Security audit

Every HTTP-layer defense in this audit — authentication, scopes, host validation — exists only when the server listens over streamable_http. Over stdio none of it runs. v1.17.0 rejects an auth block placed under stdio instead of silently ignoring it, but an environment variable can still flip the transport out from under a locked-down file.

Without a transport.auth block, the HTTP endpoint answers anyone who can reach the port: every tool, discovery and invocation alike, with no identity attached to anything. The server is designed as an OAuth checkpoint that validates tokens against your identity provider — but only once the block exists. v1.17.0 also rejects identity-provider discovery information when its issuer does not match the server Apollo contacted, before trusting its signing keys.

The global scopes list is one bar for the whole server: any token that clears it can call every tool. Per-operation required_scopes is what narrows a stolen or over-provisioned token to the operations it was actually issued for — and it is opt-in, keyed by operation name, and maintained by hand, so drift is silent.

By default the caller's validated token is forwarded to the upstream API — a token that upstream never issued and that the MCP spec says it must not receive. The upstream then makes authorization decisions on wholesale-delegated identity, and every forwarded token lands in upstream request logs and traces, replayable from there. forward_headers is a second, separate path that forwards the raw header even when the passthrough flag is off.

DNS rebinding lets a web page in a victim's browser re-point its own hostname at 127.0.0.1 and script requests against a local HTTP server that was never meant to face the internet. Host validation rejects requests whose Host header is not on the allowlist. It defaults on — but one YAML key or one environment variable turns it off.

Spans record tool arguments, the GraphQL query, and the response by default — which makes traces a second copy of whatever secrets pass through the server, stored wherever your telemetry lands and readable by whoever can query it. Redaction is per-exporter: covering tracing but not metrics still leaks.

Whoever can write to the operations or schema source can change what every connected agent is offered. v1.17.0 adds GraphOS as a schema source for non-federated graphs and applies new schema publications without a restart. Operation and schema updates can therefore change tool names, descriptions, inputs, or behavior without a diff against the approved set or a new approval. The real trust boundary includes both source write access and the exact definitions the agent reads.

With mutation_mode: all, the execute tool runs any mutation that type-checks against the schema — one injected instruction away from schema-shaped writes. none filters mutations out entirely; explicit exposes only the mutation operations you committed as files. All three are config-time gates: nobody is asked at invocation time.

If the binary or image you run is not the one Apollo built, every other check on this page audits an attacker's code. The v1.17.0 audit observed the published multi-platform container index. Its individual Linux images have Apollo build proof, and the tested arm64 image reported version 1.17.0, but the combined multi-platform image has no separate proof. Every downloaded release file matched GitHub's recorded fingerprint, but the release supplies no separate package proof, signature, checksum file, or software inventory.