Skip to content
SPECIFICTION
Get listed

GraphQL-Cop

github.com

WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 7.2 #23 of 27 in API Security Testing Software

Spec sheet

Purpose
GraphQL-Cop is a lightweight Python utility for running common security tests against GraphQL APIs, including CI/CD checks.Read 7 Oct 2026 · github.com
Intended users
The repository describes the tool as suitable for GraphQL security auditing and CI/CD checks.Read 7 Oct 2026 · github.com
Deployment
The README documents running GraphQL-Cop from Python and building and running it as a Docker container.Read 7 Oct 2026 · github.com
Support
The README provides command-line help and troubleshooting guidance for Docker file and dependency issues.Read 7 Oct 2026 · github.com
License
The repository identifies its license as MIT.Read 7 Oct 2026 · github.com
CI/CD
The project describes itself as suitable for lightweight GraphQL CI/CD checks.Read 7 Oct 2026 · github.com
Configuration
Users can supply request headers, exclude tests, force a scan, configure a proxy, or provide a custom endpoint wordlist.Read 7 Oct 2026 · github.com
Detection coverage
Its listed checks include alias and batch query overloading, CSRF risks, information leaks, and circular introspection queries.Read 7 Oct 2026 · github.com
Docker
The README documents building and running the tool in a Docker container.Read 7 Oct 2026 · github.com
Endpoint discovery
If no GraphQL path is provided, the tool iterates through common GraphQL paths.Read 7 Oct 2026 · github.com
Findings
It tests for issues including alias overloading, batch queries, CSRF, information leaks, field duplication, and denial-of-service risks.Read 7 Oct 2026 · github.com
Installation
The README lists Python 3 and the Requests library as requirements.Read 7 Oct 2026 · github.com
Maintainer
The repository owner profile identifies dolevf as Dolev Farhi and describes him as a security engineer.Read 7 Oct 2026 · github.com
Output
It supports JSON output and can include cURL reproduction commands in the results.Read 7 Oct 2026 · github.com
Reproduction
For identified vulnerabilities, it provides cURL commands to reproduce the findings.Read 7 Oct 2026 · github.com
Requirements
The listed requirements are Python 3 and the Requests library.Read 7 Oct 2026 · github.com
Target discovery
If the target URL omits a GraphQL path, it iterates through a series of common GraphQL paths.Read 7 Oct 2026 · github.com

Where Specifiction places it

Alternatives to GraphQL-CopAll alternatives →