Gateway Policies

Public-safe read calls can be described and validated. Mutating/protected downstream calls require PLATPHORM_API_KEY.

PLATPHORM_API_KEY is forwarded only after local authentication and only to trusted PlatPhormNews MCP endpoints for protected operations; it is never persisted or returned.

active_in_cloudflare.gateway_audit_log

three_failures_open_target_for_30_seconds

2000000

traceparent, tracestate, X-PlatPhorm-Trace-Id, X-PlatPhorm-Span-Id, X-PlatPhorm-Request-Id

capture when present, hash/redact for public summaries, never expose raw values publicly

*.platphormnews.com, mcp.platphormnews.com, *.ph3ar.com

localhost, private-ip-ranges, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local, metadata-services, metadata services, file://, ftp://, gopher://, URLs with embedded credentials, untrusted external domains, redirects to blocked targets

PLATPHORM_API_KEY is forwarded only after local authentication and only to trusted PlatPhormNews MCP endpoints for protected operations; it is never persisted or returned.

Only public discovery artifacts and read-only MCP methods are eligible for public proxying.

Mutating/protected proxying requires PLATPHORM_API_KEY, a durable Aurora audit record, trusted-target validation, bounded responses, and a per-target circuit breaker.