WunderGraph Cosmo Features

Build

Cosmo has everything you need to build monolithic & federated APIs across multiple protocols. At the core of Cosmo is the Schema Registry to manage your API schemas. Cosmo supports both v1 and v2 of the GraphQL Federation specification and comes with a powerful router to handle all your federation needs.

Cosmo Connect

Docs

Federation without GraphQL servers. Define a GraphQL schema contract that generates gRPC definitions while keeping full Federation compliance.

Federation without GraphQL Servers

Cosmo Connect removes the need to run GraphQL servers. You define a GraphQL schema contract that specifies the service interface. From this contract, Cosmo Connect generates Protocol Buffers and stubs, keeping your graph fully Federation compliant while avoiding GraphQL frameworks or libraries.

Two Deployment Models

Cosmo Connect supports Router Plugins and gRPC Services. Plugins run as local processes managed by the router. They are ideal for simple deployments where you want the lowest latency and do not need separate CI/CD or scaling. Services are independent deployments in any language. They are suitable when you need full lifecycle control, team ownership boundaries, and independent scaling.

Key Benefits for Developers

Backend teams implement gRPC contracts instead of GraphQL resolvers. You can wrap existing APIs like REST or SOAP without writing full subgraphs, lowering migration costs. Request/response semantics stay simple, while the router handles GraphQL query planning and batching.

SDK Generation

Docs

Compile GraphQL operations into typed client SDKs, HTTP/JSON endpoints, and OpenAPI specs. Consumers get the interface they prefer without building a separate API layer.

Typed SDKs in Any Language

Generate strongly typed client libraries for TypeScript, Go, and more. Catch errors at compile time, not at runtime.

HTTP/JSON & OpenAPI

Every persisted operation becomes a plain HTTP endpoint. An OpenAPI spec is auto-generated for integration with existing API gateways and partner portals.

Safe Schema Evolution

Update your GraphQL operations and regenerate. Breaking changes are caught by the type system before they reach consumers.

MCP Gateway

Docs

Transform your API into an AI-ready interface that LLMs like ChatGPT and Claude can discover, understand, and interact with in a secure and direct way. The MCP Gateway creates a secure bridge between your data and modern AI systems.

The MCP Gateway

Intelligent API Discovery

Enable AI models to autonomously explore your schema, understand available operations, and execute queries without requiring custom integration code for each AI platform.

Granular Access Control

Define exactly which operations AI models can access through persisted operations (trusted documents). This gives you operation-level control over what data they can query or mutate.

Built-in Tool Ecosystem

Automatically exposes your operations as AI compatible tools with proper metadata, JSON schemas for inputs, and clear descriptions that help models use your API correctly.

Security-First Design

Maintains all authentication and authorization mechanisms of your router, ensuring AI systems can only access what they are allowed to see based on your existing security policies.

Developer Experience

Simply create purpose built operations in files, and the MCP Gateway transforms them into AI tools that work across platforms like Claude, Cursor, Windsurf, and OpenAI without additional coding.

Schema Registry

The version control for your schemas. It always ensures the latest valid state is used to compose your federated graphs.

Publish schemas to the registry

Support for Monographs, Federation v1 & v2

Publish schemas that are compatible with both versions of GraphQL Federation. All your existing GraphQL Services will work out of the box. Any framework, any language. More info on what features are supported in v1 and v2 can be found in the Compatibility Matrix.

Schema Checks

Schema Checks are in integral part of the Cosmo Schema Registry. With Checks, you can govern the quality of your schemas and avoid publishing broken schemas. Cosmo performs checks in four different categories:

• Composition Checks
• Breaking Change Detection
• Client Traffic Checks
• Linting Checks

Composition Checks ensure that a change in a subgraph does not break the composition of the federated graph. Breaking Change Detection ensures that a change in a subgraph does not introduce a breaking change. Client Traffic Checks take the result of breaking change detection and validate it against real client traffic, allowing you to skip breaking changes that are not breaking any clients. Linting Checks allows you to enforce a certain schema style guide and best practices across all subgraphs.

Changelog

Track and document all schema modifications over time. Receive real time updates through webhooks and slack notification to always stay on top of everything.

Compositions

The Cosmo Schema Registry keeps track of all compositions over time. You can view the composition history of your federated graph and see how it evolved over time.

