# Apollo MCP Server — QA
# Standalone server fronting the federated graph via the MCP contract variant.
# Runs as the qa-apollo-mcp Fargate service; upstream is qa-graphql-router-mcp.

# Upstream GraphQL endpoint = the MCP router (serves the qa-mcp contract variant).
endpoint: "https://qa-graphql-router-mcp.theorchard.io/graphql"

transport:
  type: streamable_http
  address: 0.0.0.0
  port: ${env.MCP_PORT:-8080}
  # Stateless: the service runs 2+ Fargate tasks behind an ALB, and the ALB can't do
  # mcp-session-id header affinity (only cookie stickiness, which MCP clients ignore).
  # In stateful mode the in-memory session lives on one task, so ~half the follow-up
  # requests hit the wrong task and 404 "Session not found". Stateless = every POST is
  # self-contained, so any task serves any request. Required for horizontal scaling.
  stateful_mode: false
  # Host validation (DNS-rebinding protection) is on by default and only allows
  # loopback. Behind the ALB the container sees the public Host, so allowlist it.
  host_validation:
    allowed_hosts:
      - qa-apollo-mcp.theorchard.io
  # OAuth 2.1 (Auth0) — MCP clients authenticate with the
  # pre-registered `apollo-mcp-login` Auth0 app (Auth Code + PKCE). This server is
  # only a resource server: it advertises Auth0 and validates the JWT (signature
  # via JWKS, audience, issuer), then passes the bearer through to the router.
  auth:
    servers:
      - "https://qa-orchard.auth0.com/"
    audiences:
      - "https://workstation.qaorch.com/api"   # pilot reuses the existing Orchard audience (no dedicated MCP API)
    # Bare origin (no /mcp path) so the Protected Resource Metadata is served at the
    # ROOT /.well-known/oauth-protected-resource. RFC 9728 appends the resource path to
    # the well-known segment, so a /mcp here serves PRM at /.well-known/oauth-protected-resource/mcp,
    # which the claude.ai connector doesn't find (it probes the root) → it falls back to
    # <origin>/authorize instead of Auth0. Token validation keys off `audiences`/`issuers`,
    # not this value, and Auth0 ignores the RFC 8707 resource param — so dropping the path is safe.
    resource: "https://qa-apollo-mcp.theorchard.io"
    scopes: []                                  # read-only pilot; no scopes required
    scope_mode: disabled                        # router + PDP enforce downstream

# ALB target-group health check hits GET /health (health_check_path in
# terraform-infra/qa/apollo-mcp). Off by default, so enable it; defaults
# (path /health, readiness thresholds) are fine for the pilot.
health_check:
  enabled: true

# Tools = pre-defined operations from the MCP contract variant (graphql-theorchard@qa-mcp).
# `collection` reads the variant's "Default MCP Tools" collection from GraphOS.
# Requires APOLLO_KEY + APOLLO_GRAPH_REF (=graphql-theorchard@qa-mcp) in the env.
operations:
  source: collection
  id: default

# The MCP router requires a valid JWT (pde.auth_enforcement) AND a client name
# (theorchard.require_apollo_client_name). Forward the caller's bearer token
# (token passthrough — open decision in the rollout doc) plus the profile/identity
# headers (router propagates them to subgraphs), and tag the client.
forward_headers:
  - authorization
  - apollographql-client-name
  - user-agent

headers:
  apollographql-client-name: "apollo-mcp"

# Pilot is read-only; keep the surface tight. Introspection tools OFF
# (tools come from pre-defined operations, not live introspection).
introspection:
  introspect:
    enabled: true
  search:
    enabled: true
  execute:
    enabled: true
  validate:
    enabled: true

# CORS stays off for the pilot — no browser frontends call the MCP server directly.
cors:
  enabled: false

server_info:
  name: "PDEGO MCP (QA)"
  description: "MCP surface over the federated graph (qa-mcp contract variant)"
  version: ${env.VERSION:-1.15.0}

telemetry:
  service_name: apollo-mcp
  version: ${env.VERSION:-apollo-mcp-1.15.0}
  exporters:
    metrics:
      otlp:
        endpoint: http://localhost:4317
        protocol: grpc
        metadata:
          env: qa
          service.name: apollo-mcp
    tracing:
      otlp:
        endpoint: http://localhost:4317
        protocol: grpc
        metadata:
          env: qa
          service.name: apollo-mcp

logging:
  level: info