Merge pull request #453 from apollographql/release/1.1.0

Releasing 1.1.0

Author: alocay

CHANGELOG.md

@@ -4,6 +4,82 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+# [1.1.0] - 2025-10-16
+
+## ❗ BREAKING ❗
+
+### Change default port from 5000 to 8000 - @DaleSeo PR #417
+
+The default server port has been changed from `5000` to `8000` to avoid conflicts with common development tools and services that typically use port 5000 (such as macOS AirPlay, Flask development servers, and other local services).
+
+**Migration**: If you were relying on the default port 5000, you can continue using it by explicitly setting the port in your configuration file or command line arguments.
+
+- Before 
+
+```yaml
+transport:
+  type: streamable_http
+```
+
+- After
+
+```yaml
+transport:
+  type: streamable_http
+  port: 5000
+```
+
+## 🚀 Features
+
+### feat: Add configuration option for metric temporality - @swcollard PR #413
+
+Creates a new configuration option for telemetry to set the Metric temporality to either Cumulative (default) or Delta.
+
+* Cumulative - The metric value will be the overall value since the start of the measurement.
+* Delta - The metric will be the difference in the measurement since the last time it was reported.
+
+Some observability  vendors require that one is used over the other so we want to support the configuration in the MCP Server.
+
+### Add support for forwarding headers from MCP clients to GraphQL APIs - @DaleSeo PR #428
+
+Adds opt-in support for dynamic header forwarding, which enables metadata for A/B testing, feature flagging, geo information from CDNs, or internal instrumentation to be sent from MCP clients to downstream GraphQL APIs. It automatically blocks hop-by-hop headers according to the guidelines in [RFC 7230, section 6.1](https://datatracker.ietf.org/doc/html/rfc7230#section-6.1), and it only works with the Streamable HTTP transport.
+
+You can configure using the `forward_headers` setting:
+
+```yaml
+forward_headers:
+  - x-tenant-id
+  - x-experiment-id
+  - x-geo-country
+```
+
+Please note that this feature is not intended for passing through credentials as documented in the best practices page.
+
+### feat: Add mcp-session-id header to HTTP request trace attributes - @swcollard PR #421
+
+Includes the value of the [Mcp-Session-Id](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management) HTTP header as an attribute of the trace for HTTP requests to the MCP Server
+
+## 🐛 Fixes
+
+### Fix compatibility issue with VSCode/Copilot - @DaleSeo PR #447
+
+This updates Apollo MCP Server’s tool schemas from [Draft 2020-12](https://json-schema.org/draft/2020-12) to [Draft‑07](https://json-schema.org/draft-07) which is more widely supported across different validators. VSCode/Copilot still validate against Draft‑07, so rejects Apollo MCP Server’s tools. Our JSON schemas don’t rely on newer features, so downgrading improves compatibility across MCP clients with no practical impact.
+
+## 🛠 Maintenance
+
+### Update rmcp sdk to version 0.8.x - @swcollard PR #433 
+
+Bumping the Rust MCP SDK version used in this server up to 0.8.x
+
+### chore: Only initialize a single HTTP client for graphql requests - @swcollard PR #412
+
+Currently the MCP Server spins up a new HTTP client every time it wants to make a request to the downstream graphql endpoint. This change creates a static reqwest client that gets initialized using LazyLock and reused on each graphql request.
+
+This change is based on the suggestion from the reqwest [documentation](https://docs.rs/reqwest/latest/reqwest/struct.Client.html)
+> "The Client holds a connection pool internally, so it is advised that you create one and reuse it."
+
+
+
 # [1.0.0] - 2025-10-01
 
 # Apollo MCP Server 1.0 Release Notes

CHANGELOG_SECTION.md

@@ -1,16 +1,74 @@
-# [1.0.0] - 2025-10-01
+# [1.1.0] - 2025-10-16
 
-## 🐛 Fixes
+## ❗ BREAKING ❗
+
+### Change default port from 5000 to 8000 - @DaleSeo PR #417
+
+The default server port has been changed from `5000` to `8000` to avoid conflicts with common development tools and services that typically use port 5000 (such as macOS AirPlay, Flask development servers, and other local services).
+
+**Migration**: If you were relying on the default port 5000, you can continue using it by explicitly setting the port in your configuration file or command line arguments.
+
+- Before 
+
+```yaml
+transport:
+  type: streamable_http
+```
+
+- After
+
+```yaml
+transport:
+  type: streamable_http
+  port: 5000
+```
+
+## 🚀 Features
+
+### feat: Add configuration option for metric temporality - @swcollard PR #413
+
+Creates a new configuration option for telemetry to set the Metric temporality to either Cumulative (default) or Delta.
+
+* Cumulative - The metric value will be the overall value since the start of the measurement.
+* Delta - The metric will be the difference in the measurement since the last time it was reported.
 
-### fix: remove verbose logging - @swcollard PR #401
+Some observability  vendors require that one is used over the other so we want to support the configuration in the MCP Server.
 
