validate_graphql_codeblocks
This tool validates GraphQL code blocks against the Shopify GraphQL schema to ensure they don't contain hallucinated fields or operations. If a user asks for an LLM to generate a GraphQL operation, this tool should always be used to ensure valid code was generated. Supports all Shopify GraphQL AP...
This record as markdown: /tools/dev/validate-graphql-codeblocks.md
What validate_graphql_codeblocks does on Dev
AI agents call validate_graphql_codeblocks to retrieve information from Dev without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
| Parameter | Type | Required | Description |
|---|---|---|---|
api | string | — | The GraphQL API to use. Valid options are: - 'admin': Write or explain **Admin GraphQL** queries and mutations for apps and integrations that extend the Shopify |
version | string | — | Optional API version to validate against. When omitted, the latest stable version for the selected API is used. |
codeblocks | array | Yes | Array of GraphQL code blocks with content and optional artifact metadata |
conversationId | string | Yes | 🔗 REQUIRED: conversationId from learn_shopify_api tool. Call learn_shopify_api first if you don't have this. |
Parameters from the server's own tool schema.
Why validate_graphql_codeblocks is rated Low
This tool only reads and validates existing GraphQL code blocks against a schema—it performs static analysis to detect errors or hallucinations. It does not execute GraphQL queries, modify data, delete anything, or commit financial actions. The validation output provides feedback but does not alter any state. This is a standard Read category tool analogous to linters or schema validators.
From the tool's definition The tool description explicitly states it 'validates GraphQL code blocks against the Shopify GraphQL schema' and 'returns a comprehensive validation result.' The words 'validates,' 'ensures,' and 'returns' indicate it performs schema checking and analysis…
Risk signalsAccepts raw HTML/template content (codeblocks[].content) · Admin/system-level operation
Attacks that exploit this kind of access
The rule that runs validate_graphql_codeblocks safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Dev, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For validate_graphql_codeblocks, this is the rule to start with:
validate_graphql_codeblocks is read-only, so it stays allowed. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Dev, apply this rule, and every validate_graphql_codeblocks call is checked against it from then on.
Questions about validate_graphql_codeblocks
This tool validates GraphQL code blocks against the Shopify GraphQL schema to ensure they don't contain hallucinated fields or operations. If a user asks for an LLM to generate a GraphQL operation, this tool should always be used to ensure valid code was generated. Supports all Shopify GraphQL APIs including Admin, Storefront, Partner, Customer, Payments Apps, and Function APIs. For Shopify Functions, use this to validate the input GraphQL queries (run.graphql). It returns a comprehensive validation result with details for each code block explaining why it was valid or invalid. This detail is provided so LLMs know how to modify code snippets to remove errors. It also returns an artifact ID and revision number for each code block. This is used to track the code block and its validation results. When validating an iteration of the same code block, use the same artifact ID and increment the revision number. Do not pass your own artifact ID to this tool, the tool will generate one for you. It is categorised as a Read tool in the Dev MCP Server, which means it retrieves data without modifying state.
validate_graphql_codeblocks accepts 4 parameters: api, version, codeblocks, conversationId. Required: codeblocks, conversationId. The full parameter table on this page comes from the server's own tool schema.
Register the Dev MCP server in PolicyLayer and add a rule for validate_graphql_codeblocks: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Dev. Nothing to install.
validate_graphql_codeblocks is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the validate_graphql_codeblocks rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for validate_graphql_codeblocks. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
validate_graphql_codeblocks is provided by the Dev MCP server (@shopify/dev-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Dev, and thousands of servers like it.
This server
Across the catalogue