config

type Auth struct {
	// Resource is the URL at which clients reach this server's MCP endpoint.
	Resource string `yaml:"resource"`
	// Issuer is the exact iss claim of the identity provider's tokens.
	Issuer string `yaml:"issuer"`
	// Audience must identify this server's API, never the client app, whose ID tokens carry the client's aud.
	Audience string `yaml:"audience"`
	// RequiredScopes are the scopes every access token must have in its scope or scp claim.
	RequiredScopes []string `yaml:"required_scopes"`
	// ScopesSupported are the scopes advertised to clients; RequiredScopes if empty. They do not grant or deny access.
	ScopesSupported []string `yaml:"scopes_supported"`
	// AuthorizationServer is the authorization server advertised to clients; Issuer if empty.
	AuthorizationServer string `yaml:"authorization_server"`
}

type Authorization struct {
	Profiles map[string]Profile `yaml:"profiles"`
	Rules    []Rule             `yaml:"rules"`
}

type Certificate struct {
	// CertFile is the path of a PEM certificate chain, leaf first.
	CertFile string `yaml:"cert_file"`
	// KeyFile is the path of the certificate's PEM private key.
	KeyFile string `yaml:"key_file"`
}

type Codec struct {
	// Endpoint is the codec server's URL, without the /decode path. The
	// placeholder {namespace} in it stands for the namespace of the target.
	Endpoint string `yaml:"endpoint"`
	// AllowPlainHTTP allows an http Endpoint on any host, not only a loopback one.
	AllowPlainHTTP bool `yaml:"allow_plain_http"`
	// AuthorizationHeader says where to read the whole value of the Authorization
	// header sent to the codec server, such as "Bearer abc". Without one, requests
	// carry no Authorization header.
	AuthorizationHeader *Secret `yaml:"authorization_header"`
}

type Config struct {
	// Listen is the host:port the HTTP server binds to. Without Auth, the host must be a loopback IP.
	Listen string `yaml:"listen"`
	// ListenTLS, when set, makes the server serve HTTPS on Listen rather than plain HTTP.
	ListenTLS *Certificate `yaml:"listen_tls"`
	// ShutdownTimeout is how long the server waits for the tool calls in progress
	// after SIGINT, SIGTERM or stdin closing before it cancels them. Zero means DefaultShutdownTimeout.
	ShutdownTimeout time.Duration `yaml:"shutdown_timeout"`
	Targets         []Target      `yaml:"targets"`
	// Codecs are the codec servers that targets name in their codec field, by name.
	Codecs map[string]Codec `yaml:"codecs"`
	// Auth, when set, requires every MCP request to carry a valid access token.
	Auth *Auth `yaml:"auth"`
	// Authorization decides which tools each caller may use on which targets. It is required with Auth and not allowed without it.
	Authorization *Authorization `yaml:"authorization"`
	// AuditLogFile is the path of the file the server appends audit records to; stdout, or stderr over stdio, if empty.
	AuditLogFile string `yaml:"audit_log_file"`
	// ErrorLogFile is the path of the file the server appends its logs to; stderr if empty.
	ErrorLogFile string `yaml:"error_log_file"`
}

type Profile struct {
	Tools     []string `yaml:"tools"`
	ToolsDeny []string `yaml:"tools_deny"`
	Targets   []string `yaml:"targets"`
}

type Rule struct {
	ClaimName  string `yaml:"claim_name"`
	ClaimValue string `yaml:"claim_value"`
	Profile    string `yaml:"profile"`
}

type Secret struct {
	// Env is the name of an environment variable holding the secret, read at startup and on every use.
	Env string `yaml:"env"`
	// File is the path of a file holding the secret, read at startup and on every use.
	File string `yaml:"file"`
}

type Target struct {
	Name        string   `yaml:"name"`
	Aliases     []string `yaml:"aliases"`
	Description string   `yaml:"description"`
	Address     string   `yaml:"address"`
	Namespace   string   `yaml:"namespace"`
	// APIKey says where to read the target's API key.
	APIKey *Secret `yaml:"api_key"`
	// TLS is the client certificate the server presents to the target instead of
	// an API key. With either, the server connects over TLS; with neither it
	// connects in plaintext with no credentials.
	TLS *Certificate `yaml:"tls"`
	// PayloadHandling says how tool responses show the target's payloads:
	// PayloadOmit, PayloadPassthrough or PayloadDecode. Empty means PayloadOmit.
	PayloadHandling string `yaml:"payload_handling"`
	// Codec is the name of the codec server in Config.Codecs that decodes the
	// target's payloads. It is required when PayloadHandling is PayloadDecode.
	Codec string `yaml:"codec"`
}