Merge pull request #303 from apollographql/fix-missing-token-propagation

Fix missing token propagation

Author: DaleSeo

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+# [0.7.4] - 2025-08-27
+
+## 🐛 Fixes
+
+### fix: Add missing token propagation for execute tool - @DaleSeo PR #298
+
+The execute tool is not forwarding JWT authentication tokens to upstream GraphQL endpoints, causing authentication failures when using this tool with protected APIs. This PR adds missing token propagation for execute tool.
+
 # [0.7.3] - 2025-08-25
 
 ## 🐛 Fixes

Cargo.lock

@@ -8,7 +8,7 @@ members = [
 
 [workspace.package]
 authors = ["Apollo <[email protected]>"]
-version = "0.7.3"
+version = "0.7.4"
 
 [workspace.dependencies]
 apollo-compiler = "1.27.0"

Cargo.toml

@@ -187,7 +187,7 @@ mod test {
             "extensions": {
                 "clientLibrary": {
                     "name":"mcp",
-                    "version":"0.7.3"
+                    "version":"0.7.4"
                 }
             },
             "operationName":"mock_operation"
@@ -233,7 +233,7 @@ mod test {
                 },
                 "clientLibrary": {
                     "name":"mcp",
-                    "version":"0.7.3"
+                    "version":"0.7.4"
                 }
             },
         })

crates/apollo-mcp-server/src/graphql.rs

@@ -210,6 +210,11 @@ impl ServerHandler for Running {
             EXECUTE_TOOL_NAME => {
                 let mut headers = self.headers.clone();
                 if let Some(axum_parts) = context.extensions.get::<axum::http::request::Parts>() {
+                    // Optionally extract the validated token and propagate it to upstream servers if present
+                    if let Some(token) = axum_parts.extensions.get::<ValidToken>() {
+                        headers.typed_insert(token.deref().clone());
+                    }
+
                     // Forward the mcp-session-id header if present
                     if let Some(session_id) = axum_parts.headers.get("mcp-session-id") {
                         headers.insert("mcp-session-id", session_id.clone());

crates/apollo-mcp-server/src/server/states/running.rs

@@ -26,14 +26,14 @@ To download a **specific version** of Apollo MCP Server (recommended for CI envi
 
 ```bash
 # Note the `v` prefixing the version number
-docker image pull ghcr.io/apollographql/apollo-mcp-server:v0.7.3
+docker image pull ghcr.io/apollographql/apollo-mcp-server:v0.7.4
 ```
 
 To download a specific version of Apollo MCP Server that is a release candidate:
 
 ```bash
 # Note the `v` prefixing the version number and the `-rc` suffix
-docker image pull ghcr.io/apollographql/apollo-mcp-server:v0.7.3-rc.1
+docker image pull ghcr.io/apollographql/apollo-mcp-server:v0.7.4-rc.1
 ```
 
 <Note>
@@ -65,7 +65,7 @@ To install or upgrade to a **specific version** of Apollo MCP Server (recommende
 
 ```bash
 # Note the `v` prefixing the version number
-curl -sSL https://mcp.apollo.dev/download/nix/v0.7.3 | sh
+curl -sSL https://mcp.apollo.dev/download/nix/v0.7.4 | sh
 ```
 
 If your machine doesn't have the `curl` command, you can get the latest version from the [`curl` downloads page](https://curl.se/download.html).
@@ -82,5 +82,5 @@ To install or upgrade to a **specific version** of Apollo MCP Server (recommende
 
 ```bash
 # Note the `v` prefixing the version number
-iwr 'https://mcp.apollo.dev/download/win/v0.7.3' | iex
+iwr 'https://mcp.apollo.dev/download/win/v0.7.4' | iex
 ```

docs/source/install.mdx

@@ -14,7 +14,7 @@ BINARY_DOWNLOAD_PREFIX="${APOLLO_MCP_SERVER_BINARY_DOWNLOAD_PREFIX:="https://git
 
 # Apollo MCP Server version defined in apollo-mcp-server's Cargo.toml
 # Note: Change this line manually during the release steps.
-PACKAGE_VERSION="v0.7.3"
+PACKAGE_VERSION="v0.7.4"
 
 download_binary_and_run_installer() {
     downloader --check

scripts/nix/install.sh

@@ -8,7 +8,7 @@
 
 # Apollo MCP Server version defined in apollo-mcp-server's Cargo.toml
 # Note: Change this line manually during the release steps.
-$package_version = 'v0.7.3'
+$package_version = 'v0.7.4'
 
 function Install-Binary($apollo_mcp_server_install_args) {
   $old_erroractionpreference = $ErrorActionPreference