-The tracing-subscriber crate we are using to create logs does not have a configuration to exclude the span name and attributes from the log line. This led to rather verbose logs on app startup which would dump the full operation object into the logs before the actual log line. 
+### Add support for forwarding headers from MCP clients to GraphQL APIs - @DaleSeo PR #428
 
-This change strips the attributes from the top level spans so that we still have telemetry and tracing during this important work the server is doing, but they don't make it into the logs. The relevant details are provided in child spans after the operation has been parsed so we aren't losing any information other than a large json blob in the top level trace of generating Tools from GraphQL Operations.
+Adds opt-in support for dynamic header forwarding, which enables metadata for A/B testing, feature flagging, geo information from CDNs, or internal instrumentation to be sent from MCP clients to downstream GraphQL APIs. It automatically blocks hop-by-hop headers according to the guidelines in [RFC 7230, section 6.1](https://datatracker.ietf.org/doc/html/rfc7230#section-6.1), and it only works with the Streamable HTTP transport.
+
+You can configure using the `forward_headers` setting:
+
+```yaml
+forward_headers:
+  - x-tenant-id
+  - x-experiment-id
+  - x-geo-country
+```
+
+Please note that this feature is not intended for passing through credentials as documented in the best practices page.
+
+### feat: Add mcp-session-id header to HTTP request trace attributes - @swcollard PR #421
+
+Includes the value of the [Mcp-Session-Id](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#session-management) HTTP header as an attribute of the trace for HTTP requests to the MCP Server
+
+## 🐛 Fixes
+
+### Fix compatibility issue with VSCode/Copilot - @DaleSeo PR #447
+
+This updates Apollo MCP Server’s tool schemas from [Draft 2020-12](https://json-schema.org/draft/2020-12) to [Draft‑07](https://json-schema.org/draft-07) which is more widely supported across different validators. VSCode/Copilot still validate against Draft‑07, so rejects Apollo MCP Server’s tools. Our JSON schemas don’t rely on newer features, so downgrading improves compatibility across MCP clients with no practical impact.
 
 ## 🛠 Maintenance
 
-### deps: update rust to v1.90.0 - @DaleSeo PR #387
+### Update rmcp sdk to version 0.8.x - @swcollard PR #433 
+
+Bumping the Rust MCP SDK version used in this server up to 0.8.x
+
+### chore: Only initialize a single HTTP client for graphql requests - @swcollard PR #412
+
+Currently the MCP Server spins up a new HTTP client every time it wants to make a request to the downstream graphql endpoint. This change creates a static reqwest client that gets initialized using LazyLock and reused on each graphql request.
 
-Updates the Rust version to v1.90.0
+This change is based on the suggestion from the reqwest [documentation](https://docs.rs/reqwest/latest/reqwest/struct.Client.html)
+> "The Client holds a connection pool internally, so it is advised that you create one and reuse it."
 

Cargo.lock

@@ -12,7 +12,7 @@ edition = "2024"
 license-file = "LICENSE"
 repository = "https://github.com/apollographql/apollo-mcp-server"
 rust-version = "1.89.0"
-version = "1.0.0"
+version = "1.1.0-rc.1"
 
 [workspace.dependencies]
 apollo-compiler = "1.27.0"

Cargo.toml

@@ -50,7 +50,7 @@ regex = "1.11.1"
 reqwest-middleware = "0.4.2"
 reqwest-tracing = { version = "0.5.8", features = ["opentelemetry_0_30"] }
 reqwest.workspace = true
-rmcp = { version = "0.6", features = [
+rmcp = { version = "0.8", features = [
   "server",
   "transport-io",
   "transport-sse-server",

crates/apollo-mcp-server/Cargo.toml

@@ -12,7 +12,7 @@ use url::Url;
 /// Note: This is used as a marker to ensure that we have validated this
 /// separately from just reading the header itself.
 #[derive(Clone, Debug, PartialEq)]
-pub(crate) struct ValidToken(pub(super) Authorization<Bearer>);
+pub(crate) struct ValidToken(pub(crate) Authorization<Bearer>);
 
 impl Deref for ValidToken {
     type Target = Authorization<Bearer>;

crates/apollo-mcp-server/src/auth/valid_token.rs

@@ -1,11 +1,13 @@
 //! Execute GraphQL operations from an MCP tool
 
+use std::sync::LazyLock;
+
 use crate::errors::McpError;
 use crate::generated::telemetry::{TelemetryAttribute, TelemetryMetric};
 use crate::meter;
 use opentelemetry::KeyValue;
 use reqwest::header::{HeaderMap, HeaderValue};
-use reqwest_middleware::{ClientBuilder, Extension};
+use reqwest_middleware::{ClientBuilder, ClientWithMiddleware, Extension};
 use reqwest_tracing::{OtelName, TracingMiddleware};
 use rmcp::model::{CallToolResult, Content, ErrorCode};
 use serde_json::{Map, Value};
@@ -24,6 +26,13 @@ pub struct OperationDetails {
     pub operation_name: Option<String>,
 }
 
+static GRAPHQL_CLIENT: LazyLock<ClientWithMiddleware> = LazyLock::new(|| {
+    ClientBuilder::new(reqwest::Client::new())
+        .with_init(Extension(OtelName("mcp-graphql-client".into())))
+        .with(TracingMiddleware::default())
+        .build()
+});
+
 /// Able to be executed as a GraphQL operation
 pub trait Executable {
     /// Get the persisted query ID to be executed, if any
@@ -86,12 +95,7 @@ pub trait Executable {
             }
         }
 
-        let client = ClientBuilder::new(reqwest::Client::new())
-            .with_init(Extension(OtelName("mcp-graphql-client".into())))
-            .with(TracingMiddleware::default())
-            .build();
-
-        let result = client
+        let result = GRAPHQL_CLIENT
             .post(request.endpoint.as_str())
             .headers(self.headers(&request.headers))
             .body(Value::Object(request_body).to_string())