v1.2.0

🚀 Features

Adding config option to specify metadata/header values for telemetry exporters - @alocay PR #460

Adding a metadata (for grpc protocol) and headers (for http/protobuf protocol) config option for the telemetry.exporters.metrics.otlp yaml config section.

telemetry:
  exporters:
    metrics:
      otlp:
        endpoint: "http://127.0.0.1:4317"
        protocol: "grpc"
        metadata:
          the-key: some-value
    tracing:
      otlp:
        endpoint: "http://127.0.0.1:4317"
        protocol: "http/protobuf"
        headers:
          some-key: another-value

🐛 Fixes

Allow using builtin names for custom tools - @dylan-apollo PR #481

Previously, the names of builtin tools were reserved even if the tool was disabled.
These names are now available for custom tools if the matching builtin tool is disabled via config:

• introspect
• search
• explorer
• execute
• validate

Improved performance of parallel tool calls - @dylan-apollo PR #475

Responsiveness of all tools is improved when many clients are connected.

v1.2.0-rc.1

1.2.0-rc.1

v1.1.1

🐛 Fixes

fix docker image ignoring port setting - @DaleSeo PR #467

The Docker image had APOLLO_MCP_TRANSPORT__PORT=8000 baked in as an environment variable in flake.nix. Since environment variables take precedence over config file settings (by design in our config loading logic), users are unable to override the port in their config.yaml when running the Docker container.

v1.1.0

❗ BREAKING ❗

Change default port from 5000 to 8000 - @DaleSeo PR #417

The default server port has been changed from 5000 to 8000 to avoid conflicts with common development tools and services that typically use port 5000 (such as macOS AirPlay, Flask development servers, and other local services).

Migration: If you were relying on the default port 5000, you can continue using it by explicitly setting the port in your configuration file or command line arguments.

• Before

transport:
  type: streamable_http

• After

transport:
  type: streamable_http
  port: 5000

🚀 Features

feat: Add configuration option for metric temporality - @swcollard PR #413

Creates a new configuration option for telemetry to set the Metric temporality to either Cumulative (default) or Delta.

• Cumulative - The metric value will be the overall value since the start of the measurement.
• Delta - The metric will be the difference in the measurement since the last time it was reported.

Some observability vendors require that one is used over the other so we want to support the configuration in the MCP Server.

Add support for forwarding headers from MCP clients to GraphQL APIs - @DaleSeo PR #428

Adds opt-in support for dynamic header forwarding, which enables metadata for A/B testing, feature flagging, geo information from CDNs, or internal instrumentation to be sent from MCP clients to downstream GraphQL APIs. It automatically blocks hop-by-hop headers according to the guidelines in RFC 7230, section 6.1, and it only works with the Streamable HTTP transport.

You can configure using the forward_headers setting:

forward_headers:
  - x-tenant-id
  - x-experiment-id
  - x-geo-country

Please note that this feature is not intended for passing through credentials as documented in the best practices page.

feat: Add mcp-session-id header to HTTP request trace attributes - @swcollard PR #421

Includes the value of the Mcp-Session-Id HTTP header as an attribute of the trace for HTTP requests to the MCP Server

🐛 Fixes

Fix compatibility issue with VSCode/Copilot - @DaleSeo PR #447

This updates Apollo MCP Server’s tool schemas from Draft 2020-12 to Draft‑07 which is more widely supported across different validators. VSCode/Copilot still validate against Draft‑07, so rejects Apollo MCP Server’s tools. Our JSON schemas don’t rely on newer features, so downgrading improves compatibility across MCP clients with no practical impact.

🛠 Maintenance

Update rmcp sdk to version 0.8.x - @swcollard PR #433

Bumping the Rust MCP SDK version used in this server up to 0.8.x

chore: Only initialize a single HTTP client for graphql requests - @swcollard PR #412

Currently the MCP Server spins up a new HTTP client every time it wants to make a request to the downstream graphql endpoint. This change creates a static reqwest client that gets initialized using LazyLock and reused on each graphql request.

This change is based on the suggestion from the reqwest documentation

"The Client holds a connection pool internally, so it is advised that you create one and reuse it."

v1.1.0-rc.1

❗ BREAKING ❗

Change default port from 5000 to 8000 - @DaleSeo PR #417

The default server port has been changed from 5000 to 8000 to avoid conflicts with common development tools and services that typically use port 5000 (such as macOS AirPlay, Flask development servers, and other local services).

