·
Last changedVersion:
This version passed the hardening gate. Hardening applied 23 targeted changes, normalized allowed-tools to the canonical single-string form, and preserved all other text. Classified findings before hardening: 14. Classified findings closed: 9. Classified findings remaining: 5. Unclassified scanner findings remaining: 0. Review findings closed: 12. Review findings remaining: 6.
5
8
1
1
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Malicious Code & Command Execution | Dynamic code execution | High | Closed | |
references/configuration.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
references/configuration.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
SKILL.md | Tool & MCP Manipulation | Unauthorized tool use | High | Closed | |
references/configuration.md | Supply Chain & Install-Time Trust | — | Medium | Closed | |
references/graphs.md | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Open | |
references/subgraphs.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed |
14 findings
Rover is the official CLI for Apollo GraphOS. It helps you manage schemas, run composition locally, publish to GraphOS, and develop supergraphs on your local machine.
To answer "what's in this graph?", find a field, or write a query against a GraphOS graph, fetch the API schema and pipe it into rover schema — this keeps the SDL out of your context and returns only what you need:
Three rules that keep this correct:
rover graph fetch (the API schema) — not rover supergraph fetch (that returns composition SDL with federation internals like join__/link__).rover graph fetch alone and read the raw SDL (a large schema floods your context; that's exactly what rover schema avoids).schema commands read piped SDL, not a graph ref — rover schema describe <graph@variant> fails; you must fetch first and pipe.Full reference, ranking rules, and the save-once pattern: Schema Exploration and references/schema.md.
| Command | Description | Use Case |
|---|---|---|
| Publish subgraph schema to GraphOS | CI/CD, schema updates |
| Validate schema changes | PR checks, pre-deploy |
| Download subgraph schema | Local development |
| Compose supergraph locally | Local testing |
| Local supergraph development | Development workflow |
| Publish monograph schema | Non-federated graphs |
| Explore a schema by coordinate; takes SDL via stdin/file, not a graph ref — pipe from | Agent schema discovery |
| Search a schema by keyword; takes SDL via stdin/file, not a graph ref — pipe from | Agent schema discovery |
Most commands require a graph reference in the format:
Examples:
my-graph@productionmy-graph@stagingmy-graph@current (default variant)Set as environment variable:
Create supergraph.yaml:
federation_version here is the composition version — it only needs to be ≥
each subgraph's @link floor, so subgraphs pinned to a lower version compose
fine. If a subgraph server throws UNKNOWN_FEDERATION_LINK_VERSION at startup,
that's a client-library lag, not a composition problem. See the apollo-federation
skill's Federation versions.
Compose:
rover devStart a local Router with automatic schema composition:
rover schema describe and rover schema search let an agent explore a schema without loading the full SDL into context — that is the entire point of these commands.
To explore a graph in GraphOS, fetch its schema and pipe it in. Use rover graph fetch (the API schema) for "what can I query?" exploration — it omits federation internals. Reach for rover supergraph fetch only when you need composition details (join__/link__ types, subgraph structure):
Coordinate forms: --coord accepts a type (User), a field (User.posts), a field argument (Type.field(arg:)), or a directive (@deprecated) — omit it for the overview.
search vs describe: reach for rover schema search first when matching a concept or keyword and you don't yet know the field name — it finds nested fields and shows the path from a root operation. The describe overview lists only root fields, so search is how you locate fields buried deeper. Use describe for the overview or once you know the type/field coordinate.
This enables a closed-loop workflow — search → describe → write a query — with no MCP server setup. See Schema Exploration for the full command reference, ranking rules, and the save-once pattern for large schemas.
Running the generated operation: Rover does not execute queries — it only manages and inspects schemas. To actually run a generated query you need the graph's endpoint:
rover subgraph list <graph@variant> prints the Routing Url.rover cloud config fetch <graph@variant>), not the per-subgraph routing URLs.$APOLLO_KEY, so ad-hoc API calls will come back unauthenticated.Detailed documentation for specific topics:
rover config auth or APOLLO_KEY)graph@variantrover subgraph check before rover subgraph publish in CI/CDrover dev for local supergraph development instead of running Router manuallyAPOLLO_KEY to version control; use environment variables--format json when parsing output programmaticallyfederation_version explicitly in supergraph.yaml for reproducibilityrover subgraph introspect to extract schemas from running servicesrover schema search / rover schema describe (piped from a fetch) to explore large schemas instead of loading the full SDL into contextrover graph fetch/introspect into rover schema describe/search (a bare fetch is only for when the user wants the SDL file itself)Get started with chainctlchainctl skill install public/apollographql/rover:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/apollographql/skills/rover:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/configuration.md
references/dev.md
references/graphs.md
references/schema.md
references/subgraphs.md
references/supergraphs.md