Install
openclaw skills install @paulieb14/subgraph-registryDiscover and filter 15,500+ The Graph subgraphs by domain, network, protocol type, or natural language goal. Each result includes an x402 query URL — $0.01 USDC on Base per call, no API key required.
openclaw skills install @paulieb14/subgraph-registryAgent-friendly discovery of 15,500+ classified subgraphs on The Graph Network. Search by domain, network, protocol type, or natural language goal — get reliability-scored results with x402-ready query URLs. Agents can go from question → answer without ever touching a Studio API key.
@xenova/transformers; if the bundled model is missing it downloads it once from Hugging Face (see Network & Data Behavior). Skip this tool for a strictly offline runtime.Every result now ships with two URLs and a pricing manifest:
query_url_x402 (recommended) — https://gateway.thegraph.com/api/x402/subgraphs/id/{id}. POST your GraphQL query; the gateway returns HTTP 402 with a payment manifest. Use an x402 client (@graphprotocol/client-x402, x402-fetch, or any generic wrapper) to sign $0.01 USDC on Base via EIP-3009 and retry. No signup, no Studio key, no GRT.query_url (legacy) — https://gateway.thegraph.com/api/[api-key]/subgraphs/id/{id}. Get an API key from thegraph.com/studio/apikeys and replace the placeholder.npx)Pin a known-good version. Audit the source on GitHub before installing if you plan to ship this in an autonomous-agent runtime.
# Pin to a published version, do not run unpinned (`npx subgraph-registry-mcp`
# without @VERSION will pull whatever's latest at the moment).
npx subgraph-registry-mcp@0.6.0
registry.db (SQLite) from the GitHub repository (~5 MB). This is cached locally and reused on subsequent runs.search_subgraphs, recommend_subgraph, get_subgraph_detail, list_registry_stats, get_schema_changes) run entirely against the local database — no external API calls at query time.semantic_search_subgraphs: it loads a bundled ONNX embedding model via @xenova/transformers. If that bundled model is not present, the runtime downloads it once from Hugging Face (huggingface.co), then caches it. This is the only query-time network call. Don't call this tool (or pre-bundle the model) for a strictly air-gapped runtime.--http or --http-only starts a local HTTP/SSE server on port 3848 (MCP_HTTP_PORT to change), exposing /messages, health, and OpenAPI/manifest endpoints. It is off unless you pass those flags — bind only to trusted/firewalled environments.The npm package version 0.6.0 ships with this expected hash:
SHA-256(registry.db) = f81b79c53cc13c3428472024187fc7fd502f7418f5da20f0a6e01807dd4011c6
This hash is hard-coded in src/index.js (EXPECTED_DB_SHA256). On every run,
the server checks the cached or freshly-downloaded registry.db against it. If
the hashes don't match — which would happen if the GitHub-hosted file were
swapped, or your local cache were tampered with — the server refuses to load
the database and exits with an error. The bad file is deleted so the next run
attempts a fresh download.
Verify manually:
shasum -a 256 ~/.npm/_npx/*/node_modules/subgraph-registry-mcp/data/registry.db
# (path varies by npx cache layout; the file is the one referenced as
# `data/registry.db` inside the package)
If you intentionally rebuilt the DB locally (using the optional Python
crawler), the hash will not match. Set SUBGRAPH_REGISTRY_SKIP_VERIFY=1 to
bypass — never set this in an agent-runtime default config.
When the registry is regenerated, the maintainer bumps the npm version and updates the hash constant atomically — so a given npm version uniquely corresponds to a known DB.