GraphOS MCP Server
by apollographql · remote · no sign-in to list tools · v1.17.0 · published by GitHub user apollographql
Search Apollo docs, specs, and best practices
32 tools: 7 can delete or cancel things, 3 change things and 22 only read.
Scanned Oct 21, 2026
- Deletes or cancels7Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads22Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http graphos https://mcp.apollographql.comTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
32 tools
Deletes or cancels 7Claude Code: deny
DeleteGraphDelete a graph, the same write that `rover graph delete` performs.Reads text others writeNo findings
Why it is in this group
- The name "DeleteGraph" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Delete a graph, the same write that `rover graph delete` performs. This is a soft delete: the data is not removed permanently and Apollo support can restore the graph. Every variant of the graph stops serving, so confirm the graph ID with the user before you call this. Returns null on success. Provide the graph ID.
Annotations the server declares
- title: Delete a graph
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
DeleteSubgraphRemove a subgraph from a variant and start composition, the same write that `rover subgraph delete` performs.Reads text others writeNo findings
Why it is in this group
- The name "DeleteSubgraph" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Remove a subgraph from a variant and start composition, the same write that `rover subgraph delete` performs. Returns the composition errors that the removal causes. This deletes the subgraph from the variant and can break the running router. Set dryRun to true first: the response then reports the composition result that the removal would produce, including updatedGateway, and deletes nothing. Provide the graph ID, the variant name, and the subgraph name.
Annotations the server declares
- title: Delete a subgraph
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
PublishContractCreate or update a contract variant and start a launch for it, the same write that `rover contract publish` performs.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "PublishContract" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "PublishContract" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Create or update a contract variant and start a launch for it, the same write that `rover contract publish` performs. A contract variant is a filtered view of another variant's schema, built by including and excluding schema elements by tag. The filter configuration replaces the previous one in full, so send the complete include and exclude lists rather than only the tags you want to change. The same applies to hideUnreachableTypes, which has no default: when you update a contract, pass the value it has now. GetContractConfig states that value in its description. Returns the contract variant and a link to the launch, or the error messages that stopped it. Provide the graph ID, the contract variant name, the source variant, the include and exclude tag lists, and whether to hide unreachable types.
Annotations the server declares
- title: Publish a contract
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
PublishGraphSchemaPublish a schema to a graph variant, the same write that `rover graph publish` performs.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "PublishGraphSchema" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "PublishGraphSchema" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Publish a schema to a graph variant, the same write that `rover graph publish` performs. Use this for a monograph; use PublishSubgraph for one subgraph of a federated graph. Returns a result code, whether the publish succeeded, a human-readable message, and the hash of the published schema. This changes the schema registry and can change what clients see. Run RunSchemaCheck first to see the effect on client operations. Provide the graph ID, the variant name, and the schema as SDL. Optionally provide the git branch and commit to label the publication.
Annotations the server declares
- title: Publish a graph schema
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
PublishPersistedQueriesPublish operations to a persisted query list, the same write that `rover persisted-queries publish` performs.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "PublishPersistedQueries" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "PublishPersistedQueries" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Publish operations to a persisted query list, the same write that `rover persisted-queries publish` performs. A persisted query list is the set of operations a router accepts when it is configured to reject anything else. Operations you do not mention stay in the list unchanged: pass operations to add or replace entries, and remove to drop them. Returns the new revision and the total operation count, or reports that nothing changed. Use GetPersistedQueryListStatus to find the list ID and its current revision. Provide the graph ID and the persisted query list ID.
Annotations the server declares
- title: Publish persisted queries
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
PublishReadmeReplace the README of a graph variant, the same write that `rover readme publish` performs.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "PublishReadme" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "PublishReadme" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Replace the README of a graph variant, the same write that `rover readme publish` performs. The README is the Markdown document shown on the variant's page in GraphOS Studio. The new text replaces the whole README, so read the current one with GetReadme first if you intend to keep any of it. Provide the graph ID, the variant name, and the full README text.
Annotations the server declares
- title: Publish a variant README
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
PublishSubgraphPublish a subgraph schema to a variant and start composition, the same write that `rover subgraph publish` performs.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "PublishSubgraph" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "PublishSubgraph" says "publish": it sends or publishes something to other people.
Description, as the server wrote it Publish a subgraph schema to a variant and start composition, the same write that `rover subgraph publish` performs. Returns whether the subgraph was created or updated, any composition errors, and the launch that started. This changes the schema registry and can change what the router serves. Run RunSubgraphCheck first to see the effect on client operations. Provide the graph ID, the variant name, the subgraph name, and the schema as SDL. Provide the routing URL when you add a subgraph or move its endpoint. Optionally provide a revision label and the git branch and commit.