Pull Request based Schema Composition Workflows

Check and publish schemas from your git workflows. With our GitHub integration, receive statuses right in your PR commits.

Router / Gateway

Docs

The router is the component that understands the GraphQL Federation protocol. It is responsible for routing requests to the correct service and for aggregating the responses.

P99 Latency

Requests Per Second

OTEL for Metrics and Tracing

Cosmo router supports exporting tracing and metrics via OpenTelemetry. These can be configured with multiple exporters. Both http and grpc are supported.

Prometheus Metrics

The router offers built-in support for Prometheus. We export the default Go and Process metrics including (R.E.D) metrics related to incoming GraphQL traffic.

Subscriptions over WebSockets and Server-Sent Events (SSE)

The Cosmo Router comes with subscription support out of the box without any limitations. We support two different protocols: WebSockets, Server-Sent Events.

Local Composition, Development & running in Air-Gapped environments

The Cosmo Router can be run in a local environment not only for development but also for running in air-gapped environments. There's no need to connect to the internet or a control plane. You can compose a configuration file at build time and run the router in a completely offline environment.

Custom Modules, Middleware & Extensions

The Cosmo Router is built with extensibility in mind. You can write custom modules, middleware and extensions to fit your specific use case. For example, you can write a custom module to modify the request or response, or to add custom metrics, tracing or authorization.

Compliance & Data Privacy

At the heart of Cosmo is the ability to comply with data privacy regulations. As such, the Router comes with default configurations to ensure that no sensitive information of requests is sent to the Control Plane or Analytics.

GraphQL Federation v1 & v2

Docs

Compatible with both v1 and v2, all your existing services will work out of the box. Any framework, any language.

Schema Composition

Leverage open-source tooling around GraphQL in both JavaScript and Go to compose your federated graphs.

Schema Composition Checks

Easily avoid publishing broken schemas. Validate schema changes for breaking changes and composition errors. Perform checks against real time client traffic.

OSS Router with Authentication & Authorization

The Cosmo Router supports authenticating incoming requests using JWKS authentication. Multiple auth providers is also supported.

Subscriptions for Federation

Docs

The Cosmo Router comes with subscription support out of the box without any limitations. We support two different protocols to enable the most versatile data synchronization: WebSockets, Server-Sent Events.

Subscriptions over WebSockets and Server-Sent Events (SSE)

Websockets using Epoll and Kqueue

We support subscriptions over websocket using graphql-ws (GraphQL over WebSocket Protocol compliant server and client) or graphql-transport-ws (Legacy) as well as the absinthe protocol. To ensure the best performance and minimize memory usage, we use epoll on Linux and kqueue on BSD-based systems to handle the connections.

Server-Sent Events

We support subscriptions over Server-Sent Events (SSE).

Event Driven Federated Subscriptions (EDFS)

Docs

EDFS combines the power of Federation and Event-Driven Architecture (Kafka, NATS, SQS, RabbitMQ, etc.). Build highly scalable and resource-efficient Event-Driven Federated Graphs.

Subscriptions backed by Event-Driven Architecture

Drive Subscriptions with Events

EDFS directly connects the Router to the Event Source. The Router listens to the events and triggers the Subscription resolvers. This eliminates the need for a WebSocket connection to the Subgraphs.

Deduplication of Subscriptions

The Cosmo Router deduplicates Subscriptions internally to save resources. If multiple Subscriptions use the same topic as a trigger, all Subscriptions share the same trigger. The trigger is shut down when all Subscriptions that depend on it are unsubscribed.

Stateless-ness of Subgraphs

With EDFS, the Router connects directly to the Event Source but doesn't require any stateful connections, e.g. WebSocket, to the Subgraphs. This makes the Subgraphs much simpler to reason about and easier to deploy

Efficiency, CPU & Memory Consumption

EDFS is built on top of Event-Driven principles, which means that the implementation is non-blocking, as CPU efficient as possible, and has a very low memory footprint.

Publish Events from any System, not just Subgraphs

EDFS is designed to fully decouple the API Consumer from the implementation of the Event-Driven Architecture.

Authentication & Authorization

Docs

The Cosmo Router supports authenticating incoming requests using JWKS authentication. Multiple auth providers is also supported.

JWKS / JWT Auth Support

Cosmo router supports authenticating incoming requests using JWKS authentication.

