{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "hygraph", "name": "Hygraph", "vendor": "Hygraph GmbH", "vendorUrl": "https://hygraph.com", "kind": "http-api", "category": "cms", "summary": "Hygraph is a hosted headless CMS from Hygraph GmbH in Berlin. Agents read and write entries, assets and localisations through a GraphQL Content API, change schema through a Management API and SDK, or connect through a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/hygraph", "markdownUrl": "https://www.anchorterminal.com/tools/hygraph.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hygraph.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hygraph.json", "repo": "https://github.com/hygraph/management-sdk", "license": "Proprietary service under Hygraph GmbH's Terms of Service. The `@hygraph/management-sdk` package is MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://mcp.hygraph.com/mcp", "packages": [ { "registry": "npm", "name": "@hygraph/management-sdk" } ], "auth": "mixed", "authNotes": "Self-serve. The Content API and Management API take a Permanent Auth Token as a Bearer header. A person creates the token in Project Settings and sets its content permissions (by model, stage, locale, environment and action) and its Management API permissions. A new token has none enabled. Deleting a token invalidates it, and no expiry or rotation was found. The project MCP endpoint takes the same token. The global MCP endpoint uses a browser login through auth.hygraph.com and follows the user's own permissions. OAuth for third-party apps needs a client ID from Hygraph support. No app review or sales approval is needed for tokens.", "pricing": "freemium", "pricingNotes": "The Hobby plan is free with no card and includes 500,000 API calls a month, 1,000 entries, 2 locales and 3 API tokens. Usage past the limit is blocked until the next period. Growth is $199 a month with 1,000,000 API calls, and overage of $0.20 per 10,000 API operations and per GB of asset traffic. Enterprise is sold through sales, with a 30-day trial that needs no card (https://hygraph.com/pricing, checked 2026-10-08).", "priceSummary": "$199 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the MCP server docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 17, "popularity": { "githubStars": 52, "npmWeekly": 8645, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://hygraph.com/docs/api-reference", "llmsTxt": "https://hygraph.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets", "cms.localisation", "cms.schema" ], "tags": [ "official", "hosted", "mcp", "graphql", "closed-source", "no-card", "free-tier", "llms-txt", "webhooks", "typescript", "status-page", "soc2" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 69.3, "grade": "B", "agentReady": false, "rank": 182, "ranked": true, "rankOf": 842, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 74, "payments": 35, "reliability": 89, "schema": 78, "security": 63, "transparency": 60 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 89, "points": 17.8, "reason": "Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com with the API and the asset CDN as components for 11 regions and an incident feed back to 2021 (20). In the 90 days to 8 October 2026 it lists one incident, 36 minutes on 7 August when new sign-ups were unavailable, marked major, with existing users unaffected (26 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. `Retry-After` is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 78, "points": 12.68, "reason": "GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root `llms.txt` with a Markdown copy of every docs section under `/llms-full/` (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on `execute_graphql` (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries `/v2/` and the changelog is public and dated. No API versioning policy was found (10)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "GraphQL field selection sizes every response, `first` defaults to 10 and is capped at 100, and the MCP tool `list_entities` takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). `first`, `last`, `skip`, `before` and `after`, Relay connections, typed `where` filters and ordering (20). Errors use documented HTTP statuses and a `requestId`, with free-text messages and no machine code (11). No idempotency keys. `upsert` mutations key on a unique field, batch migrations apply all or nothing with a `dry_run` on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 63, "points": 11.03, "reason": "Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing `execute_graphql`. