Graphor Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Graphor Mcp Server (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Graphor Remote MCP Server lets you connect AI assistants and agentic frameworks to the Graphor API using the Model Context Protocol (MCP). It runs on Cloudflare Workers and uses OAuth for authentication.
Server URL:
https://mcp.graphor.workers.dev/sseLooking for the local MCP server instead? See the Local MCP Server section below or the graphor-mcp package.
For local MCP clients (e.g. Cursor, VS Code), you can use the graphor-mcp package which authenticates via API key instead of OAuth.
Install directly using the buttons below:
Or manually add it to your MCP client's configuration:
{
"mcpServers": {
"graphor_api": {
"command": "npx",
"args": ["-y", "graphor-mcp@latest"],
"env": {
"GRAPHOR_API_KEY": "grlm_your_api_key_here"
}
}
}
}Note: You can get your API key from graphorlm.com.
For web-based AI clients (e.g. Claude.ai) or agentic frameworks (e.g. LangChain, CrewAI) that cannot run local npx processes, use the hosted remote MCP server. Authentication is handled via OAuth — a browser window will open for you to log in.
https://mcp.graphor.workers.dev/sseAdd the following to your Claude Desktop configuration file (Settings > Developer > Edit Config):
{
"mcpServers": {
"graphor_api": {
"command": "npx",
"args": ["mcp-remote", "https://mcp.graphor.workers.dev/sse"]
}
}
}When you open Claude Desktop, a browser window will open for you to log in. After authenticating, the Graphor tools will appear in the bottom right of your conversation.
Add the following to your Cursor MCP configuration (Settings > Tools & MCP > New MCP Server):
{
"mcpServers": {
"graphor_api": {
"command": "npx",
"args": ["mcp-remote", "https://mcp.graphor.workers.dev/sse"]
}
}
}For agentic frameworks that support MCP, connect to the remote server via SSE transport:
LangChain (Python):
from langchain_mcp_adapters.client import MultiServerMCPClient
async with MultiServerMCPClient(
{
"graphor": {
"url": "https://mcp.graphor.workers.dev/sse",
"transport": "sse",
}
}
) as client:
tools = client.get_tools()
# Use tools with your LangChain agentLangChain (TypeScript):
import { MultiServerMCPClient } from "@langchain/mcp-adapters";
const client = new MultiServerMCPClient({
graphor: {
url: "https://mcp.graphor.workers.dev/sse",
transport: "sse",
}
});
const tools = await client.getTools();
// Use tools with your LangChain agentNote: The OAuth flow will open a browser window on first connection. For headless environments, you may need to complete the OAuth flow beforehand or use mcp-remote as a local proxy.For any client that supports remote MCP servers via SSE, use the URL:
https://mcp.graphor.workers.dev/sseFor clients that only support stdio transport, use mcp-remote as a bridge:
{
"mcpServers": {
"graphor_api": {
"command": "npx",
"args": ["mcp-remote", "https://mcp.graphor.workers.dev/sse"]
}
}
}If you run into issues connecting, try the following:
npx mcp-remote https://mcp.graphor.workers.dev/sserm -rf ~/.mcp-authYou can deploy your own instance of this server to Cloudflare Workers.
npm installnpx wrangler@latest kv namespace create remote-mcp-server-oauth-kvwrangler.jsoncnpm run deploynpm install
npm run devThe server will be available at http://localhost:8787/.
To test with the MCP Inspector:
npx @modelcontextprotocol/inspectorSSE and enter http://localhost:8787/sse~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.