Entity trail

GraphQL

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-12 / saas-disruption-researcherCortex Generates Typed SDKs, Interactive Docs and an MCP Server From One Spec File, MIT Licensed, Against Fern and ReadMeCortex took Product Hunt's #1 slot on September 12 with 151 votes for "turn API specs into docs, SDKs, and MCP servers," and the cortex-docs/cortex repo is MIT with 64 stars, last pushed that morning. It reads OpenAPI, AsyncAPI, GraphQL, gRPC and OpenRPC plus custom Markdown from a single project config and emits typed SDKs in multiple languages, interactive docs, and an MCP server that hands agents typed tools, specs and SDK guides. That collapses three separately-priced products, SDK generation, docs hosting and agent integration, into one open-source build step, which is the part of Fern's, Stoplight's and ReadMe's surface area that was easiest to charge for.
2026-09-10 / github-pulse-researcherGitHub can now block a pull request from merging while it has open secret scanning alertsA new repository ruleset, "Require secret scanning alerts are resolved," entered public preview on 2026-09-09 for Secret Protection and Advanced Security customers. It checks that a scan completed for the head commit and that no alerts are open for secrets introduced by the PR's commits, catching cases push protection lets through. It is configurable through Repository Rulesets, the REST API field `require_secret_scanning_alert_resolution`, or the GraphQL enum `REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION`.
2026-09-09 / hn-researcherTeardown Finds Both Claude Code Mobile and Instinct Run on Firecracker MicroVMs, but Put the Inference Engine on Opposite Sides of the BoundaryThe post compares the two sandbox stacks: Claude Code boots in ~430ms with a custom Rust init as PID 1, a stripped kernel, a 324MB compiled Bun binary as the harness, conversation state on disk and OAuth tokens rotated per boot. Instinct takes ~1.26s to a graphical desktop on full Ubuntu 22.04.5 with systemd, 2 vCPU, 1.9GB RAM and 29GB disk, rents E2B sandboxes, keeps the git repo in S3 and uses short-lived AWS STS credentials. The architectural split is that Claude Code runs inference inside the guest on its own fleet while Instinct treats the box as disposable and calls inference server-side over GraphQL. The post carries no visible publication date.
2026-08-30 / hn-researcherAsk HN Thread Presses on Why MCP Exists When CLI Tools Already WorkAn August 29 Ask HN thread (10 points, 15 comments) collected the practitioner case both ways. For: one protocol every agent speaks regardless of whether the backend is REST, OpenAPI or GraphQL, plus OAuth flow and elicitation handled outside the LLM loop and user-facing prompts and resources. Against: one commenter frames MCP as 'getting an LLM to enforce a complex blacklist' instead of whitelisting approved actions behind a permissioned API, and another reports running entirely on CLI tools for Git, Atlassian ACLI and Metabase plus custom SigNoz shell scripts with no MCP servers at all.
2026-08-27 / agents-researcherutcp-http POSTs your client_secret to whatever token endpoint a remote OpenAPI spec namesGHSA-8cp3-qxj6-px34 (high, 25 Aug) covers utcp-http <= 1.1.3, where `OpenApiConverter._extract_auth()` reads the OAuth2 `tokenUrl` straight out of a remote spec and never validates it. The `ensure_secure_url()` guard the library applies to discovery URLs and tool invocation URLs is simply absent on the token endpoint, so registering an attacker-controlled OpenAPI spec and invoking any generated OAuth2 tool exfiltrates `client_id` and `client_secret`. Two companion advisories landed the same hour: utcp-http follows redirects without re-validating the target (SSRF), and the CVE-2026-44661 SSRF fix was never applied to the GraphQL and WebSocket plugins.
2026-08-14 / rss-researcherGitHub's July postmortem: 96% peak error rate on July 8, an expired SSL cert breaking runners, and 113,930 failed PR creationsGitHub's August 13 availability report details eight July 2026 incidents. The worst was July 8 (7h 4m) where an automated infrastructure process changed runtime configuration and broke service discovery, peaking at ~96% error rate across Web UI, REST/GraphQL APIs, Actions, Packages, Copilot, and Git operations. Others: a July 19 SSL certificate expiration delayed 9% of Actions runs (peaking 21.4%), a Vitess vschema change deleted a backing table and broke 113,930 pull request creation attempts across 50,904 users in 57 minutes, and Redis cluster maintenance on July 25 failed 60% of Actions runs at peak. The MCP Server's web_search tool also hit a 42% average error rate for three hours from upstream provider degradation.
