## Tool: `execute_graphql`

Executes any GraphQL query or mutation against a Firebase SQL Connect Service instance.

Grants full read and write access to the connected data sources.

**When to use it:**

- Use this tool to execute arbitrary GraphQL queries or mutations against your SQL Connect schema (e.g. inserting, updating, deleting data, or complex reads).

**How to use it:**

- Call `execute_graphql` with `projectId`, `location`, `serviceId` to identify the service, and provide the GraphQL `query` string.
- Optionally provide `variables`, `operationName`, and `extensions`.

**JSON Example:**

    {
              "projectId": "my-project",
              "location": "us-central1",
              "serviceId": "my-service",
              "query": "mutation CreateUser($name: String!) { createUser(data: {name: $name}) { id } }",
              "variables": {
                "name": "Alice"
              }
            }
            

The following code sample shows how to use `curl` to call the `execute_graphql` MCP tool.

| Curl Request |
|---|
| ```bash curl --location 'https://firebasedataconnect.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "execute_graphql", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }' ``` |

## Input Schema

Request message for ExecuteGraphql facade.

### ExecuteGraphqlRequest

| JSON representation |
|---|
| ``` { "projectId": string, "location": string, "serviceId": string, "query": string, "variables": { object }, "extensions": { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Input.Schema.GraphqlRequestExtensions`) }, // Union field `_operation_name` can be only one of the following: "operationName": string // End of list of possible types for union field `_operation_name`. } ``` |

| Fields ||
|---|---|
| `projectId` | `string` Required. The project ID or number. |
| `location` | `string` Required. The location of the service. |
| `serviceId` | `string` Required. Identifier. The service ID. |
| `query` | `string` Required. The GraphQL query document source. |
| `variables` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Optional. Values for GraphQL variables provided in this request. |
| `extensions` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Input.Schema.GraphqlRequestExtensions`)`` Optional. Additional GraphQL request information. |
| Union field `_operation_name`. `_operation_name` can be only one of the following: ||
| `operationName` | `string` Optional. The name of the GraphQL operation name. |

### Struct

| JSON representation |
|---|
| ``` { "fields": { string: value, ... } } ``` |

| Fields ||
|---|---|
| `fields` | ``map (key: string, value: value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format))`` Unordered map of dynamically typed values. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`. |

### FieldsEntry

| JSON representation |
|---|
| ``` { "key": string, "value": value } ``` |

| Fields ||
|---|---|
| `key` | `string` |
| `value` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` |

### Value

| JSON representation |
|---|
| ``` { // Union field `kind` can be only one of the following: "nullValue": null, "numberValue": number, "stringValue": string, "boolValue": boolean, "structValue": { object }, "listValue": array // End of list of possible types for union field `kind`. } ``` |

| Fields ||
|---|---|
| Union field `kind`. The kind of value. `kind` can be only one of the following: ||
| `nullValue` | `null` Represents a JSON `null`. |
| `numberValue` | `number` Represents a JSON number. Must not be `NaN`, `Infinity` or `-Infinity`, since those are not supported in JSON. This also cannot represent large Int64 values, since JSON format generally does not support them in its number type. |
| `stringValue` | `string` Represents a JSON string. |
| `boolValue` | `boolean` Represents a JSON boolean (`true` or `false` literal in JSON). |
| `structValue` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Represents a JSON object. |
| `listValue` | ``array (`https://protobuf.dev/reference/protobuf/google.protobuf#list-value` format)`` Represents a JSON array. |

### ListValue

| JSON representation |
|---|
| ``` { "values": [ value ] } ``` |

| Fields ||
|---|---|
| `values[]` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` Repeated field of dynamically typed values. |

### GraphqlRequestExtensions

| JSON representation |
|---|
| ``` { "impersonate": { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Input.Schema.Impersonation`) } } ``` |

| Fields ||
|---|---|
| `impersonate` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Input.Schema.Impersonation`)`` Optional. If set, impersonate a request with given Firebase Auth context and evaluate the auth policies on the operation. If omitted, bypass any defined auth policies. |

