--- title: Where Apollo MCP Server Stands on the OWASP MCP Top 10 description: An MIT-licensed Rust MCP server is audited against all ten OWASP MCP Top 10 risks by its own maintainers, using the v1.17.0 source tag as reference.... canonical: https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Where Apollo MCP Server Stands on the OWASP MCP Top 10 | daily.dev og:description: An MIT-licensed Rust MCP server is audited against all ten OWASP MCP Top 10 risks by its own maintainers, using the v1.17.0 source tag as reference.... og:url: https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje og:image: https://api.daily.dev/og/posts/dqBSQQOje.png og:image:alt: Where Apollo MCP Server Stands on the OWASP MCP Top 10 og:image:width: 1200 og:image:height: 630 og:locale: en --- [Apollo Blog](https://daily.dev/sources/apollo) [Read post](https://api.daily.dev/r/dqBSQQOje) # [Where Apollo MCP Server Stands on the OWASP MCP Top 10](https://api.daily.dev/r/dqBSQQOje "Go to post") An MIT-licensed Rust MCP server is audited against all ten OWASP MCP Top 10 risks by its own maintainers, using the v1.17.0 source tag as reference. Architecture alone fully closes only one risk (command injection), since tools are typed, schema-validated GraphQL operations with no shell in the request path. The other nine risks ship as configurable primitives requiring deliberate setup: scope enforcement (auth.scopes, required\_scopes), mutation gating (mutation\_mode), host validation, and telemetry redaction (omitted\_attributes). Notable gaps include token passthrough enabled by default (spec-noncompliant), uneven binary signing (only macOS is signed/notarized), unredacted trace spans by default, and no automatic diffing when hot-reloaded operations change tool behavior. Two risks (shadow servers, tenant isolation) are declared entirely outside server scope, belonging to asset inventory and deployment topology instead. [#security](/tags/security "Check all #security posts")[#authentication](/tags/authentication "Check all #authentication posts")[#graphql](/tags/graphql "Check all #graphql posts")[#mcp](/tags/mcp "Check all #mcp posts") Aug 14•8m read time•From [apollographql.com](https://api.daily.dev/r/dqBSQQOje "apollographql.com") [](https://api.daily.dev/r/dqBSQQOje "Go to post") Table of contents [What architecture settles and only bounds \[MCP05, MCP03, MCP06\]](https://api.daily.dev/r/dqBSQQOje "What architecture settles and only bounds [MCP05, MCP03, MCP06]")[What turns on with a configuration key](https://api.daily.dev/r/dqBSQQOje "What turns on with a configuration key")[The gaps](https://api.daily.dev/r/dqBSQQOje "The gaps")[Not this server’s layers](https://api.daily.dev/r/dqBSQQOje "Not this server’s layers")[Ownership](https://api.daily.dev/r/dqBSQQOje "Ownership") Questions this post answers Does Apollo MCP Server forward the caller's authentication token to upstream services by default? Yes, when auth is configured, Apollo MCP Server forwards the caller's validated token upstream by default, which the MCP Authorization spec forbids. This means the upstream API makes authorization decisions on a token never issued to it. An off-switch, disable\_auth\_token\_passthrough, exists, but flipping it currently loses the caller's identity upstream since no token exchange replacement has shipped yet. Teams hardening MCP deployments can track spec-compliance changes like this one on daily.dev. How does mutation\_mode control which GraphQL mutations an MCP agent can execute in Apollo MCP Server? mutation\_mode has three levels: none (default) filters out all mutations so none become tools; explicit exposes only mutations authored as committed operation files, while ad-hoc execution still can't run other mutations; all lets the execute tool run any mutation that type-checks against the schema. All three are config-time gates set before deployment, not per-invocation approvals. Engineers choosing safe MCP tool configurations can compare settings like this on daily.dev. What supply chain security gaps exist in Apollo MCP Server's release artifacts at version 1.17.0? At the v1.17.0 tag, only the macOS binary is signed and notarized, while Linux and Windows tarballs ship without signatures, checksums, or an SBOM. Container images carry per-architecture SLSA attestations, but the multiarch manifest itself carries none, so digests should be pinned and verified per architecture rather than pulling by tag. Developers vetting MCP server supply chain risk can follow attestation gaps like these on daily.dev. 157 Impressions Comment Bookmark Copy Share your thoughtsPost [](https://daily.dev/sources/apollo) [Apollo Blog](https://daily.dev/sources/apollo "https://daily.dev/sources/apollo") Apollo's platform is dedicated to providing insights and resources for developers and teams buildin... Read more 8 Followers • 0 Upvotes #### Would you recommend this post? Copy link WhatsApp Facebook X New Squad Copy linkShare with your friends ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Where Apollo MCP Server Stands on the OWASP MCP Top 10","url":"https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje"},"datePublished":"2026-08-14T21:15:56.696Z","dateModified":"2026-08-14T21:30:22.997Z","description":"An MIT-licensed Rust MCP server is audited against all ten OWASP MCP Top 10 risks by its own maintainers, using the v1.17.0 source tag as reference....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71eee063d7c774bc3e09987ecac9f7a9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/71eee063d7c774bc3e09987ecac9f7a9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Apollo Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Apollo Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/cb3bc4fd879a485cacd1cff99536c010","url":"https://daily.dev/sources/apollo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,graphql,mcp","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Apollo Blog","item":"https://daily.dev/sources/apollo"},{"@type":"ListItem","position":3,"name":"Where Apollo MCP Server Stands on the OWASP MCP Top 10"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/where-apollo-mcp-server-stands-on-the-owasp-mcp-top-10-dqbsqqoje#faq","mainEntity":[{"@type":"Question","name":"Does Apollo MCP Server forward the caller's authentication token to upstream services by default?","acceptedAnswer":{"@type":"Answer","text":"Yes, when auth is configured, Apollo MCP Server forwards the caller's validated token upstream by default, which the MCP Authorization spec forbids. This means the upstream API makes authorization decisions on a token never issued to it. An off-switch, disable_auth_token_passthrough, exists, but flipping it currently loses the caller's identity upstream since no token exchange replacement has shipped yet. Teams hardening MCP deployments can track spec-compliance changes like this one on daily.dev."}},{"@type":"Question","name":"How does mutation_mode control which GraphQL mutations an MCP agent can execute in Apollo MCP Server?","acceptedAnswer":{"@type":"Answer","text":"mutation_mode has three levels: none (default) filters out all mutations so none become tools; explicit exposes only mutations authored as committed operation files, while ad-hoc execution still can't run other mutations; all lets the execute tool run any mutation that type-checks against the schema. All three are config-time gates set before deployment, not per-invocation approvals. Engineers choosing safe MCP tool configurations can compare settings like this on daily.dev."}},{"@type":"Question","name":"What supply chain security gaps exist in Apollo MCP Server's release artifacts at version 1.17.0?","acceptedAnswer":{"@type":"Answer","text":"At the v1.17.0 tag, only the macOS binary is signed and notarized, while Linux and Windows tarballs ship without signatures, checksums, or an SBOM. Container images carry per-architecture SLSA attestations, but the multiarch manifest itself carries none, so digests should be pinned and verified per architecture rather than pulling by tag. Developers vetting MCP server supply chain risk can follow attestation gaps like these on daily.dev."}}]} ```