AI Extensions: Apollo MCP Server 2.0 makes hooks concurrent
The MIT-licensed server adds a new MCP protocol and removes a hook lock. Cached state and side effects need a migration check.
Today’s AI Extensions digest is one project examined closely rather than a list of names. Apollo MCP Server 2.0 changes how request hooks share state. A fix for a server hang can also change what your script means.
AI Extensions: Apollo MCP Server 2.0 makes hooks concurrent
The MIT-licensed server adds a new MCP protocol and removes a hook lock. Cached state and side effects need a migration check.
Verified release and license
Apollo’s official server exposes GraphQL operations as MCP tools. Release 2.0.0 is headed October 5, 2026 on the release page, with a GitHub release timestamp shown on October 6. It adds MCP protocol 2026-07-28 support while retaining older supported clients. The server repository and LICENSE identify the server code as MIT. That does not establish the terms of a hosted GraphOS account or of every dependency.
The official repository displayed 305 stars and 75 forks when read on October 7. These are observed community signals, not installation counts or evidence of safety. The dated 2.0 release is the maintenance signal used here. I read the release notes, README, license and quickstart; I did not build or run the server.
The change that deserves an upgrade test
The release notes describe an exclusive lock around Rhai hook execution. A hook waiting for an HTTP call could hold the engine lock and block waiting worker threads. The reported reproducer needed three concurrent calls on a two-core deployment. Version 2.0 runs hooks against an engine snapshot without keeping that lock for the whole script. A reload swaps in a newly compiled engine while in-flight hooks keep their original scripts.
Each invocation also gets a separate copy of variables declared at the top level of main.rhai, including values captured by top-level closures. Writes disappear when the hook returns instead of reaching later calls. The notes warn that a token cache or counter stored there loses writes without an error or log. External side effects now run concurrently too; the former lock is no longer accidental serialization.
Setup from current official documentation
The GraphOS quickstart requires Rover CLI 0.37 or later, authentication to a GraphOS account, Node.js 18 or later for mcp-remote, and an MCP client. Its initialization command is rover init --mcp. The wizard creates schema, operations and configuration files. The documented local command is rover dev --supergraph-config supergraph.yaml --mcp .apollo/mcp.local.yaml, after loading the environment file.
The guide places the GraphQL server on localhost:4000 and MCP on 127.0.0.1:8000, then uses the MCP Inspector to connect over HTTP and list tools. A client can connect through mcp-remote to the local /mcp endpoint. This is a description of the vendor’s route, not an instruction to paste a secret into chat or run an unreviewed installer. The README also documents a source build with cargo build if Rust is installed.
My analysis: a small migration rehearsal
Use a staging graph with synthetic data. List the exact operations exposed and their scopes before a model connects. Try a read-only operation first. Then send concurrent test calls that previously relied on a top-level counter or cached value, and record each result. A state change that must survive a request needs a deliberately chosen store; an in-script variable is no longer that store. Do not copy real tokens into diagnostic output.
Also test one rejected token, one missing required scope, and one interrupted request. Check the behavior at the GraphQL API, not only a successful MCP response. Mutations are writes to the backing application even if presented as convenient agent tools. Hook side effects need their own concurrency and retry design. This proposed rehearsal is not a test I performed and does not certify the server.
Compatibility and privacy limits
The notes say an upgrade from 1.20.0 needs no configuration changes, but top-level Rhai writes still need review. Earlier 1.x migrations include removal of SSE in favor of streamable_http, a default-port change and stricter host/configuration validation. Review the release page for the version you actually run rather than treating every historical highlight as new in 2.0.
GraphQL schemas and operation descriptions reveal application structure; operation results may contain private data. Expose a narrow operation set, use least-privilege credentials and keep auth enforcement on. Release notes are vendor-maintainer evidence, not independent security assurance. Popularity is not quality, and an MIT license is not a privacy policy.