logging:
  level: INFO
  json_format: true

mcp_servers:
  # The official "everything" server from modelcontextprotocol/servers, as the
  # image Docker publishes for it, run beside the gateway by the compose file.
  #
  # `mode: remote` rather than `mode: container`: container mode shells out to
  # a podman or docker CLI on the host running Hangar, and the published
  # Hangar image has neither -- it says so when you try
  # ("No container runtime (podman or docker) found on PATH"). Mounting the
  # Docker socket does not help, because the socket is not what it uses.
  #
  # This is also why the server is `everything` and not `filesystem`: of the
  # official servers, it is the one that speaks streamable HTTP
  # (`node dist/index.js streamableHttp`). The rest are stdio-only, which a
  # gateway in its own container cannot attach to without a bridge.
  #
  # The example used to declare `image: my-org/openai-mcp:latest` running
  # `python -m openai_mcp_server` -- neither of which exists.
  everything:
    mode: remote
    endpoint: http://everything:3001/mcp
    idle_ttl_s: 300

    # Capability declaration: what this provider needs, which the operator
    # turns into a NetworkPolicy and Hangar enforces. It describes the provider
    # actually declared above -- the point of the block is lost if it describes
    # a different one.
    capabilities:
      network:
        egress:
          - host: everything
            port: 3001
            protocol: http
        dns_allowed: true
      filesystem:
        read_paths: []
        write_paths: []
        temp_allowed: false
      environment:
        required: []
        optional:
          - LOG_LEVEL
      tools:
        max_count: 30
        schema_drift_alert: true
      resources:
        max_memory_mb: 256
        max_cpu_percent: 50
      enforcement_mode: alert