Reference

The wire contract for the Graphistry visualization MCP endpoint. See Graphistry MCP for connecting and authenticating.

 

Methods

MethodAuthNotes
POST /mcpinitializeNone Returns protocolVersion, capabilities, and server instructions. Sets the mcp-session-id response header.
POST /mcptools/listNone Returns all nine tool definitions. Requires mcp-session-id.
POST /mcptools/callRequired Executes a tool. Requires mcp-session-id and an Authorization header.
POST /mcp — notificationsNone Acknowledged with 202.
GET /mcpNone Opens the SSE stream the transport expects; requires mcp-session-id. The server holds it open but does not push notifications.
DELETE /mcpNone Closes the MCP transport session.

Only tools/call requires a credential.

 

Tools

Every tool except list_sessions takes session_id, the id of a live Graphistry visualization. Tools marked owner may only be called by the person who has that visualization open; tools marked read are also available to anyone entitled to view the underlying dataset.

list_sessionsread

Lists your own active visualization sessions — the ones opened by the account whose credential you sent. It never enumerates other people's sessions. Takes no arguments.

Treat the result as a best-effort list rather than a complete one: a session you know is open can be absent. The more reliable source is the viewer's own address bar — the session= parameter of their visualization URL is the same id. Every other tool takes the session_id directly and is unaffected.

get_session_inforead

Returns a plain-text schema summary for one session — not JSON. The result is a newline-separated block giving the session id, node and edge counts, and the node and edge column names with their dtypes, plus the workbook title and description when they are set. Call this before your first query and choose column names only from the schema it returns. It does not inspect stored values — use query_graph for that.

Very wide graphs are truncated: at most 120 column names are listed per axis, taken from both ends of the list, and the remainder is reported inline as (+N more not listed). Treat that count as a signal to query for the columns you need rather than assuming the summary is exhaustive.

Arguments: session_id (required).

query_graphread

Runs a read-only query to filter, traverse, or summarize the graph.

ArgumentTypeNotes
session_idstringRequired.
gfql_operationsstring Required. A JSON string holding a GFQL operation array or a Let expression, or one whole read-only Cypher query.
output_typeenum shape (default, counts only), nodes, edges, or all.
formatenum Leave unset. Only json is returned; csv is advertised in the schema but is not supported, and asking for it either has no effect or fails the call.

A query that matches nothing returns success with zero rows. Some malformed shapes do the same, so treat an empty result as unverified until you have confirmed the columns and values exist. Node steps filter with filter_dict; Edge steps use direction, hops, and edge_match. Numeric comparisons are predicate objects such as {"type":"GT","val":10}; a plain value means equality.

create_collectionowner

Colors the nodes or edges matching a GFQL expression, and the viewer sees the change immediately. See Collections for how collections stack and the palette list.

ArgumentTypeNotes
session_idstringRequired.
namestringRequired. Shown in the collections panel.
gfql_operationsstring Required. JSON-encoded GFQL array or Let object. A single operation must still be wrapped in an array. Cypher is not accepted here.
node_colorstringHex, #RRGGBB or #RRGGBBAA.
palettestringPalette name, for example Blues. If both are given, node_color wins.
descriptionstringOne-line summary.

Validate the expression with query_graph first, then pass the identical string here. The response carries collection.matchCount — the number of elements colored, or null when the count is unknown. Do not read null as zero.

A collection whose name already exists is replaced, not added alongside. Vary the name to keep both.

list_collectionsread

Lists the collections on the graph, each with its id, name, position (0 = rendered on top), and color. Call this before any tool that takes a collection_id.

Arguments: session_id (required).

update_collectionowner

Renames or recolors an existing collection. Does not change which elements match.

Arguments: session_id, collection_id (both required); name, node_color, palette (all optional, omit rather than passing null).

delete_collectionowner

Deletes one collection, leaving the rest intact. The built-in global background layer cannot be deleted.

Arguments: session_id, collection_id (both required).

reorder_collectionsowner

Sets render order. Where collections overlap, an earlier one is painted on top of a later one. Ids left out of the array keep their relative order after the listed ones.

Arguments: session_id, order (array of collection ids, first = on top).

reset_collectionsowner

Clears every collection at once, returning the graph to its default view.

Arguments: session_id (required).

 

Results and errors

A tools/call returns the tool's payload as JSON serialized into a text content block, so the caller decodes twice: once for the JSON-RPC envelope, then again for result.content[0].text.

Check for failure by looking for an error key in that decoded payload, not by checking isError. When a tool fails for a reason of its own — an invalid query, a column that does not exist — it reports that failure inside its payload and the response is still an ordinary HTTP 200 success with no isError flag:

{"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text",
  "text":"{\"error\":\"[column-not-found] Column \\\"degree\\\" does not exist in dataframe\"}"}]}}

isError: true appears only when a tool crashes unexpectedly. A client that branches on isError alone will read ordinary tool failures as successes. Transport and authorization failures are different again — those use HTTP status codes and JSON-RPC error codes, listed below.

HTTPCodeMeaning
400-32700Parse error — body is not JSON-RPC.
400-32000Missing mcp-session-id header.
400-32602Invalid params.
401-32001Missing or invalid credential. Carries a WWW-Authenticate header.
403-32003Talk2Graph is not enabled for the account.
403-32002Caller may not modify, or may not access, this session.
404-32000Unknown or expired mcp-session-id. Re-initialize.
410-32004Session owner unavailable — the visualization closed.
500-32603Internal error.
503-32006Authorization check could not be completed. Retry.
504-32005Tool call timed out.
-32601Unknown method or unknown tool name.
 

Limits

LimitValue
Collections per session10 (oldest dropped past the cap)
Query rows returned50 (20 when no columns are projected)
Tool call timeout60 seconds
Credential revocation latencyUp to 60 seconds — a revoked key can still work briefly
 

Registry metadata

For clients that read a server.json manifest, the descriptor for this endpoint is below. It is not served from your Graphistry host and is not published to the MCP registry — copy it into your own tooling. A client that understands manifest variables will prompt you for host; anything else needs {host} replaced with your Graphistry hostname by hand.

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "com.graphistry/viz",
  "title": "Graphistry Visualization",
  "description": "Query and recolor a live Graphistry graph visualization session",
  "version": "1.0.0",
  "websiteUrl": "https://hub.graphistry.com/docs/mcp/intro/",
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://{host}/mcp",
      "variables": {
        "host": {
          "description": "Your Graphistry server host, for example hub.graphistry.com",
          "isRequired": true
        }
      },
      "headers": [
        {
          "name": "Authorization",
          "description": "Bearer <key_id>:<key> using a Graphistry personal key, or Bearer <jwt> using a viewer token. Required on tools/call.",
          "isRequired": true,
          "isSecret": true
        }
      ]
    }
  ]
}