### Impersonation

| JSON representation |
|---|
| ``` { "includeDebugDetails": boolean, // Union field `kind` can be only one of the following: "unauthenticated": boolean, "authClaims": { object } // End of list of possible types for union field `kind`. } ``` |

| Fields ||
|---|---|
| `includeDebugDetails` | `boolean` Optional. If set, include debug details in GraphQL error extensions. |
| Union field `kind`. The kind of impersonation. `kind` can be only one of the following: ||
| `unauthenticated` | `boolean` Evaluate the auth policy as an unauthenticated request. Can only be set to true. |
| `authClaims` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Evaluate the auth policy with a customized JWT auth token. Should follow the Firebase Auth token format. <https://firebase.google.com/docs/rules/rules-and-auth> For example: a verified user may have auth_claims of {"sub": , "email_verified": true} |

### NullValue

Represents a JSON `null`.

`NullValue` is a sentinel, using an enum with only one value to represent the null value for the `Value` type union.

A field of type `NullValue` with any value other than `0` is considered invalid. Most ProtoJSON serializers will emit a `Value` with a `null_value` set as a JSON `null` regardless of the integer value, and so will round trip to a `0` value.

| Enums ||
|---|---|
| `NULL_VALUE` | Null value. |

## Output Schema

The GraphQL response from Firebase SQL Connect.

It strives to match the GraphQL over HTTP spec. Note: Firebase SQL Connect always responds with `Content-Type:
application/json`. <https://github.com/graphql/graphql-over-http/blob/main/spec/GraphQLOverHTTP.md#body>

### GraphqlResponse

| JSON representation |
|---|
| ``` { "data": { object }, "errors": [ { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlError`) } ], "extensions": { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlResponseExtensions`) } } ``` |

| Fields ||
|---|---|
| `data` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` The result of the execution of the requested operation. If an error was raised before execution begins, the data entry should not be present in the result. (a request error: <https://spec.graphql.org/draft/#sec-Errors.Request-Errors>) If an error was raised during the execution that prevented a valid response, the data entry in the response should be null. (a field error: <https://spec.graphql.org/draft/#sec-Errors.Error-Result-Format>) |
| `errors[]` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlError`)`` Errors of this response. If the data entry in the response is not present, the errors entry must be present. It conforms to <https://spec.graphql.org/draft/#sec-Errors> . |
| `extensions` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlResponseExtensions`)`` Additional response information. It conforms to <https://spec.graphql.org/draft/#sec-Extensions> . |

### Struct

| JSON representation |
|---|
| ``` { "fields": { string: value, ... } } ``` |

| Fields ||
|---|---|
| `fields` | ``map (key: string, value: value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format))`` Unordered map of dynamically typed values. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`. |

### FieldsEntry

| JSON representation |
|---|
| ``` { "key": string, "value": value } ``` |

| Fields ||
|---|---|
| `key` | `string` |
| `value` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` |

### Value

| JSON representation |
|---|
| ``` { // Union field `kind` can be only one of the following: "nullValue": null, "numberValue": number, "stringValue": string, "boolValue": boolean, "structValue": { object }, "listValue": array // End of list of possible types for union field `kind`. } ``` |

| Fields ||
|---|---|
| Union field `kind`. The kind of value. `kind` can be only one of the following: ||
| `nullValue` | `null` Represents a JSON `null`. |
| `numberValue` | `number` Represents a JSON number. Must not be `NaN`, `Infinity` or `-Infinity`, since those are not supported in JSON. This also cannot represent large Int64 values, since JSON format generally does not support them in its number type. |
| `stringValue` | `string` Represents a JSON string. |
| `boolValue` | `boolean` Represents a JSON boolean (`true` or `false` literal in JSON). |
| `structValue` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Represents a JSON object. |
| `listValue` | ``array (`https://protobuf.dev/reference/protobuf/google.protobuf#list-value` format)`` Represents a JSON array. |

