refactor(plugins): replace in-tree rate_limiter with cpex-rate-limiter package

Remove the in-tree rate_limiter plugin and replace it with the
cpex-rate-limiter PyPI package, a compiled Rust extension providing
the same RateLimiterPlugin class with additional algorithms
(sliding-window, token-bucket) alongside the original fixed-window.

- Add cpex-rate-limiter>=0.0.2 as a [plugins] optional dependency
- Update Containerfile.lite to install the plugins extra
- Remove plugins/rate_limiter/ source directory
- Remove unit and integration tests that imported plugin internals
- Update all config files to use cpex_rate_limiter.RateLimiterPlugin
- Disable RateLimiterPlugin in test fixture config (package not
  available in unit test environment)
- Update documentation to reflect the external package

Signed-off-by: Jonathan Springer <jps@s390x.com>

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: jonpspri

Containerfile.lite

@@ -164,6 +164,7 @@ RUN chmod 644 /etc/profile.d/use-openssl.sh
 # This maximizes Docker layer caching - dependencies change less often
 # ----------------------------------------------------------------------------
 COPY pyproject.toml /app/
+COPY plugins/requirements.txt /app/plugins/requirements.txt
 
 # ----------------------------------------------------------------------------
 # Copy Rust plugin wheels from rust-builder stage (if any exist)
@@ -201,6 +202,10 @@ RUN set -euo pipefail \
     else \
         /app/.venv/bin/uv pip install ".[redis,postgres,observability,granian]"; \
     fi \
+    && if [ -f /app/plugins/requirements.txt ]; then \
+        echo "🧩 Installing plugin packages..."; \
+        /app/.venv/bin/pip install --no-cache-dir -r /app/plugins/requirements.txt; \
+    fi \
     && if [ "$ENABLE_RUST" = "true" ] && ls "/tmp/rust-wheels/"*.whl 1> /dev/null 2>&1; then \
         echo "🦀 Installing Rust plugins..."; \
         /app/.venv/bin/python3 -m pip install "/tmp/rust-wheels/"*.whl && \

docker-entrypoint.sh

@@ -389,7 +389,18 @@ sys.exit(1)
 PY
 }
 
+install_plugin_requirements() {
+    RELOAD_PLUGIN_REQUIREMENTS_TXT="${RELOAD_PLUGIN_REQUIREMENTS_TXT:-false}"
+    PLUGIN_REQUIREMENTS_TXT_PATH="${PLUGIN_REQUIREMENTS_TXT_PATH:-/app/plugins/requirements.txt}"
+
+    if [[ "${RELOAD_PLUGIN_REQUIREMENTS_TXT}" = "true" && -f "${PLUGIN_REQUIREMENTS_TXT_PATH}" ]]; then
+        echo "🧩 Installing plugin packages from ${PLUGIN_REQUIREMENTS_TXT_PATH}..."
+        /app/.venv/bin/pip install --no-cache-dir -r "${PLUGIN_REQUIREMENTS_TXT_PATH}"
+    fi
+}
+
 apply_rust_mcp_mode_defaults
+install_plugin_requirements
 build_server_command "$@"
 print_mcp_runtime_mode
 

docs/docs/manage/configuration-plugins.md

@@ -26,6 +26,15 @@ Inside the gateway, plugin settings are exposed under `settings.plugins`.
 | `PLUGINS_LOG_LEVEL`           | Plugin framework log level                       | `INFO`                | string  |
 | `PLUGINS_SKIP_SSL_VERIFY`     | Skip TLS verification for plugin HTTP requests   | `false`               | bool    |
 
+### Plugin Package Installation (docker-entrypoint.sh)
+
+These variables are evaluated by `docker-entrypoint.sh` at container startup, before the application server begins. They allow re-installing or overriding plugin packages at runtime without rebuilding the container image.
+
+| Setting                            | Description                                                      | Default                            | Options |
+| ---------------------------------- | ---------------------------------------------------------------- | ---------------------------------- | ------- |
+| `RELOAD_PLUGIN_REQUIREMENTS_TXT`  | Re-install plugin packages from requirements file at startup     | `false`                            | bool    |
+| `PLUGIN_REQUIREMENTS_TXT_PATH`    | Path to the plugin requirements file                             | `/app/plugins/requirements.txt`    | string  |
+
 ### HTTP Client Settings
 
 | Setting                                   | Description                                      | Default | Options |

