GraphQL MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| GRAPHQL_ENDPOINT | No | GraphQL endpoint URL (can also be set at runtime via connect_endpoint tool) | |
| GRAPHQL_AUTH_TOKEN | No | Bearer token for Authorization header | |
| GRAPHQL_BASIC_PASS | No | Basic auth password | |
| GRAPHQL_BASIC_USER | No | Basic auth username | |
| GRAPHQL_TIMEOUT_MS | No | Request timeout in milliseconds | 30000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| connect_endpointA | Set or change the active GraphQL endpoint. All subsequent tool calls (introspect, query, mutate) target this endpoint. Replaces the previous client; existing schema cache for the old endpoint is kept but a new schema will be fetched for the new one. Use set_auth_token / set_headers immediately after to configure credentials. If the endpoint requires CORS for browser access, that is the caller's responsibility — the MCP server is a backend process. |
| set_auth_tokenA | Set a bearer token to send in the Authorization header on every request. Pass an empty string to clear. The token is held in process memory and never logged. For Basic auth or arbitrary headers, use set_basic_auth or set_headers / add_header instead. |
| set_basic_authA | Configure HTTP Basic authentication. Replaces any bearer token. Pass empty username + password to clear. |
| set_headersA | Replace the full set of custom HTTP headers. Use this for X-API-Key, X-Tenant, X-Trace-Id, etc. Authorization is handled separately by set_auth_token / set_basic_auth and will be re-applied on top of these headers. Pass an empty object to clear all custom headers. |
| add_headerA | Add or update a single custom HTTP header without replacing the others. Useful for one-off headers like X-Trace-Id. To remove, use remove_header. |
| remove_headerA | Remove a custom HTTP header. Does not affect Authorization (use set_auth_token with empty string). |
| get_connection_statusA | Show the current endpoint, configured headers (with secrets masked), auth state, and schema cache state. Set ping=true to also send a {__typename} query to verify the endpoint is reachable and measure latency. |
| introspect_schemaA | Fetch the full GraphQL schema via introspection and cache it. Required before any list_*, describe_*, or execute_typed_* call. Idempotent: returns the cached schema if available unless force=true. The schema can be large (>1MB for Shopify/GitHub) so consider clearing the cache or using search/describe tools on subsequent calls. |
| list_typesA | List all types in the introspected schema. Filter by kind (OBJECT, SCALAR, INTERFACE, UNION, ENUM, INPUT_OBJECT) or by name substring. Excludes introspection system types (those starting with __) by default. Use describe_type to get full details for a specific type. |
| describe_typeA | Get full details of a single type: all fields (with their args and return types), input fields, interfaces, enum values, and possible types. Use this to understand a type's shape before constructing a query. Pass the name of any type — including root types like 'Query' or 'Mutation', input types like 'CreateUserInput', or scalar types. |
| list_queriesA | List all root query fields (e.g. user, posts, search). Each entry shows the field's return type and its argument types. Use describe_field to get more detail on a specific query. Use search= to filter by name substring. |
| list_mutationsA | List all root mutation fields (e.g. createUser, updatePost). Each entry shows the return type and argument types. Returns an empty list if the schema has no mutation type. Use search= to filter by name. |
| list_subscriptionsA | List all root subscription fields (e.g. messageAdded, onUserUpdate). Note: this MCP server uses HTTP request/response, so subscriptions cannot be executed here — list is informational only. Use a websocket-based GraphQL client to consume subscriptions. Returns an empty list if the schema has no subscription type. |
| describe_fieldA | Get full details of a single field on any type: description, return type, arguments (each with name, type, description, default value), and deprecation info. Pass type_name='Query' or 'Mutation' to look up root operations, or pass any object type name to look up one of its fields. |
| search_schemaA | Search the entire schema for types, fields, input fields, and enum values matching a substring (case-insensitive). Useful for finding things by partial name when the schema is large. Returns up to 100 hits by default. |
| execute_queryA | Send a raw GraphQL query string to the endpoint. Use this when you already have a complete query — for example, one written by a human or copied from API docs. Returns the data field of the response, or a structured error message if the server returned errors. Variables are passed through as-is. Idempotent: same query → same result (for read-only queries). |
| execute_mutationA | Send a raw GraphQL mutation string to the endpoint. Functionally identical to execute_query — use whichever is more semantically clear. Not idempotent: mutations can have side effects. |
| execute_typed_queryA | Execute a query by field name. Looks up the field on the root Query type using the introspected schema, validates that the variables you pass match the field's argument types (by name), and constructs a query string automatically. If you don't provide a selection set, the server auto-builds one with __typename plus scalar fields. Requires the schema to be introspected first. |
| execute_typed_mutationA | Execute a mutation by field name. Looks up the field on the root Mutation type, validates arguments, and constructs the mutation. If selection is omitted, defaults to __typename. Not idempotent — mutations can have side effects. |
| get_cached_schemaA | Return the cached introspection result for the current endpoint as JSON. Use this when you need the full schema in one shot (e.g. to build a query offline). For large schemas this can be 1MB+ — use describe_type / list_queries / search_schema for targeted access. The max_depth parameter caps type traversal to keep output size bounded. |
| clear_cacheA | Clear the schema cache. If endpoint is given, clears only that endpoint's cache; otherwise clears all. Use this to free memory after switching endpoints, or to force a fresh introspection on the next call. |
| reload_schemaA | Force a fresh introspection, replacing any cached schema for the given endpoint (or the current one if not specified). Use this when you suspect the remote schema has changed. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 22 tools
Every tool has a clearly distinct purpose: connection management, authentication, schema introspection, typed execution, and raw execution. There is no overlap or ambiguity between any pair of tools.
Tool names consistently follow a verb_noun pattern with underscores (e.g., connect_endpoint, list_queries, execute_typed_mutation). Minor variations like 'reload_schema' vs 'introspect_schema' are still consistent in style.
At 22 tools, the set is on the higher side of reasonable for a comprehensive GraphQL client server. While each tool serves a justifiable purpose, the count exceeds the typical well-scoped range of 3-15, making it slightly heavy but not excessive.
The tool surface covers the full lifecycle: connection setup, authentication (token, basic, custom headers), schema introspection, exploration (list, describe, search), query/mutation execution (raw and typed), and cache management. Subscriptions are omitted with a valid explanation. No obvious gaps.