DEVELOPMENT WORKFLOW / Apollo GraphQL
Apollo MCP Server
Exposes a chosen set of GraphQL operations as MCP tools backed by an existing graph.
“Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools.”
01 / THE REASONING
Why this made the selection.
- Allows teams to define the GraphQL operations that become named tools instead of handing over an unrestricted API client.
- Documents mutation modes and separate ad-hoc execution settings that make the intended operation boundary reviewable.
- The pinned README is Apollo's server for turning configured GraphQL operations into MCP tools in front of a graph.
- It does not list the operations itself; those have to be supplied in configuration, which the README points at the user guide for.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md, Cargo.toml and LICENSE
- Official installation and configuration reference, including mutation and introspection controls
- 2026-10-14 reread of retained pinned setup/configuration evidence for the specific operational details added in this batch.
- README.md
- LICENSE
Our findings
- The documented mutation-mode default is none; ad-hoc execution is a separate option that should remain disabled unless required.
- Current publisher configuration docs distinguish predefined mutation exposure from ad hoc execution: explicit permits predefined mutations but rejects ad hoc mutations, while all permits both if execute is enabled. The executable accepts a positional configuration path.
- The server exposes GraphQL operations as MCP tools so a model can call APIs running with Apollo.
- It will not function until a graph, the operation definitions to expose, a configuration file, and an MCP client are all configured.
- This README does not contain that configuration. It says the details are on the user guide, and it says not to open a public GitHub issue for a security vulnerability.
Not established by this review
- No MCP server or upstream package was installed or run.
- No authenticated account, client handshake, query, write operation or security test was performed.
- No authenticated session, installation, permission bypass or package-to-source parity test was performed.
- The server was not started and its tools were not called.
- A pin does not verify transitive dependencies.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
- Inspect an official release or build the pinned source with the documented Rust workflow.
- Configure the graph endpoint and a reviewed operation allowlist; begin with mutation_mode: none and no ad-hoc execution.
- Use stdio locally or protect the HTTP deployment with appropriate authentication, then inspect tools in the intended client.
Before you start
- A GraphQL endpoint and authorized credentials
- A reviewed operation set and configuration file
- Rust if building from source
Documented configuration example
Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts.
{
"mcpServers": {
"mcp-My API": {
"command": "npx",
"args": [
"mcp-remote",
"http://127.0.0.1:8000/mcp"
]
}
}
}04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/apollographql/apollo-mcp-server/blob/04e4e6e406a7747e97238dbbea352007c253738e/README.md
Supports: summary, upstreamDescription, whySelected, bestFor, install, compatibility, transports, limitations, access, review
https://github.com/apollographql/apollo-mcp-server/blob/04e4e6e406a7747e97238dbbea352007c253738e/LICENSE
Supports: license, access.cost
https://www.apollographql.com/docs/apollo-mcp-server/run
Supports: install, compatibility, summary, configExample, access, limitations, bestFor, review, transports
https://www.apollographql.com/docs/apollo-mcp-server/config-file
Supports: limitations, review, access, summary, install, configExample, bestFor, compatibility, transports