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. `/.well-known/security.txt` answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). Growth is $199 a month, with overage of $0.20 per 10,000 API operations and per GB of asset traffic. Enterprise is priced through sales (15). The Hobby plan needs no card and includes 500,000 API calls a month (20). A person signs up in a browser by email or social login and creates the token in Studio (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "reason": "The changelog's newest entry is 30 September 2026 (30). Entries on 30 July, 31 August and 30 September, and `@hygraph/management-sdk` 1.6.1 on 19 August (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows 9 open issues and no push since 13 September 2024 (9 of 15). The Management SDK is current on npm. The official MCP registry returned no Hygraph entry (11). npm has three SDK releases since June 2026, and the public repository does not carry them, so CI could not be seen (4)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "note": "editorial 45, provenance 75", "reason": "Closed service under published Terms of Service from Hygraph GmbH, with the Management SDK under MIT (15 of 30). The privacy policy, last updated 19 March 2025, covers the service and lists six categories of service provider without naming them. Retention is stated only as the legal period, the terms disclaim liability for deleted content, and no data processing agreement was found (12). Dated notices for the 2025 move off the legacy asset system and a statement that the old `@graphcms/management` SDK is deprecated. The terms allow the service to change without prior notice (10). The status page and pricing page name 11 hosting regions. Sub-processors are not named (8)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "GraphQL field selection sizes every response, `first` defaults to 10 and is capped at 100, and the MCP tool `list_entities` takes a limit and field selection. The project MCP endpoint lists 17 tools (22 of 25). `first`, `last`, `skip`, `before` and `after`, Relay connections, typed `where` filters and ordering (20). Errors use documented HTTP statuses and a `requestId`, with free-text messages and no machine code (11). No idempotency keys. `upsert` mutations key on a unique field, batch migrations apply all or nothing with a `dry_run` on the MCP tool, and MCP rejects delete and unpublish. We couldn't read the tool annotations (12). Only the Bearer header is required and any GraphQL client works. The one official SDK covers the Management API in JavaScript and TypeScript (7).", "maintenance": "The changelog's newest entry is 30 September 2026 (30). Entries on 30 July, 31 August and 30 September, and `@hygraph/management-sdk` 1.6.1 on 19 August (20). Public changelog, a community Slack, in-app chat and email support on Growth. The SDK's GitHub repository shows 9 open issues and no push since 13 September 2024 (9 of 15). The Management SDK is current on npm. The official MCP registry returned no Hygraph entry (11). npm has three SDK releases since June 2026, and the public repository does not carry them, so CI could not be seen (4).", "payments": "No x402, MPP or L402 (0). Growth is $199 a month, with overage of $0.20 per 10,000 API operations and per GB of asset traffic. Enterprise is priced through sales (15). The Hobby plan needs no card and includes 500,000 API calls a month (20). A person signs up in a browser by email or social login and creates the token in Studio (0).", "reliability": "Graded on the GraphQL Content and Management APIs, with the hosted MCP server noted. Public status page at status.hygraph.com with the API and the asset CDN as components for 11 regions and an incident feed back to 2021 (20). In the 90 days to 8 October 2026 it lists one incident, 36 minutes on 7 August when new sign-ups were unavailable, marked major, with existing users unaffected (26 of 30). Rate limits published by plan as uncached requests a second (5, 25, up to 500) and concurrent operations (15). The docs give exponential backoff guidance with sample code. `Retry-After` is documented only for asset transformation limits, and there are no idempotency keys (10). The pricing page lists an Enterprise uptime SLA of up to 99.95%. The SLA document was not found (8). The APIs and the MCP server carry no beta label (10).", "schema": "GraphQL introspection is on by default for each project's Content API, so the contract is machine-readable and specific to the project. The Management API answered 401 to an introspection query without a token, and no static schema file was found (20 of 25). A root `llms.txt` with a Markdown copy of every docs section under `/llms-full/` (10). The Management SDK page states when to use it and when not to, and the MCP tools reference gives each of 19 tools one line with a warning on `execute_graphql` (15). Inputs are typed per