We'll first explore how we implemented our MCP server for GraphQL APIs and then use Grafbase extensions to federate non-GraphQL datasources to have them all available for agents without increasing the number of tools.

REST APIs were designed for human-built clients that know exactly what URL to call. AI agents are different — they reason, plan, and decide what data they need at runtime. That mismatch is quietly becoming one of the biggest friction points in enterprise AI adoption.

In this session, we explore why GraphQL, paired with the Model Context Protocol (MCP), is uniquely positioned to become the standard interface layer for agentic systems. You'll learn how GraphQL's strong typing and introspection eliminate the hallucination risk of ambiguous REST contracts, how its precise data retrieval model solves the over-fetching and under-fetching problems that make LLM tool calls expensive and unpredictable, and how MCP builds on top of this to give AI agents a standardised, self-describing surface to discover and invoke capabilities — without custom glue code per integration.

Walk away with a clear mental model of the GraphQL-MCP stack, a practical pattern for evolving existing REST endpoints into agent-ready GraphQL APIs, and real examples of AI agents successfully navigating complex multi-step queries using schema-declared tools.

Whether you're an API architect, a backend engineer, or a developer building your first AI agent, this session gives you the vocabulary and the blueprint to make your APIs first-class citizens in the agentic world.

This talk explores the architecture and implementation of OAuth-based authentication for remote-hosted MCP servers. I'll walk through the specific challenges I encountered while building an MCP server at Tigris — including managing dynamic client registrations, token lifecycle management and scope handling across distributed environments.

I'll also cover UX choices like reducing friction in the auth flow, handling token refresh gracefully, and managing session state.