Features
Add a GraphOS schema source for non-federated graphs - @DaleSeo #798
Uplink only distributes composed supergraphs, so non-federated (monograph) graphs had no live schema source and required a manually maintained local file. The new schema.source: graphos option fetches the latest published schema for the configured graph variant from the GraphOS Platform API, reusing the existing graphos credentials. The server polls the schema hash periodically, re-fetches the document only when it changes, and applies a republish without a restart.
Fixes
Reject auth configuration under the stdio transport - @DaleSeo #796
An auth block nested under a stdio transport was parsed successfully and then silently dropped, so an operator could believe authentication was configured while the server ran with none of it applied. Apollo MCP Server now rejects misplaced keys such as auth under stdio at config parse time, matching how top-level auth and the streamable_http transport already reject unknown fields. Configurations that place auth under streamable_http (the normal case) are unaffected.
Retry transient Platform API errors instead of failing startup - @DaleSeo #797
HTTP error responses from the GraphOS Platform API were parsed as JSON before their status was checked, so a 5xx or 429 surfaced as a body decode error that the retry policy classified as permanent. A transient GraphOS failure during the initial operation collection fetch therefore stopped the server at startup instead of retrying. The server now checks the response status first, so 5xx and 429 responses are correctly treated as transient and retried.
Validate authorization server metadata issuer - @DaleSeo #791
Apollo MCP Server now checks that the issuer in an authorization server's discovery metadata matches the server it was fetched from, as required by RFC 8414 section 3.3. Metadata that advertises a mismatched issuer is rejected before its keys are trusted, so a token cannot be bound to an issuer identity the signing server did not actually claim. Servers whose discovery document returns a matching issuer (the normal case) are unaffected.
