# MCP Security Gateway Configuration
# This file configures the MCP security gateway service.
#
# Pass-Through Authentication:
# Extract credentials from incoming request headers and forward to downstream servers.
# Enable per-client via auth.pass_through config with header mappings.

# Logging configuration
logging:
  level: info  # debug, info, warn, error
  path: stderr # filename, stderr, stdout

audit:
  enabled: true
  path: ./audit.log # filename, stderr, stdout

# Downstream MCP servers configuration
downstream_mcp_servers:
  github:
    type: http # stdio, sse, http
    url: "https://api.githubcopilot.com/mcp/"
    auth:
      pass_through:
        enabled: true
        headers:
          - source_header: X-Github-Token
            target_header: "Authorization"
            format: "Bearer {value}"

  # Example 3: STDIO server (pass-through only works with HTTP/SSE)
  aws-docs:
    type: http
    url: "https://knowledge-mcp.global.api.aws"

# Server configuration
server:
  # Server type (stdio, http, sse)
  type: http
  # Address to listen on (host:port)
  listen_addr: "0.0.0.0:8080"

# Policy configuration
policy_validation:
  # Enable CEL-based tool validation
  enabled: true
  # Path to CEL policy rules file (required when enabled)
  rules_file: "cel.rules.yaml"

# AI validation configuration
ai_validation:
  # Enable AI-powered tool validation
  enabled: true
  # OpenAI-compatible API endpoint
  endpoint: "https://api.openai.com/v1/chat/completions"
  # Model to use for validation
  model: "gpt-4o-mini"
  # Path to AI policy rules file (required when enabled)
  rules_file: "ai.rules.yaml"

# Response validation configuration
# These policies validate and filter tool call RESPONSES before returning to the client
response_validation:
  # Enable CEL-based response validation
  enabled: false
  # Path to CEL response policy rules file (required when enabled)
  rules_file: "cel_response.rules.yaml"

# AI response validation configuration
# Uses AI to detect and filter sensitive information in responses
ai_response_validation:
  # Enable AI-powered response validation
  enabled: false
  # Path to AI response policy rules file (required when enabled)
  rules_file: "ai_response.rules.yaml"
  # Note: Uses the same endpoint and model as ai_validation above
