Graphql MCP Server
GraphQL API schema introspection and query execution for your LLM assistant.
Data last scanned today · Reviewed today
Overview
This server allows LLMs to interact with GraphQL APIs by providing tools for schema introspection and data querying. It supports both remote introspection and local schema files, enabling models to dynamically discover and navigate API structures.
Our verdict
With a security score of 39/100, this tool is categorized as high risk. The rating reflects that it is community-maintained rather than official, and its status has not been editorially reviewed. Users should exercise caution as the last commit occurred over 300 days ago, potentially indicating a lack of active maintenance or updates to keep pace with security standards.
- Supports both introspection and local schema file loading
- Configurable support for GraphQL mutation operations
- Limited surface area with only five direct dependencies
- High risk score due to lack of editorial review
- Repository has not been updated for 322 days
- Authentication methods remain unreviewed
Setup
{
"mcpServers": {
"mcp-graphql": {
"args": [
"-y",
"mcp-graphql"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| introspect-schema | This tool retrieves the GraphQL schema. | low |
| query-graphql | Execute GraphQL queries against the endpoint. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›How do I configure the GraphQL endpoint?
You must set the ENDPOINT environment variable to your GraphQL API URL. The default value is http://localhost:4000/graphql.
›Are mutations enabled by default?
No, mutations are disabled by default as a security measure. You must set the ALLOW_MUTATIONS environment variable to true to enable them.
›Can I provide custom headers for API requests?
Yes, you can include custom headers by setting the HEADERS environment variable as a JSON string containing the required keys and values.
›Is it possible to use a local schema file instead of introspection?
Yes, you can provide a local file path or a URL to the SCHEMA environment variable to use a specific schema definition.
›What tools are available for interacting with the API?
The server provides the introspect-schema tool to retrieve the schema and the query-graphql tool to execute queries against the endpoint.
Alternatives
Changelog
Badge
Maintain this server? Add the live badge to your README.