Annotations the server declares
- title: Publish a subgraph schema
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
Changes things 3Claude Code: ask
LintSchemaLint a GraphQL schema document against the graph's lint rules and return each diagnostic's coordinate, severity level, message, rule, and source location, plus the error, warning, …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Lint a GraphQL schema document against the graph's lint rules and return each diagnostic's coordinate, severity level, message, rule, and source location, plus the error, warning, total, and ignored counts. This is the same check that `rover graph lint` and `rover subgraph lint` run. Nothing is published and no state changes. Provide the graph ID and the schema as SDL. Optionally provide baseSdl to report only the diagnostics that the new schema introduces against that base.
Annotations the server declares
- title: Lint a schema
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
RunSchemaCheckStart a schema check of a proposed schema against a variant, the same check that `rover graph check` starts.Reads text others writeNo findings
Why it is in this group
- The name "RunSchemaCheck" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start a schema check of a proposed schema against a variant, the same check that `rover graph check` starts. Use this for a monograph or for a whole supergraph schema; use RunSubgraphCheck for one subgraph. The check runs in the background, so this returns a workflow ID and a Studio URL, not a result. Pass the returned workflowID to GetCheckResults to read the outcome. Provide the graph ID, the variant name, and the proposed schema as SDL. Optionally provide the git branch and commit to label the run in Studio.
Annotations the server declares
- title: Run a schema check
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
RunSubgraphCheckStart a schema check of one proposed subgraph schema against a variant, the same check that `rover subgraph check` starts.Reads text others writeNo findings
Why it is in this group
- The name "RunSubgraphCheck" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start a schema check of one proposed subgraph schema against a variant, the same check that `rover subgraph check` starts. The check runs in the background, so this returns a workflow ID and a Studio URL, not a result. Pass the returned workflowID to GetCheckResults to read the outcome. Provide the graph ID, the variant name, the subgraph name, and the proposed subgraph schema as SDL. Optionally provide the git branch and commit to label the run in Studio.
Annotations the server declares
- title: Run a subgraph schema check
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
Only reads 22Claude Code: allow
ApolloConnectorsSpecReturns the Apollo Connectors specification for guidance on creating or modifying GraphQL schemas that use @connect or @source.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns the Apollo Connectors specification for guidance on creating or modifying GraphQL schemas that use @connect or @source.
Annotations the server declares
- title: Read the Apollo Connectors specification
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
ApolloDocsReadReads an Apollo documentation page by slug in chunks.Reads private dataNo findings
Why it is in this group
- The name "ApolloDocsRead" says "read": a word for reading.
What it can reach
- private-dataThe name "ApolloDocsRead" says "read" and "doc": it reads documents.
Description, as the server wrote it Reads an Apollo documentation page by slug in chunks. Use slugs returned by ApolloDocsSearch.
Annotations the server declares
- title: Read Apollo documentation
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
ApolloDocsSearchSearches official Apollo documentation for GraphQL, GraphOS, Apollo Router, Apollo Client, MCP Server, schema design, deployment, and Connectors.Reads private dataNo findings
Why it is in this group
- The name "ApolloDocsSearch" says "search": a word for reading.
What it can reach
- private-dataThe name "ApolloDocsSearch" says "search" and "doc": it reads documents.
Description, as the server wrote it Searches official Apollo documentation for GraphQL, GraphOS, Apollo Router, Apollo Client, MCP Server, schema design, deployment, and Connectors. Returns URLs, slugs, and excerpts.
Annotations the server declares
- title: Search Apollo documentation
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
GetCheckResultsRead the outcome of one schema check run: the overall status, and for each task in the run the composition errors, lint diagnostics, schema changes with the client operations they …Reads text others writeNo findings
Why it is in this group
- The name "GetCheckResults" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read the outcome of one schema check run: the overall status, and for each task in the run the composition errors, lint diagnostics, schema changes with the client operations they affect, downstream variant results, and custom check violations. Use this after GetSchemaChecks gives you a check ID. Provide the graph ID and the check ID. The affected operations are paged with affectedOperationsLimit and affectedOperationsOffset; the change list is capped by the server, and areChangesTruncated reports when that happened.
