GraphHub (slnquangtran/Graph-Hub) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 32 tools. No publisher has claimed this listing.

C
Caution
74/100

GraphHub

Transforms codebases into a knowledge graph for AI agents, enabling semantic search, impact analysis, and persistent session memory with up to 94% token savings.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

slnquangtran

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 3 credentials: ANTHROPIC_API_KEY, GRAPHHUB_API_KEY, OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes32 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

query_graph

Run a direct Cypher query against the codebase graph database. Use this to find complex relationships.

get_file_symbols

Retrieve all symbols (classes, functions, etc.) defined in a specific file.

semantic_search

Search for code using natural language. Supports semantic (meaning-based), keyword, or hybrid search modes.

search_by_name

Search for symbols by their name. Supports exact or fuzzy matching.

search_grouped

Search for code and group results by file. Useful for understanding which files are most relevant.

find_similar

Find symbols that are semantically similar to a given symbol. Useful for finding related code.

explain_search

Explain how a search query will be processed. Shows tokenization and search strategy.

get_context

Get all callers and callees of a symbol by name. Shows the full call graph context around a function or class.

impact_analysis

Analyze all symbols that directly call or import a given symbol. Shows what would break if the symbol changes.

remember

Save a learning, decision, finding, or other observation to persistent memory. Searchable via recall with semantic similarity.

recall

Search memory for past observations using natural language. Returns results ranked by semantic similarity.

timeline

View observations chronologically. Useful for reviewing what happened during a session or project.

memory_stats

Get statistics about stored observations: totals, counts by type, by project, by importance.

get_observation

Get a specific observation by its ID.

update_observation

Update an existing observation's content, title, importance, or tags.

forget

Delete observations from memory. Can delete by ID, session, project, type, or date.

related_observations

Get all observations that are linked to a specific code symbol.

debug_trace

One-shot debugging entry point. Given a bug description or error message, returns ranked candidate symbols enriched with callers, callees, and impact risk. Replaces the semantic_search → get_context → impact_analysis chain with a single call to save tokens.

remember_bugfix

Record a resolved bug so future agents can reuse the fix pattern. Stores symptom, root cause, and fix as a structured observation searchable via recall_bugfix.

recall_bugfix

Find past bug fixes with similar symptoms. Returns structured fix patterns (symptom/root_cause/fix) ranked by semantic similarity. Call this FIRST when debugging — a past fix may apply.

remember_skill_choice

Cache which .skill.md / SKILL.md file was used for a task so similar future tasks route to the same skill without re-choosing. Record outcome to let recall_skill_choice rank successful choices higher.

recall_skill_choice

Find which skill was used for similar past tasks. Skip the skill-selection decision for common task patterns.

batch_context

Get definition + caller/callee counts for multiple symbols in one call. Replaces N get_context calls when an agent needs to look up several symbols at once. Default compact mode returns only counts; pass compact=false for full neighbor lists.

changed_symbols

List the symbols in files changed by the current branch (or working tree / staged diff). Each entry includes a direct-caller count and risk bucket so agents know where breakage is most likely. Use this before committing or when reviewing a PR.

find_dead_code

Find functions, methods, and classes that are never called by anything in the graph. Useful before refactors or cleanups. Common entry-point patterns (main, init, onX, handleX, etc.) are filtered out by default.

find_duplicates

Find functions that are semantically similar to a given symbol — likely duplicate or near-duplicate implementations. Uses stored embeddings; no API cost.

find_cycles

Detect circular import chains or mutual-recursion call cycles in the codebase. Returns each cycle as an ordered list of file paths or symbol names.

review_diff

Generate a structured pre-merge review of the current git diff. Returns each changed symbol with its blast radius, test coverage, and an overall risk rating (LOW/MEDIUM/HIGH/CRITICAL). Use this before committing or opening a PR.

check_arch_rules

Enforce architecture boundary rules — detect files that import across forbidden layer boundaries. Rules can be passed inline or loaded from .graphhub/arch-rules.json.

get_test_coverage

Show which functions and methods in the codebase are exercised by test files. Identifies uncovered symbols so agents know where to add tests.

get_hierarchy

Explore the inheritance and interface implementation tree for a class or interface. Returns ancestors (parent classes / implemented interfaces) and descendants (subclasses / implementors). Use before modifying a base class to understand the full blast radius across the hierarchy.

find_tech_debt

Surface TODO/FIXME/HACK/OPTIMIZE markers stored in the graph during indexing. Returns symbols sorted by risk score (debt_count × caller_count) so agents tackle the highest-impact debt first.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretANTHROPIC_API_KEY
🔐 secretGRAPHHUB_API_KEY
🔐 secretOPENAI_API_KEY
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

32/32 tools missing one or more hints — query_graph (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_file_symbols (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); semantic_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +29 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 5/32 tools referenced in tests (16%)

Write tests that reference each tool by name so every tool has at least one test.

Tests pass

npm test failed — tests do not pass

Make sure npm test runs cleanly. Common cause: missing build step or missing env vars.

Shell command execution

1 child_process/subprocess call in production code — runs shell commands (src/services/debug/changed-symbols-service.ts:67)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Dependency freshness

1/13 production deps stale: @xenova/transformers@2024-05-29 (2.2y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/slnquangtran/graph-hub?variant=verified)](https://m8ven.ai/mcp/slnquangtran/graph-hub)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b9a8c5a3511c814d799e4f6144b0e186ddf93232
code hash: b8970a96fda875583ba51c6cb988e486ab5add3357b44e2238d110d72e8c8126
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client