graftBLOCK
Graft writes the API integration your agent is missing, on demand, and serves it over MCP. Connect Claude, ChatGPT, Hermes or OpenClaw; the model reads the vendor docs, writes and verifies a small tool, and the proxy injects the credential so it never reaches the code. Self-hostable with Docker and
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Graft gives an agent the integration it is missing. The basics of thirteen integrations are ready-made; anything else is written on demand against the integration's real API, verified before use, and handed to the agent as an MCP tool.
Add Graft to Claude, Claude Code, Codex, ChatGPT, Hermes or OpenClaw as one MCP server. When the agent hits a task no tool covers, it calls find_tool, and a ready-made tool for a connected integration is one call from its list. When nothing fits, it calls acquire. Graft's own coding model reads the integration's documentation, writes the smallest module that makes the call, checks it, proves it with reads, publishes it, dry-runs it against the live API with every write stopped at a proxy, and promotes it into that agent's tool list. The credential never enters the module, the sandbox or the model. When the agent stops using a tool it leaves the list again, and stays in the toolbox one call from coming back.
Four words are used exactly as CONTEXT.md defines them. A harness is the agent software you run. A person is the account holder. An integration is a service Graft can connect, Gmail or Slack or your own API, and a connection is one account of it that you have given Graft.
Connect it
Claude, Claude Code, Codex and ChatGPT need no token. Give the product your Graft origin plus /mcp: as a custom connector in Claude, with claude mcp add --transport http in Claude Code, with codex mcp add in Codex, or as an MCP app under Plugins in ChatGPT with Developer mode on.
https://your-graft.example/mcp
The product discovers Graft's own authorization server from that endpoint, registers itself, and sends you to the console to consent. The consent mints the agent the connector will be, or hands it the agent Setup minted for it, and you choose what it reaches: every connection of yours, the default for Claude and ChatGPT, or a list. A client Graft does not vouch for starts
c00e48f7cae2OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add vault --env CANDO_TOKEN=${CANDO_TOKEN} --env GRAFT_MODEL_API_KEY=${GRAFT_MODEL_API_KEY} --env GRAFT_MODEL_AUTHORING=${GRAFT_MODEL_AUTHORING} --env GRAFT_TOKEN=${GRAFT_TOKEN} -- npx -y @graft/[email protected]{
"mcpServers": {
"vault": {
"command": "npx",
"args": [
"-y",
"@graft/[email protected]"
],
"env": {
"CANDO_TOKEN": "${CANDO_TOKEN}",
"GRAFT_MODEL_API_KEY": "${GRAFT_MODEL_API_KEY}",
"GRAFT_MODEL_AUTHORING": "${GRAFT_MODEL_AUTHORING}",
"GRAFT_TOKEN": "${GRAFT_TOKEN}"
}
}
}
}Exposed tools (51)
40 read · 9 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
ChatGPT | read | Web & desktop |
Claude | read | Web & desktop |
Codex | read | App, CLI & IDE |
Hermes | read | Local agent |
OpenClaw | read | Local agent |
a | read | b |
alpha | read | Read this: always |
authoring | write | How to write a module. |
beta | read | Say |
count-things | read | Counts things at Revocable. |
create-customer | write | Creates a customer. |
create-item | write | Creates an item |
create-order | write | Creates an order |
current-weather | read | Reads the current temperature for a city from Open-Meteo. |
current-weather-city | read | Current weather in a city. |
decoy | read | Answers a result shaped like the server |
decoy-counts | read | Answers a result wearing the wide event |
delete-item | destructive | Deletes an item. |
download-report | read | Downloads a file from Files by its id and answers it as a blob ref. |
echo | read | Echo. |
export-file | read | Downloads the Demo Orders export as a file. |
graft-ask | read | The card Graft shows for an ask a tool answers with: a build approval, a connection confirmation or a scope ask the person answers in place, or the link to answer it in the console; and the offer of Setup, which opens the console |
greet | read | Greets whoever asks, by listing Demo items. |
hello | read | Greets a name through the vendor |