Field Level Auth Directives

Authorization directives can be used in your schema to define granular authorization rules on the field definition level.

Header forwarding to the Subgraphs

We provide several ways to simplify the work with propagating or orchestrating client data.

Graph Access Control

Docs

Resource-based access control enables allows machines or users to manipulate only specific federated-graphs and sub-graphs.

Add specific members to modify subgraph

Resource based API Keys

Create an API key restricted to specific resources within your organization. This limits the blast radius of a compromised API key and allows for fine-grained access control.

Subgraph Access & Ownership

Add specific members to Subgraphs. This allows you to control who can modify the subgraph through a 'publish' operation.

Cost Control

Docs

Prevent overly expensive operations in your Supergraph by estimating the cost of each request and rejecting operations that exceed the set cost limit.

Measuring & Enforcing Modes

In Measuring Mode, estimated cost is recorded without rejecting requests — useful for determining limits and observing query complexity. In Enforcing Mode, operations exceeding the cost limit are rejected before execution starts, protecting your infrastructure from expensive queries.

Estimated & Actual Cost

Estimated cost is computed statically at planning time based on field weights and list size hints. Actual cost is recorded dynamically from real subgraph responses, enabling accurate usage-based billing.

Customizable with @cost and @listSize Directives

Built on IBM's GraphQL Cost Directive specification. Customize field weights with @cost and list multipliers with @listSize to match the actual resource usage of your production workloads.

Observable via OTEL, Headers & Custom Modules

Cost metrics are exported through response headers, OpenTelemetry metrics, and custom modules — integrating seamlessly with your existing observability stack.

Persisted Operations

Docs

Persisted operations, also known as trusted documents or persisted Queries, allow you to register GraphQL Operations in the Router enabling the clients to send just an identifier in their request instead of sending the whole operation body.

Create persisted operations from the CLI or UI

Compatible with the tooling of your choice

Pushing persisted operations works with the manifest generated by clients like Apollo, Relay or graphql-code-generator. You can also push them directly from the studio playground.

Integrated analytics

Persisted operations work with Cosmo's analytics stack allowing you to filter and search by their client and operations IDs.

AWS Lambda Router

Docs

Run the Cosmo Router on AWS Lambda and save on infrastructure costs. The Lambda Router is a serverless implementation of the Cosmo Router with full support for federation and analytics. Leverage your existing AWS infrastructure and scale your API with ease.

Deploy your serverless router to AWS Lambda

Optimized for AWS Lambda

Fast cold-start times, low memory footprint, and low cost. The Lambda Router is designed to run on AWS Lambda. Metrics and tracing are fully supported.

Low cost & Maintenance

Save on infrastructure costs by running the Cosmo Router on AWS Lambda. Pay only for what you use. AWS comes with a generous free tier.

Subgraph Check Extensions

Docs

Run checks on your changes to ensure they meet your organization's policies.

Configure subgraph check extensions

Scale

The Cache Warmer allows Cosmo to scale Federation reliably under heavy load. By precomputing query plans and caching them ahead of time, it removes cold start latency and lowers CPU and memory usage. With built-in observability, it ensures consistent performance as traffic grows.

Cache Warmer

Docs

The Cache Warmer is an optimization feature designed to enhance Federation performance by precomputing query plans and storing them in the cache. This proactive caching mechanism reduces latency spikes caused by cold starts and ensures that high-traffic applications can handle demand surges without performance degradation.

Up to 99% improvement in latency

The Cache Warmer can reduce the latency of your queries by up to 99%. The performance improvement is achieved by precomputing query plans and storing them in the cache. In addition to reduced latency spikes, this will also keep CPU & memory usage much lower.

Cache Warmer performance graph

Cache Observability

Our understanding of caching is that it's only as good as the observability you have over it. If you don't know about cache hit ratios, cache misses, or cache fill rates, you can't optimize your cache. As such, the Cache Warmer comes with powerful Prometheus metrics and an example Grafana dashboard to monitor the cache.

Cache Warmer dashboard

Analyze

Cosmo provides a powerful set of tools to analyze and monitor your federated graph. We provide advanced request tracing to visualize the execution plan of your queries and detailed insights into the performance of your federated graph. Cosmo Analytics & Tracing is built on top of OpenTelemetry (OTEL) as well as Prometheus and can be easily integrated with your existing monitoring stack.

