Model Context Protocol moderate risk

Gqai

Gqai exposes GraphQL operations as MCP tools, enabling AI models to interact with GraphQL backends using defined queries and mutations.

Connections & Capabilities

Connects To

GitHub

Capabilities

readwrite

Quickstart

Config

{
  "gqai": {
    "command": "gqai",
    "args": [
      "run",
      "--config",
      ".graphqlrc.yml"
    ]
  }
}

Exposed MCP Tools (2)

safe

get_all_films

Retrieves a list of all Star Wars films.

Read-only operation, no data modification.

safe

get_film_by_id

Retrieves details of a specific film by its ID.

Read-only operation, no data modification.

Safety Assessment

Gqai's safety depends heavily on the security of the underlying GraphQL API and the configurations defined in `.graphqlrc.yml`. It is relatively safe when used with read-only queries and a well-secured GraphQL backend. However, it becomes risky if mutations are exposed without proper authorization or if environment variables containing sensitive information are not adequately protected.

Relies on GraphQL backend's security for data access.
Operations are defined through GraphQL queries, limiting potential for arbitrary code execution.
Uses `.graphqlrc.yml` for configuration, allowing centralized management.
Can leverage environment variables for sensitive information like API keys.

Exposes GraphQL endpoint to AI models, potentially increasing attack surface.
Improperly configured GraphQL schema or operations could lead to data leaks or unauthorized modifications.
Lack of built-in rate limiting could lead to abuse or denial-of-service.
If environment variables are not properly secured, secrets could be exposed.
The tool's access is only as secure as the underlying GraphQL API.