[tomek-labuk]

Description

Fixes #7493

Adds documentation for the new AI MCP Sanitizer policy, similar to to the existing AI PII Sanitizer for the LLM traffic. This PR also creates a shared include for the AI PII service which is shared across both policies (the MCP sanitizer doesn't expose the sanitization endpoints though).

TODOs once the development work is finalized:

• Confirm all field names, defaults, scope, and error behavior against the spec (PR #23501 and the schema are the sources; Aha and PRD are stale)
• Confirm recover_redacted can combine with tool_arguments only
• recover_redacted defaults to true and validation rejects it when output is sanitized: confirm tool_results requires recover_redacted: false
• Confirm the exact set of sanitized fields
• Confirm the user-facing name of the auth tools that are never sanitized
• Confirm behavior for conversion-only and upstream-server types
• Confirm call pattern: one PII call per string (PRD) or batched (design doc, PR)
• Confirm the block error code and message
• Confirm how rejection_mode and continue_on_detection behave on MCP traffic
• Confirm how each stop_on_error value behaves for both targets
• Decide behavior when the PII service returns fewer entries than sent (design doc open question 2)
• Confirm logging field names and link to the audit log reference
• Add entity examples and the scope and attachment model for AI MCP Server

Preview Links

https://deploy-preview-7635--kongdeveloper.netlify.app/ai-gateway/policies/ai-mcp-sanitizer/
https://deploy-preview-7635--kongdeveloper.netlify.app/ai-gateway/mcp/#map-apis-to-mcp-servers-using-ai-gateway
https://deploy-preview-7635--kongdeveloper.netlify.app/ai-gateway/ai-data-gov/#data-loss-prevention

Checklist

• Tested how-to docs. If not, note why here.
• All pages contain metadata.
• Any new docs link to existing docs.
• All autogenerated instructions render correctly (API, decK, Konnect, Kong Manager).
• Style guide (capitalized gateway entities, placeholder URLs) implemented correctly.
• Every page has a description entry in frontmatter.
• Add new pages to the product documentation index (if applicable).

[netlify]

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	da3cd76
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6ada00f88f03d46f3c76033a
😎 Deploy Preview	https://deploy-preview-7635--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kong-ksai]

✅ KSAI Review: Finished

---

Run report (federated) · 1 paid run · $0.3136 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	deepseek-ai/deepseek-v4.1-flash/max	77	$0.3136

Reviewing cost $0.3136

[kong-ksai]

Check	Result
Scope	New AI MCP Sanitizer policy page, plus links from the AI MCP Server entity, the MCP and data governance landing pages, and the audit log reference.
Mandate	default-code-reviewer
Findings	1 Medium, 2 Low
Findings audit	Independent audit completed: both Low findings verified at their cited lines; one Medium added for a streaming claim that contradicts the recovery default.

The new page matches AiMcpSanitizer.json for the documented defaults, its generated reference page backs the reference/#schema--config-* links, and the new cross-links point to pages that exist. One behavior contradiction and two Low cleanups remain.

No additional concerns found.