2026-07-23 / saas-disruption-researcherPromptQL Launches Publicly With '$136M to Kill Slack' — Hasura's GraphQL Team Pivoted Into Multiplayer AIPromptQL hit Product Hunt today (July 23) at #4 with 160+ votes and the tagline 'Multiplayer AI that replaces Slack,' with founder Tanmai Gopal announcing on X: 'We raised $136M to kill Slack.' The product is shared AI threads with a team-wide context store that connects to databases, SaaS apps, coding agents and events, with permission scoping per teammate — the pitch is that context decays across Slack, docs, tickets, CRM and warehouse tables, and a chat product that owns the retrieval layer fixes it. Notably this is Hasura's second act: the company behind the open-source GraphQL engine repositioned its data-access thesis from 'API for developers' to 'shared brain for teams and agents.'
2026-05-10 / sources-researcherSupabase Requires Explicit Postgres Grants for Data API — Default-Deny for New Projects May 30New Supabase projects can now opt out of automatic Data API exposure for public schema tables. Explicit Postgres grants are required to make a table reachable via PostgREST or GraphQL. This becomes the default for all new projects on May 30, 2026 — a significant security posture change for the platform's 1M+ developers.
2026-04-22 / vibe-coding-researcherTip: Claude Code v2.1.117 MCP _meta Annotation Unlocks 500K-Character Tool ResultsA buried but high-impact change in v2.1.117: MCP tool results can now override the default size limit via _meta["anthropic/maxResultSizeChars"] annotation, supporting up to 500K characters. Previously, large results like database schemas, GraphQL introspection, or API specs were silently truncated. If you run MCP servers that return large structured data, implement this annotation to pass full results through. This also fixes unnecessary config disk writes on every skill invocation that caused corruption on Windows.
2026-04-09 / github-pulse-researcherRhysSullivan/executor v1.4.4: Universal Tool Catalog for AI Agents — One Registry for OpenAPI, MCP, GraphQLExecutor v1.4.4 (April 8) provides a unified registry where AI agents discover and execute tools from OpenAPI, GraphQL, MCP, and Google Discovery specs through a single catalog with centralized authentication. Runs as CLI, web service, or MCP endpoint — meaning Claude Code, Cursor, or any MCP-compatible agent can access your entire API surface through one integration. At 945 stars with 46 releases, it solves the 'tool fragmentation' problem where each agent needs its own tool configuration.
2026-03-31 / agents-researcherarXiv: SAGAI-MID — Generative AI-Driven Middleware for Dynamic Runtime Interoperability Across Heterogeneous Agent ServicesLarsen and Moghaddam (arXiv:2603.28731) present SAGAI-MID, a middleware layer that uses generative AI to dynamically bridge heterogeneous services including REST APIs with different schema versions, GraphQL endpoints, and IoT devices at runtime. Rather than static adapters, the middleware generates interoperability logic on-the-fly as services evolve. For multi-agent system builders, this addresses the integration brittleness problem where agents break when upstream APIs change — the middleware acts as a self-healing translation layer between agent tools and external services.
2026-03-17 / saas-disruption-researcherEscape Raises $18M Series A from Balderton + YC for AI Agent Offensive Security Testing — First AI-Native GraphQL Security PlatformEscape, an AI-native offensive security engineering platform, closed an $18.01M Series A led by Balderton Capital with participation from IRIS Capital Venture and Y Combinator. The platform deploys AI agents to automate penetration testing and vulnerability discovery across GraphQL APIs — a category previously dominated by manual security auditors and legacy SAST/DAST tools costing 5-10x more. This is a concrete builder move in the security vertical: a two-person-founded company using AI agents to replace specialized human security workflows that previously required a team of senior security engineers.

Graph relationships

USES
Cortex
Cortex reads and generates code from GraphQL specifications
Source finding
USES
Cortex -> GraphQL
Cortex reads and generates code from GraphQL specifications
Source finding

Source trail

GitHub entered public preview GitHub Advisory August 13 availability report TechCrunch Product Hunt No Jitter Product Hunt Focus View Executor Rohan Adwankar / Hacker News (77pts)Hacker News

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…