list-issues | read | Lists Linear issues. |
list-items | read | Lists items |
list-items-retry | read | Lists items from Demo Orders, up to a limit — the documented path. |
list-latest-inbox-conversations | read | Lists the latest conversations in the inbox with subject, sender and snippet. |
list-messages | read | Lists messages |
list-open-issues | read | Lists the open issues of a GitHub repository. |
list-orders | read | Lists orders |
list-rebound | read | Lists items from Demo Orders, again. |
list-repos | read | Lists repositories and notes the first. |
list-things | read | Lists things |
never-passed | read | Lists items from Demo Orders, though no version of it has passed. |
ok-name | read | d |
other | read | x |
pad | read | Pads a word on the left |
ping | read | Ping the other vendor. |
post-note | write | Posts a note to a Demo Orders channel. |
recent-repos | read | Lists the authenticated user |
refund-payment | read | Refunds a charge. |
save-place | write | Saves a place. |
save-report | write | Saves the Demo Orders report as a file. |
search-places | read | Finds a place by name in Demo Orders |
their-tool | read | Another person |
triage | read | How to triage |
update-order | write | Updates an order |
upload-file | write | Uploads a file to a Demo Orders channel. |
upload-report | destructive | Uploads a file held as a blob into a Drop folder. |
x | read | d |
Trust audit
BLOCKgrade F · trust 35/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
export const GITHUB_TOKEN = "ghp_evalFakeToken0123456789abcdefghijkl";
const made = await exec({const result = await exec({const started = await exec({const polled = await exec({const listed = await exec({typescript6 ~ typescript
snowflake-jwt.ts
.claude/skills/ask-matt
.claude/skills/claude-handoff
.claude/skills/codebase-design
.claude/skills/diagnosing-bugs
.claude/skills/domain-modeling
console.log(`checked ${used.size} design-token utilities against ${tokens.length} tokens`);"data": "DUW-QD7sCy7JSIM-CWV-XNcdXTX3zTvzKDXgbDLnEs40SRkjLf7qM08ilAYnfFEmGN6vYNXzyEGygCYloPKkJTJ8UQB0DuwacZ5LAq6WSMuqEa9FGWe1jR0ShzZ2PJHbxgZwAZXbvABhlxmjS5roaGq3Zw4cw04gO4A4xN3gLRXmILQbJ0zaJJO0R4V8eDk
"data": "WDSLE4OSMIXEAHe2uMatYKSRVCsWTNIqSr8PW4HqN8NJNPRKHITOFNRtQwSmGVAeoqOexMizxiLiLg4ACyGlWic2lSZ0Zp10k4oqjbXmh8NcS9UYF5hiwV4gOS5IICZgaHi3cLpdCGLaRD2qxCWax38jwW2bnKHwQv9RGQu1jXnnxQ3udrY4Ttx0fWR2Kh6
const MODEL_API_KEY = "sk-ant-a-persons-own-model-key-0123456789";
TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/graft_test
-e GRAFT_DATABASE_URL=postgresql://postgres:postgres@nowhere:5432/graft \
-e GRAFT_DATABASE_URL=postgresql://postgres:postgres@nowhere:5432/graft \
-e GRAFT_DATABASE_URL=postgresql://postgres:postgres@nowhere:5432/graft \
`TEST_DATABASE_URL=postgresql://postgres:password@localhost:5432/graft pnpm --filter @graft/server test`.
secret: "api-test-handoff-secret-that-is-long-enough-32",
const SECRET = "test-secret-that-is-long-enough-32";
const API_KEY = "sk_live_the_real_vendor_key";
Gates applied: critical_finding, no_behavioural_pass.
c00e48f7cae2full audit observations/trust-audit/mcp-server/getmodern-ai__graft.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | c00e48f7cae2 | BLOCK | F | 35 | first audit |
Questions
What is the graft MCP server?
Graft writes the API integration your agent is missing, on demand, and serves it over MCP. Connect Claude, ChatGPT, Hermes or OpenClaw; the model reads the vendor docs, writes and verifies a small tool, and the proxy injects the credential so it never reaches the code. Self-hostable with Docker and
What tools does graft expose?
51 in total: 40 read-only, 9 that write, and 2 that can delete or overwrite (delete-item, upload-report). Every one is listed on this page with its risk.
Is graft safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (35/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does graft need?
It reads CANDO_TOKEN, GRAFT_MODEL_API_KEY, GRAFT_MODEL_AUTHORING and GRAFT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does graft run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @graft/vault at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (c00e48f7cae2), read on 2026-10-14. The repository is watched and re-audited when it changes.