Grafbase

@grafbase list all active API keys for our production graph and show when each was last used

Found 4 active API keys for your production graph: 1. 'ci-deploy-key' (created 2024-01-15, last used 2 hours ago) - Full access 2. 'frontend-prod' (created 2024-02-01, last used 12 minutes ago) - Read-only 3. 'analytics-service' (created 2024-02-10, last used 3 days ago) - Read-only 4. 'admin-backup' (created 2023-11-20, never used) - Full access The 'admin-backup' key hasn't been used in over 3 months. Consider rotating or removing unused keys for security.

This example shows Grafbase's key management capabilities. Requires API_KEY auth with admin scope to list keys across the project. The MCP can surface security hygiene issues like stale credentials, but cannot determine if a key is actually needed—coordinate with your team before revoking access.

@grafbase delete the schema check from yesterday's failed CI run, then create a new check for the branch 'feature/user-profiles'

Deleted schema check 'chk_8x2mq9' from the failed CI run (2024-03-14 16:42 UTC). Created new schema check for branch 'feature/user-profiles': - Check ID: chk_9p4fn1 - Status: In progress - Comparing against: main branch schema - Validating: Breaking changes, composition errors, deprecated field usage The check will complete in ~30 seconds. You'll receive a webhook notification if breaking changes are detected.

Demonstrates Grafbase's schema validation workflow for federated graphs. Deleting a check is permanent and removes its history from the registry—useful for cleaning up noise from aborted CI runs. Schema checks run asynchronously; the MCP confirms creation but doesn't wait for results.

@grafbase review our audit logs from the past week and summarize any unusual extension or MCP server configuration changes

Reviewed 47 audit log entries from March 8-15, 2024. Key findings: **Extension changes (3 events):** - March 12: 'auth-validator' extension updated by sarah@team.com (config change: added new OAuth provider) - March 14: 'rate-limiter' extension deleted by deploy-bot (automated cleanup) **MCP server changes (2 events):** - March 10: MCP server enabled for project 'api-gateway' by admin@team.com - March 13: MCP server 'mcp_5x8kl' disabled by system (health check failure) The automated MCP disable on March 13 is unusual—typically indicates connectivity issues. Check server logs for that timeframe.

Showcases how the AI can synthesize Grafbase audit data to surface operational anomalies. Note that Grafbase's audit log API may not support programmatic deletion (per tool description), so this is read-only analysis. Useful for post-incident review or compliance reporting, but audit retention policies are set at the account level.

When Grafbase MCP makes schema checks a team habit

A product team with 8 backend engineers ships 3-5 GraphQL schema changes per week. Without automation, schema reviews happen in PR comments and breaking changes slip through. The Grafbase MCP gives your AI assistant direct access to schema checks, audit logs, and extension configs—so standup conversations shift from 'did anyone review the schema?' to 'Claude, show me failed checks from yesterday and flag the breaking ones.' The MCP's 19 tools cover the full lifecycle: create checks, delete stale schemas, revoke API keys when contractors leave. This works until your schema registry hits 200+ versions or you need custom governance rules—at that threshold, you're writing your own tooling anyway. If your team merges schema changes daily and wants AI-native guardrails, Grafbase MCP turns schema governance into a Slack thread instead of a Jira ticket.

Revoking Grafbase keys without opening the dashboard

A 3-person startup hires contractors for a 6-week build, grants them Grafbase API keys for local dev, then needs to revoke access when the contract ends. The Grafbase MCP's Delete API Key and audit log tools let you handle this in Switchy: 'Claude, list all keys created in the last 60 days, then revoke the ones tagged contractor-Q1.' The AI cross-references audit logs to confirm which keys were actually used, so you're not blindly deleting. This scenario assumes you're already tagging keys at creation—if your key hygiene is messy, the MCP can't infer intent from names like 'test-key-final-v2.' The win is speed: offboarding moves from a 15-minute dashboard hunt to a 90-second AI conversation. If you onboard and offboard external devs more than twice a quarter, this MCP pays for itself in saved context-switching.

Keeping staging and prod MCP servers in sync

A 5-engineer team runs Grafbase in staging and production, each with its own MCP server config. After a few sprints, the configs diverge—staging has debug extensions enabled, prod is missing a schema check that staging relies on. The Grafbase MCP's Enable/Disable MCP Server and Delete Extension tools let you audit and reconcile: 'Claude, compare MCP server settings between staging and prod, then disable the debug extension in staging to match prod.' The AI reads both environments' configs, flags the diff, and executes the changes in sequence. This assumes you have API keys scoped per environment and you're comfortable letting the AI write to prod (if not, use Switchy's approval gates). The boundary: if your team ships to more than 3 environments or has complex RBAC, the MCP's flat tool list gets unwieldy—you'll want Terraform or a custom CLI. For 2-3 environments and weekly deploys, this MCP keeps config drift from becoming a post-mortem footnote.