model with enums and required fields. Rich Text takes an AST and JSON fields are free-form (13). Request and response examples throughout, and an errors page for nine HTTP statuses. Error bodies carry a message only, with no code list (10). The endpoint path carries `/v2/` and the changelog is public and dated. No API versioning policy was found (10).", "security": "Permanent Auth Tokens are JWTs sent as a Bearer header, each limited by model, stage, locale, environment and action, with separate Management API permissions, and deleting one invalidates it. No expiry or rotation was found. The global MCP endpoint uses OAuth through auth.hygraph.com with PKCE and a registration endpoint, with access following the user's own permissions (25 of 30). New tokens start with no permissions, MCP token presets include read-only and content-only, MCP rejects delete and unpublish, and public API access is off by default. The API itself has no confirmation step (17). The docs warn against always allowing `execute_graphql`. No guidance on treating stored content as untrusted input was found (5). Audit logs are Enterprise only with 90 days of retention and record the token that made a change (7). The site states SOC 2 Type 2 and ISO 27001 certified hosting. `/.well-known/security.txt` answered 404, no disclosure policy or bounty was found, and the trust report on app.drata.com answered 403 (9).", "transparency": "Closed service under published Terms of Service from Hygraph GmbH, with the Management SDK under MIT (15 of 30). The privacy policy, last updated 19 March 2025, covers the service and lists six categories of service provider without naming them. Retention is stated only as the legal period, the terms disclaim liability for deleted content, and no data processing agreement was found (12). Dated notices for the 2025 move off the legacy asset system and a statement that the old `@graphcms/management` SDK is deprecated. The terms allow the service to change without prior notice (10). The status page and pricing page name 11 hosting regions. Sub-processors are not named (8)." }, "sources": [ { "what": "robots.txt, with no Content-Signal line", "url": "https://hygraph.com/robots.txt", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://hygraph.com/llms.txt", "seen": "2026-10-08" }, { "what": "API reference, Markdown copy", "url": "https://hygraph.com/llms-full/api-reference.txt", "seen": "2026-10-08" }, { "what": "API limits", "url": "https://hygraph.com/docs/api-reference/basics/api-limits", "seen": "2026-10-08" }, { "what": "authorisation and endpoints", "url": "https://hygraph.com/docs/api-reference/basics/authorization", "seen": "2026-10-08" }, { "what": "errors", "url": "https://hygraph.com/docs/api-reference/basics/errors", "seen": "2026-10-08" }, { "what": "mutations", "url": "https://hygraph.com/docs/api-reference/content-api/mutations", "seen": "2026-10-08" }, { "what": "Management SDK", "url": "https://hygraph.com/docs/api-reference/management-sdk/management-sdk", "seen": "2026-10-08" }, { "what": "MCP server overview", "url": "https://hygraph.com/docs/hygraph-ai/mcp-server", "seen": "2026-10-08" }, { "what": "MCP server setup", "url": "https://hygraph.com/docs/hygraph-ai/mcp-server-setup", "seen": "2026-10-08" }, { "what": "MCP tools reference", "url": "https://hygraph.com/docs/hygraph-ai/mcp-tools-reference", "seen": "2026-10-08" }, { "what": "token permissions, Markdown copy of Get Started", "url": "https://hygraph.com/llms-full/getting-started.txt", "seen": "2026-10-08" }, { "what": "audit logs, backups and versioning", "url": "https://hygraph.com/docs/developer-guides/project/audit-logs", "seen": "2026-10-08" }, { "what": "pricing and plan comparison", "url": "https://hygraph.com/pricing", "seen": "2026-10-08" }, { "what": "Terms of Service", "url": "https://hygraph.com/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://hygraph.com/privacy", "seen": "2026-10-08" }, { "what": "imprint", "url": "https://hygraph.com/imprint", "seen": "2026-10-08" }, { "what": "security feature page", "url": "https://hygraph.com/features/secure", "seen": "2026-10-08" }, { "what": "changelog", "url": "https://hygraph.com/changelog", "seen": "2026-10-08" }, { "what": "status incidents feed", "url": "https://status.hygraph.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status components", "url": "https://status.hygraph.com/api/v2/summary.json", "seen": "2026-10-08" }, { "what": "MCP protected resource metadata", "url": "https://mcp.hygraph.com/.well-known/oauth-protected-resource/mcp", "seen": "2026-10-08" }, { "what": "OAuth server metadata", "url": "https://auth.hygraph.