MCP server · Org-owned · Audited from source
Graft MCP server
by trailhq/graftMIT licenceAudited 21 Sep 2026 · source 799ec0ed07c3
Is it safe? With care — CAUTION, grade B (89/100). It exposes 10 tools: 8 read, 2 write and 0 destructive. The audit recorded 16 findings (0 critical, 0 high, 3 medium, 9 low). Maintainer's description: Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.
Cite
Cite this page
ModelsAtlas. “Graft MCP server (trailhq/graft)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/trailhq/graft-2
Copy of mcp/nanonets/graft-1: identical text; the original is the page to read and cite.
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
16 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared3 observations
- NetworkDeclared5 observations
- ShellDeclared5 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 6 findings |
L1 Static source | Secrets, path traversal, supply chain | WARN 10 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
trailhqOrganizationAccount type recorded when we read the repository. - PackagePublished on npm
@nanonets/graftat version 0.18.0 - LicenceMITFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit read799ec0ed07c3The audit covers exactly this commit, read on 21 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory10 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (16)
Sorted by severity
MEDIUMNetwork egressnet.raw_ip · Dockerfile:74
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · src/brain/signup.ts:99
const url = new URL(req.url ?? "/", "http://127.0.0.1");
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · src/viz/serve.ts:139
url: `http://127.0.0.1:${port}`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/graph/lsp/enrich.ts:15
import { relPosix } from "../../util/paths.js";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · test/graph-follow-nested-repos.test.ts:78
'import { depAValue } from "../../dep_a/src/api.js";\n' +- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · test/telemetry-contract.test.ts:170
assert.equal(langsValue(['ts', '../../etc/passwd']), 'ts');
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.beacon_words · test/telemetry-contract.test.ts:38
assert.equal(track('exfiltrate', { anything: 'here' }, { home, env: OPEN }), null);- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/app-review-process.test.ts:117
url: `http://127.0.0.1:${port}`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/app-server.test.ts:69
url: `http://127.0.0.1:${port}`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · package.json
@anthropic-ai/sdk, commander, dotenv, gray-matter, openai, tree-sitter, tree-sitter-go, tree-sitter-java
- Why
- 24 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
INFOInventory / provenanceinv.oversize · assets/graft-comparison-demo.gif
assets/graft-comparison-demo.gif
- Why
- 5317843 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · assets/graft-hook-blast-radius-demo.gif
assets/graft-hook-blast-radius-demo.gif
- Why
- 17593393 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · assets/graft-site-act-demo.gif
assets/graft-site-act-demo.gif
- Why
- 1387508 bytes not read
- Fix
- —
INFOInventory / provenanceinv.oversize · assets/graft-viz-demo.gif
assets/graft-viz-demo.gif
- Why
- 15360796 bytes not read
- Fix
- —
Tools it exposes
10 declared in source · 0 destructive
| Tool | Risk | What it does |
|---|---|---|
graft_check_freshness | write | Report whether the committed graph is in sync with the code (drift check). |
graft_trace_calls | write | Structural edges for a symbol, over call/reference/import/implements/extends ($0, no LLM). Defaults to direct callers (who depends on it). Set direction: |
a | read | d |
b | read | d |
graft_file_api | read | Signatures-only view of one file — every definition |
graft_find_all | read | Regex search over the graph\ |
graft_find_code | read | Query the repo context graph in plain words. Returns ranked nodes with exact file:line spans and the relevant source inlined — usually the full answer, no file reads needed. |
graft_repo_map | read | Token-budgeted repo orientation — directory clusters, per-directory hubs, and global hotspots computed purely from the wiring graph ($0, no LLM). Use this to get oriented in an unfamiliar repo before diving into files. |
record_graph | read | d |
record_names | read | Record one name per cluster. |
Install
Package version 0.18.0 · audited commit 799ec0e
Read the findings first. The most severe is Network egress (medium) at Dockerfile.
One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.18.0. The audit covers commit 799ec0e only.
claude mcp add graft --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env GRAFT_BRAIN_BUILD_SECRET=${GRAFT_BRAIN_BUILD_SECRET} --env GRAFT_BRAIN_TOKEN=${GRAFT_BRAIN_TOKEN} -- npx -y @nanonets/[email protected]{
"mcpServers": {
"graft": {
"command": "npx",
"args": [
"-y",
"@nanonets/[email protected]"
],
"env": {
"GH_TOKEN": "${GH_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"GRAFT_BRAIN_BUILD_SECRET": "${GRAFT_BRAIN_BUILD_SECRET}",
"GRAFT_BRAIN_TOKEN": "${GRAFT_BRAIN_TOKEN}"
}
}
}
}The command pins the package version recorded in the source (0.18.0); the audit covers commit 799ec0ed07c3. Transport: not declared. Reads these environment variables: GH_TOKEN, GITHUB_TOKEN, GRAFT_BRAIN_BUILD_SECRET, GRAFT_BRAIN_TOKEN, GRAFT_POSTHOG_KEY, GRAFT_PUBLIC_GITHUB_TOKEN. Give it the narrowest token it needs.
Audit history
- !CAUTION B 89 / 100
Source changed, verdict held ·
799ec0ed07c3 - !CAUTION B 89 / 100
First audit ·
6bd383c03303
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about Graft MCP server
What is the Graft MCP server?
What tools does Graft expose?
Is Graft safe to connect to an agent?
What credentials does Graft need?
How current is this page?
Sources
- trailhq/graft on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit 799ec0ed07c3Observed · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Graft MCP server?
- What tools does Graft expose?
- Is Graft safe to connect to an agent?