Install
$ agentstack add skill-apollographql-skills-rover Open-source listing — not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Pipes remote content directly into a shell (remote code execution).
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Apollo Rover CLI Guide
Rover is the official CLI for Apollo GraphOS. It helps you manage schemas, run composition locally, publish to GraphOS, and develop supergraphs on your local machine.
Quick Start
Step 1: Install
# macOS/Linux
curl -sSL https://rover.apollo.dev/nix/latest | sh
# npm (cross-platform)
npm install -g @apollo/rover
# Windows PowerShell
iwr 'https://rover.apollo.dev/win/latest' | iex
Step 2: Authenticate
# Interactive authentication (opens browser)
rover config auth
# Or set environment variable
export APOLLO_KEY=your-api-key
Step 3: Verify Installation
rover --version
rover config whoami
Explore a Graph's Schema (start here for schema questions)
To answer "what's in this graph?", find a field, or write a query against a GraphOS graph, fetch the API schema and pipe it into rover schema — this keeps the SDL out of your context and returns only what you need:
# What can I query? (compact overview)
rover graph fetch | rover schema describe -
# Find a field by concept/keyword (returns the path from a root operation)
rover graph fetch | rover schema search - ""
# Zoom into one type or field
rover graph fetch | rover schema describe - --coord --depth 1
Three rules that keep this correct:
- Use
rover graph fetch(the API schema) — notrover supergraph fetch(that returns composition SDL with federation internals likejoin__/link__). - Pipe it in — never run
rover graph fetchalone and read the raw SDL (a large schema floods your context; that's exactly whatrover schemaavoids). - The
schemacommands read piped SDL, not a graph ref —rover schema describefails; you must fetch first and pipe.
Full reference, ranking rules, and the save-once pattern: [Schema Exploration](#schema-exploration-for-agents) and [references/schema.md](references/schema.md).
Core Commands Overview
| Command | Description | Use Case | |---------|-------------|----------| | rover subgraph publish | Publish subgraph schema to GraphOS | CI/CD, schema updates | | rover subgraph check | Validate schema changes | PR checks, pre-deploy | | rover subgraph fetch | Download subgraph schema | Local development | | rover supergraph compose | Compose supergraph locally | Local testing | | rover dev | Local supergraph development | Development workflow | | rover graph publish | Publish monograph schema | Non-federated graphs | | rover schema describe | Explore a schema by coordinate; takes SDL via stdin/file, not a graph ref — pipe from rover graph fetch | Agent schema discovery | | rover schema search | Search a schema by keyword; takes SDL via stdin/file, not a graph ref — pipe from rover graph fetch | Agent schema discovery |
Graph Reference Format
Most commands require a graph reference in the format:
@
Examples:
my-graph@productionmy-graph@stagingmy-graph@current(default variant)
Set as environment variable:
export APOLLO_GRAPH_REF=my-graph@production
Subgraph Workflow
Publishing a Subgraph
# From schema file
rover subgraph publish my-graph@production \
--name products \
--schema ./schema.graphql \
--routing-url https://products.example.com/graphql
# From running server (introspection)
rover subgraph publish my-graph@production \
--name products \
--schema supergraph.graphql
Fetch Composed Supergraph
rover supergraph fetch my-graph@production
> This returns the supergraph SDL (federation directives + join__/link__ internals) — use it for composition/router work. To explore what you can query or write an operation, use rover graph fetch (the API schema) instead — see [Explore a Graph's Schema](#explore-a-graphs-schema-start-here-for-schema-questions).
Local Development with rover dev
Start a local Router with automatic schema composition:
# Start with supergraph config
rover dev --supergraph-config supergraph.yaml
# Start with GraphOS variant as base
rover dev --graph-ref my-graph@staging --supergraph-config local.yaml
With MCP Integration
# Start with MCP server enabled
rover dev --supergraph-config supergraph.yaml --mcp
Schema Exploration (for Agents)
rover schema describe and rover schema search let an agent explore a schema without loading the full SDL into context — that is the entire point of these commands.