Migration: If you were relying on the default port 5000, you can continue using it by explicitly setting the port in your configuration file or command line arguments.

• Before

transport:
  type: streamable_http

• After

transport:
  type: streamable_http
  port: 5000

🚀 Features

feat: Add configuration option for metric temporality - @swcollard PR #413

Creates a new configuration option for telemetry to set the Metric temporality to either Cumulative (default) or Delta.

• Cumulative - The metric value will be the overall value since the start of the measurement.
• Delta - The metric will be the difference in the measurement since the last time it was reported.

Some observability vendors require that one is used over the other so we want to support the configuration in the MCP Server.

Add support for forwarding headers from MCP clients to GraphQL APIs - @DaleSeo PR #428

Adds opt-in support for dynamic header forwarding, which enables metadata for A/B testing, feature flagging, geo information from CDNs, or internal instrumentation to be sent from MCP clients to downstream GraphQL APIs. It automatically blocks hop-by-hop headers according to the guidelines in RFC 7230, section 6.1, and it only works with the Streamable HTTP transport.

You can configure using the forward_headers setting:

forward_headers:
  - x-tenant-id
  - x-experiment-id
  - x-geo-country

Please note that this feature is not intended for passing through credentials as documented in the best practices page.

feat: Add mcp-session-id header to HTTP request trace attributes - @swcollard PR #421

Includes the value of the Mcp-Session-Id HTTP header as an attribute of the trace for HTTP requests to the MCP Server

🐛 Fixes

Fix compatibility issue with VSCode/Copilot - @DaleSeo PR #447

This updates Apollo MCP Server’s tool schemas from Draft 2020-12 to Draft‑07 which is more widely supported across different validators. VSCode/Copilot still validate against Draft‑07, so rejects Apollo MCP Server’s tools. Our JSON schemas don’t rely on newer features, so downgrading improves compatibility across MCP clients with no practical impact.

🛠 Maintenance

Update rmcp sdk to version 0.8.x - @swcollard PR #433

Bumping the Rust MCP SDK version used in this server up to 0.8.x

chore: Only initialize a single HTTP client for graphql requests - @swcollard PR #412

Currently the MCP Server spins up a new HTTP client every time it wants to make a request to the downstream graphql endpoint. This change creates a static reqwest client that gets initialized using LazyLock and reused on each graphql request.

This change is based on the suggestion from the reqwest documentation

"The Client holds a connection pool internally, so it is advised that you create one and reuse it."

v1.0.0

Apollo MCP Server 1.0 Release Notes

Apollo MCP Server 1.0 marks the General Availability (GA) milestone, delivering a production-ready Model Context Protocol server that seamlessly bridges GraphQL APIs with AI applications. This release transforms how AI agents interact with GraphQL APIs through standardized MCP tools, enabling natural language access to your GraphQL operations.

🎯 GA Highlights

Production-Ready MCP Protocol Implementation

Apollo MCP Server 1.0 provides full compliance with the MCP specification, enabling AI applications to discover and invoke GraphQL operations through standardized protocols. The server acts as a translation layer, converting GraphQL operations into MCP tools that AI models can execute through natural language requests.

Key Benefits:

• Standardized AI Integration: No more custom API bridges - use the industry-standard MCP protocol
• Automatic Tool Discovery: AI agents automatically discover available GraphQL operations as MCP tools
• Type-Safe Execution: All operations are validated against your GraphQL schema before execution
• Enterprise-Ready: Full OAuth 2.1 authentication and comprehensive observability

🚀 Multi-Transport Architecture

Flexible communication options for every deployment scenario:

• stdio: Perfect for local development and debugging with MCP Inspector
• Streamable HTTP: Production-grade transport with load balancer support and concurrent connections

All transports maintain full MCP protocol compliance while optimizing for specific use cases.

🔧 Advanced GraphQL Integration

Custom Scalar Support: Seamlessly handle specialized types like DateTime, UUID, and domain-specific scalars with automatic JSON Schema mapping.

