eloquentjs
mcp
Fail
Health Warn
- No license — Repository has no license file
- Description — Repository has a description
- Active repo — Last push 0 days ago
- Community trust — 69 GitHub stars
Code Fail
- fs module — File system access in .github/workflows/ci.yml
- fs module — File system access in .github/workflows/release.yml
- rm -rf — Recursive force deletion command in package.json
Permissions Pass
- Permissions — No dangerous permissions requested
Purpose
This tool is a modular, extensible Object-Relational Mapper (ORM) for Node.js that mimics the behavior of Laravel's Eloquent. It includes a dedicated MCP server designed to give AI coding agents direct access to database schemas and CRUD operations.
Security Assessment
Overall Risk: Medium
The tool inherently deals with sensitive data because it is an ORM designed to manage database connections, handle migrations, and execute queries. While the automated audit notes no hardcoded secrets or directly requested dangerous permissions, it does pose indirect risks.
Notably, the scan found recursive force deletion commands (`rm -rf`) inside the project's `package.json`. While common in npm build and cleanup scripts, this is a well-known vector for accidental data loss or malicious script execution if the package is compromised. Additionally, file system access was flagged in the GitHub CI/CD workflows, which is standard for automated testing and publishing, but worth noting. Because MCP servers act as a bridge between AI agents and your local file system or database, granting it access implies trusting the tool with your database credentials.
Quality Assessment
The project demonstrates strong active maintenance, with its most recent code push occurring today. It features an impressive monorepo structure with 737 passing tests and comprehensive documentation, which are excellent indicators of developer diligence. The tool also boasts 69 GitHub stars, showing a baseline of growing community trust. However, there is a major discrepancy: the README claims an MIT license, but the repository lacks an actual license file. This creates legal ambiguity regarding how the code can be used or contributed to.
Verdict
Use with caution — it is a well-tested and active project, but you should review the `rm -rf` scripts in the package.json and be aware of the missing license file before integrating it into a production environment.
This tool is a modular, extensible Object-Relational Mapper (ORM) for Node.js that mimics the behavior of Laravel's Eloquent. It includes a dedicated MCP server designed to give AI coding agents direct access to database schemas and CRUD operations.
Security Assessment
Overall Risk: Medium
The tool inherently deals with sensitive data because it is an ORM designed to manage database connections, handle migrations, and execute queries. While the automated audit notes no hardcoded secrets or directly requested dangerous permissions, it does pose indirect risks.
Notably, the scan found recursive force deletion commands (`rm -rf`) inside the project's `package.json`. While common in npm build and cleanup scripts, this is a well-known vector for accidental data loss or malicious script execution if the package is compromised. Additionally, file system access was flagged in the GitHub CI/CD workflows, which is standard for automated testing and publishing, but worth noting. Because MCP servers act as a bridge between AI agents and your local file system or database, granting it access implies trusting the tool with your database credentials.
Quality Assessment
The project demonstrates strong active maintenance, with its most recent code push occurring today. It features an impressive monorepo structure with 737 passing tests and comprehensive documentation, which are excellent indicators of developer diligence. The tool also boasts 69 GitHub stars, showing a baseline of growing community trust. However, there is a major discrepancy: the README claims an MIT license, but the repository lacks an actual license file. This creates legal ambiguity regarding how the code can be used or contributed to.
Verdict
Use with caution — it is a well-tested and active project, but you should review the `rm -rf` scripts in the package.json and be aware of the missing license file before integrating it into a production environment.
EloquentJS monorepo — Laravel Eloquent for Node.js
README.md
EloquentJS
Laravel Eloquent for Node.js — modular, extensible, batteries-included.
