MCP server · Org-owned · Audited from source

Graft MCP server

by nanonets/graftMIT licenceAudited 21 Sep 2026 · source 799ec0ed07c3

npm @nanonets/graft 0.18.0★ 8,839

!CAUTIONGrade B · 89/100 · 21 Sep 2026 · 799ec0e

8,839GitHub stars

Is it safe? With care — CAUTION, grade B (89/100). It exposes 10 tools: 8 read, 2 write and 0 destructive. The audit recorded 16 findings (0 critical, 0 high, 3 medium, 9 low). Maintainer's description: Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Graft MCP server (nanonets/graft)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/nanonets/graft-1

2 MCP servers are called Graft. This is the one we pick. Compare all 2 →

nanonets/graft Org-owned★ 8,839!CAUTION
getmodern-ai/graft Org-owned★ 5✕BLOCK

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100!CAUTION B

0 critical0 high3 medium9 low4 info

16 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared3 observations
NetworkDeclared5 observations
ShellDeclared5 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 6 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 10 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner nanonetsOrganizationAccount type recorded when we read the repository.
PackagePublished on npm@nanonets/graft at version 0.18.0
LicenceMITFrom the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit read799ec0ed07c3The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory10 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (16)

Sorted by severity

MEDIUMNetwork egressnet.raw_ip · Dockerfile:74

F-04 Network egressCWE-200 · CWE-319Layer L1

CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src/brain/signup.ts:99

F-04 Network egressCWE-200 · CWE-319Layer L1

const url = new URL(req.url ?? "/", "http://127.0.0.1");

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src/viz/serve.ts:139

F-04 Network egressCWE-200 · CWE-319Layer L1

url: `http://127.0.0.1:${port}`,

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .ignore

F-13 Inventory / provenanceCWE-1104Layer L0

.ignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .mailmap

F-13 Inventory / provenanceCWE-1104Layer L0

.mailmap

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · src/graph/lsp/enrich.ts:15

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { relPosix } from "../../util/paths.js";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · test/graph-follow-nested-repos.test.ts:78

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

'import { depAValue } from "../../dep_a/src/api.js";\n' +

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · test/telemetry-contract.test.ts:170

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

assert.equal(langsValue(['ts', '../../etc/passwd']), 'ts');

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · test/telemetry-contract.test.ts:38

F-04 Network egressCWE-200 · CWE-319Layer L1

assert.equal(track('exfiltrate', { anything: 'here' }, { home, env: OPEN }), null);

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · test/app-review-process.test.ts:117

F-04 Network egressCWE-200 · CWE-319Layer L1

url: `http://127.0.0.1:${port}`,

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · test/app-server.test.ts:69

F-04 Network egressCWE-200 · CWE-319Layer L1

url: `http://127.0.0.1:${port}`,

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@anthropic-ai/sdk, commander, dotenv, gray-matter, openai, tree-sitter, tree-sitter-go, tree-sitter-java

Why: 24 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · assets/graft-comparison-demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

assets/graft-comparison-demo.gif

Why: 5317843 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · assets/graft-hook-blast-radius-demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

assets/graft-hook-blast-radius-demo.gif

Why: 17593393 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · assets/graft-site-act-demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

assets/graft-site-act-demo.gif

Why: 1387508 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · assets/graft-viz-demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

assets/graft-viz-demo.gif

Why: 15360796 bytes not read
Fix: —

Tools it exposes

10 declared in source · 0 destructive

8 read2 write0 destructive

Tool	Risk	What it does
`graft_check_freshness`	write	Report whether the committed graph is in sync with the code (drift check).
`graft_trace_calls`	write	Structural edges for a symbol, over call/reference/import/implements/extends ($0, no LLM). Defaults to direct callers (who depends on it). Set direction:
`a`	read	d
`b`	read	d
`graft_file_api`	read	Signatures-only view of one file — every definition
`graft_find_all`	read	Regex search over the graph\
`graft_find_code`	read	Query the repo context graph in plain words. Returns ranked nodes with exact file:line spans and the relevant source inlined — usually the full answer, no file reads needed.
`graft_repo_map`	read	Token-budgeted repo orientation — directory clusters, per-directory hubs, and global hotspots computed purely from the wiring graph ($0, no LLM). Use this to get oriented in an unfamiliar repo before diving into files.
`record_graph`	read	d
`record_names`	read	Record one name per cluster.

Install

Package version 0.18.0 · audited commit 799ec0e

Read the findings first. The most severe is Network egress (medium) at Dockerfile.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.18.0. The audit covers commit 799ec0e only.

claude mcp add graft --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env GRAFT_BRAIN_BUILD_SECRET=${GRAFT_BRAIN_BUILD_SECRET} --env GRAFT_BRAIN_TOKEN=${GRAFT_BRAIN_TOKEN} -- npx -y @nanonets/[email protected]

{
  "mcpServers": {
    "graft": {
      "command": "npx",
      "args": [
        "-y",
        "@nanonets/[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "GRAFT_BRAIN_BUILD_SECRET": "${GRAFT_BRAIN_BUILD_SECRET}",
        "GRAFT_BRAIN_TOKEN": "${GRAFT_BRAIN_TOKEN}"
      }
    }
  }
}

The command pins the package version recorded in the source (0.18.0); the audit covers commit 799ec0ed07c3. Transport: not declared. Reads these environment variables: GH_TOKEN, GITHUB_TOKEN, GRAFT_BRAIN_BUILD_SECRET, GRAFT_BRAIN_TOKEN, GRAFT_POSTHOG_KEY, GRAFT_PUBLIC_GITHUB_TOKEN. Give it the narrowest token it needs.

Audit history

2026-09-21
!CAUTION B 89 / 100
Source changed, verdict held · 799ec0ed07c3
2026-09-18
!CAUTION B 89 / 100
First audit · 6bd383c03303

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/nanonets/graft-1/badge.svg)](https://modelsatlas.com/mcp/nanonets/graft-1/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Graft MCP server

What is the Graft MCP server?

Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.

What tools does Graft expose?

10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Graft safe to connect to an agent?

With care. The audit graded it B (89/100) and found 16 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Graft need?

It reads GH_TOKEN, GITHUB_TOKEN, GRAFT_BRAIN_BUILD_SECRET, GRAFT_BRAIN_TOKEN, GRAFT_POSTHOG_KEY and GRAFT_PUBLIC_GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (799ec0ed07c3), read on 2026-09-21. The repository is watched and re-audited when it changes.

Which Graft MCP server is the right one?

nanonets/graft (this page). 2 servers share the name; see the side-by-side comparison.

Sources

nanonets/graft on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 799ec0ed07c3Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Graft MCP server?
GChatGPT CClaude PPerplexity
What tools does Graft expose?
GChatGPT CClaude PPerplexity
Is Graft safe to connect to an agent?
GChatGPT CClaude PPerplexity