Mutation Controls: Fine-grained security controls to prevent unintended data changes:

• all: Enable all mutations (default)
• none: Disable all mutations for read-only access
• allowlist: Only allow specific mutations

📊 Flexible Schema & Operation Management

Dual Schema Sources:

• Local Files: Direct schema control for development and offline scenarios
• Apollo GraphOS: Centralized schema management with automatic updates via uplink integration

Multiple Operation Sources:

• Local Statement Files: Hot-reloading .graphql files for rapid development
• Persisted Query Manifests: Security-focused pre-approved operation execution
• GraphOS Operation Collections: Centrally managed operations with automatic polling
• GraphOS Persisted Queries: Enterprise-grade operation management

🤖 AI-Optimized Introspection Tools

Core Tools:

• introspect: Comprehensive schema exploration with AI-friendly formatting
• execute: Safe dynamic operation execution with proper error handling
• validate: Operation validation without execution to prevent side effects
• search: Semantic schema search to efficiently find relevant types and fields

AI Optimizations:

• Minified Output: Configurable minification reduces context window usage by 30%+ while preserving essential information
• Semantic Search: Natural language schema exploration with ranked results

⚙️ Configuration-Driven Architecture

YAML Configuration: Replace complex command-line arguments with structured, version-controllable configuration files.

Environment Variable Overrides: Seamless environment-specific customization using the APOLLO_MCP_ prefix convention.

Comprehensive Validation: Clear error messages and sensible defaults for rapid deployment.

🔐 Enterprise Security & Observability

OAuth 2.1 Authentication: Production-ready authentication supporting major identity providers:

• Auth0, WorkOS, Keycloak, Okta
• JWT token validation with audience and scope enforcement
• OIDC discovery for automatic provider configuration

Health Monitoring: Kubernetes-ready health checks with configurable liveness and readiness probes.

OpenTelemetry Integration: Comprehensive observability with traces, metrics, and events:

• Operation-level performance tracking
• Semantic conventions for HTTP servers when using the Streamable HTTP transport.
• OTLP export to any OpenTelemetry-compatible collector
• Integration with existing monitoring infrastructure

CORS Support: Enable browser-based MCP clients with comprehensive Cross-Origin Resource Sharing support following Apollo Router patterns.

v1.0.0-rc.1

1.0.0-rc.1

v0.9.0

🚀 Features

Prototype OpenTelemetry Traces in MCP Server - @swcollard PR #274

Pulls in new crates and SDKs for prototyping instrumenting the Apollo MCP Server with Open Telemetry Traces.

• Adds new rust crates to support OTel
• Annotates excecute and call_tool functions with trace macro
• Adds Axum and Tower middleware's for OTel tracing
• Refactors Logging so that all the tracing_subscribers are set together in a single module.

Add CORS support - @DaleSeo PR #362

This PR implements comprehensive CORS support for Apollo MCP Server to enable web-based MCP clients to connect without CORS errors. The implementation and configuration draw heavily from the Router's approach. Similar to other features like health checks and telemetry, CORS is supported only for the StreamableHttp transport, making it a top-level configuration.

Enhance tool descriptions - @DaleSeo PR #350

This PR enhances the descriptions of the introspect and search tools to offer clearer guidance for AI models on efficient GraphQL schema exploration patterns.

Telemetry: Trace operations and auth - @swcollard PR #375

• Adds traces for the MCP server generating Tools from Operations and performing authorization
• Includes the HTTP status code to the top level HTTP trace

Implement metrics for mcp tool and operation counts and durations - @swcollard PR #297

This PR adds metrics to count and measure request duration to events throughout the MCP server

• apollo.mcp.operation.duration
• apollo.mcp.operation.count
• apollo.mcp.tool.duration
• apollo.mcp.tool.count
• apollo.mcp.initialize.count
• apollo.mcp.list_tools.count
• apollo.mcp.get_info.count

Adding ability to omit attributes for traces and metrics - @alocay PR #358

Adding ability to configure which attributes are omitted from telemetry traces and metrics.

1. Using a Rust build script (build.rs) to auto-generate telemetry attribute code based on the data found in telemetry.toml.
2. Utilizing an enum for attributes so typos in the config file raise an error.
3. Omitting trace attributes by filtering it out in a custom exporter.
4. Omitting metric attributes by indicating which attributes are allowed via a view.
5. Created telemetry_attributes.rs to map TelemetryAttribute enum to a OTEL Key.

