GraphHub (slnquangtran/Graph-Hub) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 32 tools. No publisher has claimed this listing.
Transforms codebases into a knowledge graph for AI agents, enabling semantic search, impact analysis, and persistent session memory with up to 94% token savings.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
slnquangtran
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
query_graphRun a direct Cypher query against the codebase graph database. Use this to find complex relationships.
get_file_symbolsRetrieve all symbols (classes, functions, etc.) defined in a specific file.
semantic_searchSearch for code using natural language. Supports semantic (meaning-based), keyword, or hybrid search modes.
search_by_nameSearch for symbols by their name. Supports exact or fuzzy matching.
search_groupedSearch for code and group results by file. Useful for understanding which files are most relevant.
find_similarFind symbols that are semantically similar to a given symbol. Useful for finding related code.
explain_searchExplain how a search query will be processed. Shows tokenization and search strategy.
get_contextGet all callers and callees of a symbol by name. Shows the full call graph context around a function or class.
impact_analysisAnalyze all symbols that directly call or import a given symbol. Shows what would break if the symbol changes.
rememberSave a learning, decision, finding, or other observation to persistent memory. Searchable via recall with semantic similarity.
recallSearch memory for past observations using natural language. Returns results ranked by semantic similarity.
timelineView observations chronologically. Useful for reviewing what happened during a session or project.
memory_statsGet statistics about stored observations: totals, counts by type, by project, by importance.
get_observationGet a specific observation by its ID.
update_observationUpdate an existing observation's content, title, importance, or tags.
forgetDelete observations from memory. Can delete by ID, session, project, type, or date.
related_observationsGet all observations that are linked to a specific code symbol.
debug_traceOne-shot debugging entry point. Given a bug description or error message, returns ranked candidate symbols enriched with callers, callees, and impact risk. Replaces the semantic_search → get_context → impact_analysis chain with a single call to save tokens.
remember_bugfixRecord a resolved bug so future agents can reuse the fix pattern. Stores symptom, root cause, and fix as a structured observation searchable via recall_bugfix.
recall_bugfixFind past bug fixes with similar symptoms. Returns structured fix patterns (symptom/root_cause/fix) ranked by semantic similarity. Call this FIRST when debugging — a past fix may apply.
remember_skill_choiceCache which .skill.md / SKILL.md file was used for a task so similar future tasks route to the same skill without re-choosing. Record outcome to let recall_skill_choice rank successful choices higher.
recall_skill_choiceFind which skill was used for similar past tasks. Skip the skill-selection decision for common task patterns.
batch_contextGet definition + caller/callee counts for multiple symbols in one call. Replaces N get_context calls when an agent needs to look up several symbols at once. Default compact mode returns only counts; pass compact=false for full neighbor lists.
changed_symbolsList the symbols in files changed by the current branch (or working tree / staged diff). Each entry includes a direct-caller count and risk bucket so agents know where breakage is most likely. Use this before committing or when reviewing a PR.
find_dead_codeFind functions, methods, and classes that are never called by anything in the graph. Useful before refactors or cleanups. Common entry-point patterns (main, init, onX, handleX, etc.) are filtered out by default.
find_duplicatesFind functions that are semantically similar to a given symbol — likely duplicate or near-duplicate implementations. Uses stored embeddings; no API cost.
find_cyclesDetect circular import chains or mutual-recursion call cycles in the codebase. Returns each cycle as an ordered list of file paths or symbol names.
review_diffGenerate a structured pre-merge review of the current git diff. Returns each changed symbol with its blast radius, test coverage, and an overall risk rating (LOW/MEDIUM/HIGH/CRITICAL). Use this before committing or opening a PR.
check_arch_rulesEnforce architecture boundary rules — detect files that import across forbidden layer boundaries. Rules can be passed inline or loaded from .graphhub/arch-rules.json.
get_test_coverageShow which functions and methods in the codebase are exercised by test files. Identifies uncovered symbols so agents know where to add tests.
get_hierarchyExplore the inheritance and interface implementation tree for a class or interface. Returns ancestors (parent classes / implemented interfaces) and descendants (subclasses / implementors). Use before modifying a base class to understand the full blast radius across the hierarchy.
find_tech_debtSurface TODO/FIXME/HACK/OPTIMIZE markers stored in the graph during indexing. Returns symbols sorted by risk score (debt_count × caller_count) so agents tackle the highest-impact debt first.
ANTHROPIC_API_KEYGRAPHHUB_API_KEYOPENAI_API_KEYTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
32/32 tools missing one or more hints — query_graph (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_file_symbols (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); semantic_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +29 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 5/32 tools referenced in tests (16%)
Write tests that reference each tool by name so every tool has at least one test.
Tests pass
npm test failed — tests do not pass
Make sure npm test runs cleanly. Common cause: missing build step or missing env vars.
Shell command execution
1 child_process/subprocess call in production code — runs shell commands (src/services/debug/changed-symbols-service.ts:67)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
No arbitrary install scripts
Has postinstall/preinstall script — runs arbitrary code on npm install
Remove postinstall/preinstall hooks unless they’re essential.
Dependency freshness
1/13 production deps stale: @xenova/transformers@2024-05-29 (2.2y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/slnquangtran/graph-hub)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check