, tue, wed, thu, fri], start: "13:00", end: "17:00" }
      blackout_dates: ["2026-12-25", "2027-01-01"]
      deny_http_status: 403
      deny_code: -32030

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.tool-gate.schema
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/tool-gate-schema:protocol-1" }
    config:
      schema:
        type: object
        required: ["query"]
        properties:
          query: { type: string, minLength: 1 }
          limit: { type: integer, maximum: 100 }
      max_errors: 8
      http_status: 400
      code: -32602

  # HTTP is a runtime-loaded cdylib, not linked into the gateway. Without
  # this entry the tool below lists fine and fails on every call with
  # "HTTP backend plugin not registered".
  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    tools:
      - name: search.documents
        description: Search the document index.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://search.internal/query
          method: post
          timeout_ms: 5000

governance:
  approvals:
    # the gateway mints the signed callback URL from this base
    callback_base_url: https://gw.example.com

plugins:
  - id: dev.mcpg.tool-gate-slack-approval
    class: tool_gate
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/tool-gate-slack-approval:protocol-1" }
    granted_capabilities: ["network_outbound", "http_route_serve"]
    config:
      bot_token: ${env.SLACK_BOT_TOKEN}
      signing_secret: ${env.SLACK_SIGNING_SECRET}
      default_channel: "#mcp-approvals"
      interactive_path: /slack/interactive
      callback_allowed_origins:
        - https://gw.example.com
      rules:
        - tool_pattern: '^prod\.'
          summary_template: "Approve {tool} for {subject}?"
          deadline_secs: 300
          channel: "#prod-approvals"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.transform.csv
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-csv:protocol-1" }
    config:
      direction: csv_to_json           # csv_to_json | json_to_csv
      phase: result
      pointer: /structuredContent/report
      delimiter: ";"
      has_headers: true
      max_output_bytes: 1048576

  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities: [network_outbound]

# Or the reverse direction as a pipeline step:
mcp:
  capabilities:
    tools:
      - name: orders.report
        description: Fetch the vendor's orders and hand them back as a CSV table.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: pipeline
          steps:
            - kind: graphql
              id: fetch
              url: https://vendor.example.com/graphql
              operation: "query { orders { id total } }"
            - kind: plugin_transform
              id: table
              plugin: dev.mcpg.transform.csv
              config:
                direction: json_to_csv
                pointer: /steps/fetch/output/orders

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.transform.json-schema
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-json-schema:protocol-1" }
    config:
      phase: arguments
      max_errors: 32
      schema:
        type: object
        required: [query]
        properties:
          query: { type: string, minLength: 1 }
          limit: { type: integer, maximum: 100 }

  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities: [network_outbound]

# In the global chain above a failure is logged and the last good value carries
# on. Wire it as a pipeline step when an invalid payload must stop the call:
mcp:
  capabilities:
    tools:
      - name: orders.enriched
        description: Fetch orders and refuse to continue unless the shape matches.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: pipeline
          steps:
            - kind: graphql
              id: fetch
              url: https://orders.example.com/graphql
              operation: "query { orders { id } }"
            - kind: plugin_transform
              id: check
              plugin: dev.mcpg.transform.json-schema
              config:
                pointer: /steps/fetch/output
                schema: { type: object }

governance:
  access:
    oidc_oauth:
      providers:
        - issuer: "https://idp.example.com"
          audiences: ["mcpg-gateway"]
          verification: { kind: oidc_jwks, allowed_algs: ["RS256"] }

plugins:
  - id: dev.mcpg.transform.jsonata
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-jsonata:protocol-1" }
    config:
      phase: arguments                # arguments | result | both
      expression: '{ "names": items.name, "total": $sum(items.qty) }'
      max_output_bytes: 1048576

  # A pipeline's first step must be a REGISTRY-DISPATCHED backend kind.
  # `http` and `pipeline` are gateway-native routes with no register-profile
  # spec mapping, and naming one as a step fails boot.
  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities: [network_outbound]

# The same registered plugin, invoked from one binding's pipeline:
mcp:
  capabilities:
    tools:
      - name: orders.flow
        description: Fetch orders, then reshape them for the enrichment step.
        governance:
          minimum_trust: verified
        backend:
          kind: pipeline
          steps:
            - kind: graphql
              id: fetch
              url: https://orders.example.com/graphql
              operation: "query { orders { id } }"
            - kind: plugin_transform
              id: reshape
              plugin: dev.mcpg.transform.jsonata
              config:
                expression: '{ "ids": steps.fetch.output.orders.id }'

# Requires a gateway built with --features wasm-plugins, and the descriptor
# copied beside the artifact as mcpg_plugin_transform_masking.wasm.plugin.yaml
plugins:
  - id: dev.mcpg.transform.masking
    class: transform
    kind: wasm
    source: { path: ./plugins/mcpg_plugin_transform_masking.wasm }
    limits: { memory_mb: 16, fuel: 5000000, timeout_ms: 50 }
    config:
      policy: strict                   # strict | input_only | output_only
      redact_fields: [ssn, credit_card, password, "card_*"]
      mask_char: "*"
      mask_length: 8
      preserve_type: false             # false also redacts numeric/boolean values
      nested: true

