Model Context Protocol moderate risk

GraphQL

A Model Context Protocol server that enables LLMs to interact with GraphQL APIs, allowing for schema introspection and query execution.

Connections & Capabilities

Connects To

GitHubTwitter

Capabilities

readwriteexec

Quickstart

Install

npx -y @smithery/cli install mcp-graphql --client claude

Config

{
    "mcpServers": {
        "mcp-graphql": {
            "command": "npx",
            "args": ["mcp-graphql"],
            "env": {
                "ENDPOINT": "http://localhost:3000/graphql"
            }
        }
    }
}

Exposed MCP Tools (2)

safe

introspect-schema

Retrieves the GraphQL schema from the endpoint via introspection or a provided schema file.

Read-only operation that retrieves schema information.

moderate

query-graphql

Executes GraphQL queries against the specified endpoint.

Can potentially modify data if mutations are enabled.

Safety Assessment

This server is relatively safe in its default configuration with mutations disabled. Enabling mutations significantly increases the risk. Using a specific schema file instead of introspection reduces the attack surface.

Mutations are disabled by default, preventing unintended data modification.
Allows for schema introspection, enabling discovery of available queries.
Can be configured to use a local schema file or URL, limiting external dependencies.

If mutations are enabled, LLMs could potentially modify data.
Introspection exposes the entire schema, potentially revealing sensitive information.
Lack of built-in rate limiting could lead to abuse or denial-of-service.
Relies on environment variables for configuration, which can be insecure if not properly managed.