{
  "name": "mcp-p1",
  "condition": "${find(request.uri.path, '^/p1-mcp')}",
  "properties": {
    "mcpServerUrl": "http://localhost:8000",
    "gatewayUrl": "https://ig.example.com:8443",
    "pingOneAsUrl": "https://auth.pingone.com/<envId>/as",
    "pingOneIntrospectUrl": "https://auth.pingone.com/<envId>/as/introspect",
    "pingOneResourceClientId": "<resourceId>"
  },
  "baseURI": "&{mcpServerUrl}",
  "heap": [
    {
      "name": "AuditService",
      "type": "AuditService",
      "config": {
        "eventHandlers": [
          {
            "class": "org.forgerock.audit.handlers.json.JsonAuditEventHandler",
            "config": {
              "name": "json",
              "logDirectory": "&{ig.instance.dir}/audit",
              "topics": [
                "access",
                "mcp"
              ]
            }
          }
        ]
      }
    },
    {
      "name": "rsFilter",
      "type": "OAuth2ResourceServerFilter",
      "config": {
        "scopes": [
          "test"
        ],
        "accessTokenResolver": {
          "type": "TokenIntrospectionAccessTokenResolver",
          "config": {
            "endpoint": "&{pingOneIntrospectUrl}",
            "providerHandler": {
              "type": "Chain",
              "config": {
                "filters": [
                  {
                    "type": "ClientSecretBasicAuthenticationFilter",
                    "config": {
                      "clientId": "&{pingOneResourceClientId}",
                      "clientSecretId": "pingone.resource.secret",
                      "secretsProvider": {
                        "type": "SystemAndEnvSecretStore"
                      }
                    }
                  }
                ],
                "handler": "ClientHandler"
              }
            }
          }
        }
      }
    }
  ],
  "handler": {
    "type": "Chain",
    "config": {
      "filters": [
        {
          "type": "McpAuditFilter",
          "config": {
            "auditService": "AuditService"
          }
        },
        {
          "type": "McpProtectionFilter",
          "config": {
            "resourceId": "&{gatewayUrl}/p1-mcp",
            "authorizationServerUri": "&{pingOneAsUrl}",
            "resourceServerFilter": "rsFilter",
            "supportedScopes": [
              "test"
            ]
          }
        },
        {
          "type": "McpValidationFilter",
          "config": {
            "acceptedOrigins": ".*"
          }
        },
        {
          "type": "UriPathRewriteFilter",
          "config": {
            "mappings": {
              "/p1-mcp": "/"
            }
          }
        }
      ],
      "handler": {
        "type": "ReverseProxyHandler",
        "config": {
          "soTimeout": "20 seconds"
        }
      }
    }
  }
}