# Ahmet Soormally

Principal Solutions Engineer at WunderGraph

## Bio

Ahmet is a Principal Solutions Engineer at WunderGraph, helping teams adopt Cosmo. He leads technical evaluations, builds prototypes, and runs workshops to accelerate adoption, while improving SDKs, documentation, and onboarding to enhance the developer experience.

[LinkedIn](https://www.linkedin.com/in/ahmet-soormally/) | [GitHub](https://github.com/asoorm)

**Blog**  
June 10, 2026  
**Safelist GraphQL Operations for AI Agents | Cosmo MCP Gateway**  
Learn how to use the Cosmo Router MCP Gateway to expose federated GraphQL schemas to AI agents with reviewed, OAuth-scoped MCP tools.  
[Read post](/content/blog/safelist-graphql-operations-for-ai-agents-cosmo-mcp/index.html)

**Blog**  
June 8, 2026  
**Don't Let AI Agents Improvise Against Production GraphQL**  
AI agents should explore your GraphQL schema in development and invoke only reviewed operations in production. Design in an open world, ship in a closed one — using the Cosmo Router MCP Gateway.  
[Read post](/content/blog/governing-ai-agent-access-to-graphql-mcp-gateway/index.html)

**Blog**  
April 27, 2026  
**Where Does API Complexity Live?**  
Compare REST, GraphQL, and federation by where the complexity actually lives — data fetching, caching, security, contracts, and governance.  
[Read post](/content/blog/rest-vs-graphql-vs-federation-complexity/index.html)

**Blog**  
April 16, 2026  
**Per-Tool OAuth Scopes for MCP, Derived from Your Schema**  
Enforce per-tool OAuth scopes on MCP servers using your GraphQL schema. AI agents get least-privilege access with automatic scope step-up — no BFF needed.  
[Read post](/content/blog/mcp-per-tool-oauth-scopes-graphql-schema/index.html)

**Blog**  
March 17, 2026  
**ConnectRPC: Generate Typed SDKs from Your GraphQL API**  
Cosmo ConnectRPC compiles GraphQL operations into Protocol Buffers and serves them as gRPC, REST, and typed SDKs — no separate API layer required.  
[Read post](/content/blog/connectrpc-generate-typed-sdks-from-graphql/index.html)

**Blog**  
March 8, 2026  
**Why MCP Is the Ceiling, Not the Foundation of Enterprise AI Agent Architecture**  
MCP standardized how AI agents invoke tools — but not what they can see or do. Here's why the real bottleneck in enterprise AI is data readiness, not protocol adoption.  
[Read post](/content/blog/why-mcp-is-ceiling-enterprise-ai-agent-architecture/index.html)

**Blog**  
March 4, 2026  
**MCP Scope Step-Up Authorization: From Implementation to Spec Contribution**  
Cosmo's MCP server already exposes your graph as AI-ready tools. When we added per-tool OAuth scope step-up authorization so clients don't need a god token, we hit an infinite loop. The root cause: a gap between the MCP spec and RFC 6750 on scope challenges, plus SDK behavior that overwrites scopes instead of accumulating them. Here's what we found and how we're approaching it.  
[Read post](/content/blog/mcp-scope-step-up-authorization/index.html)

**Blog**  
October 29, 2025  
**GraphQL Operation Descriptions: How a Spec Update Solved Our MCP Problem**  
The September 2025 GraphQL spec update added official support for operation descriptions. This solved a real problem: how to document GraphQL operations for MCP tools without custom hacks or non-standard conventions.  
[Read post](/content/blog/graphql-operation-descriptions-2025-spec/index.html)

**Blog**  
October 16, 2025  
**MCP Gateway with Curated GraphQL Persisted Operations**  
Curated GraphQL Persisted Operations (POs) provide a secure, task-level facade for exposing APIs to LLMs via the Modex Context Protocol (MCP). They reduce complexity, enforce security, and ensure stable tool use compared to raw REST APIs.  
[Read post](/content/blog/graphql-persisted-operations-llms-mcp/index.html)