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "npm, @hygraph/management-sdk", "url": "https://registry.npmjs.org/@hygraph/management-sdk", "seen": "2026-10-08" }, { "what": "GitHub organisation repositories", "url": "https://api.github.com/orgs/hygraph/repos?per_page=100\u0026sort=pushed", "seen": "2026-10-08" }, { "what": "official MCP registry search, no result", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=hygraph", "seen": "2026-10-08" }, { "what": "security.txt, 404", "url": "https://hygraph.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.org/domain/hygraph.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the trust report linked from hygraph.com/security-and-compliance redirects to app.drata.com, which answered 403, so the SOC 2 report, any penetration test summary and any sub-processor list there were unread", "unchecked: the MCP tool definitions, their JSON Schemas and their readOnlyHint and destructiveHint annotations, because listing tools needs a token. The tool count comes from the docs", "unchecked: whether GitHub CI passes for the Management SDK, because the public repository is behind the npm releases", "No data processing agreement, sub-processor list, SLA document, API versioning policy, token expiry or rotation, or a restore mutation for versions was found in the pages read", "The yearly price for Growth is drawn by script on the pricing page and was not read. Whether failed requests count as API operations was not found", "The lead was right about the vendor and the two GraphQL APIs. It did not mention the hosted MCP server, which the docs list as available on all projects" ] }, "negative": 0, "verdict": "Tokens are limited by model, stage, locale and action, the GraphQL schema is typed and introspectable, and a hosted MCP server rejects delete and unpublish operations. Error bodies carry a message without a machine code, there are no idempotency keys, audit logs are Enterprise only, and no data processing agreement, sub-processor list or security.txt was found.", "bestFor": "Teams on Hygraph who want an agent to create, localise and publish entries, upload assets or change schema, with delete and unpublish kept out of reach on MCP.", "strengths": [ "Permanent Auth Tokens are limited by model, stage, locale, environment and action, and a new token starts with no permissions enabled", "The hosted MCP server rejects `delete*` and `unpublish*` operations, and `submit_batch_migration` takes `dry_run` and applies schema changes in one transaction", "GraphQL field selection, `first`, `skip` and cursor arguments and typed filters size every response. The default page is 10 entries and the maximum 100", "The Hobby plan needs no card and includes 500,000 API calls a month, 1,000 entries and 3 API tokens", "`llms.txt` links a Markdown copy of every documentation section, and the changelog has dated entries for 30 July, 31 August and 30 September 2026" ], "weaknesses": [ "GraphQL error bodies carry a message and a `requestId` with no machine-readable code, and only asset transformation 429 responses are documented with `Retry-After`", "No idempotency keys in the reviewed documentation. Safe retries rest on `upsert` mutations keyed on a unique field", "Audit logs, backups with recovery and an uptime SLA are Enterprise only, and version history is absent on Hobby and 14 days on Growth", "No data processing agreement, named sub-processor list, security.txt or disclosure policy was found on hygraph.com. The privacy policy names categories of service provider only", "The only official SDK is `@hygraph/management-sdk` for JavaScript and TypeScript, and its public GitHub repository was last pushed on 13 September 2024" ], "agentNotes": [ "Send the Permanent Auth Token as `Authorization: Bearer \u003ctoken\u003e` to `https://\u003cregion\u003e.hygraph.com/v2/\u003cprojectId\u003e/\u003cenvironment\u003e`. Read the schema by introspection first, because every type is generated from the project's models", "Mutations write to DRAFT. Call `publish\u003cModel\u003e` with `to: [PUBLISHED]` as a separate mutation, and pass `locales` to write or publish a localisation", "Stay under the plan's limit for uncached requests (5 a second on Hobby, 25 on Growth) and its concurrent mutations (5 and 10). Back off exponentially on 429", "Upload an asset with `createAsset`, then POST the file to the returned pre-signed URL, or pass `uploadUrl` for a remote file. The asset stays `ASSET_CREATE_PENDING` until processed", "Schema changes go to the Management API through `@hygraph/management-sdk` or the MCP tool `submit_batch_migration`. Version restore has no documented mutation, so read `\u003cmodel\u003eVersion` and write the old values back" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.3 } ], "editorialScores": { "ergonomics": 72, "maintenance": 74, "payments": 35, "reliability": 89, "schema": 