Annotations the server declares
- title: Get schema check results
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetClientMetricsTraffic broken down by client for a graph over a time window, as compact CSV.Reads text others writeNo findings
Why it is in this group
- The name "GetClientMetrics" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Traffic broken down by client for a graph over a time window, as compact CSV. Columns: start timestamp, end exclusive timestamp, client name, client version, operation name, request count, request latency p50 ms, request latency p99 ms, request with error count. Answers which clients call a graph, which client versions are still on the wire, and which client drives errors or latency. Clients that do not report `apollographql-client-name`/`-version` come back with empty name and version columns. Ranked by `orderBy` descending: default REQUEST_COUNT (busiest); REQUEST_WITH_ERROR_COUNT for most error-prone, REQUEST_LATENCY_P99_MS for slowest. `variantName` and `operationName` scope to one or more variants or operations by exact name (omit for all). Rows are one per client + version + operation, so a busy graph has far more groups than the other metrics tools: scope by `operationName` or raise `limit` when a breakdown looks truncated. Keep the default `resolution` of ENTIRE_RANGE for totals and top-N, which gives one row per group ranked over the whole window. DAY/HOUR/MINUTE give one row per group per bucket ranked within each bucket, so a window total then needs a per-group sum plus a `limit` big enough to cover every bucket; too small a `limit` silently undercounts. Only HOUR and MINUTE accept a `to` of now, so use them for bursts in the last 24 hours. Avoid MONTH: it labels buckets by calendar month, not by the requested window.
Annotations the server declares
- title: Get client metrics
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetContractConfigRead the filter configuration of a contract variant: the tags it includes, the tags it excludes, the source variant it is built from, and a human-readable description of the config…Reads text others writeNo findings
Why it is in this group
- The name "GetContractConfig" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read the filter configuration of a contract variant: the tags it includes, the tags it excludes, the source variant it is built from, and a human-readable description of the configuration. This is the same read that `rover contract describe` performs. A contract variant is a filtered view of another variant's schema, built by including and excluding schema elements by tag. The filter configuration does not include whether unreachable types are hidden. The description states it, so read it there before you update a contract with PublishContract. A variant that is not a contract returns null for the filter configuration. Provide the graph ID and the contract variant name.
Annotations the server declares
- title: Get a contract configuration
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetGraphSchemaRead the schema (SDL) that is currently published to a graph variant, with its hash and publication time.Reads text others writeNo findings
Why it is in this group
- The name "GetGraphSchema" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read the schema (SDL) that is currently published to a graph variant, with its hash and publication time. This is the same read that `rover graph fetch` performs. The response holds the whole document and is not truncated. A large federated graph measured over 800,000 characters, roughly 200,000 tokens, which exceeds the context window of most models. Prefer GetSubgraphSchema, which reads one subgraph at a time, and use this tool only when you need the whole API schema. Provide the graph ID and the variant name.
Annotations the server declares
- title: Get a graph schema
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetLatestLaunchInspect the most recent launch for a graph variant: status, completion time, subgraph changes, composition errors, and a schema diff summary vs the previous launch (additions/remov…Reads text others writeNo findings
Why it is in this group
- The name "GetLatestLaunch" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Inspect the most recent launch for a graph variant: status, completion time, subgraph changes, composition errors, and a schema diff summary vs the previous launch (additions/removals/edits/deprecations plus affected operations). Use to assess schema composition health and the impact of recent schema changes. Also returns the latest approved launch for comparison. Provide the graph ID and variant name.
Annotations the server declares
- title: Get latest launch
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetLaunchInspect a single launch by ID for full detail: status, timestamps, which subgraphs changed, composition errors, and the schema diff summary.Reads text others writeNo findings
Why it is in this group
- The name "GetLaunch" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Inspect a single launch by ID for full detail: status, timestamps, which subgraphs changed, composition errors, and the schema diff summary. Use to drill into a specific launch — e.g. a failed or superseded one found via GetLaunchHistory (pass its id here). Provide the graph ID, variant name, and launch ID.
Annotations the server declares
- title: Get a specific launch
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetLaunchHistoryRetrieve recent launches for a graph variant (most recent first) to detect deployment instability such as repeated failures or frequent superseded launches.Reads text others writeNo findings
Why it is in this group
- The name "GetLaunchHistory" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Retrieve recent launches for a graph variant (most recent first) to detect deployment instability such as repeated failures or frequent superseded launches. Each entry includes the launch id, status, and timestamps, so you can identify a specific launch and drill into it with GetLaunch. Use to assess deployment stability. Provide the graph ID, variant name, and optionally a limit (default 20 most recent launches, max 100 per page) and an offset to page further back.
