.env.example

# Enable the plugin framework
# PLUGINS_ENABLED=False

# Default behavior for hooks without an explicit policy: 'allow' accepts all modifications (backwards compatible), 'deny' rejects all. Standard hooks always have explicit policies; this only affects custom hook types. Set to 'deny' for stricter production environments.
# Possible values:
#   `allow`, `deny`
# PLUGINS_DEFAULT_HOOK_POLICY=allow

# Path to main plugins configuration file
# PLUGINS_CONFIG_FILE=plugins/config.yaml

# Logging level for plugin framework components
# PLUGINS_LOG_LEVEL=INFO

# Skip SSL certificate verification for plugin HTTP requests. WARNING: Only enable in dev environments with self-signed certificates.
# PLUGINS_SKIP_SSL_VERIFY=False

# Enable SSRF protection for plugin endpoint URLs. Blocks private/reserved IP ranges (10.x, 172.16.x, 192.168.x, 127.x, 169.254.x). Disable for development or sidecar plugin configurations that use private IPs.
# PLUGINS_SSRF_PROTECTION_ENABLED=True

# Plugin execution timeout in seconds
# PLUGINS_PLUGIN_TIMEOUT=30

# Globally halt the pipeline on any plugin error. Superseded by per-plugin on_error; prefer setting on_error: fail on individual plugins for finer control.
# PLUGINS_FAIL_ON_PLUGIN_ERROR=False

# Maximum number of concurrent background tasks. Unlimited if None.
# PLUGINS_EXECUTION_POOL=10

# Maximum total concurrent HTTP connections for plugin requests
# PLUGINS_HTTPX_MAX_CONNECTIONS=200

# Maximum idle keepalive connections to retain (typically 50%% of max_connections)
# PLUGINS_HTTPX_MAX_KEEPALIVE_CONNECTIONS=100

# Seconds before idle keepalive connections are closed
# PLUGINS_HTTPX_KEEPALIVE_EXPIRY=30.0

# Timeout in seconds for establishing new connections (5s for LAN, increase for WAN)
# PLUGINS_HTTPX_CONNECT_TIMEOUT=5.0

# Timeout in seconds for reading response data (set high for slow MCP tool calls)
# PLUGINS_HTTPX_READ_TIMEOUT=120.0

# Timeout in seconds for writing request data
# PLUGINS_HTTPX_WRITE_TIMEOUT=30.0

# Timeout in seconds waiting for a connection from the pool (fail fast on exhaustion)
# PLUGINS_HTTPX_POOL_TIMEOUT=10.0

# Enable shell auto-completion for the mcpplugins CLI
# PLUGINS_CLI_COMPLETION=False

# Markup renderer for CLI output (rich, markdown, or disabled)
# PLUGINS_CLI_MARKUP_MODE=

# Path to PEM client certificate for mTLS
# PLUGINS_CLIENT_MTLS_CERTFILE=

# Path to PEM client private key for mTLS
# PLUGINS_CLIENT_MTLS_KEYFILE=

# Path to CA bundle for client certificate verification
# PLUGINS_CLIENT_MTLS_CA_BUNDLE=

# Password for encrypted client private key
# PLUGINS_CLIENT_MTLS_KEYFILE_PASSWORD=

# Verify the upstream server certificate
# PLUGINS_CLIENT_MTLS_VERIFY=

# Enable hostname verification
# PLUGINS_CLIENT_MTLS_CHECK_HOSTNAME=

# Path to PEM server private key
# PLUGINS_SERVER_SSL_KEYFILE=

# Path to PEM server certificate
# PLUGINS_SERVER_SSL_CERTFILE=

# Path to CA certificates for client verification
# PLUGINS_SERVER_SSL_CA_CERTS=

# Password for encrypted server private key
# PLUGINS_SERVER_SSL_KEYFILE_PASSWORD=

# Client certificate requirement (0=NONE, 1=OPTIONAL, 2=REQUIRED)
# PLUGINS_SERVER_SSL_CERT_REQS=

# MCP server host to bind to
# PLUGINS_SERVER_HOST=

# MCP server port to bind to
# PLUGINS_SERVER_PORT=

# Unix domain socket path for MCP streamable HTTP
# PLUGINS_SERVER_UDS=

# Enable SSL/TLS for the MCP server
# PLUGINS_SERVER_SSL_ENABLED=

# Path to plugin configuration file for external servers
# PLUGINS_CONFIG_PATH=

# Transport type for external MCP server (http, stdio)
# PLUGINS_TRANSPORT=

# Path to PEM client certificate for gRPC mTLS
# PLUGINS_GRPC_CLIENT_MTLS_CERTFILE=

# Path to PEM client private key for gRPC mTLS
# PLUGINS_GRPC_CLIENT_MTLS_KEYFILE=

# Path to CA bundle for gRPC client verification
# PLUGINS_GRPC_CLIENT_MTLS_CA_BUNDLE=

# Password for encrypted gRPC client private key
# PLUGINS_GRPC_CLIENT_MTLS_KEYFILE_PASSWORD=

# Verify the gRPC upstream server certificate
# PLUGINS_GRPC_CLIENT_MTLS_VERIFY=

# Path to PEM gRPC server private key
# PLUGINS_GRPC_SERVER_SSL_KEYFILE=

# Path to PEM gRPC server certificate
# PLUGINS_GRPC_SERVER_SSL_CERTFILE=

# Path to CA certificates for gRPC client verification
# PLUGINS_GRPC_SERVER_SSL_CA_CERTS=

# Password for encrypted gRPC server private key
# PLUGINS_GRPC_SERVER_SSL_KEYFILE_PASSWORD=

# gRPC client certificate requirement (none, optional, require)
# PLUGINS_GRPC_SERVER_SSL_CLIENT_AUTH=

# gRPC server host to bind to
# PLUGINS_GRPC_SERVER_HOST=

# gRPC server port to bind to
# PLUGINS_GRPC_SERVER_PORT=

# Unix domain socket path for gRPC server
# PLUGINS_GRPC_SERVER_UDS=

# Enable SSL/TLS for the gRPC server
# PLUGINS_GRPC_SERVER_SSL_ENABLED=