78, "security": 63, "transparency": 45 }, "provenanceScore": 75 }, "connect": { "install": "npm install @hygraph/management-sdk", "claudeCode": "claude mcp add hygraph https://mcp-{REGION}.hygraph.com/{PROJECT_ID}/{ENVIRONMENT}/mcp \\\n --transport http \\\n --header \"Authorization: Bearer ${HYGRAPH_TOKEN}\"", "config": { "mcpServers": { "hygraph": { "args": [ "mcp-remote", "https://mcp-{REGION}.hygraph.com/{PROJECT_ID}/master/mcp", "--header", "Authorization: Bearer ${HYGRAPH_TOKEN}" ], "command": "npx", "env": { "HYGRAPH_TOKEN": "token_here" } } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/hygraph" }, "notable": [ "The hosted MCP server has a project endpoint at `https://mcp-{REGION}.hygraph.com/{PROJECT_ID}/{ENVIRONMENT}/mcp` with 17 tools and a global endpoint at `https://mcp.hygraph.com/mcp` that adds `list_projects` and `list_environments` (https://hygraph.com/docs/hygraph-ai/mcp-tools-reference)", "Delete and unpublish are not supported through MCP, for content or schema, and `execute_graphql` rejects `delete*` and `unpublish*` operations (https://hygraph.com/docs/hygraph-ai/mcp-server)", "The Claude connector for the MCP server, AI guidelines over MCP and agent runs over MCP were announced in the changelog entry of 31 August 2026 (https://hygraph.com/changelog)", "Uncached requests are limited to 5 a second on Hobby, 25 on Growth and up to 500 on Enterprise, with separate limits on concurrent queries and mutations (https://hygraph.com/docs/api-reference/basics/api-limits)", "Schema changes go through one `submitBatchChanges` mutation that applies a list of changes in a single transaction and rolls all of them back if one fails (https://hygraph.com/docs/api-reference/management-sdk/management-sdk)", "The management-sdk repository on GitHub was last pushed on 13 September 2024, and npm shows versions 1.5.3, 1.6.0 and 1.6.1 published between June and August 2026 (https://registry.npmjs.org/@hygraph/management-sdk)" ], "area": "business", "details": [ { "label": "Surfaces", "value": "GraphQL Content API at `https://\u003cregion\u003e.hygraph.com/v2/\u003cprojectId\u003e/\u003cenvironment\u003e` for reads and writes, a read endpoint on `\u003cregion\u003e.cdn.hygraph.com`, a GraphQL Management API for schema and settings, and a hosted MCP server" }, { "label": "MCP server", "value": "Hosted, streamable HTTP. Content tools `list_entity_types`, `get_entity_schema`, `list_entities`, `get_entities_by_id`, `discover_entities`, `search_content`, `execute_graphql`, `create_entry`, `update_entry` and `publish_entry`. Schema tools `get_project_info`, `get_management_operation_schema` and `submit_batch_migration`. Also `get_ai_guidelines`, `list_agents`, `trigger_agents` and `check_progress`. The global endpoint adds `list_projects` and `list_environments`. Available on all projects" }, { "label": "Credentials", "value": "Permanent Auth Tokens (JWTs) created in Project Settings, sent as a Bearer header. Hobby allows 3 tokens, Growth 5, Enterprise up to 30. The global MCP endpoint uses OAuth through auth.hygraph.com, whose metadata lists PKCE S256, a registration endpoint and a revocation endpoint" }, { "label": "Permissions", "value": "Content permissions per token by model, stage, locale and environment for read, create, update, delete, publish and unpublish. Management API permissions apply to all environments. Public API access is off by default. Custom roles are Enterprise only" }, { "label": "Rate limits", "value": "Uncached requests a second, 5 on Hobby, 25 on Growth, up to 500 on Enterprise. Concurrent operations per environment, 10 queries and 5 mutations on Hobby, 30 and 10 on Growth, 60 and 20 on Enterprise. Cached requests are not limited" }, { "label": "Request size", "value": "Queries 10 KB and mutations 30 KB on Hobby, 15 KB and 70 KB on Growth, 20 KB and 80 KB on Enterprise. Larger requests return 413" }, { "label": "Free plan", "value": "Hobby, no card. Per the pricing page, 1,000 entries, 500,000 API calls and 100 GB of asset traffic a month, 3 seats, 2 locales, 20 models, 1 environment, 5 webhooks, 50 MB an asset. No version history. Usage past the limit returns 402 until the next period" }, { "label": "Paid plans", "value": "Growth $199 a month with 10,000 entries, 1,000,000 API calls, 500 GB of asset traffic, 10 seats, 3 locales and 2 environments. Overage $0.20 per 10,000 API operations and per GB. Enterprise is priced through sales" }, { "label": "Drafts and versions", "value": "Mutations write to DRAFT, and publish and unpublish are separate mutations per stage and locale, with batch forms. A version is written on each publish and read through `history` and `\u003cmodel\u003eVersion`. Retention is 14 days on Growth and up to 365 on Enterprise. Restore is documented in Studio only. Scheduled publishing is Enterprise only" }, { "label": "Assets", "value": "`createAsset` returns a pre-signed upload URL, or takes a remote URL. Projects created before February 2024 may use a legacy asset system with a different upload API" }, { "label": "Localisation", "value": "Per-field localisation with create, update, upsert and delete of a locale inside entry mutations, and publishing per locale. 