Analytics, Metrics & Tracing

Docs

Cosmo Router supports exporting tracing and metrics via OpenTelemetry. These can be configured with multiple exporters. Both http and gRPC are supported.

Monitor federated graph and subgraph performance

Advanced Filters

Filter on several parameters that are stored for each request. You can filter and group by operations, clients, latency, errors and more.

Distributed Tracing

Track the path taken by the request through your federated graph and associated services to ensure consistent performance. In addition to just GraphQL-based tracing, our approach to build on top of OTEL allows you to add spans for any other service in your infrastructure.

Operation Metrics

Gain insights into the performance and latency of your operations, including the number of requests, the number of errors, and the average latency.

Prometheus Integration

The Router offers built-in support for Prometheus. We export the default Go and Process metrics including (R.E.D) metrics related to incoming traffic.

Schema Usage Reporting

Docs

Monitor client interactions with your schema fields. Use insights to guide schema evolution and cater to user needs.

Monitor schema field usage

Available for all types and fields

Usage tracking is accessible from the schema explorer and the schema check page. It is available for all types and fields.

Detailed Analysis

Track usage across clients and operations with custom date range filters. Also indicates which subgraphs accessed the fields.

Track usage of deprecated fields

Track the usage of deprecated fields and types in your schema to ensure that you can safely remove them.

OpenTelemetry & Distributed Tracing

Docs

Cosmo router supports exporting tracing and metrics via OpenTelemetry. These can be configured with multiple exporters. Both http and grpc are supported.

Track the path taken by a request

OTEL-instrumented Router

The Router comes out of the box with OTEL instrumentation. This enables request tracking and detailed analysis for each one.

OTEL-instrumentation of Subgraphs

Extend OpenTelemetry's capabilities to subgraphs within your system.

Support for custom attributes

Tailor your tracing data with custom attributes. Include specific data or exclude some of your choice.

Advanced Request Tracing

Docs

When it comes to debugging and optimizing a Query, it's important to have a clear understanding of the execution plan and the performance bottlenecks. With Advanced Request Tracing (ART), you can visualize the execution plan of your queries including detailed timings and performance metrics.

Dependency tree for data fetches within your graphs

Verbose planning information

Obtain information about planning times, execution plan structure, fetch type, subgraph requests, input, output and much more!

Playground++

The Playground is enhanced with visualizations for Advanced Request Tracing. Both in a a tree graph view and a waterfall view to view execution structure and bottlenecks.

Transparent & Secure

ART requires the user to be signed into Cosmo Studio and uses a request signature to ensure that only authorized users can access the tracing data. Tracing data is only available in memory to the user who requested it. For security and compliance reasons, tracing data is directly exchanged between Router and Browser, and is never exposed or stored in the Control Plane.

Operations Overview

Docs

Get a comprehensive view into every operation executed against your federated graph. Monitor performance, analyze deprecated field usage, and make data-driven decisions for safe schema evolution.

Detailed operation specific analytics and client usage data

Track All Operations & Client Usage

Monitor every operation executed against your federated graph. See which clients are using specific operations and track usage patterns across your entire API ecosystem. Perfect for understanding how your API is actually being used in the wild.

Analyze Deprecated Fields Like a Detective

Identify which operations use deprecated fields and which clients are affected. It's like having X-ray vision for your schema evolution—you can see exactly who's still using that field you marked as deprecated.

Performance Debugging Made Simple

Sort operations by latency or error rate to quickly spot the troublemakers. Visual charts show request rate, P95 latency, and error percentage trends.

Iterate

Once the initial version of your Graph is published, Cosmo helps you to safely iterate on your schema and subgraphs.

Breaking Change Detection

Docs

Easily avoid publishing broken schemas. Validate schema changes for breaking changes and composition errors. Perform checks against real time client traffic. Lint your schemas for best practices and style guides.

Check all breaking changes in the proposed schema

Static Analysis

Check for breaking changes and composition errors for your new subgraph schema or check if deleting a subgraph would cause any conflicts.

Real-traffic Analysis

With every check, you can monitor if breaking changes in your updated schema affect clients and operations. This is thanks to field level metrics we record on the schema.

