Graphql Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Graphql Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for GraphQL — schema introspection, auto-generated tools, query/mutation execution for Claude, Cursor, and AI agents.
Connects to any GraphQL endpoint and gives AI agents the ability to:
npx @supernova123/graphql-mcp-serverSet your endpoint via environment variable:
GRAPHQL_ENDPOINT=https://your-api.com/graphql npx @supernova123/graphql-mcp-serverOr configure at runtime with the connect_endpoint tool.
| Tool | Description |
|---|---|
connect_endpoint | Set or change the active GraphQL endpoint |
set_auth_token | Configure Bearer token authentication |
set_basic_auth | Configure HTTP Basic authentication |
set_headers | Replace custom HTTP headers |
add_header | Add/update a single header |
remove_header | Remove a header |
get_connection_status | Show endpoint config, auth state, and schema cache |
| Tool | Description |
|---|---|
introspect_schema | Fetch the full schema via introspection |
list_types | List all types (filter by kind or name) |
describe_type | Get full details of a single type |
list_queries | List all root query fields |
list_mutations | List all root mutation fields |
list_subscriptions | List all root subscription fields |
describe_field | Get full details of a field |
search_schema | Search types and fields by substring |
| Tool | Description |
|---|---|
execute_query | Send a raw GraphQL query |
execute_mutation | Send a raw GraphQL mutation |
execute_typed_query | Execute a query by field name (auto-constructed) |
execute_typed_mutation | Execute a mutation by field name (auto-constructed) |
| Tool | Description |
|---|---|
get_cached_schema | Return the cached introspection result |
clear_cache | Clear schema cache |
reload_schema | Force a fresh introspection |
| Variable | Description | Default |
|---|---|---|
GRAPHQL_ENDPOINT | GraphQL endpoint URL | (none — must configure at runtime) |
GRAPHQL_AUTH_TOKEN | Bearer token for Authorization header | (none) |
GRAPHQL_BASIC_USER | Basic auth username | (none) |
GRAPHQL_BASIC_PASS | Basic auth password | (none) |
GRAPHQL_TIMEOUT_MS | Request timeout in milliseconds | 30000 |
GRAPHQL_HEADER_* | Custom headers (e.g. GRAPHQL_HEADER_X_API_KEY=secret) | (none) |
{
"mcpServers": {
"graphql": {
"command": "npx",
"args": ["-y", "@supernova123/graphql-mcp-server"],
"env": {
"GRAPHQL_ENDPOINT": "https://your-api.com/graphql",
"GRAPHQL_AUTH_TOKEN": "***"
}
}
}
}npm install
npm run build
npm testReal data from building and running this server:
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.