Skip to main content
Glama

executeGraphQLOperation

Execute GraphQL queries and mutations against target APIs. Use this tool to send operation requests after schema introspection.

Instructions

Executes an arbitrary GraphQL query or mutation against the target API. Use introspectGraphQLSchema first to understand the available operations.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queryYesThe GraphQL query string to execute.
variablesNoAn optional object containing variables for the query.
operationNameNoAn optional name for the operation, if the query contains multiple operations.

Implementation Reference

  • src/server.ts:52-57 (registration)
    Registration of the 'executeGraphQLOperation' tool in the ListTools response, including name, description, and input schema reference.
    {
      name: "executeGraphQLOperation",
      description:
        "Executes an arbitrary GraphQL query or mutation against the target API. Use introspectGraphQLSchema first to understand the available operations.",
      inputSchema: executeInputSchema,
    },
  • src/server.ts:87-92 (registration)
    Dispatch logic in CallTool handler that routes calls to 'executeGraphQLOperation' to the handleExecution function after validation.
    case "executeGraphQLOperation":
      // Validate arguments using the Zod schema
      const validatedArgs = ExecutorSchemaInput.parse(args);
      console.error(`Calling handler for ${name}`);
      result = await handleExecution(validatedArgs);
      break;
  • Zod schema definition for input validation of the 'executeGraphQLOperation' tool.
    export const ExecutorSchemaInput = z.object({
      query: z.string().describe("The GraphQL query string to execute."),
      variables: z
        .record(z.unknown())
        .optional()
        .describe("An optional object containing variables for the query."),
      operationName: z
        .string()
        .optional()
        .describe(
          "An optional name for the operation, if the query contains multiple operations."
        ),
    });
  • Main handler function for 'executeGraphQLOperation' tool that orchestrates input destructuring, GraphQL execution, error handling, and response formatting.
    export async function handleExecution(
      input: z.infer<typeof ExecutorSchemaInput>
    ): Promise<z.infer<typeof ExecutorSchemaOutput>> {
      const { query, variables, operationName } = input;
    
      try {
        console.error(`Executing GraphQL query: ${operationName || "unnamed"}...`);
    
        const response = await executeGraphQL<z.infer<typeof ExecutorSchemaOutput>>(
          query,
          variables,
          operationName
        );
    
        // GraphQL endpoints often return 200 OK even if there are query errors.
        // These are included in the 'errors' array in the response body.
        if (response.errors && response.errors.length > 0) {
          const errorMessages = response.errors.map((e) => e.message).join("; ");
          console.error(
            `GraphQL query ${
              operationName || "unnamed"
            } returned errors: ${errorMessages}`,
            response.errors
          );
          // We return the full response including data and errors as per the MCP flow
          // The client consuming the MCP tool will decide how to handle the errors field.
          // No McpError is thrown here unless the request itself failed (handled in executeGraphQL)
        }
    
        console.error(`GraphQL query ${operationName || "unnamed"} executed.`);
        return response; // Return the full response { data?: ..., errors?: ... }
      } catch (error) {
        // This catches errors thrown by executeGraphQL (network, HTTP errors, etc.)
        console.error(
          `Error executing GraphQL query ${operationName || "unnamed"}:`,
          error
        );
        if (error instanceof McpError) {
          // Re-throw McpErrors directly
          throw error;
        }
        // Wrap unexpected errors
        throw new McpError(
          ErrorCode.InternalError,
          `An unexpected error occurred while executing the GraphQL query '${
            operationName || "unnamed"
          }'.`,
          { cause: error as Error }
        );
      }
    }
  • Core helper function 'executeGraphQL' that performs the HTTP POST request to the GraphQL endpoint using axios, handles authentication, and manages various error conditions.
    export async function executeGraphQL<T = any>(
      query: string,
      variables?: Record<string, any>,
      operationName?: string
    ): Promise<GraphQLResponse<T>> {
      const { graphqlEndpoint, authToken } = config;
    
      if (!graphqlEndpoint) {
        // Use PascalCase for ErrorCode members
        throw new McpError(
          ErrorCode.InternalError,
          "GraphQL endpoint URL is not configured."
        );
      }
      // We check authToken existence in config.ts, assume it's present if needed or proceed if not.
    
