June 2026 Summaries

Alexandra Stoica, responsible for People and Culture at WunderGraph, reflects on the success of an in-person work week in Madrid where 31 team members, spanning 12 countries and 18 nationalities, gathered to reconnect and strengthen their culture. The event emphasized the importance of face-to-face interactions to foster trust, collaboration, and alignment, crucial for a remote team spread across continents and time zones. Stoica highlights the challenges of maintaining company culture amidst rapid growth, noting that culture is a dynamic entity that requires continuous attention and investment. By designing intentional moments for connection, such as mixed lunch groups and open Q&A sessions with investors, the team is able to preserve the essence of WunderGraph's culture while scaling. The Madrid gathering served as a reminder of the responsibility to nurture the company's unique culture and the need to keep investing in opportunities for in-person connection to ensure that trust and collaboration continue to flourish as the company expands.

The Cosmo Router MCP Gateway enables AI agents to interact with federated GraphQL schemas by exposing them as reviewed and OAuth-scoped tools. This approach ensures that AI agents can explore schemas during development but are restricted to executing only approved operations in production. The MCP Gateway operates on a composed supergraph, allowing seamless data resolution across multiple subgraphs without requiring additional services. Two configuration flags manage its operation: one controls schema exposure and the other manages the ability for agents to execute arbitrary operations. During development, both flags are enabled to allow comprehensive schema exploration and query execution, while in production, they are disabled to restrict agents to pre-approved operations, minimizing potential security risks. The system supports per-operation authorization using OAuth 2.1, ensuring that agents operate within their permitted scopes. The architecture is designed to handle schema changes efficiently, with operations re-validated automatically upon schema updates, ensuring continued functionality without manual intervention. This setup avoids the need for a separate AI-safe API by maintaining a single source of truth, which simplifies governance and reduces infrastructure complexity.

AI agents should not be given open-ended access to production GraphQL graphs due to governance and security risks, such as exposing unintended fields and executing unreviewed operations. In development, an open-world setup allows agents to explore and discover useful queries, but in production, it is crucial to restrict them to a safelist of named, reviewed operations. This approach prevents the creation of ungoverned "shadow MCP" servers and minimizes API sprawl by ensuring agents execute only pre-approved operations via the Cosmo Router MCP Gateway. The transition from development to production involves converting discovered behavior into reviewed software artifacts, which are then exposed as tools for agents. This closed-world model ensures a manageable and auditable interface between agents and the graph, supporting operational controls like rate limits and anomaly detection.