Bridge — hosted MCP for any GraphQL API

Bridge is the hosted companion to graphql-mcp. Paste any GraphQL endpoint into your MCP client, attach your own auth headers, and Bridge exposes every query and mutation as an MCP tool that your agent can call. No code, no servers, no keys to sign up for.

It is the fastest way to get a GraphQL API into Claude, Cursor, or any MCP-speaking client — and a zero-effort demo of what graphql-mcp does under the hood.

Generate your MCP URL

GraphQL endpointMCP URL (paste this into your MCP client)

The upstream URL is base64url-encoded — no tricky %3A%2F characters to escape in your JSON config.

One-line setup

Bridge accepts either a base64url-encoded upstream (the form the generator above produces) or a standard URL-encoded upstream:

https://bridge.graphql-mcp.com/mcp/<base64url upstream>        ← cleaner
https://bridge.graphql-mcp.com/mcp/<url-encoded upstream>      ← also works

For example, to expose the public Countries API:

{
  "mcpServers": {
    "countries": {
      "url": "https://bridge.graphql-mcp.com/mcp/aHR0cHM6Ly9jb3VudHJpZXMudHJldm9yYmxhZGVzLmNvbS9ncmFwaHFs"
    }
  }
}

Restart your MCP client and every query the Countries API exposes is now a tool.

Authenticated APIs

Pass your upstream credentials via your MCP client's headers. Bridge forwards Authorization, X-API-Key, and Cookie to the upstream by default — everything else is stripped.

{
  "mcpServers": {
    "github": {
      "url": "https://bridge.graphql-mcp.com/mcp/aHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9ncmFwaHFs",
      "headers": {
        "Authorization": "Bearer ghp_yourtoken"
      }
    }
  }
}

Bridge never stores or logs header values. See Security for details.

When to use Bridge vs. the library

Bridge is the best place to start — try your API in an MCP client in under a minute. Graduate to the graphql-mcp library when you need any of:

• Private GraphQL endpoints not reachable from the public internet.
• Custom tool shaping with the @mcp directive (rename, hide, annotate).
• Higher request volume than Bridge's public rate limit.
• Co-location with your API for lower latency.
• Auth schemes beyond simple header forwarding.

Bridge and the library share the same engine: anything that works on one works on the other. Moving from Bridge to self-hosted graphql-mcp is a few lines of Python.

Limits

Bridge is free and anonymous. To keep it that way:

• 60 requests per minute per IP, token bucket.
• 30 second upstream timeout.
• 5 MB maximum upstream response.
• Upstreams must be reachable on the public internet (no RFC1918, loopback, or link-local addresses).
• Upstream schema introspection must be enabled.

If you need more, self-host Bridge — it's open source.

How it works

1. Your MCP client sends a tools/list or tools/call to bridge.graphql-mcp.com/mcp/<encoded-upstream>.
2. Bridge validates the upstream URL and rate-limits by IP.
3. On the first hit for a given upstream, Bridge introspects the schema once, builds an MCP tool surface, and caches the whole thing in memory (1 hour TTL).
4. Every subsequent request is a cache hit — Bridge just forwards the query to the upstream, passing your auth headers verbatim.

Bridge is built directly on GraphQLMCP.from_remote_url(). It adds caching, SSRF protection, header allowlisting, and rate limiting on top — nothing more.