      const headers: Record<string, string> = {
        "Content-Type": "application/json",
        Accept: "application/json",
      };
    
      if (authToken) {
        headers["Authorization"] = `Bearer ${authToken}`;
      }
    
      try {
        const response = await axios.post<GraphQLResponse<T>>(
          graphqlEndpoint,
          {
            query,
            variables,
            ...(operationName && { operationName }),
          },
          {
            headers,
            timeout: 30000, // 30 second timeout
          }
        );
    
        // Axios considers 2xx successful, return the body directly
        // The caller should check for response.data.errors
        return response.data;
      } catch (error: any) {
        // Use the imported isAxiosError type guard
        if (error.response) {
          // Now variable 'error' is narrowed to AxiosError type
          const statusCode = error.response?.status;
          const responseData = error.response?.data as any;
          const errorMessageBase = `GraphQL request failed: ${error.message}`;
          let detailedMessage = errorMessageBase;
          if (responseData?.errors?.[0]?.message) {
            detailedMessage = `${errorMessageBase} - ${responseData.errors[0].message}`;
          }
    
          if (statusCode === 401) {
            // Use PascalCase for ErrorCode members
            throw new McpError(
              ErrorCode.InvalidRequest,
              "Authentication failed. Check your AUTH_TOKEN.",
              { cause: error }
            );
          }
          if (statusCode === 403) {
            // Use PascalCase for ErrorCode members
            throw new McpError(
              ErrorCode.InvalidRequest,
              "Permission denied for GraphQL operation.",
              { cause: error }
            );
          }
          if (statusCode && statusCode >= 400 && statusCode < 500) {
            // Use PascalCase for ErrorCode members
            throw new McpError(ErrorCode.InvalidRequest, detailedMessage, {
              cause: error,
            });
          }
          // Includes 5xx errors and network errors (statusCode is undefined)
          // Use PascalCase for ErrorCode members
          throw new McpError(ErrorCode.InternalError, detailedMessage, {
            cause: error,
          });
        } else if (error instanceof Error) {
          console.error("Unexpected error during GraphQL request:", error);
          // Use PascalCase for ErrorCode members
          throw new McpError(
            ErrorCode.InternalError,
            `An unexpected error occurred: ${error.message}`,
            { cause: error }
          );
        } else {
          console.error(
            "Unexpected non-error thrown during GraphQL request:",
            error
          );
          throw new McpError(
            ErrorCode.InternalError,
            "An unexpected non-error value was thrown during the GraphQL request.",
            { cause: new Error(String(error)) }
          );
        }
      }
    }
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. While it mentions executing 'query or mutation,' it lacks critical details such as authentication requirements, rate limits, error handling, or whether it's read-only or destructive. This is a significant gap for a tool that can perform mutations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise and front-loaded, consisting of only two sentences. The first sentence states the core purpose, and the second provides essential usage guidance. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (executing arbitrary GraphQL operations with potential mutations) and lack of annotations and output schema, the description is incomplete. It covers purpose and usage guidelines well but fails to address behavioral aspects like safety, permissions, or response format, which are crucial for such a flexible tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the schema already documents all three parameters (query, variables, operationName) with clear descriptions. The description does not add any parameter-specific details beyond what the schema provides, which aligns with the baseline score of 3 when schema coverage is high.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Executes an arbitrary GraphQL query or mutation against the target API.' It specifies the verb ('executes') and resource ('GraphQL query or mutation'), and distinguishes it from the sibling tool 'introspectGraphQLSchema' by mentioning it as a prerequisite for understanding available operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: 'Use introspectGraphQLSchema first to understand the available operations.' This clearly indicates a prerequisite and distinguishes it from the sibling tool, offering a specific alternative for schema exploration.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jorgeraad/mcp4gql'

If you have feedback or need assistance with the MCP directory API, please join our Discord server