The telemetry.toml file includes attributes (both for metrics and traces) as well as list of metrics gathered. An example would look like the following:

[attributes.apollo.mcp]
my_attribute = "Some attribute info"

[metrics.apollo.mcp]
some.count = "Some metric count info"

This would generate a file that looks like the following:

/// All TelemetryAttribute values
pub const ALL_ATTRS: &[TelemetryAttribute; 1usize] = &[
    TelemetryAttribute::MyAttribute
];
#[derive(Debug, ::serde::Deserialize, ::schemars::JsonSchema,, Clone, Eq, PartialEq, Hash, Copy)]
pub enum TelemetryAttribute {
    ///Some attribute info
    #[serde(alias = "my_attribute")]
    MyAttribute,
}
impl TelemetryAttribute {
    /// Supported telemetry attribute (tags) values
    pub const fn as_str(&self) -> &'static str {
        match self {
            TelemetryAttribute::MyAttribute => "apollo.mcp.my_attribute",
        }
    }
}
#[derive(Debug, ::serde::Deserialize, ::schemars::JsonSchema,, Clone, Eq, PartialEq, Hash, Copy)]
pub enum TelemetryMetric {
    ///Some metric count info
    #[serde(alias = "some.count")]
    SomeCount,
}
impl TelemetryMetric {
    /// Converts TelemetryMetric to &str
    pub const fn as_str(&self) -> &'static str {
        match self {
            TelemetryMetric::SomeCount => "apollo.mcp.some.count",
        }
    }
}

An example configuration that omits tool_name attribute for metrics and request_id for tracing would look like the following:

telemetry:
  exporters:
    metrics:
      otlp:
        endpoint: "http://localhost:4317"
        protocol: "grpc"
      omitted_attributes:
        - tool_name
    tracing:
      otlp:
        endpoint: "http://localhost:4317"
        protocol: "grpc"
      omitted_attributes:
        - request_id

Adding config option for trace sampling - @alocay PR #366

Adding configuration option to sample traces. Can use the following options:

1. Ratio based samples (ratio >= 1 is always sample)
2. Always on
3. Always off

Defaults to always on if not provided.

🐛 Fixes

Update SDL handling in sdl_to_api_schema function - @lennyburdette PR #365

Loads supergraph schemas using a function that supports various features, including Apollo Connectors. When supergraph loading failed, it would load it as a standard GraphQL schema, which reveals Federation query planning directives in when using the search and introspection tools.

Include the cargo feature and TraceContextPropagator to send otel headers downstream - @swcollard PR #307

Inside the reqwest middleware, if the global text_map_propagator is not set, it will no op and not send the traceparent and tracestate headers to the Router. Adding this is needed to correlate traces from the mcp server to the router or other downstream APIs

Add support for deprecated directive - @esilverm PR #367

Includes any existing @deprecated directives in the schema in the minified output of builtin tools. Now operations generated via these tools should take into account deprecated fields when being generated.

📃 Configuration

Add basic config file options to otel telemetry - @swcollard PR #330

Adds new Configuration options for setting up configuration beyond the standard OTEL environment variables needed before.

• Renames trace->telemetry
• Adds OTLP options for metrics and tracing to choose grpc or http upload protocols and setting the endpoints
• This configuration is all optional, so by default nothing will be logged

Disable statefulness to fix initialize race condition - @swcollard PR #351

We've been seeing errors with state and session handling in the MCP Server. Whether that is requests being sent before the initialized notification is processed. Or running a fleet of MCP Server pods behind a round robin load balancer. A new configuration option under the streamable_http transport stateful_mode, allows disabling session handling which appears to fix the race condition issue.

🛠 Maintenance

Add tests for server event and SupergraphSdlQuery - @DaleSeo PR #347

This PR adds tests for some uncovered parts of the codebase to check the Codecov integration.

Fix version on mcp server tester - @alocay PR #374

Add a specific version when calling the mcp-server-tester for e2e tests. The current latest (1.4.1) as an issue so to avoid problems now and in the future updating the test script to invoke the testing tool via specific version.

v0.9.0-rc.2

0.9.0-rc.2

v0.9.0-rc.1

0.9.0-rc.1