Release 1.14.0

[github-actions]

This PR was created by Knope. Merging it will create a new release

Features

Resolve signing algorithm when a JWK omits alg - @DaleSeo #732

Apollo MCP Server now infers the signing algorithm from the authorization server's discovery metadata when a JWK omits the alg field, enabling support for providers like Azure AD B2C, Microsoft Entra ID, and AWS Cognito.

Capture tool call arguments and results in OpenTelemetry spans - @DaleSeo #748

Tool execution spans now include apollo.mcp.tool_arguments and apollo.mcp.tool_result attributes on the call_tool span, and apollo.mcp.graphql_query and apollo.mcp.graphql_response on the child execute span. This makes it possible to correlate traces in observability dashboards with the actual queries and data that triggered them.

Expose trace_id to the on_execute_graphql_operation Rhai hook - @DaleSeo #745

The on_execute_graphql_operation Rhai hook now exposes a read-only ctx.trace_id property, allowing scripts to access the current OpenTelemetry trace ID for custom structured logging. The value is a 32-character lowercase hex string when an OpenTelemetry trace context is active and an empty string otherwise, matching the format already used for the trace_id=<hex> prefix on server log lines. This makes it possible to emit log lines from Rhai with trace_id as a discrete field that log aggregators (Splunk, ELK, etc.) can index for correlation with distributed traces.

Fixes

Bump rmcp to 1.6 to address DNS rebinding advisory - @DaleSeo #742

Updates the rmcp Streamable HTTP server transport to 1.6.0, which patches GHSA-89vp-x53w-74fx (CVE-2026-42559). Host header validation is now performed inside rmcp itself, with a tracing::warn! event on each rejection so log-based alerting on DNS rebinding attempts continues to work; the server's existing transport.streamable_http.host_validation configuration is unchanged.

Preserve raw authorization server URLs in protected-resource metadata - @DaleSeo #749

Apollo MCP Server no longer normalizes the transport.auth.servers entries when it sets the authorization_servers field in /.well-known/oauth-protected-resource. Before, a scheme-authority-only configuration value, like https://auth.example.com, was re-parsed through url::Url, which added a trailing / to the empty path. This normalized form ended up in the metadata and caused mismatches in issuer claims for strict OAuth clients that compare authorization_servers with the auth server's discovery issuer. Now, server URLs are passed through exactly as they are, so users need to make sure each entry matches their auth server's issuer precisely.

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 2 changed, 0 removed

* (developer-tools)/apollo-mcp-server/(latest)/run.mdx
* (developer-tools)/apollo-mcp-server/(latest)/telemetry.mdx

Build ID: 23b513d8ad1c1be04811de0d
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/23b513d8ad1c1be04811de0d

---

✅ AI Style Review — No Issues Found

The pull request does not have any style issues.

Duration: 3620ms
Review Log: View detailed log

This review is AI-generated. Please use common sense when accepting these suggestions, as they may not always be accurate or appropriate for your specific context.

[claude]

LGTM — mechanical release PR (1.13.0 → 1.14.0) generated by Knope.

Extended reasoning...

Overview

This is an automated release PR generated by Knope for version 1.14.0. It performs only mechanical updates: bumps the version string from 1.13.0 to 1.14.0 across Cargo.toml, Cargo.lock, server.json, the nix and Windows install scripts, and the docs install commands in run.mdx; consolidates the five staged changesets into a new 1.14.0 section in CHANGELOG.md; and deletes the now-consumed changeset files. No source code in crates/ is touched — the underlying features and fixes already landed via prior PRs (#744, #747, #748, #749).

Security risks

None introduced by this PR itself. The release does package previously-merged security-relevant work (the rmcp 1.6 bump for the DNS rebinding advisory GHSA-89vp-x53w-74fx and the auth-server URL normalization fix), but those changes were reviewed in their original PRs and are not modified here.

Level of scrutiny

Low. Release-cut PRs that are limited to version bumps and changelog consolidation follow a well-established pattern in this repo (every prior X.Y.Z tag shows the same shape), and the version strings are internally consistent across all six bumped locations.

Other factors

The bug hunting system found no issues. CI will catch any version-string mismatch via build/test, and the docs preview is already building. No outstanding reviewer comments need follow-up.