# Pipelock configuration for Docker Compose
# See https://github.com/luckyPipewrench/pipelock for full options.

version: 1
mode: balanced

forward_proxy:
  enabled: true
  max_tunnel_seconds: 300
  idle_timeout_seconds: 60

websocket_proxy:
  enabled: false
  max_message_bytes: 1048576
  max_concurrent_connections: 128
  scan_text_frames: true
  allow_binary_frames: false
  forward_cookies: false
  strip_compression: true
  max_connection_seconds: 3600
  idle_timeout_seconds: 300
  origin_policy: rewrite

dlp:
  scan_env: true
  include_defaults: true

response_scanning:
  enabled: true
  action: warn
  include_defaults: true

mcp_input_scanning:
  enabled: true
  action: block
  on_parse_error: block

mcp_tool_scanning:
  enabled: true
  action: warn
  detect_drift: true

mcp_tool_policy:
  enabled: true
  action: warn

mcp_session_binding:
  enabled: true
  unknown_tool_action: warn

tool_chain_detection:
  enabled: true
  action: warn
  window_size: 20
  max_gap: 3