Skip to content

Commit ea774ce

Browse files
DaleSeoDaleSeo
committed
feat: include W3C trace context headers
1 parent 7048e23 commit ea774ce

File tree

5 files changed

+40
-15
lines changed

5 files changed

+40
-15
lines changed

‎crates/apollo-mcp-server/src/cors.rs‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,15 @@ impl Default for CorsConfig {
5252
"content-type".to_string(),
5353
"mcp-protocol-version".to_string(), // https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#protocol-version-header
5454
"mcp-session-id".to_string(), // https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management
55+
"traceparent".to_string(), // https://www.w3.org/TR/trace-context/#traceparent-header
56+
"tracestate".to_string(), // https://www.w3.org/TR/trace-context/#tracestate-header
5557
],
56-
expose_headers: vec!["mcp-session-id".to_string()], // https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management
57-
max_age: Some(7200), // 2 hours
58+
expose_headers: vec![
59+
"mcp-session-id".to_string(), // https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management
60+
"traceparent".to_string(), // https://www.w3.org/TR/trace-context/#traceparent-header
61+
"tracestate".to_string(), // https://www.w3.org/TR/trace-context/#tracestate-header
62+
],
63+
max_age: Some(7200), // 2 hours
5864
}
5965
}
6066
}
@@ -225,6 +231,16 @@ mod tests {
225231
"content-type".to_string(),
226232
"mcp-protocol-version".to_string(),
227233
"mcp-session-id".to_string(),
234+
"traceparent".to_string(),
235+
"tracestate".to_string(),
236+
]
237+
);
238+
assert_eq!(
239+
config.expose_headers,
240+
vec![
241+
"mcp-session-id".to_string(),
242+
"traceparent".to_string(),
243+
"tracestate".to_string(),
228244
]
229245
);
230246
assert_eq!(config.max_age, Some(7200));

‎crates/apollo-mcp-server/src/runtime.rs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,9 +158,13 @@ mod test {
158158
"content-type",
159159
"mcp-protocol-version",
160160
"mcp-session-id",
161+
"traceparent",
162+
"tracestate",
161163
],
162164
expose_headers: [
163165
"mcp-session-id",
166+
"traceparent",
167+
"tracestate",
164168
],
165169
max_age: Some(
166170
7200,

‎docs/source/_sidebar.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ items:
2828
href: "./deploy"
2929
- label: "Health Checks"
3030
href: "./health-checks"
31-
- label: "CORS Support"
31+
- label: "CORS"
3232
href: "./cors"
3333
- label: "Authorization"
3434
href: "./auth"

‎docs/source/config-file.mdx‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -45,17 +45,17 @@ These fields are under the top-level `graphos` key and define your GraphOS graph
4545

4646
These fields are under the top-level `cors` key and configure Cross-Origin Resource Sharing (CORS) for browser-based MCP clients.
4747

48-
| Option | Type | Default | Description |
49-
| :------------------ | :------------- | :---------------------------------- | :------------------------------------------------------------------------------------------------------- |
50-
| `enabled` | `bool` | `false` | Enable CORS support |
51-
| `origins` | `List<string>` | `[]` | List of allowed origins (exact matches). Use `["*"]` to allow any origin (not recommended in production) |
52-
| `match_origins` | `List<string>` | `[]` | List of regex patterns to match allowed origins (e.g., `"^https://localhost:[0-9]+$"`) |
53-
| `allow_any_origin` | `bool` | `false` | Allow requests from any origin. Cannot be used with `allow_credentials: true` |
54-
| `allow_credentials` | `bool` | `false` | Allow credentials (cookies, authorization headers) in CORS requests |
55-
| `allow_methods` | `List<string>` | `["GET", "POST", "OPTIONS"]` | List of allowed HTTP methods |
56-
| `allow_headers` | `List<string>` | `["content-type", "authorization"]` | List of allowed request headers |
57-
| `expose_headers` | `List<string>` | `[]` | List of response headers exposed to the browser (e.g., `["mcp-session-id"]`) |
58-
| `max_age` | `number` | `86400` | Maximum age (in seconds) for preflight cache |
48+
| Option | Type | Default | Description |
49+
| :------------------ | :------------- | :---------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------- |
50+
| `enabled` | `bool` | `false` | Enable CORS support |
51+
| `origins` | `List<string>` | `[]` | List of allowed origins (exact matches). Use `["*"]` to allow any origin (not recommended in production) |
52+
| `match_origins` | `List<string>` | `[]` | List of regex patterns to match allowed origins (e.g., `"^https://localhost:[0-9]+$"`) |
53+
| `allow_any_origin` | `bool` | `false` | Allow requests from any origin. Cannot be used with `allow_credentials: true` |
54+
| `allow_credentials` | `bool` | `false` | Allow credentials (cookies, authorization headers) in CORS requests |
55+
| `allow_methods` | `List<string>` | `["GET", "POST", "OPTIONS"]` | List of allowed HTTP methods |
56+
| `allow_headers` | `List<string>` | `["content-type", "mcp-protocol-version", "mcp-session-id", "traceparent", "tracestate"]` | List of allowed request headers |
57+
| `expose_headers` | `List<string>` | `["mcp-session-id", "traceparent", "tracestate"]` | List of response headers exposed to the browser (includes MCP and W3C Trace Context headers) |
58+
| `max_age` | `number` | `86400` | Maximum age (in seconds) for preflight cache |
5959

6060
### Health checks
6161

‎docs/source/cors.mdx‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,18 +113,23 @@ cors:
113113
- POST
114114

115115
# The headers to allow.
116-
# These are the default headers required for MCP protocol
116+
# These are the default headers required for MCP protocol and trace context
117117
allow_headers:
118118
- accept
119119
- content-type
120120
- mcp-protocol-version
121121
- mcp-session-id
122+
- traceparent # W3C Trace Context
123+
- tracestate # W3C Trace Context
122124

123125
# Which response headers are available to scripts running in the
124126
# browser in response to a cross-origin request.
125127
# The mcp-session-id header should be exposed for MCP session management.
128+
# Trace context headers are exposed for distributed tracing.
126129
expose_headers:
127130
- mcp-session-id
131+
- traceparent # W3C Trace Context
132+
- tracestate # W3C Trace Context
128133

129134
# Adds the Access-Control-Max-Age header
130135
# Maximum age (in seconds) for preflight cache

0 commit comments

Comments
 (0)