### ListValue

| JSON representation |
|---|
| ``` { "values": [ value ] } ``` |

| Fields ||
|---|---|
| `values[]` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` Repeated field of dynamically typed values. |

### GraphqlError

| JSON representation |
|---|
| ``` { "message": string, "locations": [ { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.SourceLocation`) } ], "path": array, "extensions": { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlErrorExtensions`) } } ``` |

| Fields ||
|---|---|
| `message` | `string` The detailed error message. The message should help developer understand the underlying problem without leaking internal data. |
| `locations[]` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.SourceLocation`)`` The source locations where the error occurred. Locations should help developers and toolings identify the source of error quickly. Included in admin endpoints (`ExecuteGraphql`, `ExecuteGraphqlRead`, `IntrospectGraphql`, `ImpersonateQuery`, `ImpersonateMutation`, `UpdateSchema` and `UpdateConnector`) to reference the provided GraphQL GQL document. Omitted in `ExecuteMutation` and `ExecuteQuery` since the caller shouldn't have access access the underlying GQL source. |
| `path` | ``array (`https://protobuf.dev/reference/protobuf/google.protobuf#list-value` format)`` The result field which could not be populated due to error. Clients can use path to identify whether a null result is intentional or caused by a runtime error. It should be a list of string or index from the root of GraphQL query document. |
| `extensions` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.GraphqlErrorExtensions`)`` Additional error information. |

### SourceLocation

| JSON representation |
|---|
| ``` { "line": integer, "column": integer } ``` |

| Fields ||
|---|---|
| `line` | `integer` Line number starting at 1. |
| `column` | `integer` Column number starting at 1. |

### GraphqlErrorExtensions

| JSON representation |
|---|
| ``` { "file": string, "code": enum (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.Code`), "debugDetails": string, "warningLevel": enum (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.WarningLevel`), "workarounds": [ { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.Workaround`) } ] } ``` |

| Fields ||
|---|---|
| `file` | `string` The source file name where the error occurred. Included only for `UpdateSchema` and `UpdateConnector`, it corresponds to `File.path` of the provided `Source`. |
| `code` | ``enum (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.Code`)`` Maps to canonical gRPC codes. If not specified, it represents `Code.INTERNAL`. |
| `debugDetails` | `string` More detailed error message to assist debugging. It contains application business logic that are inappropriate to leak publicly. In the emulator, SQL Connect API always includes it to assist local development and debugging. In the backend, ConnectorService always hides it. GraphqlService without impersonation always include it. GraphqlService with impersonation includes it only if explicitly opted-in with `include_debug_details` in `GraphqlRequestExtensions`. |
| `warningLevel` | ``enum (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.WarningLevel`)`` Warning level describes the severity and required action to suppress this warning when Firebase CLI run into it. |
| `workarounds[]` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.Workaround`)`` Workarounds provide suggestions to address the compile errors or warnings. |

### Workaround

| JSON representation |
|---|
| ``` { "description": string, "reason": string, "replace": string } ``` |

| Fields ||
|---|---|
| `description` | `string` Description of this workaround. |
| `reason` | `string` Why would this workaround address the error and warning. |
| `replace` | `string` A suggested code snippet to fix the error and warning. |

### GraphqlResponseExtensions

| JSON representation |
|---|
| ``` { "dataConnect": [ { object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.DataConnectProperties`) } ] } ``` |

| Fields ||
|---|---|
| `dataConnect[]` | ``object (`https://firebase.google.com/docs/reference/sql-connect/mcp/tools_list/execute_graphql#Output.Schema.DataConnectProperties`)`` SQL Connect specific GraphQL extension, a list of paths and properties. |