// Reads like English.
const users = await User
.where('active', true)
.where('age', '>', 18)
.with('posts', 'profile')
.orderBy('name')
.paginate(1, 20)
Packages
| Package | Version | Description |
|---|---|---|
@eloquentjs/core |
Base Model, QueryBuilder, Relations, Events, Casts | |
@eloquentjs/codegen |
Shared code generation — GraphQL SDL, TypeScript, OpenAPI, stubs | |
@eloquentjs/validator |
Full validation — async rules, fluent schema API, unique/exists, adapters | |
@eloquentjs/pgsql |
PostgreSQL driver (multi-connection, transactions) | |
@eloquentjs/sqlite |
SQLite driver (local files, in-memory databases, migrations) | |
@eloquentjs/mongodb |
MongoDB driver | |
@eloquentjs/realtime |
WebSocket pub/sub — Pusher-protocol, auto-broadcast | |
@eloquentjs/graphql |
Auto-generate GraphQL schema + resolvers | |
@eloquentjs/api |
One-line REST CRUD routes (Express + Fastify) | |
@eloquentjs/mcp |
MCP server — 21 tools for AI agents (Claude, Cursor, Windsurf) | |
@eloquentjs/cli |
CLI — scaffold, migrate, seed, generate |
Quick Start
npm install @eloquentjs/core @eloquentjs/pgsql
# Or: npm install @eloquentjs/core @eloquentjs/sqlite
npm install -g @eloquentjs/cli
# Initialize in your project
eloquent init
# Scaffold a model with everything
eloquent make:model User --all
# Run migrations
eloquent migrate
# Generate GraphQL schema, TypeScript types, and OpenAPI spec
npm install @eloquentjs/codegen
eloquent generate:graphql
eloquent generate:types
eloquent generate:openapi
# Add MCP server for AI agents (Claude.ai, Cursor, Windsurf)
npm install -g @eloquentjs/mcp
eloquent-mcp --cwd .
Feature Highlights
Model & Query Builder
import { Model } from '@eloquentjs/core'
class User extends Model {
static table = 'users'
static fillable = ['name', 'email', 'password']
static hidden = ['password']
static softDeletes = true
static casts = { is_admin: 'boolean', settings: 'json', created_at: 'date' }
posts() { return this.hasMany(Post) }
profile() { return this.hasOne(Profile) }
roles() { return this.belongsToMany(Role, 'user_roles') }
getFullNameAttribute() { return `${this.first_name} ${this.last_name}` }
setPasswordAttribute(v) { return bcrypt.hashSync(v, 10) }
static scopeActive(qb) { return qb.where('active', true) }
static async creating(u) { u.slug = slugify(u.name) }
}
await User.where('active', true).with('posts').orderBy('name').paginate(1, 20)
await User.whereIn('role', ['admin', 'editor']).get()
await User.whereBetween('age', [18, 65]).count()
await User.active().admins().latest().first()
// Global mass-assignment bypass
Model.unguard()
await User.create({ id: 99, name: 'Seed User', email: '[email protected]' })
Model.reguard()
// Or use the scoped helper to restore automatically
await Model.unguarded(async () => {
await User.create({ id: 99, name: 'Seed User', email: '[email protected]' })
})
Validation
import { v, Rule } from '@eloquentjs/validator'
const schema = v.schema({
name: v.string().min(2).max(100),
email: v.string().email().unique('users', 'email'), // async DB check
password: v.string().min(8).confirmed(),
age: v.number().integer().min(18).optional(),
role: v.string().oneOf(['admin', 'editor', 'viewer']),
address: v.object({ city: v.string(), zip: v.string().digits(5) }),
})
const data = await schema.parseAsync(req.body) // throws ValidationException on failure
const { success, errors } = await schema.safeParseAsync(req.body) // never throws
// Express middleware
import { expressValidate } from '@eloquentjs/validator/adapters'
router.post('/users', expressValidate(schema, { async: true }), handler)
// req.validated contains only schema-defined fields
Relations
// Eager load — prevents N+1
await User.with('posts.comments.author').get()
await User.with({ posts: qb => qb.where('published', true) }).get()
// BelongsToMany pivot
await user.roles().attach(roleId, { assigned_at: new Date() })
await user.roles().sync([1, 2, 3])
// Polymorphic
class Comment extends Model {
commentable() { return this.morphTo('commentable') }
