Your files stay on your device

GraphQL schema security auditor

Audit a pasted GraphQL schema or introspection result for design risks like exposed mutations and unbounded lists.

The input is auto-detected by shape: braces mean JSON, anything else SDL.

Paste a schema to audit it.

This is a design review of the pasted text, not a penetration test. It never queries an endpoint; there is no live mode. Depth, complexity, and rate limits do not appear in a schema or introspection result, so nothing here can tell you whether a server enforces them, and introspection carries no directive declarations, so @auth style guards are invisible to the audit. A clean report means the paste shows no obvious design risks, nothing stronger than that.
Options

More regex & cron tools

- JSON validator (/json/validator)
- JSON converter (/json/convert)
- Regex tester (/dev/regex-tester)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/graphql-schema-security-auditor
Markdown version: https://nutter.tools/dev/graphql-schema-security-auditor.md
Plain-text version: https://nutter.tools/dev/graphql-schema-security-auditor.txt
Agent index: https://nutter.tools/llms.txt