> ⚠️ Never read the raw SDL into context. Running rover graph fetch (or rover graph introspect ) on its own prints the entire schema — hundreds to tens of thousands of lines — straight into your context, which defeats the purpose of these commands. Always pipe fetch output into rover schema describe/search: the SDL flows through stdin and only the compact overview/results reach you. (Fetching to a file is fine when the user actually wants the SDL.) > > These commands also take SDL on stdin or a file, NOT a graph ref — you can't pass graph@variant to them. Fetch first, then pipe: > > ``bash > ❌ rover schema describe my-graph@current # error: looks for a file named that > ❌ rover graph fetch my-graph@current # dumps the full SDL into your context > ✅ rover graph fetch my-graph@current | rover schema describe - > ``
To explore a graph in GraphOS, fetch its schema and pipe it in. Use rover graph fetch (the API schema) for "what can I query?" exploration — it omits federation internals. Reach for rover supergraph fetch only when you need composition details (join__/link__ types, subgraph structure):
# Overview of a GraphOS graph
rover graph fetch my-graph@current | rover schema describe -
# Find fields by keyword (results include paths from root operations)
rover graph fetch my-graph@current | rover schema search - "playback"
# Zoom into a coordinate, expanding referenced types one level
rover graph fetch my-graph@current | rover schema describe - --coord --depth 1
Coordinate forms: --coord accepts a type (User), a field (User.posts), a field argument (Type.field(arg:)), or a directive (@deprecated) — omit it for the overview.
search vs describe: reach for rover schema search first when matching a concept or keyword and you don't yet know the field name — it finds nested fields and shows the path from a root operation. The describe overview lists only root fields, so search is how you locate fields buried deeper. Use describe for the overview or once you know the type/field coordinate.
This enables a closed-loop workflow — search → describe → write a query — with no MCP server setup. See [Schema Exploration](references/schema.md) for the full command reference, ranking rules, and the save-once pattern for large schemas.
Running the generated operation: Rover does not execute queries — it only manages and inspects schemas. To actually run a generated query you need the graph's endpoint:
- Single-subgraph graph:
rover subgraph listprints the Routing Url — send the query there withcurl. - Multi-subgraph / federated: the client endpoint is the router URL (find it in GraphOS Studio; for a GraphOS cloud router,
rover cloud config fetch), not the per-subgraph routing URLs. - Don't try to discover the endpoint via the GraphOS Platform API — Rover keeps the API key in its profile/keychain, not
$APOLLO_KEY, so ad-hoc API calls will come back unauthenticated.
Reference Files
Detailed documentation for specific topics:
- [Subgraphs](references/subgraphs.md) - fetch, publish, check, lint, introspect, delete
- [Graphs](references/graphs.md) - monograph commands (non-federated)
- [Supergraphs](references/supergraphs.md) - compose, fetch, config format
- [Dev](references/dev.md) - rover dev for local development
- [Schema Exploration](references/schema.md) - describe, search, agent schema discovery workflows
- [Configuration](references/configuration.md) - install, auth, env vars, profiles
Common Patterns
CI/CD Pipeline
# 1. Check schema changes
rover subgraph check $APOLLO_GRAPH_REF \
--name $SUBGRAPH_NAME \
--schema ./schema.graphql
# 2. If check passes, publish
rover subgraph publish $APOLLO_GRAPH_REF \
--name $SUBGRAPH_NAME \
--schema ./schema.graphql \
--routing-url $ROUTING_URL
Schema Linting
# Lint against GraphOS rules
rover subgraph lint --name products ./schema.graphql
# Lint monograph
rover graph lint my-graph@production ./schema.graphql
Output Formats
# JSON output for scripting
rover subgraph fetch my-graph@production --name products --format json
# Plain output (default)
rover subgraph fetch my-graph@production --name products --format plain
Ground Rules
- ALWAYS authenticate before using GraphOS commands (
rover config authorAPOLLO_KEY) - ALWAYS use the correct graph reference format:
graph@variant - PREFER
rover subgraph checkbeforerover subgraph publishin CI/CD - USE
rover devfor local supergraph development instead of running Router manually - NEVER commit
APOLLO_KEYto version control; use environment variables - USE
--format jsonwhen parsing output programmatically - SPECIFY
federation_versionexplicitly in supergraph.yaml for reproducibility - USE
rover subgraph introspectto extract schemas from running services - USE
rover schema search/rover schema describe(piped from afetch) to explore large schemas instead of loading the full SDL into context - NEVER fetch a full schema into context just to explore it — pipe
rover graph fetch/introspectintorover schema describe/search(a barefetchis only for when the user wants the SDL file itself)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: apollographql
- Source: apollographql/skills
- License: MIT
- Homepage: https://skills.sh/apollographql/skills
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.