}
Events & Observers
class UserObserver {
creating(user) { user.uuid = crypto.randomUUID() }
created(user) { WelcomeEmail.send(user) }
deleting(user) { user.posts().delete() }
}
HookRegistry.observe(User, new UserObserver())
Realtime
import { createRealtimeServer } from '@eloquentjs/realtime'
const rt = createRealtimeServer({ port: 6001 })
rt.broadcastFrom(User) // broadcasts User:created/updated/deleted
GraphQL
import { buildSchema, buildSchemaFromDir } from '@eloquentjs/graphql'
const { typeDefs, resolvers } = buildSchema([User, Post, Comment], {
subscriptions: true,
auth: async (ctx) => authenticateFromToken(ctx.req.headers.authorization),
})
// Or auto-load all models from a directory
const { typeDefs, resolvers } = await buildSchemaFromDir('./app/models')
// CLI generation
eloquent generate:graphql --out=schema.graphql
eloquent generate:graphql --pagination=relay
REST API
import { apiRouter, resource } from '@eloquentjs/api'
app.use('/api', apiRouter([
resource(User, {
middleware: [authRequired],
with: ['profile'],
searchable: ['name', 'email'],
sortable: ['name', 'created_at'],
policy: async (req, model, action) => action === 'destroy' ? req.user.is_admin : true,
}),
resource(Post, { only: ['index', 'show', 'store'] }),
]))
// GET /api/users?page=1&search=alice&sort=-created_at&with=profile
MCP Server for AI Agents
// Start the MCP server — AI agents get 21 tools to work with your models
eloquent-mcp --cwd /path/to/project
// Tools available to the agent:
// list_models, describe_model, describe_database_schema
// generate_model, generate_migration, generate_graphql_schema
// query_model, run_migrations, migration_status
// get_help, get_method_signature, get_examples
// nlp_query, nlp_crud, ... (21 total)
Configure in your AI tool — see @eloquentjs/mcp for setup instructions for Claude.ai, Cursor, and Windsurf.
AI Agent Files
The agent-files/ directory contains ready-to-use files for AI coding assistants:
| File | For |
|---|---|
CLAUDE.md |
Claude.ai — drop in project root, auto-loaded |
GEMINI.md |
Gemini-based tools |
.cursorrules |
Cursor — drop in project root |
.windsurfrules |
Windsurf — drop in project root |
copilot-instructions.md |
GitHub Copilot — copy to .github/copilot-instructions.md |
skills/db-skill.md |
Deep DB patterns for any agent |
skills/api-skill.md |
REST API patterns |
skills/mcp-skill.md |
MCP tool reference and setup |
Repository Structure
eloquentjs/
├── packages/
│ ├── core/ @eloquentjs/core
│ ├── codegen/ @eloquentjs/codegen
│ ├── validator/ @eloquentjs/validator
│ ├── pgsql/ @eloquentjs/pgsql
│ ├── mongodb/ @eloquentjs/mongodb
│ ├── realtime/ @eloquentjs/realtime
│ ├── graphql/ @eloquentjs/graphql
│ ├── api/ @eloquentjs/api
│ ├── mcp/ @eloquentjs/mcp
│ └── cli/ @eloquentjs/cli
├── tests/
│ └── unit/ 702 tests, 12 suites, all passing
├── agent-files/ CLAUDE.md, .cursorrules, skills/...
├── .github/
│ └── workflows/ CI + Release automation
├── scripts/
│ ├── release.js Version bump + changelog
│ ├── publish.js npm publish orchestration
│ └── check-versions.js Version consistency check
└── CHANGELOG.md
Development
git clone https://github.com/your-org/eloquentjs.git
cd eloquentjs && npm install
npm test # run all 700 tests
npm run test:coverage # with coverage report
npm test -- --testPathPattern=MCP # single suite
npm run check:versions # verify all packages at same version
Releasing
All packages share one version number. Full process in RELEASING.md.
npm run release:patch # 1.0.0 → 1.0.1
npm run release:minor # 1.0.0 → 1.1.0
npm run release:major # 1.0.0 → 2.0.0
npm run release:alpha # 1.0.0 → 1.0.1-alpha.0
npm run release:beta # 1.0.0 → 1.0.1-beta.0
npm run publish:all # publish all 10 packages to npm
Contributing
- Fork → branch:
git checkout -b feat/my-feature - Write tests:
npm test - Commit via Conventional Commits:
feat(core): add X - Open a Pull Request
License
MIT © EloquentJS Contributors
Reviews (0)
Sign in to leave a review.
Leave a reviewNo results found