Annotations the server declares
- title: Get launch history
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetLintResultsRetrieve schema lint violations from a graph's most recent schema checks: each diagnostic's coordinate, severity level, message, rule, and source location, plus error/warning/total…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "GetLintResults" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "retrieve" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "retrieve" and "message": it reads messages, which other people can write.
Description, as the server wrote it Retrieve schema lint violations from a graph's most recent schema checks: each diagnostic's coordinate, severity level, message, rule, and source location, plus error/warning/total/ignored counts. Use to assess schema quality and naming/best-practice violations. Provide the graph ID and optionally a limit (default 5 most recent schema checks).
Annotations the server declares
- title: Get schema lint results
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetMyIdentityResolve the caller's identity from their API key or OAuth token.Reads text others writeNo findings
Why it is in this group
- The name "GetMyIdentity" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Resolve the caller's identity from their API key or OAuth token. Call this FIRST when the user asks about "my graph" but has not provided a graph ID. For a graph/service key, `me` resolves to a Graph: use `id` as the graphId and `variants[].name` as the variant for the graph-scoped health-check tools, so the user does not have to supply either. For a user (personal key or OAuth), `me` resolves to a User instead: there's no single graph, so each org membership's `graphs[].id` / `graphs[].variants[].name` lists the graphId/variant options the graph-scoped tools need, across every org the user belongs to. Also handles service-account keys.
Annotations the server declares
- title: Get my GraphOS identity
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetOperationMetricsTop operations by usage/health for a graph over a time window, as compact CSV.Reads text others writeNo findings
Why it is in this group
- The name "GetOperationMetrics" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Top operations by usage/health for a graph over a time window, as compact CSV. Columns: start timestamp, end exclusive timestamp, operation name, request count, request latency p50 ms, request latency p99 ms, request with error count. Ranked by `orderBy` descending: default REQUEST_COUNT (busiest); REQUEST_WITH_ERROR_COUNT for most error-prone, REQUEST_LATENCY_P99_MS for slowest. `variantName` scopes to one or more variants (omit for all). `clients` scopes to one or more clients; omit `clientVersion` to match every version of that client, and use GetClientMetrics to discover the names a graph sees. Keep the default `resolution` of ENTIRE_RANGE for totals and top-N, which gives one row per operation ranked over the whole window. DAY/HOUR/MINUTE give one row per operation per bucket ranked within each bucket, so a window total then needs a per-operation sum plus a `limit` big enough to cover every bucket; too small a `limit` silently undercounts. Only HOUR and MINUTE accept a `to` of now, so use them for bursts in the last 24 hours. Avoid MONTH: it labels buckets by calendar month, not by the requested window.
Annotations the server declares
- title: Get operation metrics
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetPersistedQueryListStatusCheck whether a graph variant has a Persisted Query List (PQL), and return its ID, its name, and its current build (revision and operation count).Reads text others writeNo findings
Why it is in this group
- The name "GetPersistedQueryListStatus" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check whether a graph variant has a Persisted Query List (PQL), and return its ID, its name, and its current build (revision and operation count). Pass the ID to PublishPersistedQueries. Use to assess PQL configuration — a production variant with no PQL is a security gap. Provide the graph ID and variant name.
Annotations the server declares
- title: Get persisted query list status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetReadmeRead the README of a graph variant, with the time it was last updated and who updated it.Reads text others writeNo findings
Why it is in this group
- The name "GetReadme" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read the README of a graph variant, with the time it was last updated and who updated it. This is the same read that `rover readme fetch` performs. The README is the Markdown document shown on the variant's page in GraphOS Studio. Provide the graph ID and the variant name.
Annotations the server declares
- title: Get a variant README
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetSchemaChecksList past schema checks for a graph: each check's ID, status, timestamps, the subgraph it checked, the variant it ran against, the commit, and the status of each task in the check,…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "GetSchemaChecks" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "commit": it reads repositories.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List past schema checks for a graph: each check's ID, status, timestamps, the subgraph it checked, the variant it ran against, the commit, and the status of each task in the check, plus the total count for the filter. Use this to find a check, then pass its ID to GetCheckResults for failure details. Provide the graph ID. Optionally filter by status (PASSED, FAILED, PENDING), subgraph names, branches, variants, authors, or check IDs, and page with limit and offset.