docs/docs/testing/unittest.md

@@ -227,7 +227,6 @@ The remaining ~93% is DOM manipulation, fetch calls, Chart.js rendering, and HTM
 | tests/unit/mcpgateway/plugins/plugins/output_length_guard/test_output_length_guard.py           |      5 |       0 |        5 |
 | tests/unit/mcpgateway/plugins/plugins/pii_filter/test_pii_filter.py                             |     18 |       0 |       18 |
 | tests/unit/mcpgateway/plugins/plugins/resource_filter/test_resource_filter.py                   |     15 |       0 |       15 |
-| tests/unit/mcpgateway/plugins/plugins/rate_limiter/test_rate_limiter.py                         |      1 |       0 |        1 |
 | tests/unit/mcpgateway/plugins/plugins/response_cache_by_prompt/test_response_cache_by_prompt.py |     19 |       0 |       19 |
 | tests/unit/mcpgateway/plugins/plugins/schema_guard/test_schema_guard.py                         |      1 |       0 |        1 |
 | tests/unit/mcpgateway/plugins/plugins/test_init_hooks_plugins.py                                |    107 |       0 |      107 |

docs/docs/using/plugins/plugins.md

@@ -40,7 +40,7 @@ Plugins for improving system reliability, performance, and resource management.
 |--------|------|-------------|
 | [Circuit Breaker](https://github.com/IBM/mcp-context-forge/tree/main/plugins/circuit_breaker) | Native | Trips per-tool breaker on high error rates or consecutive failures and blocks during cooldown |
 | [Watchdog](https://github.com/IBM/mcp-context-forge/tree/main/plugins/watchdog) | Native | Enforces maximum runtime for tools with warn or block actions on threshold violations |
-| [Rate Limiter](https://github.com/IBM/mcp-context-forge/tree/main/plugins/rate_limiter) | Native | Per-user, tenant, and tool rate limiting with selectable algorithms (fixed_window, sliding_window, token_bucket) and memory or Redis backends |
+| [Rate Limiter](https://pypi.org/project/cpex-rate-limiter/) | Package | Rate limiting by user, tenant, or tool with fixed-window, sliding-window, and token-bucket algorithms; memory and Redis backends |
 | [Cached Tool Result](https://github.com/IBM/mcp-context-forge/tree/main/plugins/cached_tool_result) | Native | Caches idempotent tool results in-memory with configurable TTL and key fields |
 | [Response Cache by Prompt](https://github.com/IBM/mcp-context-forge/tree/main/plugins/response_cache_by_prompt) | Native | Advisory response cache using cosine similarity over prompt/input fields with configurable threshold |
 | [Retry with Backoff](https://github.com/IBM/mcp-context-forge/tree/main/plugins/retry_with_backoff) | Native | Annotates retry/backoff policy in metadata with exponential backoff on specific HTTP status codes |

llms/plugins-llms.md

@@ -175,7 +175,7 @@ Optimization:
 - `response_cache_by_prompt` - Response caching
 - `circuit_breaker` - Circuit breaker pattern
 - `retry_with_backoff` - Retry logic with backoff
-- `rate_limiter` - Rate limiting
+- `cpex-rate-limiter` - Rate limiting (external package: `cpex_rate_limiter.RateLimiterPlugin`)
 - `output_length_guard` - Output length limits
 
 Utilities:

plugins/config-pii-guardian-policy.yaml

@@ -206,11 +206,11 @@ plugins:
     conditions: []
     config: {}
 
-  # Rate limiter (fixed window, in-memory)
+  # Rate limiter (cpex-rate-limiter package)
   - name: "RateLimiterPlugin"
-    kind: "plugins.rate_limiter.rate_limiter.RateLimiterPlugin"
+    kind: "cpex_rate_limiter.RateLimiterPlugin"
     description: "Per-user/tenant/tool rate limits"
-    version: "0.1.0"
+    version: "0.0.2"
     author: "Mihai Criveti"
     hooks: ["prompt_pre_fetch", "tool_pre_invoke"]
     tags: ["limits", "throttle"]

plugins/config.yaml

@@ -206,9 +206,9 @@ plugins:
 
   # Rate limiter (fixed window, Redis-backed for shared state across instances)
   - name: "RateLimiterPlugin"
-    kind: "plugins.rate_limiter.rate_limiter.RateLimiterPlugin"
+    kind: "cpex_rate_limiter.RateLimiterPlugin"
     description: "Per-user/tenant/tool rate limits"
-    version: "0.1.0"
+    version: "0.0.2"
     author: "Mihai Criveti"
     hooks: ["prompt_pre_fetch", "tool_pre_invoke"]
     tags: ["limits", "throttle"]