2 locales on Hobby, 3 on Growth, up to 80 on Enterprise" }, { "label": "Environments", "value": "1 on Hobby, 2 on Growth, up to 10 on Enterprise. The Management SDK can diff one environment against another and apply the result, which replaces the target schema" }, { "label": "Pagination", "value": "`first`, `last`, `skip`, `before` and `after`, with Relay connection types. Default 10 entries, maximum 100" }, { "label": "Errors", "value": "HTTP 400, 401, 402, 403, 404, 413, 429 and 500 with a GraphQL `errors` array of messages and `extensions.requestId`. No error code list" }, { "label": "SDKs", "value": "`@hygraph/management-sdk` 1.6.1 (19 August 2026), JavaScript and TypeScript, MIT, Node.js 18 or later. No official Content API client. Any GraphQL client works" }, { "label": "Audit", "value": "Audit logs on Enterprise with 90 days of retention, recording the member or token behind each change. Webhook logs and a usage metrics query on the Management API" }, { "label": "SLA", "value": "The pricing page lists an uptime SLA of up to 99.95% on Enterprise. The SLA document was not found" }, { "label": "Certifications", "value": "The site states SOC 2 Type 2 and hosting on ISO 27001 certified infrastructure. No bug bounty or disclosure policy found" }, { "label": "Data location", "value": "3 shared regions (EU, US, APAC) on Hobby and 9 on Growth per the pricing page. The status page lists 11 regions. Sub-processors are not named" }, { "label": "Open source", "value": "No. The Management SDK is MIT" } ], "unitPrices": [ { "item": "Growth", "unit": "month", "usd": 199, "note": "10 seats, 1,000,000 API calls and 500 GB of asset traffic included" }, { "item": "Additional API operations on Growth", "unit": "1k-requests", "usd": 0.02, "note": "sold as $0.20 per 10,000 API operations" }, { "item": "Additional asset traffic on Growth", "unit": "gb", "usd": 0.2, "note": "per GB past the plan's 500 GB" } ], "provenance": { "legalEntity": "Hygraph GmbH", "domain": "hygraph.com", "domainRegistered": "2022-03-04", "endpointOnVendorDomain": true, "terms": "https://hygraph.com/terms", "privacy": "https://hygraph.com/privacy", "statusPage": "https://status.hygraph.com", "changelog": "https://hygraph.com/changelog", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The imprint and the privacy policy name Hygraph GmbH, Dircksenstraße 47, 10178 Berlin, registered at Amtsgericht Berlin Charlottenburg under HRB 250696 B.", "The Terms of Service define the Hygraph Services to include the cloud platform and the Hygraph API. The pricing page lists them as the online terms for Hobby and Growth, with custom terms on Enterprise.", "The privacy policy has a section on use of the Hygraph service and was last updated on 19 March 2025. It names categories of service provider and no companies. No data processing agreement was found on hygraph.com.", "The Content API answers at \u003cregion\u003e.hygraph.com, the Management API at management.hygraph.com, the MCP server at mcp.hygraph.com and the OAuth server at auth.hygraph.com.", "https://hygraph.com/.well-known/security.txt answered 404 on 8 October 2026.", "RDAP for hygraph.com gives a registration date of 2022-03-04. The product was named GraphCMS before that, and the older SDK is still on npm as `@graphcms/management`." ], "score": 75, "checks": [ { "check": "Legal entity named", "value": "Hygraph GmbH", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "hygraph.com, registered 2022-03-04 (4 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.hygraph.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 4.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.hygraph.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://hygraph.com/terms", "state": "read", "readAt": "2026-10-08", "words": 8613, "points": 4.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "16.7 The Terms, and your relationship with Hygraph under the Terms, shall be governed by the laws of the Federal Republic of Germany except for the UN Sales Convention (United Nations Convention on Contracts for the International Sale of Goods dated 11.4.1980).", "says": "The law of Federal Republic of Germany" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IF GRPAHCMS BREACHES ITS PRIMARY OBLIGATIONS THROUGH SIMPLE NEGLIGENCE, THEN ITS ENSUING LIABILITY SHALL BE LIMITED TO THE AMOUNT WHICH WAS FORESEEABLE BY HYGRAPH AT THE TIME THE RESPECTIVE SERVICE WAS PERFORMED." