LoginSign Up
← Back to all sparks
A

Appwrite

DEVOPS
Velocity10.0

Appwrite spent August hardening credentials and making itself legible to AI tools.

mcpcredential hardeninglaunch weekruntimesmulti-factor auth
◆Current state
Appwrite's recent work runs along two strands: making the platform safer to hold credentials in, and making it readable by AI tooling. API keys can no longer create API keys and JWTs can no longer mint JWTs, closing a path where one leaked secret could grow hidden replacements. The MCP server gained better tool search, untruncated parameter descriptions, and documentation embeddings that refresh daily rather than at release time.
◆Where it's heading
The MCP work is being treated as product surface rather than a side integration — schema clarity, error semantics, and a docs pipeline decoupled from the release cycle all aim at getting a tool call right on the first try. Around it, runtime currency with Bun 1.4 and a custom MFA factor keep the developer-facing envelope wide. Init at the end of August is where that groundwork either pays out or stays plumbing.
◆Prediction
Init runs 31 August to 4 September with one announcement per day, so the next five changelog entries are scheduled rather than emergent. Given where the past month's work has concentrated, at least one is likely to be AI- or MCP-adjacent.

◆Recent moves

  1. 21d ago

    Appwrite Init returns 31 August to 4 September 2026

    An event announcement rather than a release: Init runs 31 August to 4 September, with a product or feature each day alongside docs, a changelog entry, and a livestream. Nothing ships here, though it signals that the coming week of changelog activity is pre-scheduled.

    View source ↗
  2. 26d ago

    Bun 1.4 is now available for Functions and Sites

    Bun 1.4 becomes selectable for Functions and as a build runtime for Node-based Sites frameworks, with Appwrite reporting 22% faster builds than Bun 1.3 on a 640-package Next.js app. Keeping runtimes current is table stakes for the Functions product rather than a directional move.

    View source ↗
  3. 29d ago

    MCP documentation embeddings now refresh daily, independent of version releases

    Documentation embeddings behind appwrite_search_docs now rebuild on a daily cron instead of at version releases, so AI tools answer against current guidance. Decoupling the MCP server's accuracy from the product release cadence is a maintenance change with outsized effect on how often a tool call lands correctly.

    View source ↗
  4. 1mo ago

    Better tool search and clearer schemas in the Appwrite MCP server

    The MCP server now surfaces enum values and object shapes in search results, stops truncating parameter descriptions, suggests near-miss tool names, and returns larger previews to cut round-trips. Every change targets one failure mode: a model guessing at an interface it cannot fully see.

    View source ↗
  5. 1mo ago

    API keys and JWTs can no longer mint further credentials

    An API key can no longer create another API key and a JWT can no longer mint another JWT, so a leaked credential cannot quietly generate replacements or outlive its own expiry. Existing credentials keep working, and console and server-SDK paths remain for legitimate issuance. This narrows blast radius rather than adding capability.

    View source ↗
  6. 1mo ago

    Send your MFA code through any channel with the custom factor

    A custom MFA factor has Appwrite generate and verify the six-digit code while the application delivers it over any channel — WhatsApp, a voice call, or an internal system. It widens the reach of existing multi-factor support rather than adding a new factor type, with delivery responsibility shifting to the developer.

    View source ↗