Subgraph Registry

Discover and filter 15,500+ The Graph subgraphs by domain, network, or protocol with reliability scores and query URLs for precise data access.

Security Scan

The skill appears to do what it claims (a subgraph registry) but there are multiple mismatches between its declared requirements and what the code/instructions actually do (remote downloads, undeclared env vars, and an npx install), so you should review the package source and run it in a sandbox before trusting secrets or running it system-wide.

Purpose & Capability

The name/description match the code: the project crawls The Graph, classifies subgraphs, builds a registry, and exposes an MCP server. The capabilities requested by the code (crawl, classifiy, publish a DB and a REST/MCP API) are consistent with the stated purpose.

Instruction Scope

SKILL.md and README describe tools and an npx install and explain how to use the registry, but they omit that running the Python crawler/server reads an optional .env/GATEWAY_API_KEY and that the MCP server auto-downloads a prebuilt registry.db from a GitHub raw URL. The skill's runtime behavior includes network I/O (downloading registry.db, querying The Graph gateway) and optional reading of .env — none of which are declared in the skill metadata.

Install Mechanism

The SKILL.md install uses 'npx subgraph-registry-mcp' (npm package execution). The MCP server code will download a pre-built SQLite DB from a raw GitHub URL on first run. The skill metadata lists no install spec and claims no required binaries, but npx (Node) is required to run the provided npm package — this mismatch and the remote download from a raw URL raise supply-chain risk and warrant verification of the npm package and the GitHub release.

Credentials

Metadata declares no required env vars, but the code/README expect an optional GATEWAY_API_KEY (Graph gateway API key) via environment or .env for crawling/querying and the client-side query instructions tell users to replace [api-key] with their Graph API key. The skill does not request any unrelated credentials, but failing to declare the need for an API key and for Node/npx is an inconsistency the user should be aware of.

Persistence & Privilege

The skill is not set to always:true and does not request system-wide privileges. It writes its own data to its package/data directory (registry.db) and runs a local MCP/HTTP server if invoked — normal behavior for this kind of tool.

What to consider before installing

This package is functionally coherent with a subgraph registry, but there are several practical mismatches you should consider before installing or providing secrets: - The skill metadata declares no required binaries or env vars, but SKILL.md/README expect you to run 'npx subgraph-registry-mcp' (so Node/npx is required) and the Python crawler/server will read a GATEWAY_API_KEY from .env if you provide one. Treat the Graph API key as sensitive — don't paste it into unknown packages. - On first run the MCP server will download a pre-built registry.db from a raw GitHub URL. That file comes from a third-party GitHub repo (PaulieB14). Downloading binary data from a raw URL is a supply-chain risk; verify the upstream repository and its release artifacts before trusting them. - The package runs network requests (queries to The Graph gateway, GitHub download). If you need to run it, prefer: (1) inspecting src/index.js and the npm package owner on the npm registry, (2) verifying the GitHub repo and commit history, (3) running in an isolated environment/container, (4) or building the registry locally by running the Python pipeline (python registry.py) rather than relying on the prebuilt DB. - If you plan to use this skill inside an agent that has access to secrets, avoid providing your Graph API key to the skill unless you have verified the package source and are comfortable with the risk. What would increase confidence: a declared install spec that lists Node/npx, an explicit requires.env entry for GATEWAY_API_KEY (or an explicit statement that no credentials are required for read-only use), and verification that the npm package and GitHub repo are owned by a known/trusted maintainer.

Agent-friendly discovery of 15,500+ classified subgraphs on The Graph Network. Search by domain, network, protocol type, or natural language goal — get reliability-scored results with query URLs.

Tools

• search_subgraphs — Filter by domain (defi, nfts, dao, gaming), network (ethereum, arbitrum, base), protocol type (dex, lending, bridge), entity type, or keyword
• recommend_subgraph — Natural language goal like "find DEX trades on Arbitrum" returns the best matching subgraphs
• get_subgraph_detail — Full classification, entities, reliability score, and query instructions for a specific subgraph
• list_registry_stats — Registry overview with available domains, networks, and protocol types

Install

npx subgraph-registry-mcp

Use Cases

• Discover the right subgraph before querying The Graph
• Find high-reliability DeFi, NFT, DAO, or governance subgraphs by chain
• Get query URLs and entity schemas without manual exploration
• Compare subgraphs by reliability score (query fees, curation signal, indexer stake)