GraphQL API Security Scanners
For a GraphQL security testing tool, the first results are szski/shapeshifter (szski/shapeshifter is a GraphQL security testing tool, directly fitting the search for automated vulnerability scanning, though the limited evidence suggests a narrower focus on injection detection rather than the full range of features listed), swisskyrepo/graphqlmap (GraphQLmap is a dedicated pentesting engine for GraphQL endpoints, supporting injection detection and other security tests, making it a direct fit for automated vulnerability scanning of GraphQL APIs) and doyensec/inql. dolevf/graphql-cop and nikitastupin/clairvoyance round out the shortlist. Compare the match explanations and check the project documentation against your requirements.
Automated tools and frameworks designed to identify security vulnerabilities and misconfigurations within GraphQL API endpoints.
GraphQL API Security Scanners
Find the best repos with AI.We'll search the best matching repositories with AI.
- szski/shapeshifter
szski/shapeshifter
GraphQL security testing tool
szski/shapeshifter is a GraphQL security testing tool, directly fitting the search for automated vulnerability scanning, though the limited evidence suggests a narrower focus on injection detection rather than the full range of features listed.
PythonGraphQL Injection - swisskyrepo/graphqlmap
swisskyrepo/GraphQLmap
1,670View on GitHubGraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;)
GraphQLmap is a dedicated pentesting engine for GraphQL endpoints, supporting injection detection and other security tests, making it a direct fit for automated vulnerability scanning of GraphQL APIs.
PythonGraphQL Injection - doyensec/inql
doyensec/inql
1,782View on GitHubInQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
InQL is a Burp Suite extension specifically designed for automated GraphQL security testing, including introspection detection, injection testing, and vulnerability scanning, which directly matches your need for a GraphQL security scanning tool—though it requires Burp Suite rather than being a standalone tool.
KotlinGraphQL Injection - dolevf/graphql-cop
dolevf/graphql-cop
Security Auditor Utility for GraphQL APIs
graphql-cop is a security auditor utility specifically for GraphQL APIs, which directly matches your need for a scanning tool — though its exact feature set may be narrower than some full-featured alternatives.
PythonGraphQL SecurityGraphQL Security ToolsSecurity and Auditing - nikitastupin/clairvoyance
nikitastupin/clairvoyance
1,481View on GitHubObtain GraphQL API schema even if the introspection is disabled
Clairvoyance helps recover a GraphQL schema when introspection is disabled, which is useful for security testing, but it does not scan for vulnerabilities, detect misconfigurations, or cover the specific checks (query depth, batch operations, auth bypass) you are looking for.
PythonGraphQL Injection - 99designs/gqlgen
99designs/gqlgen
10,729View on GitHubgqlgen is a schema-first Go library designed to build type-safe GraphQL servers. It functions as a code generation engine that transforms declarative GraphQL schema definitions into strongly-typed Go source code, ensuring strict alignment between the API contract and the underlying implementation. The framework distinguishes itself through its deep integration with the Go type system and its highly extensible build pipeline. By using schema-first development, it automates the creation of server boilerplate and resolver stubs, allowing developers to map schema fields directly to Go structs and
gqlgen is a Go library for building GraphQL servers via schema-first code generation, not a security scanning tool—it offers no vulnerability detection, query analysis, or authentication bypass testing.
GoQuery Depth Restrictions - altair-graphql/altair
altair-graphql/altair
5,412View on GitHubAltair is a graphical GraphQL API client, integrated development environment, and schema explorer. It functions as a debugging tool and collaboration platform for executing queries, mutations, and subscriptions against GraphQL servers. The project distinguishes itself by offering cloud-synced workspaces for organizing and sharing query collections among teams. It provides a flexible extensibility framework that allows the installation and execution of third-party plugins within isolated sandboxes. The platform covers a broad range of capabilities, including AI-assisted query writing, visual
Altair is a graphical GraphQL client and IDE for exploring and debugging APIs, not an automated security scanner — it lacks the built-in vulnerability detection, introspection analysis, and misconfiguration checks this search requires.
TypeScriptGraphQL Schema Introspection - sqlmapproject/sqlmap
sqlmapproject/sqlmap
37,676View on GitHubThis project is an automated security testing suite designed to detect and exploit database vulnerabilities. It functions as a command-line utility that streamlines the identification, verification, and exploitation of web application flaws by automating the injection of malicious payloads into input parameters. The tool provides a comprehensive framework for database enumeration, allowing users to extract schema information, user data, and system configurations from identified injection points. What distinguishes this tool is its sophisticated engine for dynamic payload adaptation and heuris
sqlmap is a SQL injection detection and exploitation tool that targets database vulnerabilities, not GraphQL APIs — it does not perform introspection detection, query depth analysis, or other GraphQL-specific security checks required for this search.
PythonInjection Testing Tools - graphql-dotnet/graphql-dotnet
graphql-dotnet/graphql-dotnet
5,987View on GitHubGraphQL.NET is a server-side framework for building and executing GraphQL APIs within C# applications. It provides a comprehensive toolkit for schema building, a federated engine for distributed data graphs, and a subscription handler for managing real-time data streams. The project distinguishes itself with a flexible schema builder that supports both programmatic code-first definitions and declarative schema-first approaches using the standard schema definition language. It includes a dedicated federation engine to split data graphs into subgraphs and compose them into a unified gateway, as
This is a server-side framework for building GraphQL APIs, not a security scanning tool — it lacks any vulnerability detection or testing features.
C#GraphQL Schema Introspection
Compare the top 10 at a glance
| Repository | Stars | Language | License | Last push |
|---|---|---|---|---|
| szski/shapeshifter | 125 | Python | — | |
| swisskyrepo/graphqlmap | 1.7K | Python | MIT | |
| doyensec/inql |