### DataConnectProperties

| JSON representation |
|---|
| ``` { "path": array, "entityId": string, "entityIds": [ string ], "maxAge": string } ``` |

| Fields ||
|---|---|
| `path` | ``array (`https://protobuf.dev/reference/protobuf/google.protobuf#list-value` format)`` The path under response.data where the rest of the fields apply. Each element may be a string (field name) or number (array index). The root of response.data is denoted by the empty list `[]`. |
| `entityId` | `string` A single Entity ID. Set if the path points to a single entity. |
| `entityIds[]` | `string` A list of Entity IDs. Set if the path points to an array of entities. An ID is present for each element of the array at the corresponding index. |
| `maxAge` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#duration` format)`` The server-suggested duration before data under path is considered stale. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`. |

### Duration

| JSON representation |
|---|
| ``` { "seconds": string, "nanos": integer } ``` |

| Fields ||
|---|---|
| `seconds` | `string (https://developers.google.com/discovery/v1/type-format format)` Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min \* 60 min/hr \* 24 hr/day \* 365.25 days/year \* 10000 years |
| `nanos` | `integer` Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive. |

### NullValue

Represents a JSON `null`.

`NullValue` is a sentinel, using an enum with only one value to represent the null value for the `Value` type union.

A field of type `NullValue` with any value other than `0` is considered invalid. Most ProtoJSON serializers will emit a `Value` with a `null_value` set as a JSON `null` regardless of the integer value, and so will round trip to a `0` value.

| Enums ||
|---|---|
| `NULL_VALUE` | Null value. |

### Code

The canonical error codes for gRPC APIs.

Sometimes multiple error codes may apply. Services should return the most specific error code that applies. For example, prefer `OUT_OF_RANGE` over `FAILED_PRECONDITION` if both codes apply. Similarly prefer `NOT_FOUND` or `ALREADY_EXISTS` over `FAILED_PRECONDITION`.

| Enums ||
|---|---|
| `OK` | Not an error; returned on success. HTTP Mapping: 200 OK |
| `CANCELLED` | The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request |
| `UNKNOWN` | Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error |
| `INVALID_ARGUMENT` | The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request |
| `DEADLINE_EXCEEDED` | The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout |
| `NOT_FOUND` | Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found |
| `ALREADY_EXISTS` | The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict |
| `PERMISSION_DENIED` | The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden |
| `UNAUTHENTICATED` | The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized |
| `RESOURCE_EXHAUSTED` | Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests |
| `FAILED_PRECONDITION` | The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an "rmdir" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request |
| `ABORTED` | The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict |
| `OUT_OF_RANGE` | The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range \[0,2\^32-1\], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request |
| `UNIMPLEMENTED` | The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented |
| `INTERNAL` | Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error |
| `UNAVAILABLE` | The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable |
| `DATA_LOSS` | Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error |

### WarningLevel

WarningLevel describes the severity and required action to suppress this warning when Firebase CLI run into it.

| Enums ||
|---|---|
| `WARNING_LEVEL_UNKNOWN` | Warning level is not specified. |
| `LOG_ONLY` | Display a warning without action needed. |
| `INTERACTIVE_ACK` | Request a confirmation in interactive deployment flow. |
| `REQUIRE_ACK` | Require an explicit confirmation in all deployment flows. |
| `REQUIRE_FORCE` | Require --force in all deployment flows. |

### Tool Annotations


[Tool annotations](https://modelcontextprotocol.io/specification/latest/schema#toolannotations) are sent to MCP clients to describe the basic risk of a given tool. Most clients treat these hints as untrusted, but they can be used to decide when a confirmation prompt might be sent to a user.


Along with the title string, the following boolean hints are defined as follows:

- `readOnlyHint`: If true, the tool doesn't modify its environment. Default: false.
- `destructiveHint`: If true, then the tool can perform destructive actions. If false, then the tool can only perform additive actions. Default: true.
- `idempotentHint`: If true, then calling the tool repeatedly with the same arguments will have no additional effect on its environment. Default: false.
- `openWorldHint`: If true, then the tool can interact with an 'open world' of external entities. If false, then the tool can only interact with internal entities. For example, a web search tool would be open world, while a memory tool would not be open world.

Destructive Hint: ✅ \| Idempotent Hint: ❌ \| Read Only Hint: ❌ \| Open World Hint: ❌