Issue-642 Header Transform

[ramapalani]

Summary

• Introduces a HeaderTransform type (Arc<dyn Fn(&mut HeaderMap) + Send + Sync>) that allows SDK consumers to programmatically transform outgoing HTTP headers before they are sent to the upstream GraphQL endpoint.
• The transform runs as the final step in header assembly -- after static headers, forwarded headers, auth token passthrough, and mcp-session-id have all been applied -- giving consumers full control to add, modify, or remove any header.
• Threads the new header_transform option through the Server builder, the state machine (Config / Starting / Running), and both the HTTP-transport and stdio-only code paths in Running.

Motivation

Closes #642

When embedding apollo-mcp-server as a library, consumers often need to apply custom authentication schemes (e.g., HMAC signing, short-lived token minting), header-based routing, or other dynamic header transformations that cannot be expressed with static headers or simple forwarding rules. Without this hook, the only workaround is placing an intermediary proxy in front of the upstream endpoint.

Changes

File	What changed
headers.rs	Added HeaderTransform type alias; build_request_headers now accepts an optional transform and applies it as the last step
server.rs	Added header_transform: Option<HeaderTransform> field to Server and its bon builder constructor
server/states.rs	Propagated header_transform through the Config struct and state machine transitions
server/states/starting.rs	Forwarded header_transform from Config into the Running state; added integration test for propagation
server/states/running.rs	Applied the transform in both HTTP-transport and stdio-only execution paths; updated existing test fixtures

Test plan

• Unit tests in headers.rs covering: transform adds headers, modifies existing headers, removes headers, runs after all other header assembly, overrides auth token, is Arc-cloneable and reusable across calls, and None is a no-op
• Integration test in starting.rs verifying the transform propagates from Config through Starting into the Running state and remains functional
• All existing header tests updated to pass None for backward compatibility
• cargo test passes
• cargo clippy --all-targets -- --deny warnings passes

[apollo-cla]

@ramapalani: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Apollo Contributor License Agreement here: https://contribute.apollographql.com/

[andrewmcgivery]

Hello @ramapalani,

Appreciate the pull request and the effort put into this.

We have it on our roadmap to evaluate extensibility of Apollo MCP Server to serve these kinds of use cases.

That said, we won't be merging this PR as it is not the approach that we have in mind. Please continue to share feedback on what you'd like to see in extensibility as it will help us shape the future of that feature!