Annotations the server declares
- title: List schema checks
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetSubgraphMetricsTop subgraphs/connectors by traffic/health for a graph over a time window, as compact CSV.Reads text others writeNo findings
Why it is in this group
- The name "GetSubgraphMetrics" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Top subgraphs/connectors by traffic/health for a graph over a time window, as compact CSV. Columns: start timestamp, end exclusive timestamp, fetch service name, fetch count, fetch latency p50 ms, fetch latency p99 ms, fetch with errors count. Ranked by `orderBy` descending: default FETCH_COUNT (busiest); FETCH_WITH_ERRORS_COUNT for most error-prone, FETCH_LATENCY_P99_MS for slowest. `variantName` scopes to one or more variants (omit for all). `subgraphName` scopes to one or more subgraphs by exact name (omit for all); pattern/substring matching is not supported. `clients` scopes to the fetches driven by one or more clients; omit `clientVersion` to match every version of that client, and use GetClientMetrics to discover the names a graph sees. Keep the default `resolution` of ENTIRE_RANGE for totals and top-N, which gives one row per subgraph ranked over the whole window. DAY/HOUR/MINUTE give one row per subgraph per bucket ranked within each bucket, so a window total then needs a per-subgraph sum plus a `limit` big enough to cover every bucket; too small a `limit` silently undercounts. Only HOUR and MINUTE accept a `to` of now, so use them for bursts in the last 24 hours. Avoid MONTH: it labels buckets by calendar month, not by the requested window.
Annotations the server declares
- title: Get subgraph metrics
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetSubgraphSchemaRead one subgraph's published schema (SDL) from a variant, with its routing URL, revision, and last update time.Reads text others writeNo findings
Why it is in this group
- The name "GetSubgraphSchema" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "read" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it Read one subgraph's published schema (SDL) from a variant, with its routing URL, revision, and last update time. This is the same read that `rover subgraph fetch` performs. Read one subgraph at a time: a whole supergraph document is much larger and can pass the token limit of the model. Provide the graph ID, the variant name, and the subgraph name. Use GetVariantDetails first if you do not know the subgraph names.
Annotations the server declares
- title: Get a subgraph schema
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetSupergraphSchemaRead the composed supergraph schema (SDL) for a graph variant, with the composition ID and any composition errors.Reads text others writeNo findings
Why it is in this group
- The name "GetSupergraphSchema" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read the composed supergraph schema (SDL) for a graph variant, with the composition ID and any composition errors. This is the same read that `rover supergraph fetch` performs. A supergraph schema is the single schema that composition builds from every subgraph, and it carries federation directives that the API schema does not. The response holds the whole document and is not truncated, and a supergraph schema is larger than the API schema it produces. Expect the same order of size: a large federated graph exceeds 800,000 characters, roughly 200,000 tokens. A variant that is not federated has no composition result, and the tool returns null for it rather than an empty document. Provide the graph ID and the variant name.
Annotations the server declares
- title: Get a supergraph schema
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetTopOperationsIdentify the most-used operations on a graph variant for a time range, with request counts, types, and signatures.Reads text others writeNo findings
Why it is in this group
- The name "GetTopOperations" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Identify the most-used operations on a graph variant for a time range, with request counts, types, and signatures. Use to find high-traffic operations, detect unused operations, and prioritize findings by traffic impact. Provide graph ID, variant, and a from/to time range (ISO 8601 timestamps; `to` must be at least 6 hours before now), plus an optional limit (default 50). This report is rate limited.
Annotations the server declares
- title: Get top operations
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
GetVariantDetailsRetrieve metadata for a graph variant: its identifier, federation version, the URL of its GraphQL endpoint, and its subgraph inventory (names only).Reads text others writeNo findings
Why it is in this group
- The name "GetVariantDetails" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "retrieve" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it Retrieve metadata for a graph variant: its identifier, federation version, the URL of its GraphQL endpoint, and its subgraph inventory (names only). Use this to assess a variant's composition setup, such as subgraph inventory and federation version compliance. Provide the graph ID and variant name (e.g., "production").
Annotations the server declares
- title: Get graph variant details
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
ValidateOperationsValidate client GraphQL operations against a variant's published schema and return each problem's type (FAILURE, WARNING, INVALID), code, description, and the name of the operation…Reads text others writeNo findings
Why it is in this group
- The name "ValidateOperations" says "validate": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Validate client GraphQL operations against a variant's published schema and return each problem's type (FAILURE, WARNING, INVALID), code, description, and the name of the operation it came from. This is the same check that `rover client check` runs. Nothing is published and no state changes. Provide the graph ID and the operations, each one a body and an optional name. Optionally name the variant to validate against; the default is "current".
