[Experimental]: Test integration of secrets detection plugin with rust bindings provided by cpex with the rust data plane

[gandhipratik203]

Summary

This is an experimental spike to wire the Rust-native secrets detection plugin from IBM/cpex-plugins#148 into the data-plane runtime CPEX path.

It adds a feature-gated secrets-detection-plugin dependency, registers SecretsDetectionFactory directly with CpexRuntimeRegistry, and validates Redis-driven runtime activation. The spike only targets the currently supported data-plane hooks: cmf.tool_pre_invoke and cmf.tool_post_invoke.

Validation

• cargo +1.96 check -p contextforge-gateway-rs --features secrets-detection-plugin
• cargo +1.96 test -p contextforge-gateway-rs-cpex
• cargo +1.96 test -p contextforge-gateway-rs-lib --test gateway_plugins -- --nocapture
• cargo +1.96 test -p contextforge-gateway-rs --features secrets-detection-plugin --test secrets_detection_e2e -- --ignored --nocapture

Manual gateway smoke test result

Verified manually with:

• one Redis instance
• one upstream MCP backend: gateway-one
• one real data-plane gateway binary
• runtime plugin config stored in Redis
• hooks: cmf.tool_pre_invoke, cmf.tool_post_invoke
• redact: true
• block_on_detection: false

Manual flow:

1. Started Redis and gateway-one.
2. Stored ContextForgeGatewayRuntimePluginConfig in Redis.
3. Started the gateway binary with --features "secrets-detection-plugin contextforge-gateway-rs-lib/with_tools" and --runtime-plugins-enabled true.
4. Configured a user route to http://127.0.0.1:5555/mcp.
5. Opened an MCP session through the gateway.
6. Confirmed tools/list exposes echo.
7. Called echo with a synthetic secret-shaped test value in the credential argument.

Observed sanitized response:

{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{\"credential\":\"[redacted]\",\"message\":\"hello\"}"
      }
    ],
    "isError": false
  }
}

Manual assertions:

• response contains [redacted]
• response does not contain the synthetic raw secret-shaped test value
• the backend tool call succeeds through the real gateway path

Binary E2E test result

Ran:

cargo +1.96 test -p contextforge-gateway-rs \
  --features secrets-detection-plugin \
  --test secrets_detection_e2e \
  -- --ignored --nocapture

Result:

running 2 tests
test binary_e2e_blocks_tool_arguments_before_backend_call ... ok
test binary_e2e_redacts_tool_arguments_and_results ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

This starts redis-server, a test MCP backend, and the real gateway binary. It verifies both deny behavior before the backend receives the call and redact behavior through the client response.

Manual commands used

Start Redis and the single sample backend:

docker compose -f docker/docker-compose-local.yaml up -d redis gateway-one
docker compose -f docker/docker-compose-local.yaml ps redis gateway-one

Add the runtime plugin config before starting the gateway:

docker compose -f docker/docker-compose-local.yaml exec -T redis redis-cli SET \
  ContextForgeGatewayRuntimePluginConfig \
  '{
    "version": 1,
    "cpex": {
      "plugins": [
        {
          "name": "secrets-detection",
          "kind": "validator/secrets-detection",
          "hooks": ["cmf.tool_pre_invoke", "cmf.tool_post_invoke"],
          "config": {
            "redact": true,
            "redaction_text": "[redacted]",
            "block_on_detection": false
          }
        }
      ]
    }
  }'

Start the gateway binary:

cargo +1.96 run -p contextforge-gateway-rs \
  --features "secrets-detection-plugin contextforge-gateway-rs-lib/with_tools" \
  --bin contextforge-gateway-rs -- \
  --address 127.0.0.1:8001 \
  --redis-address 127.0.0.1 \
  --redis-port 6379 \
  --redis-mode plain-text \
  --token-verification-public-key assets/jwt.key.pub \
  --token-verification-private-key assets/jwt.key \
  --upstream-connection-mode plain-text-or-tls \
  --runtime-plugins-enabled true \
  --number-of-cpus 1

Then configure the user route to http://127.0.0.1:5555/mcp, open an MCP session, call tools/list, and call the echo tool with a synthetic secret-shaped value in the credential argument.

Notes

• The plugin must be compiled into the gateway binary; Redis config only activates the already-registered factory.
• Prompt/resource hooks are out of scope for this spike because data-plane currently rejects non-tool CPEX hooks.
• The binary E2E is ignored by default because it starts redis-server, a test MCP backend, and the real gateway binary.
• This depends on the experimental [EXPERIMENTATL] : Add Rust CPEX secrets detection experiment IBM/cpex-plugins#148 crate via a pinned Git rev: 6ff7af74587574fe6115ce87427519b63f6062da.

[lucarlig]

LGTM