@@ -4,7 +4,7 @@ Monorepo for managed CPEX plugins that are implemented in Rust and published as
 
 ## Runtime Requirements
 
-These packages target the CPEX release-candidate framework API and intentionally depend on `cpex>=0.1.0rc1,<0.2`. The RC dependency is the migration target for this repository; it is not an accidental pre-stable dependency.
+These packages target the CPEX 0.1 framework API and intentionally depend on `cpex>=0.1.0,<0.2`.
 
 Rust plugin packages require their compiled PyO3 extension at import/runtime. They do not ship Python fallback implementations for missing Rust extensions.
 
@@ -14,8 +14,14 @@ Managed plugins live under `plugins/rust/python-package/<slug>/`.
 
 Current plugins:
 
-- `rate_limiter`
-- `pii_filter`
+| Plugin | Package | Purpose |
+|---|---|---|
+| `encoded_exfil_detection` | `cpex-encoded-exfil-detection` | Detect suspicious encoded payload exfiltration patterns in prompt arguments, tool output, and resource content |
+| `pii_filter` | `cpex-pii-filter` | Detect and mask PII in nested payloads |
+| `rate_limiter` | `cpex-rate-limiter` | Enforce per-user, per-tenant, and per-tool rate limits |
+| `retry_with_backoff` | `cpex-retry-with-backoff` | Apply retry policy and exponential backoff metadata to transient failures |
+| `secrets_detection` | `cpex-secrets-detection` | Detect and redact likely credentials in prompt arguments, tool inputs and outputs, and resource content |
+| `url_reputation` | `cpex-url-reputation` | Apply static URL allowlist, blocklist, pattern, and heuristic checks before resource fetches |
 
 Each managed plugin must include:
 
 
@@ -25,7 +25,7 @@ make install
 
 ## Runtime Requirements
 
-This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+This plugin depends on `cpex>=0.1.0,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
 
 ## Usage
 
 
@@ -22,7 +22,7 @@ make install
 
 ## Runtime Requirements
 
-This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+This plugin depends on `cpex>=0.1.0,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
 
 ## Usage
 
 
@@ -6,7 +6,7 @@ Enforces rate limits per user, tenant, and tool across `tool_pre_invoke` and `pr
 
 ## Runtime Requirements
 
-This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+This plugin depends on `cpex>=0.1.0,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
 
 ## Hooks
 
 
@@ -20,7 +20,7 @@ make install
 
 ## Runtime Requirements
 
-This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+This plugin depends on `cpex>=0.1.0,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
 
 ## Usage
 
 
@@ -1,40 +1,44 @@
-# cpex-secrets-detection
+# Secrets Detection (Rust)
 
-Rust-backed secrets detection plugin for MCP Gateway / CPEX.
+Rust-backed secrets detection and redaction for ContextForge and MCP Gateway.
 
-## Runtime Requirements
+## Features
+
+- Detects likely credentials in prompt arguments, tool inputs, tool outputs, and resource content
+- Built-in detectors for AWS keys, Google API keys, GitHub tokens, Stripe keys, Slack tokens, and private key blocks
+- Optional broad detectors for generic API key assignments, JWT-like strings, long hex strings, and base64-like secrets
+- Blocking, redaction, or metadata-only reporting modes
+- Recursive scanning for nested dicts, lists, tuples, Pydantic-style objects, `__dict__`, and `__slots__`
+- Sanitized outward metadata that reports finding types and counts, not original secret values
 
-This plugin depends on `cpex>=0.1.0rc1,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
+## Build
+
+```bash
+make install
+```
 
-## What it does
+## Runtime Requirements
 
-This plugin scans hook payloads for likely secrets and can either:
+This plugin depends on `cpex>=0.1.0,<0.2` and imports hook models from `cpex.framework`. The compiled Rust extension is mandatory; there is no Python fallback implementation.
 
-- block processing when a secret is found
-- redact matched values in the returned payload
-- attach findings metadata to the hook result
+## Usage
 
-Supported hooks:
+The plugin scans these hooks:
 
 - `prompt_pre_fetch`: scans `payload.args`
+- `tool_pre_invoke`: scans tool invocation payloads before execution
 - `tool_post_invoke`: scans `payload.result`
 - `resource_post_fetch`: scans `payload.content.text`
 
-It walks nested values, not just top-level strings. Coverage includes:
+Typical uses:
 
-- plain strings
-- `dict`
-- `list`
-- `tuple`
-- custom Python objects with `__dict__`
-- slot-based objects with `__slots__`
-- Pydantic-style objects that expose `model_dump()` and `model_copy()`
+- block requests that contain likely credentials before they reach tools or prompts
+- redact secrets from returned tool or resource payloads
+- surface sanitized findings metadata for observability and tuning
 
-When redaction is enabled, the plugin preserves payload shape as much as possible instead of flattening everything to plain dicts.
+## Detection Coverage
 
-## Exact detector coverage
-
-The plugin ships these regex-based detectors:
+Enabled by default:
 