Annotations the server declares
- title: Validate client operations
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
580 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 4 private-data tools breaks every one.
- Reads private data4
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write29
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out5
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__graphos__ApolloDocsRead",
"mcp__graphos__ApolloDocsSearch",
"mcp__graphos__GetLintResults",
"mcp__graphos__GetSchemaChecks"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:56 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 10
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://mcp.apollographql.com/.well-known/oauth-protected-resource
- Authorization servers
- https://auth.apollographql.com/oauth2
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- no
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 10 tools that change things (7 destructive, 3 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.apollographql.com: tools/list returned 32 tools to an anonymous client, including DeleteSubgraph (destructive), PublishContract (destructive), PublishReadme (destructive), PublishGraphSchema (destructive), PublishSubgraph (destructive) and 5 more
Install
Pinned to version 1.17.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http graphos https://mcp.apollographql.comRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__graphos__GetSchemaChecks",
"mcp__graphos__GetPersistedQueryListStatus",
"mcp__graphos__GetSupergraphSchema",
"mcp__graphos__ApolloDocsRead",
"mcp__graphos__GetCheckResults",
"mcp__graphos__ApolloDocsSearch",
"mcp__graphos__ValidateOperations",
"mcp__graphos__GetLatestLaunch",
"mcp__graphos__GetLaunch",
"mcp__graphos__ApolloConnectorsSpec",
"mcp__graphos__GetLintResults",
"mcp__graphos__GetContractConfig",
"mcp__graphos__GetClientMetrics",
"mcp__graphos__GetSubgraphSchema",
"mcp__graphos__GetSubgraphMetrics",
"mcp__graphos__GetVariantDetails",
"mcp__graphos__GetOperationMetrics",
"mcp__graphos__GetReadme",
"mcp__graphos__GetLaunchHistory",
"mcp__graphos__GetMyIdentity",
"mcp__graphos__GetGraphSchema",
"mcp__graphos__GetTopOperations"
],
"ask": [
"mcp__graphos__LintSchema",
"mcp__graphos__RunSchemaCheck",
"mcp__graphos__RunSubgraphCheck"
],
"deny": [
"mcp__graphos__DeleteSubgraph",
"mcp__graphos__PublishContract",
"mcp__graphos__PublishReadme",
"mcp__graphos__PublishGraphSchema",
"mcp__graphos__PublishSubgraph",
"mcp__graphos__DeleteGraph",
"mcp__graphos__PublishPersistedQueries"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as graphos. Review it before you use it.
Capability tags behind 31 rules
- mcp__graphos__DeleteSubgraph untrusted-input
- mcp__graphos__GetSchemaChecks private-data, untrusted-input
- mcp__graphos__GetPersistedQueryListStatus untrusted-input
- mcp__graphos__GetSupergraphSchema untrusted-input
- mcp__graphos__ApolloDocsRead private-data
- mcp__graphos__GetCheckResults untrusted-input
- mcp__graphos__ApolloDocsSearch private-data
- mcp__graphos__ValidateOperations untrusted-input
- mcp__graphos__PublishContract untrusted-input, outbound
- mcp__graphos__PublishReadme untrusted-input, outbound
- mcp__graphos__GetLatestLaunch untrusted-input
- mcp__graphos__GetLaunch untrusted-input
- mcp__graphos__LintSchema untrusted-input
- mcp__graphos__GetLintResults private-data, untrusted-input
- mcp__graphos__GetContractConfig untrusted-input
- mcp__graphos__GetClientMetrics untrusted-input
- mcp__graphos__RunSchemaCheck untrusted-input
- mcp__graphos__PublishGraphSchema untrusted-input, outbound
- mcp__graphos__PublishSubgraph untrusted-input, outbound
- mcp__graphos__DeleteGraph untrusted-input
- mcp__graphos__GetSubgraphSchema untrusted-input
- mcp__graphos__GetSubgraphMetrics untrusted-input
- mcp__graphos__GetVariantDetails untrusted-input
- mcp__graphos__GetOperationMetrics untrusted-input
- mcp__graphos__RunSubgraphCheck untrusted-input
- mcp__graphos__GetReadme untrusted-input
- mcp__graphos__GetLaunchHistory untrusted-input
- mcp__graphos__GetMyIdentity untrusted-input
- mcp__graphos__GetGraphSchema untrusted-input
- mcp__graphos__PublishPersistedQueries untrusted-input, outbound
- mcp__graphos__GetTopOperations untrusted-input
