graphql-mcp-bridge

The library employs Zod for comprehensive input and output validation, significantly reducing common injection risks. GraphQL queries are generated using variables (`$var`) rather than direct string interpolation of user data, preventing GraphQL injection vulnerabilities. No direct use of `eval` or `child_process` detected at runtime. The `schemaParser` includes configurable limits (`maxOperations`, `maxFields`, `maxSchemaDepth`) to mitigate potential Denial-of-Service attacks from overly complex or large GraphQL schema inputs, though proper configuration is required for very large/malicious schemas.