🐞 Bug Summary

• RESOURCE_POST_FETCH plugins are executed before invoke_resource() resolves resource templates. Because of this ordering, plugins only receive raw/template content, and values introduced during invoke_resource() are not redacted.

🧩 Affected Component

Select the area of the project impacted:

• mcpgateway - API
• mcpgateway - UI (admin panel)
• mcpgateway.wrapper - stdio wrapper
• Federation or Transports
• CLI, Makefiles, or shell scripts
• Container setup (Docker/Podman/Compose)
• Other (explain below)

🔁 Steps to Reproduce

1. Enable RESOURCE_POST_FETCH hook with secrets_detection plugin.
2. Create a resource whose content is dynamically resolved via invoke_resource() (e.g., template expansion or secret injection).
3. Call read_resource() for that resource.
4. Observe that secrets added during invoke_resource() appear in the response without being redacted.

🤔 Expected Behavior

What should have happened instead?

1. RESOURCE_POST_FETCH should execute after invoke_resource() so plugins receive the fully materialized content.
2. Secrets detection should redact sensitive values from the final resolved payload before returning it to the client.

🧠 Environment Info

You can retrieve most of this from the /version endpoint.

🧩 Additional Context (optional)

Add any configuration details, flags, or related issues.

Root cause: RESOURCE_POST_FETCH currently runs immediately after DB fetch instead of after resource resolution.

Proposed fix:

Move RESOURCE_POST_FETCH invocation to after content normalization + invoke_resource()

Ensure plugins operate on fully resolved content