Summary

Package the in-tree plugins/content_moderation/ plugin as a standalone cpex-* PyPI package (same pattern established in #3965 for pii_filter, secrets_detection, url_reputation, retry_with_backoff, encoded_exfil_detection, and rate_limiter), wire it into the dynamic plugin configuration so it's discoverable at runtime, and author user-facing documentation — including a walkthrough of how to reproduce the plugins/config-pii-guardian-policy.yaml setup dynamically via the plugin management API.

Motivation

• Consistency: all other first-party plugins have been migrated to cpex-* wheels; content_moderation is the remaining in-tree holdout and should follow the same distribution model.
• Decoupling: removes the plugin from the core gateway release surface, allowing independent versioning and faster iteration on moderation policy.
• Discoverability: once registered in the dynamic plugin configuration, operators can enable, configure, and bind the plugin per-tool/per-tenant without editing static YAML and restarting.
• Usability: the config-pii-guardian-policy.yaml example is powerful but opaque to users who want to achieve the same result through the API — we need a documented, copy-pasteable path.

Scope

1. Package as cpex-content-moderation

• Move plugins/content_moderation/ out of the main repo tree and into a standalone package repo following the established cpex-* layout.
• Publish to PyPI as cpex-content-moderation with pinned version.
• Add it to the [plugins] extra in pyproject.toml so make install-dev picks it up.
• Update any kind: references in docs/examples from plugins.content_moderation.content_moderation.ContentModerationPlugin to cpex_content_moderation.ContentModerationPlugin (mirror of refactor(plugins): migrate in-tree plugins to PyPI packages (cpex-*) #3965).
• Remove the in-tree plugins/content_moderation/ directory and move/port tests from tests/unit/mcpgateway/plugins/plugins/content_moderation/ to the new package.

2. Dynamic Plugin Configuration

• Ensure cpex_content_moderation is discoverable via the runtime plugin registry and the admin/plugin-management API.
• Verify it appears in GET /plugins (or equivalent) without additional static YAML entries.
• Confirm plugin bindings (binding_reference_id, per-tool config from feat: add binding_reference_id to tool plugin bindings and expand plugin config schemas #4143) work with the moderation plugin.

3. Documentation

Create user-facing docs under docs/docs/plugins/content-moderation.md covering:

• Overview of what the plugin does, which hooks it registers, and when it fires.
• Configuration reference (all supported options, defaults, examples).
• Dynamic configuration walkthrough: step-by-step API calls (curl + Python SDK) that reproduce the config-pii-guardian-policy.yaml behavior entirely through the plugin management API — no static YAML edits required.
  • Register/enable the plugin
  • Set configuration (thresholds, categories, modes)
  • Bind to a tool or virtual server
  • Verify via GET endpoints
• Troubleshooting (common misconfigurations, how to read moderation decisions in traces/logs).
• Link from the main plugins index.

Acceptance Criteria

• cpex-content-moderation published to PyPI and pinned in the [plugins] extra.
• plugins/content_moderation/ removed from the main repo; tests migrated.
• Plugin loads automatically after make install-dev and appears in the dynamic plugin registry / management API.
• Existing config-pii-guardian-policy.yaml continues to work with the new cpex_content_moderation.* kind path (updated in-place).
• New documentation page published under docs/docs/plugins/content-moderation.md with a complete API-driven equivalent of the policy YAML.
• test_all_plugins_load_together (or equivalent) updated for the new package.

References

• refactor(plugins): migrate in-tree plugins to PyPI packages (cpex-*) #3965 — original cpex-* migration PR (template for this work)
• feat: add binding_reference_id to tool plugin bindings and expand plugin config schemas #4143 — binding_reference_id and plugin config schema expansion (relevant for per-tool binding docs)
• plugins/config-pii-guardian-policy.yaml — the reference configuration to reproduce via API