
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@silkspace/graphistry-mcp
Advanced tools
Graphistry MCP server - GPU-accelerated graph visualization for MCP clients
GPU-accelerated graph visualization and analytics for Large Language Models using Graphistry and MCP.
This project integrates Graphistry's powerful GPU-accelerated graph visualization platform with the Model Control Protocol (MCP), enabling advanced graph analytics capabilities for AI assistants and LLMs. It allows LLMs to visualize and analyze complex network data through a standardized, LLM-friendly interface.
Key features:
graph_data dict for graph toolsThis MCP server requires a free Graphistry account to use visualization features.
.env file before starting the server:
export GRAPHISTRY_USERNAME=your_username
export GRAPHISTRY_PASSWORD=your_password
# or create a .env file with:
# GRAPHISTRY_USERNAME=your_username
# GRAPHISTRY_PASSWORD=your_password
See .env.example for a template.To use this project with Cursor or other MCP-compatible tools, you need a .mcp.json file in your project root. A template is provided as .mcp.json.example.
Setup:
cp .mcp.json.example .mcp.json
Edit .mcp.json to:
graphistry-http: Connects via HTTP (set the url to match your server's port)graphistry: Connects via stdio (set the command, args, and env as needed)Note:
.mcp.json.example contains both HTTP and stdio configurations. Enable/disable as needed by setting the disabled field..env.example for environment variable setup.# Install via npx (no installation required)
npx -y @silkspace/graphistry-mcp
# Or install globally
npm install -g @silkspace/graphistry-mcp
graphistry-mcp
MCP Client Configuration:
Add to your MCP client settings (.mcp.json, MCP client config, etc.):
{
"graphistry": {
"command": "npx",
"args": ["-y", "@silkspace/graphistry-mcp"],
"env": {
"GRAPHISTRY_USERNAME": "your_username",
"GRAPHISTRY_PASSWORD": "your_password"
}
}
}
The npm package automatically:
uv if available, otherwise pip)# Clone the repository
git clone https://github.com/graphistry/graphistry-mcp.git
cd graphistry-mcp
# Set up virtual environment and install dependencies
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
# Set up your Graphistry credentials (see above)
Or use the setup script:
./setup-graphistry-mcp.sh
# Activate your virtual environment if not already active
source .venv/bin/activate
# Start the server (stdio mode)
python run_graphistry_mcp.py
# Or use the start script for HTTP or stdio mode (recommended, sources .env securely)
./start-graphistry-mcp.sh --http 8080
.env using python-dotenv, so you can safely use a .env file for local development.start-graphistry-mcp.sh script sources .env and is the most robust and secure way to launch the server.Using npm (Recommended):
Add the MCP server to your MCP client config:
{
"graphistry": {
"command": "npx",
"args": ["-y", "@silkspace/graphistry-mcp"],
"env": {
"GRAPHISTRY_USERNAME": "your_username",
"GRAPHISTRY_PASSWORD": "your_password"
}
}
}
Using manual installation:
{
"graphistry": {
"command": "/path/to/your/.venv/bin/python",
"args": ["/path/to/your/run_graphistry_mcp.py"],
"env": {
"GRAPHISTRY_USERNAME": "your_username",
"GRAPHISTRY_PASSWORD": "your_password"
}
}
}
Notes:
The main tool, visualize_graph, now accepts a single graph_data dictionary. Example:
{
"graph_data": {
"graph_type": "graph",
"edges": [
{"source": "A", "target": "B"},
{"source": "A", "target": "C"},
{"source": "A", "target": "D"},
{"source": "A", "target": "E"},
{"source": "B", "target": "C"},
{"source": "B", "target": "D"},
{"source": "B", "target": "E"},
{"source": "C", "target": "D"},
{"source": "C", "target": "E"},
{"source": "D", "target": "E"}
],
"nodes": [
{"id": "A"}, {"id": "B"}, {"id": "C"}, {"id": "D"}, {"id": "E"}
],
"title": "5-node, 10-edge Complete Graph",
"description": "A complete graph of 5 nodes (K5) where every node is connected to every other node."
}
}
Example (hypergraph):
{
"graph_data": {
"graph_type": "hypergraph",
"edges": [
{"source": "A", "target": "B", "group": "G1", "weight": 0.7},
{"source": "A", "target": "C", "group": "G1", "weight": 0.6},
{"source": "B", "target": "C", "group": "G2", "weight": 0.8},
{"source": "A", "target": "D", "group": "G2", "weight": 0.5}
],
"columns": ["source", "target", "group"],
"title": "Test Hypergraph",
"description": "A simple test hypergraph."
}
}
The following MCP tools are available for graph visualization, analysis, and manipulation:
PRs and issues welcome! This project is evolving rapidly as we learn more about LLM-driven graph analytics and tool integration.
MIT
FAQs
Graphistry MCP server - GPU-accelerated graph visualization for MCP clients
We found that @silkspace/graphistry-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.