Skip to content

GuestGraph

by guestgraph.io · remote · no sign-in to list tools · v0.1.0 · published by io.guestgraph

GuestGraph: One guest, not five strangers

Changes · 1

14 tools: 1 change things and 13 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http mental-model https://mcp.guestgraph.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Changes things 1Claude Code: ask
  • diagramA picture of the model as Mermaid; edge data: list_references.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A picture of the model as Mermaid; edge data: list_references. Input: `shape`; `id`, `domain`, `type` or `unit` narrow it. aggregate, flow, lifecycle take a context's `id`; organization without `id` draws the company; system a landscape, holds its data; usecase, scenario a use case's; requirements a feature's, product's, use case's or requirement's. Returns `mermaid`, `nodes`, `links`, `units`, counts. Max 50 nodes.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
Only reads 13Claude Code: allow
  • describe_errorsWhat a refused call looks like.No findings

    Why it is in this group

    • The name "describe_errors" says "describe": a word for reading.
    Description, as the server wrote it
    What a refused call looks like. A tool's output schema covers its answers only, so use this once, to branch on refusals or validate them. No input. Returns `errors`, every `code` with `when` it is raised and the JSON Schema of its `details`, and `schema`, the JSON Schema of a whole refusal: `error` with `code`, `message`, `rule`, `details`, beside `model`.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • describe_relationsWhat the schemas declare between types: references with form and cardinality, ownership, enums, joins, list kinds.No findings

    Why it is in this group

    • The name "describe_relations" says "describe": a word for reading.
    Description, as the server wrote it
    What the schemas declare between types: references with form and cardinality, ownership, enums, joins, list kinds. Use for a diagram or audit; for one type's full schema use describe_schema. Optional `type` narrows every list, `direction` (declares, declared-to, both; needs `type`) one side of relations, `via` relations and enums. Returns those lists, with `forms` and `reading` explaining every term. Not paged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • describe_ruleOne convention of the vocabulary as written, not a company's own rule (an entity of type `rule`: list_entities, get_entity).No findings

    Why it is in this group

    • The name "describe_rule" says "describe": a word for reading.
    Description, as the server wrote it
    One convention of the vocabulary as written, not a company's own rule (an entity of type `rule`: list_entities, get_entity). Input: `rule`, a number from list_rules such as R9, in either case. Returns `rule`, `title`, `part`, `text` and the file's `url`. An unknown number is refused with the known ones listed.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • describe_schemaOne type's schema: its sections as written and its declared relations as data.No findings

    Why it is in this group

    • The name "describe_schema" says "describe": a word for reading.
    Description, as the server wrote it
    One type's schema: its sections as written and its declared relations as data. Use to learn what an entity of the type may hold; for the whole vocabulary use describe_relations. Input: `type`. Returns `url`, the schema's own file, `sections`, and `relations`: owner, owns, references both ways, enums, joins and lists.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • fetchOne entity's page as written.No findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.
    Description, as the server wrote it
    One entity's page as written. Use to quote or display the source; for structured fields and references use get_entity. Input: `id` or address, from search, list_entities or any reference. Returns `id`, `title`, `type`, `url` and `text`, the Markdown source. Takes no name: search with match "name" finds the id.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • find_evidenceEvery edge into one skill, grouped by the type of the page that drew it.No findings

    Why it is in this group

    • The name "find_evidence" says "find": a word for reading.
    Description, as the server wrote it
    Every edge into one skill, grouped by the type of the page that drew it. Use to check a claimed skill against its evidence. Input: `skill`, an id, canonical name or address; optional `limit`, `cursor`. Returns `skill`, `evidence` and `page`; a profile's claim arrives via Skills.Skill with its level, an evidence row via Evidence.Skill. Attributes are verbatim.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • get_entityOne entity as structured data: fields, sections, tables, references both ways.Reads private dataNo findings

    Why it is in this group

    • The name "get_entity" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    One entity as structured data: fields, sections, tables, references both ways. Use to reason over one; for its page as written use fetch. Input: `id` or address, where its page sits, or `type` and `name`; an ambiguous name is refused with candidate ids. Returns `entity`, by id. Reference lists hold at most 50 edges; `referenceCounts` gives totals, list_references the rest.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_checksThe checks the model's own gate runs, from the checker release this server was built with.No findings

    Why it is in this group

    • The name "list_checks" says "list": a word for reading.
    Description, as the server wrote it
    The checks the model's own gate runs, from the checker release this server was built with. Use to see which rules a script enforces and which are left to a reader. No input. Returns `checks`, each with `name`, `rule`, `title` and what it `reports`, a `failure` or a `note` that fails nothing, and `ranBy`. This server runs none of them.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_entitiesEntities with their frontmatter's short facts, in address order or newest first.No findings

    Why it is in this group

    • The name "list_entities" says "list": a word for reading.
    Description, as the server wrote it
    Entities with their frontmatter's short facts, in address order or newest first. Use to browse, or for what runs on a date, came last or has a value; to find by words use search. Input: optional `type`, `owner`, `order`, `on`, `by`, `where`, `fields`, `limit`, `cursor`. Returns `entities` with `fields`, and `page`; follow `page.nextCursor` while `page.hasMore`.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_referencesThe model's edges, filtered and paged.No findings

    Why it is in this group

    • The name "list_references" says "list": a word for reading.
    Description, as the server wrote it
    The model's edges, filtered and paged. Use to inspect one entity's relations or one kind of reference without taking whole entities. Optional `entity` (an id or address), `direction` (out, in, both; needs `entity`), `via`, `type` (the far end's type, or either end's without `entity`), `limit`, `cursor`. Returns `edges`, each `from`, `via`, `to`, `attrs`, and `page`.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_rulesThe vocabulary's conventions the model is held to, R0 onwards, from its core's CONVENTIONS.md.No findings

    Why it is in this group

    • The name "list_rules" says "list": a word for reading.
    Description, as the server wrote it
    The vocabulary's conventions the model is held to, R0 onwards, from its core's CONVENTIONS.md. Use to resolve a number a schema or refusal cites, such as R9. A company's own rules are entities of type `rule`: list_entities and get_entity. No input. Returns `tagline`, the file's `url`, and `rules`, each with `rule`, `title` and `part`; describe_rule gives one rule's text.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_typesEvery type the model's schemas declare.No findings

    Why it is in this group

    • The name "list_types" says "list": a word for reading.
    Description, as the server wrote it
    Every type the model's schemas declare. Use first, to learn which types exist before listing or describing one. No input. Returns `types`, each with `type`, `name`, `tagline`, `owner` (the type it nests under, or null) and `count`, the entities it holds.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:08 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
1
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 1 tool that changes things (1 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.guestgraph.io/mcp: tools/list returned 14 tools to an anonymous client, including diagram (write)

    What this check looks for

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mental-model https://mcp.guestgraph.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mental-model__list_types",
      "mcp__mental-model__describe_schema",
      "mcp__mental-model__describe_relations",
      "mcp__mental-model__list_rules",
      "mcp__mental-model__describe_rule",
      "mcp__mental-model__list_checks",
      "mcp__mental-model__describe_errors",
      "mcp__mental-model__list_entities",
      "mcp__mental-model__get_entity",
      "mcp__mental-model__list_references",
      "mcp__mental-model__find_evidence",
      "mcp__mental-model__search",
      "mcp__mental-model__fetch"
    ],
    "ask": [
      "mcp__mental-model__diagram"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mental-model. Review it before you use it.

Capability tags behind 1 rule
  • mcp__mental-model__get_entity private-data