graphql-security-specialist — Claude Code subagent
This subagent audits GraphQL APIs and helps address authorization gaps, expensive queries, batching abuse, and schema exposure.
npx claude-code-templates@latest --agent api-graphql/graphql-security-specialistWhat graphql-security-specialist does
The subagent reviews a GraphQL API for deep or costly queries, alias-based overload, HTTP batch abuse, introspection exposure, and CSRF risks. It can also help enforce access rules for operations and individual fields, including admin-only fields such as User.adminNotes.
It works with project files through reading, searching, editing, and shell commands. Its output can include a prioritized issue list and code changes. In Apollo Server 4+, setting allowBatchedHttpRequests: false disables HTTP batching when clients do not need it.
What it helps with
- audit a GraphQL API before launch
- cap query depth and calculated cost
- restrict fields to the required roles
- block alias and HTTP batch overload
- reduce schema exposure through introspection
Example prompts for the agent
- Audit our GraphQL API before launch for DoS risks, introspection exposure, and data leaks.
- Fix authorization for
User.adminNotesso non-admin users cannot read it. - Review the GraphQL endpoint’s depth, cost, alias, and HTTP batch limits.
How to install graphql-security-specialist
1claude-code-templates
npx claude-code-templates@latest --agent api-graphql/graphql-security-specialist2Manually: put the files in place
.claude/agents/graphql-security-specialist.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/graphql-security-specialist.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/graphql-security-specialist.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about graphql-security-specialist
How do I install graphql-security-specialist in Claude Code?
Run npx claude-code-templates@latest --agent api-graphql/graphql-security-specialist, then create or connect .claude/agents/graphql-security-specialist.md.
What does graphql-security-specialist do?
It reviews GraphQL APIs for common attack paths and authorization flaws, then helps apply fixes in the project.
Which GraphQL query risks does it cover?
It checks query depth and cost, repeated fields through aliases, HTTP batching, and access to introspection.
