graphjinBLOCK
One governed graph for AI agents — GraphQL + MCP over your databases, files, APIs, and code
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/dosco/graphjin/blob/master/LICENSE) [](https://www.npmjs.com/package/graphjin) [](https://hub.docker.com/r/dosco/graphjin/tags) [](https://discord.gg/6pSWCTZ) [](https://pkg.go.dev/github.com/dosco/graphjin/core/v3) [](https://goreportcard.com/report/github.com/dosco/graphjin/core/v3)
GraphJin is a compiler and runtime that gives AI agents one governed graph over the systems a real company already has: databases, warehouses, files, source code, workflows, metadata, and security policy. Instead of handing an agent raw credentials and hoping it guesses correctly, GraphJin exposes that graph through GraphQL + MCP: the agent discovers before acting, validates queries, runs approved work, observes runtime status — and every answer is checked against an execution ledger before it leaves the server.
It is not only for agents. GraphJin is still a high-performance GraphQL-to-database compiler, Go library, standalone API service, REST/OpenAPI gateway, and real-time subscription server. The agent use case is where everything comes together: the same compiler that serves your apps can also give AI a smart, auditable way to work across data, code, and operations.
Works with PostgreSQL, MySQL, MongoDB, SQLite, Oracle, MSSQL, Snowflake, Redshift, BigQuery, Apache Cassandra / Amazon Keyspaces, S3/GCS/local files, CodeSQL source indexes - and models from Claude/GPT-4 to local 7B
ed3f1f55a764OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add graphjin-site -- npx -y [email protected]
{
"mcpServers": {
"graphjin-site": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Alcohol | read | Bad for you! |
Beers | read | Liquid Bread |
oops | read | nope |
Trust audit
BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
# # Or inline: private_key_pem: "-----BEGIN PRIVATE KEY-----\n..."
# # Or inline: private_key_pem: "-----BEGIN PRIVATE KEY-----\n..."
.env
func (s *Stmt) Exec(args []driver.Value) (driver.Result, error) {func (e *gocqlExecutor) Exec(ctx context.Context, stmt Statement) (ResultSet, error) {Exec(ctx context.Context, stmt Statement) (ResultSet, error)
func (s *Stmt) Exec(args []driver.Value) (driver.Result, error) {Every demo ships an end-to-end smoke suite: `scripts/smoke.sh` exercises data queries, saved queries, workflows, watches, and the artifact store; `--agent-eval` adds strict agent-protocol evals; `--mo
If needed, add test tables to all database schema files. **IMPORTANT: When adding test tables, you MUST add them to ALL database schema files to ensure consistency across different database backends.*
import{a as e,r as t,t as n}from"./rolldown-runtime-CNC7AqOf.js";import{Fr as r,Ir as i,Mr as a,Nr as o,c as s}from"./graphiql-D05UQ1BV.js";var c=e(i(),1),l=/^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i,u=/^[\\return "http://127.0.0.1:8090"
return "http://127.0.0.1:8090"
return "http://127.0.0.1:8090"
const _ExpOp_name = "OpNopOpAndOpOrOpNotOpEqualsOpNotEqualsOpGreaterOrEqualsOpLesserOrEqualsOpGreaterThanOpLesserThanOpInOpNotInOpLikeOpNotLikeOpILikeOpNotILikeOpSimilarOpNotSimilarOpRegexOpNotRegexOp
anthropic := "sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789"
connection_string: postgres://app:secret@db/app
connection_string: postgres://app:secret@db/app
connection_string: postgres://app:secret@db/app
connStr := "postgres://postgres:postgres@localhost:5432/adventureworks?sslmode=disable"
secret: "long-random-shared-secret" # used to sign and verify local JWTs
const secret = "a-very-long-test-secret-not-for-prod-use"
iss, err := New(Config{Secret: "x-very-long-secret-for-testing-only", TTL: time.Hour})const secret = "AIza-canary-secret-value-1234567890"
Secret: "test-secret-plenty-long",
# private_key_pem: "-----BEGIN PRIVATE KEY-----\n..."
Gates applied: critical_finding, instruction_override, no_behavioural_pass.
ed3f1f55a764full audit observations/trust-audit/mcp-server/dosco__graphjin.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | ed3f1f55a764 | BLOCK | F | 46 | first audit |
Questions
What is the graphjin MCP server?
One governed graph for AI agents — GraphQL + MCP over your databases, files, APIs, and code
What tools does graphjin expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is graphjin safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does graphjin need?
No credential environment variables were found in its source, so it appears to need none.
How does graphjin run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as graphjin-site at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (ed3f1f55a764), read on 2026-10-12. The repository is watched and re-audited when it changes.