graphify (Graphify-Labs/graphify) is an MCP server listed on the M8ven Trust Index. It scores 98 out of 100, grade A. It declares 10 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
A
Trusted
98/100
7 days ago

graphify

Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.

→ Graphify-Labs/graphify· listed on github_code

Trusted. Deep verification, no outstanding findings, and an established reputation. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Graphify-Labs

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 7 credentials: GEMINI_API_KEY, GOOGLE_API_KEY, MOONSHOT_API_KEY, DEEPSEEK_API_KEY, FALKORDB_PASSWORD, NEO4J_PASSWORD, GRAPHIFY_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configGRAPHIFY_MTIME_GRANULARITY_MS
configGRAPHIFY_HOOK_STRICT
configGRAPHIFY_HOOK_STRICT_TTL
configCLAUDE_PROJECT_DIR
configGRAPHIFY_FORCEoptional — also --force flag
🔐 secretGEMINI_API_KEY--backend gemini
🔐 secretGOOGLE_API_KEY--backend gemini
🔐 secretMOONSHOT_API_KEY--backend kimi
🔐 secretDEEPSEEK_API_KEY--backend deepseek
configGRAPHIFY_NO_TIPS
🔐 secretFALKORDB_PASSWORD
🔐 secretNEO4J_PASSWORD
configGRAPHIFY_API_TIMEOUToptional — also --api-timeout flag
configGRAPHIFY_MAX_WORKERSoptional — also --max-workers flag
configOLLAMA_BASE_URL--backend ollama (default: http://localhost:11434)
configAWS_PROFILE
configAWS_REGION
configAWS_DEFAULT_REGION
configAWS_ACCESS_KEY_ID
configGRAPHIFY_NO_BACKUP
configGRAPHIFY_DEBUG
configGRAPHIFY_GOOGLE_WORKSPACEYou can also set =1. Graphify exports shortcuts into
configGRAPHIFY_GOOGLE_WORKSPACE_TIMEOUT
configGRAPHIFY_CHANGED
configGRAPHIFY_REBUILD_TIMEOUT
configGRAPHIFY_OUT
configGRAPHIFY_REBUILD_LOG
configCLAUDE_CONFIG_DIR
configOLLAMA_HOST
configANTHROPIC_BASE_URL--backend claude (default: https://api.anthropic.com)
configANTHROPIC_MODEL--backend claude (default: claude-sonnet-4-6)
configKIMI_BASE_URL
configOLLAMA_MODEL--backend ollama (default: auto-detect)
configGEMINI_BASE_URL
configOPENAI_BASE_URL--backend openai (default: https://api.openai.com/v1)
configOPENAI_MODEL--backend openai (default: gpt-4.1-mini)
configDEEPSEEK_BASE_URL
configAZURE_OPENAI_DEPLOYMENToptional — default gpt-4o
configGRAPHIFY_AZURE_MODELoptional — default gpt-4o
configGRAPHIFY_ALLOW_LOCAL_PROVIDERS
configGRAPHIFY_MAX_OUTPUT_TOKENSoptional — e.g. 32768 for large files
configGRAPHIFY_LLM_TEMPERATUREoptional — auto-omitted for o1/o3/o4/gpt-5 reasoning models
configGRAPHIFY_MAX_RETRIESoptional — raise for strict per-org limits (e.g. kimi); 0 disables
configGRAPHIFY_MAX_RETRY_DEPTHoptional — lower it to cap worst-case spend; 0 disables every retry (no bisection, no hollow-response retry), so a chunk costs exactly one call
configGRAPHIFY_DISABLE_THINKING
configGRAPHIFY_OLLAMA_VISION
configGRAPHIFY_OLLAMA_NUM_CTXoptional — auto-sized by default
configGRAPHIFY_OLLAMA_KEEP_ALIVEoptional — set 0 to unload after each chunk
configGRAPHIFY_CLAUDE_CLI_MODEL
configAZURE_OPENAI_API_VERSIONoptional — default 2024-12-01-preview
configAZURE_OPENAI_ENDPOINTuv tool install "graphifyy[openai]"
configGRAPHIFY_OLLAMA_PARALLEL
configGRAPHIFY_CLAUDE_CLI_PARALLEL
configGRAPHIFY_NO_INCREMENTAL_CACHE
configNO_COLOR
configGRAPHIFY_TRIAGE_BACKENDoptional — auto-detected from available keys
configGRAPHIFY_TRIAGE_MODELoptional — e.g. claude-opus-4-7
configGRAPHIFY_QUERY_LOG_DISABLEoptional
configGRAPHIFY_QUERY_LOGoptional — off unless this or _ENABLE is set
configGRAPHIFY_QUERY_LOG_ENABLEoptional
configGRAPHIFY_QUERY_LOG_RESPONSESoptional
configGRAPHIFY_MAX_GRAPH_BYTESoptional — useful for very large corpora
configGRAPHIFY_MAX_CONTEXTSoptional — default: 8; invalid values use 8, and values below 1 use 1
🔐 secretGRAPHIFY_API_KEYRequire Authorization: Bearer <key> (or X-API-Key)
configGRAPHIFY_WHISPER_MODEL
configGRAPHIFY_WHISPER_PROMPT
configGRAPHIFY_REBUILD_MEMORY_LIMIT_MB
configGRAPHIFY_REPO_ROOT
configSTATIC
configGRAPHIFY_VIZ_NODE_LIMIT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

10/10 tools missing one or more hints — query_graph (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_node (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_neighbors (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +7 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Secrets not logged

5 secret values sent to print

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/graphify-labs/graphify)](https://m8ven.ai/mcp/graphify-labs/graphify)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 33362d969292b57eda82f3fbd9eb5f3f5bc9bbc2
code hash: 072144565029cec274e2647348dc3aefc9156cb16d384d367b4f80ec9fc2fcbe
verified: 9/4/2026, 4:53:14 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client