Follow-along: Mutation mode and introspection

7. Follow-along: Mutation mode and introspection

Mutation mode

The MCP server's mutation_mode can be configured for:

No mutations to run (mutation_mode: none, which is the default)
Allowing pre-defined mutation operations through local files, operation collections and Persisted Queries but it blocks the LLM from creating ad-hoc mutations (mutation_mode: explicit)
Allowing any mutations to run (mutation_mode: any)

Introspection

You can configure the following MCP server tools to enable introspection capabilities:

introspect: Get the full GraphQL schema
search: Search for types, fields, or other schema elements
validate: Validate GraphQL queries without executing them
execute: Execute GraphQL operations dynamically

By default, all of these tools are disabled. To disable them, set enabled: false for the tools you want to disable, or omit them entirely from the configuration file.

Currently, our MCP server has enabled all the tools, but it would be better to disable the execute tool to prevent the LLM from executing arbitrary queries.

Follow-along: Configuring mutation mode and introspection (⏳ 5 min)

Goal: Configure the MCP server to only allow pre-defined mutation operations and disable the execute tool.

Steps

We need to add a mutation tool to our project. Copy the operation below and create a new file in your operations folder called AddFundsToWallet.graphql.

# this operation adds funding to a logged in user account
mutation AddFundsToWallet($amount: Float!) {
  addFundsToWallet(amount: $amount) {
    message
    success
  }
}

In your MCP Inspector click Clear Tools then List Tools. The mutation should not be present. (you may need to log in again if you session expires)
Configure the MCP server to only allow pre-defined mutation operations. This blocks the LLM from creating ad-hoc mutations.
mcp/mcp.yaml
overrides:
mutation_mode: explicit

Configure the MCP server to disable the execute tool.

mcp/mcp.yaml

introspection:
  execute:
    enabled: false

Restart the MCP server.

rover dev --supergraph-config supergraph.yaml --router-config router.yaml  --mcp mcp.yaml

Connect to the MCP Inspector. You should see a new AddFunds tool (a mutation) and the absence of the execute tool.
Task!
I've configured the MCP server's mutation mode and disabled the execute tool.