Your files stay on your device

# GraphQL schema security auditor

Audit a pasted GraphQL schema or introspection result for design risks like exposed mutations and unbounded lists.

The input is auto-detected by shape: braces mean JSON, anything else SDL.

Paste a schema to audit it.

This is a design review of the pasted text, not a penetration test. It never queries an endpoint; there is no live mode. Depth, complexity, and rate limits do not appear in a schema or introspection result, so nothing here can tell you whether a server enforces them, and introspection carries no directive declarations, so @auth style guards are invisible to the audit. A clean report means the paste shows no obvious design risks, nothing stronger than that.
Options

## More regex & cron tools

- [JSON validator](/json/validator)
- [JSON converter](/json/convert)
- [Regex tester](/dev/regex-tester)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/graphql-schema-security-auditor
Markdown version: https://nutter.tools/dev/graphql-schema-security-auditor.md
Plain-text version: https://nutter.tools/dev/graphql-schema-security-auditor.txt
Agent index: https://nutter.tools/llms.txt