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.transform.template
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-template:protocol-1" }
    config:
      phase: result
      pointer: /structuredContent      # narrow to the payload, keep the envelope
      output: json                     # string (default) | json
      template: '{"summary": "Order {{ id }}: {{ items|length }} item(s), total {{ total }}"}'

  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities: [network_outbound]

# Or as a pipeline step, rendering a prior step's output:
mcp:
  capabilities:
    tools:
      - name: orders.summary
        description: Fetch an order and return a human-readable summary.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: pipeline
          steps:
            - kind: graphql
              id: fetch
              url: https://orders.example.com/graphql
              operation: "query { order { id customer status } }"
            - kind: plugin_transform
              id: summarise
              plugin: dev.mcpg.transform.template
              config:
                pointer: /steps/fetch/output
                template: "Order {{ id }} for {{ customer }} — {{ status }}"

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.transform.xml
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-xml:protocol-1" }
    config:
      direction: xml_to_json           # xml_to_json | json_to_xml
      pointer: /body                   # the XML string carried on the arguments
      phase: arguments
      max_output_bytes: 1048576

  - id: dev.mcpg.backend.soap
    class: backend
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/backend-soap:protocol-1" }
    granted_capabilities: [network_outbound]

# Decoding a SOAP response inside one binding's pipeline:
mcp:
  capabilities:
    tools:
      - name: order.lookup
        description: Fetch an order from a SOAP service and return JSON.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: pipeline
          steps:
            - kind: soap
              id: fetch
              endpoint: https://orders.example.com/soap/order
              soap_version: "1.1"
              soap_action: "http://orders.example.com/GetOrder"
              body_template: "<GetOrder xmlns=\"http://orders.example.com/\"/>"
            - kind: plugin_transform
              id: decode
              plugin: dev.mcpg.transform.xml
              config:
                direction: xml_to_json
                pointer: /steps/fetch/output/body

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.transform.xslt
    class: transform
    source: { oci: "ghcr.io/mcpg-dev/source-code/plugins/transform-xslt:protocol-1" }
    config:
      phase: result
      input: response.xml              # JSON Pointer or dotted path to the XML string
      output: string                   # string | xml_to_json
      output_method: xml               # xml | text | html (html serialises as XML)
      max_output_bytes: 1048576
      stylesheet: |
        <xsl:stylesheet xmlns:xsl='http://www.w3.org/1999/XSL/Transform'>
          <xsl:template match='/a'><out><xsl:value-of select='b'/></out></xsl:template>
        </xsl:stylesheet>

  - id: dev.mcpg.backend.graphql
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.graphql/plugin.so }
    granted_capabilities: [network_outbound]

# Or as a pipeline step over the previous step's XML output. The stylesheet is
# inlined: config-load interpolation expands `${env.NAME}` only, so a
# `${file://…}` wrapper would arrive as a literal string, not as XML.
mcp:
  capabilities:
    tools:
      - name: catalogue.normalise
        description: Fetch the vendor feed and normalise it with our stylesheet.
        governance:
          minimum_trust: header_asserted
        backend:
          kind: pipeline
          steps:
            - kind: graphql
              id: call
              url: https://vendor.example.com/graphql
              operation: "query { feed { xml } }"
            - kind: plugin_transform
              id: normalise
              plugin: dev.mcpg.transform.xslt
              config:
                input: steps.call.output.feed.xml
                stylesheet: |
                  <xsl:stylesheet xmlns:xsl='http://www.w3.org/1999/XSL/Transform'>
                    <xsl:template match='/feed'><items><xsl:value-of select='item'/></items></xsl:template>
                  </xsl:stylesheet>

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.watch.cron
    class: watch_strategy
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/watch-cron:protocol-1"

  - id: dev.mcpg.backend.http
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.http/plugin.so }
    granted_capabilities: [network_outbound]

mcp:
  capabilities:
    resources:
      - name: daily-report
        description: Daily report, re-notified on a fixed cadence.
        uri: "report://daily"
        mime_type: application/json
        governance:
          minimum_trust: header_asserted
        backend:
          kind: http
          url: https://reports.example.com/daily.json
          method: get
        watch:
          strategy:
            type: plugin
            kind: cron
            cron: "0 */5 * * * *"     # every five minutes, UTC

gateway:
  server:
    trust_subject_header: true

plugins:
  - id: dev.mcpg.watch.file
    class: watch_strategy
    kind: native
    source:
      oci: "ghcr.io/mcpg-dev/source-code/plugins/watch-file:protocol-1"

  # Baked into the published image. The resource below names `kind: command`,
  # and a binding whose backend kind has no registered plugin fails boot.
  - id: dev.mcpg.backend.command
    class: backend
    source: { path: /usr/local/lib/mcpg/plugins/dev.mcpg.backend.command/plugin.so }

mcp:
  capabilities:
    resources:
      - name: app-settings
        description: Application settings, re-notified whenever the file changes.
        uri: "config://app/settings"
        mime_type: application/json
        governance:
          minimum_trust: header_asserted
        backend:
          kind: command
          command: /bin/cat
          args: ["/etc/myapp/settings.json"]
        watch:
          strategy:
            type: plugin
            kind: file
            path: /etc/myapp/settings.json
            event_kinds: [create, modify, remove]