Loading ToolBench
MCP server for GraphQL — schema introspection, auto-generated tools, query/mutation execution for Claude, Cursor, and AI agents
Strong tool naming (verb_noun pattern throughout) and comprehensive descriptions (avg 180 chars, well within 10-1024 range). All 14 tools have clear, actionable descriptions explaining WHAT, WHEN, and consequences. Input schemas present with type definitions for all parameters. However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Error handling is minimal; tools lack recovery guidance. Security is well-handled (secrets via env vars, no token params), but composition could be tighter, some tools (set_auth_token, set_basic_auth, set_headers, add_header, remove_header) are granular when a unified auth config tool might reduce cognitive load.
Add or update a single custom HTTP header without replacing the others. Useful for one-off headers like X-Trace-Id. To remove, use remove_header.
Clear the schema cache. If endpoint is given, clears only that endpoint's cache; otherwise clears all. Use this to free memory after switching endpoints, or to force a fresh introspection on the next call.
Set or change the active GraphQL endpoint. All subsequent tool calls (introspect, query, mutate) target this endpoint. Replaces the previous client; existing schema cache for the old endpoint is kept but a new schema will be fetched for the new one. Use set_auth_token / set_headers immediately after to configure credentials. If the endpoint requires CORS for browser access, that is the caller's responsibility — the MCP server is a backend process.
Send a raw GraphQL mutation string to the endpoint. Functionally identical to execute_query — use whichever is more semantically clear. Not idempotent: mutations can have side effects.
Send a raw GraphQL query string to the endpoint. Use this when you already have a complete query — for example, one written by a human or copied from API docs. Returns the data field of the response, or a structured error message if the server returned errors. Variables are passed through as-is. Idempotent: same query → same result (for read-only queries).
Output schemas not documented. LLMs cannot predict response structure for tools like execute_query, execute_typed_query, get_cached_schema. This breaks tool chaining, agents cannot know what fields to extract for downstream calls.
Error handling lacks recovery guidance. Tools return raw GraphQL errors without actionable next steps. E.g., 'Field not found' should suggest 'Call get_cached_schema to inspect available fields' or 'Call reload_schema if the endpoint schema changed'.
Header management tools (set_headers, add_header, remove_header) are granular. Consider a unified 'configure_headers' tool or batch operations to reduce cognitive load and API surface. Current design requires 3 separate calls to manage headers.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Execute a mutation by field name. Looks up the field on the root Mutation type using the introspected schema, validates that the variables you pass match the field's argument types (by name), and constructs a mutation string automatically. If you don't provide a selection set, the server auto-builds one with __typename plus scalar fields. Requires the schema to be introspected first.
Execute a query by field name. Looks up the field on the root Query type using the introspected schema, validates that the variables you pass match the field's argument types (by name), and constructs a query string automatically. If you don't provide a selection set, the server auto-builds one with __typename plus scalar fields. Requires the schema to be introspected first.
Return the cached introspection result for the current endpoint as JSON. Use this when you need the full schema in one shot (e.g. to build a query offline). For large schemas this can be 1MB+ — use describe_type / list_queries / search_schema for targeted access. The max_depth parameter caps type traversal to keep output size bounded.
Show the current endpoint, configured headers (with secrets masked), auth state, and schema cache state. Set ping=true to also send a {__typename} query to verify the endpoint is reachable and measure latency.
Force a fresh introspection, replacing any cached schema for the given endpoint (or the current one if not specified). Use this when you suspect the remote schema has changed.
Remove a custom HTTP header. Does not affect Authorization (use set_auth_token with empty string).
Set a bearer token to send in the Authorization header on every request. Pass an empty string to clear. The token is held in process memory and never logged. For Basic auth or arbitrary headers, use set_basic_auth or set_headers / add_header instead.
Configure HTTP Basic authentication. Replaces any bearer token. Pass empty username + password to clear.
Replace the full set of custom HTTP headers. Use this for X-API-Key, X-Tenant, X-Trace-Id, etc. Authorization is handled separately by set_auth_token / set_basic_auth and will be re-applied on top of these headers. Pass an empty object to clear all custom headers.
execute_typed_query and execute_typed_mutation lack parameter constraints. 'field' is a free-form string, no enum of available fields. LLMs will hallucinate field names. Should validate against introspected schema and return 'Field not found. Available query fields: [list]'.
No pagination support on get_cached_schema. For large schemas (1MB+), returning the entire introspection result wastes tokens and risks context window exhaustion. Should support max_depth (present) but also offer field-level filtering or chunked retrieval.