Fix GraphQL toolkit audit findings

.github/workflows/ci.yml

@@ -21,4 +21,5 @@ jobs:
         run: npm run lint
       - run: npm run typecheck
       - run: npm test
+      - run: npm run test:coverage:check
       - run: npm run build

.github/workflows/release.yml

@@ -33,9 +33,12 @@ jobs:
       - name: Upgrade npm (OIDC trusted publishing needs npm >= 11.5; pin 11)
         run: npm install -g npm@11
       - name: Install
-        run: npm ci || npm install
-      - run: npm run build --if-present
+        run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
       - run: npm test
+      - run: npm run test:coverage:check
+      - run: npm run build
       - name: Configure git identity
         run: |
           git config user.name "Mark Stuart"

README.md

@@ -8,7 +8,7 @@
   <a href="https://github.com/mstuart/graphql-agent-toolkit/actions/workflows/ci.yml"><img src="https://github.com/mstuart/graphql-agent-toolkit/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
   <a href="https://www.npmjs.com/package/graphql-agent-toolkit"><img src="https://img.shields.io/npm/v/graphql-agent-toolkit?label=npm" alt="npm"></a>
-  <img src="https://img.shields.io/badge/node-%E2%89%A518-339933.svg" alt="Node 18+">
+  <img src="https://img.shields.io/badge/node-%E2%89%A522-339933.svg" alt="Node 22+">
   <a href="https://deepwiki.com/mstuart/graphql-agent-toolkit"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
   <a href="https://socket.dev/npm/package/graphql-agent-toolkit"><img src="https://socket.dev/api/badge/npm/package/graphql-agent-toolkit" alt="Socket"></a>
 </p>
@@ -39,7 +39,7 @@ npm install graphql-agent-toolkit graphql
 
 ## Requirements
 
-- Node.js >= 18.0.0
+- Node.js >= 22.0.0
 - `graphql` >= 16.0.0 (peer dependency)
 - TypeScript >= 5.0 (optional, for type definitions)
 
@@ -67,7 +67,7 @@ import { fetchSchema, parseSchema } from 'graphql-agent-toolkit';
 
 const introspection = await fetchSchema({
   endpoint: 'https://your-api.com/graphql',
-  headers: { Authorization: 'Bearer YOUR_TOKEN' },
+  headers: { Authorization: `Bearer ${process.env.GRAPHQL_AUTH_TOKEN}` },
 });
 
 const schema = parseSchema(introspection);
@@ -109,7 +109,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 
 const server = await createAgentToolkitServer({
   endpoint: 'https://your-api.com/graphql',
-  headers: { Authorization: 'Bearer YOUR_TOKEN' },
+  headers: { Authorization: `Bearer ${process.env.GRAPHQL_AUTH_TOKEN}` },
   operationDepth: 2,
 });
 
@@ -262,16 +262,29 @@ graphql-agent-toolkit init \
   --output config.json
 ```
 
+`init` uses literal headers only for the introspection request. Generated config replaces header values with environment placeholders such as `Bearer ${GRAPHQL_AGENT_AUTHORIZATION}` so auth secrets are not persisted.
+
 ### `serve` -- Start MCP server
 
 ```bash
 # From a config file
+export GRAPHQL_AGENT_AUTHORIZATION=your-token
 graphql-agent-toolkit serve --config config.json
 
 # Directly from an endpoint
 graphql-agent-toolkit serve --endpoint https://your-api.com/graphql
 ```
 
+### Runnable examples
+
+```bash
+export GRAPHQL_ENDPOINT=https://your-api.com/graphql
+export GRAPHQL_AUTH_TOKEN=your-token # omit for public APIs
+
+node examples/langchain-structured.mjs
+node examples/mcp-server.mjs
+```
+
 ## MCP Server Usage
 
 Add to your MCP client configuration (e.g., Claude Desktop):
@@ -281,7 +294,10 @@ Add to your MCP client configuration (e.g., Claude Desktop):
   "mcpServers": {
     "my-graphql-api": {
       "command": "npx",
-      "args": ["graphql-agent-toolkit", "serve", "--endpoint", "https://your-api.com/graphql"]
+      "env": {
+        "GRAPHQL_AGENT_AUTHORIZATION": "your-token"
+      },
+      "args": ["graphql-agent-toolkit", "serve", "--config", "/absolute/path/to/config.json"]
     }
   }
 }
@@ -363,9 +379,7 @@ The `AgentToolkitConfig` object accepts:
 
 1. Clone the repository
 2. Install dependencies: `npm install`
-3. Run tests: `npm test`
-4. Build: `npm run build`
-5. Lint: `npm run lint`
+3. Run lint/typecheck/tests/coverage/build: `npm run lint && npm run typecheck && npm test && npm run test:coverage:check && npm run build`
 
 ## License
 

examples/langchain-structured.mjs

@@ -0,0 +1,21 @@
+import { GraphQLClient } from 'graphql-request';
+import { createStructuredTools, fetchSchema, parseSchema } from 'graphql-agent-toolkit';
+
+const endpoint = process.env.GRAPHQL_ENDPOINT;
+
+if (!endpoint) {
+  throw new Error('Set GRAPHQL_ENDPOINT before running this example.');
+}
+
+const token = process.env.GRAPHQL_AUTH_TOKEN;
+const headers = token ? { Authorization: `Bearer ${token}` } : undefined;
+const introspection = await fetchSchema({ endpoint, headers });
+const schema = parseSchema(introspection);
+const client = new GraphQLClient(endpoint, { headers });
+
+const tools = createStructuredTools(schema, {
+  execute: async (operation, variables) =>
+    JSON.stringify(await client.request(operation, variables)),
+});
+
+console.log(tools.map((tool) => tool.name).join('\n'));

examples/mcp-server.mjs

@@ -0,0 +1,18 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createAgentToolkitServer } from 'graphql-agent-toolkit';
+
+const endpoint = process.env.GRAPHQL_ENDPOINT;
+
+if (!endpoint) {
+  throw new Error('Set GRAPHQL_ENDPOINT before running this example.');
+}
+
+const token = process.env.GRAPHQL_AUTH_TOKEN;
+
+const server = await createAgentToolkitServer({
+  endpoint,
+  headers: token ? { Authorization: `Bearer ${token}` } : undefined,
+  operationDepth: 2,
+});
+
+await server.connect(new StdioServerTransport());