Grafbase — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

The documented gateway MCP integration has a limited-security-maintenance commitment and an elapsed planned archival date. One short follow-up is valuable to resolve actual support/archival status and avoid misleading users about the retired platform.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Maintaining or evaluating the Grafbase Gateway/CLI

What we know

Rust repository for Grafbase Gateway and CLI components for GraphQL federation/routing; the prior Grafbase platform has been sunset.

Maintenance / activity evidence

Observed May 11, 2026 (UTC)chore(gateway): release bump to address wolfi CVEs ( 3615)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Depends on deployed GraphQL configuration. Writes: Can route GraphQL mutations depending on upstream API.
Deployment-specific.
Sensitive access: GraphQL data

Operational/lifecycle caveats are more material than an MCP-specific security model because this is not a standalone MCP server.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,229 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

All limitations / Review context

Is the self-hosted MCP gateway still receiving the stated security maintenance, and has the overdue repository archival plan been completed?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Operational/lifecycle caveats are more material than an MCP-specific security model because this is not a standalone MCP server.
Depends on deployed GraphQL configuration.
Deployment-specific.
Processes GraphQL/API traffic.
Reviewed write actions: Can route GraphQL mutations depending on upstream API
Sensitive access: GraphQL data
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
The official README announces a sunset and planned archive; this review records that lifecycle context without treating it as an installation or security certification.
No independent runtime, installation, or comprehensive security audit was performed.
The retained integration README is historical; the current retirement notice controls platform and support claims.
Platform/dashboard sunset; gateway security-maintenance-only. The announced May archival date has elapsed but the fetched repository does not resolve an actual archival completion date. Do not borrow Hive successor capabilities.
No MCP-specific server identity established
Package identity
Current successor mapping
Repository states platform/dashboard/app are sunset.
Gateway/CLI were in maintenance mode with archival plans.

Original activity observations

2026-05-11T12:06:09Z: chore(gateway): release bump to address wolfi CVEs ( 3615)

Technical identity

github.com/grafbase/grafbase

Exact implementation source: https://github.com/grafbase/grafbase ↗
Reviewed resource type: Framework
Repository identity: grafbase/grafbase

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
grafbase/grafbase
Recorded repository material and project history.

Setup · Watchlist

Framework setup

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions
npx grafbase mcp <YOUR_GRAPHQL_API_URL>
Configure / authenticate
Publisher instructions
Grafbase CLI exposes a local MCP endpoint, default http://127.0.0.1:5000/mcp; alternatively enable Grafbase Gateway `[mcp] enabled = true` in grafbase.toml.
Check connection
Suggested check
Verify the client can list the target GraphQL schema tools; endpoint reachability alone is not complete API auth verification.
Remove / uninstall / revoke
MCP100 setup guide
Remove the local endpoint from client config, stop `grafbase mcp` process, or disable Gateway `[mcp]` setting if using Gateway mode.

Official Documentation & Sources

What it does

Rust repository for Grafbase Gateway and CLI components for GraphQL federation/routing; the prior Grafbase platform has been sunset.

Capability: Developer Tools
Resource type: Framework
Industry: Software & Technology
Best fit: Maintaining or evaluating the Grafbase Gateway/CLI

Representative uses

Run the Grafbase Gateway
Use the Grafbase CLI
Maintain GraphQL federation components

Limitations

Repository states platform/dashboard/app are sunset.
Gateway/CLI were in maintenance mode with archival plans.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Deployment-specific.
Permissions: Depends on deployed GraphQL configuration.
Data handling: Processes GraphQL/API traffic.
Cost: unknown
Risk and cautions: Operational/lifecycle caveats are more material than an MCP-specific security model because this is not a standalone MCP server.

Access scope and cautions

Write actions: Can route GraphQL mutations depending on upstream API
Sensitive access: GraphQL data
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Run the Grafbase Gateway; Use the Grafbase CLI; Maintain GraphQL federation components.

What setup and authentication are documented?

A complete connection procedure is not verified. Client notes: The Guild points users toward Hive alternatives. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Deployment-specific.

Can it modify data or perform write operations?

Documented write actions include: Can route GraphQL mutations depending on upstream API. Recorded permission boundary: Depends on deployed GraphQL configuration.

What data-handling boundary should I consider?

Processes GraphQL/API traffic. Recorded sensitive-access context: GraphQL data.

What limitations and risks should I check before use?

Operational/lifecycle caveats are more material than an MCP-specific security model because this is not a standalone MCP server. Repository states platform/dashboard/app are sunset. Gateway/CLI were in maintenance mode with archival plans. The official README announces a sunset and planned archive; this review records that lifecycle context without treating it as an installation or security certification. No independent runtime, installation, or comprehensive security audit was performed. The retained integration README is historical; the current retirement notice controls platform and support claims.

Is this an official MCP?

The Guild (acquired Grafbase) is listed as Ecosystem official in MCP100’s current evidence.