API Security
GraphQL Security Tools in 2026: 6 Options for Safer APIs
Bound depth, lint the schema, or crawl a graph you own. The dangerous operation was never in the OpenAPI file.
Expertise: API Security · Level: Intermediate · 6 min read
The OWASP GraphQL Cheat Sheet shows a posts(first: 99999999) amount query and a nested walk with no depth cap. That operation was never in the OpenAPI file, so REST tools never sent it.
Bound depth on the server you ship. Lint the schema in CI. Crawl a graph you own. A depth limit is not object-level authorization: depth stops a walk, the handler still checks the id.
REST and OpenAPI fuzz stay on API security tools. Object checks live on authorization libraries. Middleware you host, a CI lint, and a crawl against an endpoint you own put the bound in different places.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether the tool can bound depth, cost, or introspection, whether you operate it, whether CI can forbid a pattern, and whether the docs treat GraphQL as a query, not as REST with extra fields.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| GraphQL Armor | Middleware that caps depth and cost | Max depth and cost · MIT · middleware you run |
| graphql-eslint | Schema and operation lint in CI | Schema and operation rules · MIT · CI you already run |
| Escape | Commercial GraphQL testing | GraphQL-aware testing · commercial · CI hooks |
| Apollo GraphOS | Known GraphQL platform with limits | Registry plus limits · commercial / Apollo terms · known platform |
| InQL | Burp helper for a graph you own | Introspection dump · see repo license · Burp on an app you own |
| 42Crunch | Contract security that includes GraphQL | Contract audit · commercial · GraphQL next to OpenAPI |
GraphQL Armor
Best for middleware that caps depth and cost
GraphQL Armor is middleware for Apollo and others. It blocks overly deep or costly operations. Escape maintains it as MIT.
A bound you can set is the first control. You do not need a platform RFP to ship it. It is not object-level authorization. Escape the company is a different product.
Key features
- Max depth and cost
- Suggestion and alias limits
- Hooks for Apollo
- MIT
Why we like it
A cap in the server you ship is the first control worth installing on an unbounded graph.
Limits
It is not object-level authorization. You still check the id. The SaaS scanner is a different product.
graphql-eslint
Best for schema and operation lint in CI
graphql-eslint lints schema and operations. You can forbid the patterns you do not want in the repo.
A query that should never ship can die in CI. That is cheaper than a WAF story. A client can still send a query you never committed, so lint is not runtime.
Key features
- ESLint integration
- Schema rules
- Operation rules
- CI friendly
Why we like it
Forbidding the pattern in the repo is the cheapest time to kill a bad operation.
Limits
Lint is not runtime. A client can still send a query you never committed.
Escape
Best for commercial GraphQL testing
Escape sells GraphQL and API testing. They also maintain Armor. The SaaS is the scanner. Armor is the library.
When you want a vendor to crawl the graph, this is the commercial row that already understands GraphQL. Do not skip the middleware because you booked a demo.
Key features
- GraphQL-aware testing
- CI hooks
- Findings on operations
- Same house as Armor
Why we like it
A crawler that already speaks operations is the commercial job when Armor is not the whole ask.
Limits
Commercial. Middleware on the server you own still comes first.
Apollo GraphOS
Best for known GraphQL platform with limits
Apollo GraphOS is the known GraphQL platform. Persisted queries, limits, and a schema registry live here.
If the graph is already Apollo, start with the platform controls before you buy a second scanner. Price follows the platform. Open Server can do a lot without GraphOS, so read the current license on the repo you use.
Key features
- Schema registry
- Persisted queries
- Router limits
- Studio
Why we like it
Using the limits on the platform you already run beats a fourth scanner on the same schema.
Limits
Price follows the platform. Open Server can do a lot without GraphOS. Read the license on the repo you use.
InQL
Best for burp helper for a graph you own
InQL is a Burp extension for GraphQL introspection and generation. Use it on an app you own.
When the question is what you left open in introspection, this is the helper. It is not a production WAF. Do not point it at a third-party graph. This page is defense.
Key features
- Introspection dump
- Burp integration
- Query generation
- Defense lab use
Why we like it
Seeing the schema you exposed is how you prove introspection should have been off.
Limits
Not a production filter. Defense only. Stay on graphs you own.
42Crunch
Best for contract security that includes GraphQL
42Crunch is a contract and API security shop. GraphQL coverage sits next to OpenAPI. The API tools list is REST fuzz. This is the contract option.
If the org already bought 42Crunch for OpenAPI, ask for the GraphQL row before you add a fourth scanner. It does not replace Armor on the server you own.
Key features
- Audit of the contract
- Protection at the gateway story
- CI plugins
- Commercial
Why we like it
A contract option you already pay for should be asked about the graph before a new vendor lands.
Limits
Commercial. It does not replace a bound on the server.
What we left out
- graphql-shield. Teams want field-level permissions next to the resolver. It is an authorization library, and the authorization list already owns the object check.
- StackHawk. AppSec teams already run a DAST that speaks GraphQL. Escape already covers the commercial GraphQL tester, and the API tools list owns REST DAST.
GraphQL security threads keep asking for a whitelist of operations. That is persisted queries, not a permission language.
Questions before you buy
A quote that cannot answer these is selling a different product.
- Where is the max-depth or cost cap, and can I grep it in the server we ship?
- Is introspection off in production, and who can turn it back on?
- Are we buying middleware, a linter, a platform limit, or a crawler, and which of those is already paid for?
Turn introspection off in production unless you have a reason. Bound the query on the server you own.
FAQs
Does a depth limit replace object-level authZ?
No. Depth stops a walk. AuthZ stops another user’s node. Object-level checks live in the authorization list and the IDOR guide.
Should introspection stay on in production?
No, unless you have a documented exception. That is the wrong door for a public graph.
Is this a second API security tools page?
No. That list is REST fuzz and lint. This list is the graph.
Is this a scored bake-off?
No. Order is editorial.