Govern your Schema Quality with Linting

Enforce a certain schema style guide and best practices across all subgraphs.

Check using the CLI

Use the powerful CLI which securely authenticates against your graphs to perform schema checks.

Check during Pull Request Workflow

Check and publish schemas from your git workflows. With our GitHub integration, receive statuses right in your PR commits.

Schema Change Notifications

Docs

Track and document all schema modification over time. Receive real time updates through webhooks and Slack notification to always stay on top of everything.

Track schema changes to your federated graph

Changelog

Every change ever made to your federated graph schemas are recorded for you to refer at any time.

Slack Integration

Get notified about schema changes right into your team slack channels with our seamless integration.

Webhooks

You have the full flexibility to perform your own actions on your infra by getting notified through webhooks.

Schema Contracts

Docs

Schema Contracts enable you to build a multi-purpose, multi-audience Graph, which can be split into Subsets for different use cases. This simplifies development and keeps your Graph maintainable.

Creation of schema subsets for 2 clients from the composed schema

Tailored APIs for specific Consumers

Schema Contracts give you a powerful solution to filter out unnecessary parts of the Schema for some API consumers, giving them a tailored Developer Experience that's geared towards their expectations and not bloated with irrelevant fields.

Improving Security and Data Privacy

Schema Contracts allow you to filter out fields and types that should only be accessible to a specific audience, e.g. admins or internal users.

Pull-Request-based Schema Workflows

Docs

Check and publish schemas from your git workflows. With our GitHub integration, receive statuses right in your PR commits.

Integrate schema checks within your GitHub workflow

Continuous Integration

Run schema checks on every commit in your pull request and get the status right there to avoid merging breaking schemas.

Continuous Delivery

Publish safe and valid schemas on merging your pull requests to your default branch.

Overriding Commit Check

To mark some breaking changes as safe and allow merging your pull requests you can override the check result.

Compositions

Docs

Comprehensive records detailing every instance of a subgraph publication.

History of all compositions of your federated graph

Composed schema

Track every version of your composed schema. Copy or download the composed schema.

Composition Inputs and Errors

Track the inputs and errors of every composition.

Changelog

View the changes caused after each composition.

Feature Flags

Docs

Feature flags allow you to release changes and experimental features gradually to a subset of your consumer traffic, rather than all clients immediately.

Feature Flags and Feature Subgraphs

Incremental feature rollout with Feature Flags

Roll out new features gradually to a subset of your clients. Enable a feature for a small percentage of users, monitor performance, then increase exposure. If further iteration is required, disable the feature without deploying a new version of the API.

Schema Evolution

Make changes and adapt your schema to your clients' needs without ever breaking the API contract. Add new types and fields, or rename existing ones—your clients use their preferred version of the API until they are ready to switch.

Dynamic Configuration

Change runtime API behavior dependent on the request context: through headers, claims, cookies, etc., enable or disable feature flags to provide a personalized experience to different users without the need to deploy multiple routers or APIs.

Staging Environments

Test new features in a staging environment before rolling them out to production. Allow your developers to test their features in isolation without impacting others by simply setting a specific cookies or header; no need to run several instances of the entire stack or multiple front-end applications.

Manage, Govern & Integrate

Manage access to Cosmo using SSO, manage roles and permissions, and monitor activities within your organization.

OIDC

Docs

Cosmo supports OIDC for Single Sign-On. You can configure your OIDC provider and manage your organization members.

Configure your OIDC provider

Supported Providers

Cosmo supports all OpenID Connect compliant identity providers such as Auth0, Okta, Keycloak, Azure AD, Google, and many more.

RBAC

Docs

Simplify access control by assigning permissions to roles rather than individuals. Users are then associated with specific roles, and their access rights are determined by the permissions linked to those roles.

Assign organization wide roles to members

Fine-grained access control with Roles and Groups

Leverage group membership and roles in your existing identity provider to manage access to your organization.

Audit Log

Docs

Understand the activities conducted by users throughout your entire organization, whether performed directly or via API keys.

Monitor activity within your organization

Trusted by small companies and large enterprises

LAUNCH NOW

Get started for free in 3 minutes

The convenience of a fully managed service without vendor-lock. No credit card required to get started.

Start building now

Want to learn more?

Get in touch with our experts and we'll discuss your use case and how WunderGraph can help you.