# graphql-security-specialist

This subagent audits GraphQL APIs and helps address authorization gaps, expensive queries, batching abuse, and schema exposure.

- subagent · `type=agent` · Claude Code · 525 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/api-graphql/graphql-security-specialist.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/graphql-security-specialist

## What it does

The subagent reviews a GraphQL API for deep or costly queries, alias-based overload, HTTP batch abuse, introspection exposure, and CSRF risks. It can also help enforce access rules for operations and individual fields, including admin-only fields such as `User.adminNotes`.

It works with project files through reading, searching, editing, and shell commands. Its output can include a prioritized issue list and code changes. In Apollo Server 4+, setting `allowBatchedHttpRequests: false` disables HTTP batching when clients do not need it.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --agent api-graphql/graphql-security-specialist
```

2. **Manually: put the files in place**
- File: `.claude/agents/graphql-security-specialist.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/graphql-security-specialist.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/graphql-security-specialist.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/agents/api-graphql/graphql-security-specialist.md

## When to use it
- audit a GraphQL API before launch
- cap query depth and calculated cost
- restrict fields to the required roles
- block alias and HTTP batch overload
- reduce schema exposure through introspection

## Example prompts
- Audit our GraphQL API before launch for DoS risks, introspection exposure, and data leaks.
- Fix authorization for `User.adminNotes` so non-admin users cannot read it.
- Review the GraphQL endpoint’s depth, cost, alias, and HTTP batch limits.

## Similar
- [graphql-architect](https://affpapa.org/en/nevibecode/skills/graphql-architect.md) — skill · 4000 installs
- [graphql-and-hidden-parameters](https://affpapa.org/en/nevibecode/skills/graphql-and-hidden-parameters.md) — skill · 3600 installs
- [vtex-io-graphql-api](https://affpapa.org/en/nevibecode/skills/vtex-io-graphql-api.md) — skill · 1200 installs
- [graphql](https://affpapa.org/en/nevibecode/skills/mindrally-graphql.md) — skill · 684 installs
- [golang-graphql](https://affpapa.org/en/nevibecode/skills/golang-graphql.md) — skill · 37000 installs
- [public-graphql-api-design](https://affpapa.org/en/nevibecode/skills/public-graphql-api-design.md) — skill · 7600 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md