 - `aws_access_key_id`
 - `aws_secret_access_key`
@@ -43,92 +47,72 @@ The plugin ships these regex-based detectors:
 - `stripe_secret_key`
 - `slack_token`
 - `private_key_block`
+
+Disabled by default because they are broader and more false-positive-prone:
+
 - `generic_api_key_assignment`
 - `jwt_like`
 - `hex_secret_32`
 - `base64_24`
 
-Default behavior:
-
-- enabled by default:
-  - `aws_access_key_id`
-  - `aws_secret_access_key`
-  - `google_api_key`
-  - `github_token`
-  - `stripe_secret_key`
-  - `slack_token`
-  - `private_key_block`
-- disabled by default because they are broader and more false-positive-prone:
-  - `generic_api_key_assignment`
-  - `jwt_like`
-  - `hex_secret_32`
-  - `base64_24`
-
-## What it does not do
-
-This plugin is intentionally narrow. It does not:
-
-- verify whether a matched credential is real, active, or revoked
-- call external services
-- decode or unpack data before scanning
-  - no base64 decode pass
-  - no hex decode pass
-  - no gzip, zip, or archive inspection
-- scan binary resource bodies
-  - `resource_post_fetch` only scans `content.text`
-- inspect arbitrary object internals unless they are exposed through supported Python state surfaces such as `model_dump()`, `__dict__`, or `__slots__`
-- guarantee detection of every secret format
-  - coverage is limited to the listed regex patterns
-- use entropy scoring, ML classification, or semantic analysis
-- infer secret validity from surrounding prose
-
-It also does not emit the original matched secret in outward-facing findings metadata or violation examples. Those surfaces contain secret types only.
-
-## Config
-
-Available config keys:
-
-- `enabled`: map of detector name to `true` or `false`
-- `redact`: whether to replace matches in returned payloads
-- `redaction_text`: replacement text used when `redact=true`
-- `block_on_detection`: whether to stop processing on detection
-- `min_findings_to_block`: threshold for blocking
-
-Defaults:
+The detectors are regex-based. They do not verify whether a credential is real, active, or revoked.
+
+## Configuration
 
 ```yaml
-enabled:
-  aws_access_key_id: true
-  aws_secret_access_key: true
-  google_api_key: true
-  github_token: true
-  stripe_secret_key: true
-  generic_api_key_assignment: false
-  slack_token: true
-  private_key_block: true
-  jwt_like: false
-  hex_secret_32: false
-  base64_24: false
-redact: false
-redaction_text: "***REDACTED***"
-block_on_detection: true
-min_findings_to_block: 1
+config:
+  enabled:
+    aws_access_key_id: true
+    aws_secret_access_key: true
+    google_api_key: true
+    github_token: true
+    stripe_secret_key: true
+    slack_token: true
+    private_key_block: true
+    generic_api_key_assignment: false
+    jwt_like: false
+    hex_secret_32: false
+    base64_24: false
+  redact: false
+  redaction_text: "***REDACTED***"
+  block_on_detection: true
+  min_findings_to_block: 1
 ```
 
-## Result shape
+| Field | Type | Default | Description |
+|---|---|---|---|
+| `enabled` | dict | built-in defaults | Per-detector enable flags; unspecified detectors inherit defaults |
+| `redact` | bool | `false` | Replace matched secret values in returned payloads |
+| `redaction_text` | string | `"***REDACTED***"` | Replacement text used when `redact=true` |
+| `block_on_detection` | bool | `true` | Return a violation when enough findings are present |
+| `min_findings_to_block` | integer | `1` | Minimum finding count required before blocking |
+
+## Behavior Notes
+
+- Redaction preserves payload shape where possible instead of flattening everything to plain dicts.
+- `base64_24` uses capture-group redaction so leading non-base64 boundary characters are preserved.
+- Broad detectors remain opt-in to reduce noisy matches on ordinary identifiers.
+- Binary resource bodies are not scanned; `resource_post_fetch` only scans text content exposed as `payload.content.text`.
+- The plugin does not decode archives, compressed data, or arbitrary encoded blobs before scanning.
+
+## Returned Metadata
 
-On detection, the plugin may return:
+When detections occur, the plugin can emit:
 
-- `modified_payload` with redacted values when `redact=true`
 - `metadata.count`
 - `metadata.secrets_redacted=true` when redaction happened
 - `metadata.secrets_findings=[{"type": "..."}]` when reporting findings without redaction
-- a `PluginViolation` with `code="SECRETS_DETECTED"` when blocking
 
-## Build
+Blocking responses use the `SECRETS_DETECTED` violation code.
+
+## Security Notes
+
+- Outward-facing findings metadata and violation examples do not include original matched secret values.
+- Enable broad detectors only after testing against representative payloads.
+- The detector is best-effort pattern matching and should complement, not replace, upstream secret management controls.
+
+## Testing
 
 ```bash
-uv sync --dev
-make install
-make test-all
+make ci
 ```