AI Extensions: Appwrite MCP 1.0 and Microsoft’s Agent Package Manager 0.33
One server can now manage a backend through your agent, and one tool writes the same MCP config into every agent runtime you use. Both need a careful look at what they are allowed to touch.
Two changes this week sit on opposite sides of the same problem. Appwrite marked its MCP server stable, which gives an agent more of a backend to operate. Microsoft’s Agent Package Manager shipped version 0.33, which decides what config every agent on your machine gets. Neither is a reason to hand out wider access than the job needs.
The short version
Official sources: appwrite/mcp (MIT, v1.0.2 released October 2, 2026; 72 stars, 19 forks, 6 open issues on October 5) and microsoft/apm (MIT, v0.33.0 released October 2, last push October 5; 3,936 stars, 385 forks, 227 open issues on October 5). Popularity is not quality. I did not install either one.
Appwrite MCP server 1.0
- Official: Appwrite changelog, October 1 and https://github.com/appwrite/mcp
- License and upkeep: MIT. Version 1.0.0 was announced October 1, and the repository’s latest release was v1.0.2 on October 2.
- Setup: the README points clients at the hosted server, https://mcp.appwrite.io/, and opens a browser consent screen for OAuth. No key to copy. Local runs of a self-hosted instance need
mcp-server-appwrite1.0.0.
The changelog says this marks the existing server as stable, not a new workflow. The catalog now covers email OTP verification and recovery, more OAuth providers (Cloudflare, Kakao, Resend, TikTok, Webflow), the Appwrite messaging provider, and project API keys including short-lived ones. The key actions are organization administration and exist only on the remote OAuth connection. Clients that cache tool names should refresh discovery, because one tool was renamed and some endpoints were removed.
Caveat: an agent that can create and delete project API keys can mint its own credentials. On the consent screen, approve the narrowest scopes that fit the task, and keep it on a test project first.
Microsoft APM 0.33
- Official: https://github.com/microsoft/apm, docs at the MCP install page, release at v0.33.0
- License and upkeep: MIT. Released October 2, with a push on October 5.
- Setup: declare servers once under
dependencies.mcpin apm.yml, or run one command, and APM writes each runtime’s config for the targets it detects.
claude mcp add --transport http appwrite https://mcp.appwrite.io/
apm install --mcp io.github.github/github-mcp-serverThe point is reproducibility: one file describes an agent’s context, and a teammate who clones the repo gets the same setup. The v0.33.0 notes are mostly fixes, such as keeping Claude, Codex and Cursor MCP entries correct, plus a new apm auth command for git host credentials and a bound on the hidden-Unicode walk in audit.
Caveat: unknown keys in a server entry are passed through to every harness config, and a dependency package can contribute MCP servers to yours. Read apm.yml diffs like code, and keep tokens in environment variables rather than the manifest. The project is still before 1.0, so expect change.
Sources and limits
I read each page on October 5, 2026 and pulled stars, forks, issues and release dates from GitHub the same day. I installed and ran nothing. The caveats are my analysis.