# validate_graphql_codeblocks

This tool validates GraphQL code blocks against the Shopify GraphQL schema to ensure they don't contain hallucinated fields or operations. If a user asks for an LLM to generate a GraphQL operation, this tool should always be used to ensure valid code was generated. Supports all Shopify GraphQL APIs including Admin, Storefront, Partner, Customer, Payments Apps, and Function APIs. For Shopify Functions, use this to validate the input GraphQL queries (run.graphql). It returns a comprehensive validation result with details for each code block explaining why it was valid or invalid. This detail is provided so LLMs know how to modify code snippets to remove errors. It also returns an artifact ID and revision number for each code block. This is used to track the code block and its validation results. When validating an iteration of the same code block, use the same artifact ID and increment the revision number. Do not pass your own artifact ID to this tool, the tool will generate one for you.

Agent View of the PolicyLayer registry record for `validate_graphql_codeblocks`. HTML page: https://policylayer.com/tools/dev/validate-graphql-codeblocks

## Facts

- Tool: `validate_graphql_codeblocks`
- Server: Dev (`@shopify/dev-mcp`) — https://policylayer.com/tools/dev.md
- Install: `npx -y @shopify/dev-mcp`
- Homepage: https://www.npmjs.com/package/@shopify/dev-mcp
- Risk category: Read (Low risk)
- Registry record: grade D, identity unverified
- Server rate-limited: no
- Parameters: 4 (2 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `api` | string | no | The GraphQL API to use. Valid options are: - 'admin': Write or explain **Admin GraphQL** queries and mutations for apps and integrations that extend the Shopify |
| `version` | string | no | Optional API version to validate against. When omitted, the latest stable version for the selected API is used. |
| `codeblocks` | array | yes | Array of GraphQL code blocks with content and optional artifact metadata |
| `conversationId` | string | yes | 🔗 REQUIRED: conversationId from learn_shopify_api tool. Call learn_shopify_api first if you don't have this. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "validate_graphql_codeblocks",
    "arguments": {
      "codeblocks": [],
      "conversationId": "<conversationId>"
    }
  }
}
```

## Why validate_graphql_codeblocks is rated Low

This tool only reads and validates existing GraphQL code blocks against a schema—it performs static analysis to detect errors or hallucinations. It does not execute GraphQL queries, modify data, delete anything, or commit financial actions. The validation output provides feedback but does not alter any state. This is a standard Read category tool analogous to linters or schema validators.

From the tool's own definition: "The tool description explicitly states it 'validates GraphQL code blocks against the Shopify GraphQL schema' and 'returns a comprehensive validation result.' The words 'validates,' 'ensures,' and 'returns' indicate it performs schema checking and analysis…"

Risk signals: Accepts raw HTML/template content (codeblocks[].content) · Admin/system-level operation

## Use case

AI agents call validate_graphql_codeblocks to retrieve information from Dev without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Dev:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "validate_graphql_codeblocks": {}
  }
}
```

## Other tools on Dev (4)

- `learn_shopify_api` — Read — https://policylayer.com/tools/dev/learn-shopify-api.md
- `search_docs_chunks` — Read — https://policylayer.com/tools/dev/search-docs-chunks.md
- `validate_component_codeblocks` — Read — https://policylayer.com/tools/dev/validate-component-codeblocks.md
- `validate_theme` — Read — https://policylayer.com/tools/dev/validate-theme.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev