apollo-mcp-server
Fail
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches installation scripts for the Apollo MCP Server from the official mcp.apollo.dev domain.
- [REMOTE_CODE_EXECUTION]: Executes downloaded scripts directly using shell pipes (curl | sh and iwr | iex) to install the server binary on the host system.
- [COMMAND_EXECUTION]: Invokes npx to run the mcp-remote package and executes the apollo-mcp-server CLI tool to manage communication between the agent and the GraphQL endpoint.
- [PROMPT_INJECTION]: The execute and validate tools ingest GraphQL operation strings, creating an indirect prompt injection surface.
- Ingestion points: GraphQL operation parameters in the execute and validate tools.
- Boundary markers: None specified for the GraphQL operation input in references/tools.md.
- Capability inventory: Network access to remote GraphQL endpoints and execution of GraphQL mutations if configured.
- Sanitization: No explicit sanitization of operation content is described before the string is passed to the upstream API.
Recommendations
- HIGH: Downloads and executes remote code from: https://mcp.apollo.dev/download/nix/latest - DO NOT USE without thorough review
Audit Metadata