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "5.3 In the event that you become aware of any violation of the Acceptable Use Policy by an End User of Applications, you shall immediately terminate such end user's account on your Application." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "If we change the Terms in any substantive way, we will give you at least seven (7) days notice before the changes take effect, during which period of time you may reject the changes by terminating your account.", "says": "Gives seven days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "1.3 You may not use the Hygraph Services if you are a person barred from receiving the Hygraph Services under the German laws or other countries, including the country in which you are resident or from which you use the Hygraph Services." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "You may not access the Hygraph Services for the purpose of bringing an intellectual property infringement claim against Hygraph or for the purpose of creating a product or service competitive with the Hygraph Services.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "You acknowledge and agree that the form and nature of the Hygraph Services which Hygraph provides may change from time to time without prior notice to you, subject to the terms in Section 4.3.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "9.3 You agree that Hygraph, in its sole discretion and for any or no reason, may terminate your account or any part thereof." } ], "notes": [ { "date": "2026-10-08", "text": "Hygraph may use the customer's names, marks and logos in marketing materials and customer lists at its sole discretion.", "quote": "You agree that Hygraph, in its sole discretion, may use your trade names, trademarks, service marks, logos, domain names and other distinctive brand features in presentations, marketing materials, customer lists, financial reports and Web site listings" }, { "date": "2026-10-08", "text": "The customer must export its content before the account ends, and Hygraph says it will give a reasonable opportunity to retrieve it when Hygraph ends the account.", "quote": "You are solely responsible for exporting your Content and Application(s) from the Hygraph Services prior to termination of your account for any reason, provided that if we terminate your account, we will provide you a reasonable opportunity to retrieve your Content and Application(s)." }, { "date": "2026-10-08", "text": "Claims about a charge are waived unless raised within 30 days of the charge.", "quote": "To the fullest extent permitted by law, you waive all claims relating to charges unless claimed within 30 days after the charge (this does not affect your credit card issuer rights)." } ] }, { "kind": "privacy", "url": "https://hygraph.com/privacy", "state": "read", "readAt": "2026-10-08", "words": 3540, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "If you wish to view our website, we collect the following data, which are technically necessary for us to display our website to you and to provide stability and security (legal basis is Art." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "The criterion for the duration of the storage of your personal data is the respective legal retention period." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We use the services and storage systems of external service providers to provide Hygraph." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you believe that the processing of personal data concerning you violates the GDPR, you have the right of appeal to a supervisory authority, without prejudice to any other remedies." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "The data protection officer of the person responsible is: Will Robinson", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Data Privacy Framework, https://www.edpb.europa.eu/our-work-tools/our-documents/other-guidance/eu-us-data-privacy-framework-faq-european-businesses_en.", "says": "Relies on the Data Privacy Framework" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hygraph.json", "live": { "slug": "hygraph", "probe": { "target": "https://mcp.hygraph.com/mcp", "method": "get", "lastAt": "2026-10-09T09:26:53.018011399Z", "lastOk": true, "lastStatus": 401, "lastMs": 163, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 80, "p95ms24h": 94, "samples24h": 20, "samples30d": 20, "days": [ { "date": "2026-10-09", "probes": 20, "ok": 20 } ] }, "vendorStatus": { "page": "https://status.hygraph.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T09:25:14.386503586Z" }, "updatedAt": "2026-10-09T09:26:53.018011399Z" } } }