API Security
GraphQL security tools that bound the query (2026)
A 2026 shortlist of controls for depth, authZ, and introspection. Public docs, not a lab bake-off.
Expertise: API Security · Level: Intermediate · 12 min read
An unbounded query is a production incident with a prettier syntax.
The client asked for friends of friends of friends. The resolver walked the graph. CPU went first. GraphQL security is bounds, authZ on the field, and a closed introspection in prod. The API tools list is REST fuzz and lint. This page is the graph.
Six controls. One middleware. One linter. One commercial tester. One platform. One Burp helper. One contract shop. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| GraphQL Armor | Middleware that caps depth and cost | MIT |
| graphql-eslint | Schema and operation lint in CI | MIT |
| Escape | Commercial GraphQL testing | Commercial |
| Apollo GraphOS | Known GraphQL platform with limits | Commercial / Apollo terms |
| InQL | Burp helper for a graph you own | Apache-2.0 / see repo |
| 42Crunch | Contract security that includes GraphQL | Commercial |
GraphQL Armor
Best for middleware that caps depth and cost
GraphQL Armor is middleware for Apollo and others. It blocks overly deep or costly operations. Escape maintains it as MIT.
Key features
- Max depth and cost
- Suggestion and alias limits
- Hooks for Apollo
- MIT
Why we like it
This is the hidden gem. A bound you can set is the first control. You do not need a platform RFP to ship it.
Limits
It is not object-level authZ. You still check the id. Escape the company is a different product.
graphql-eslint
Best for schema and operation lint in CI
graphql-eslint lints schema and operations. You can forbid the patterns you do not want in the repo.
Key features
- ESLint integration
- Schema rules
- Operation rules
- CI friendly
Why we like it
A query that should never ship can die in CI. That is cheaper than a WAF story.
Limits
Lint is not runtime. A client can still send a query you never committed.
Escape
Best for commercial GraphQL testing
Escape sells GraphQL and API testing. They also maintain Armor. The SaaS is the scanner. Armor is the library.
Key features
- GraphQL-aware testing
- CI hooks
- Findings on operations
- Same house as Armor
Why we like it
When you want a vendor to crawl the graph, this is the commercial row that already understands GraphQL.
Limits
Commercial. We did not run a tenant. Do not skip Armor because you booked a demo.
Apollo GraphOS
Best for known GraphQL platform with limits
Apollo GraphOS is the known GraphQL platform. Persisted queries, limits, and a schema registry live here.
Key features
- Schema registry
- Persisted queries
- Router limits
- Studio
Why we like it
If the graph is already Apollo, start with the platform controls before you buy a second scanner.
Limits
Price follows the platform. Open Server can do a lot without GraphOS. Read the current license on the repo you use.
InQL
Best for burp helper for a graph you own
InQL is a Burp extension for GraphQL introspection and generation. Use it on an app you own.
Key features
- Introspection dump
- Burp integration
- Query generation
- Defense lab use
Why we like it
When the question is ‘what did we leave open in introspection,’ InQL is the helper. Not a production WAF.
Limits
Do not point it at a third-party graph. This page is defense. No payload cookbook.
42Crunch
Best for contract security that includes GraphQL
42Crunch is a contract and API security shop. GraphQL coverage sits next to OpenAPI. The API tools list is REST fuzz. This is the contract shelf.
Key features
- Audit of the contract
- Protection at the gateway story
- CI plugins
- Commercial
Why we like it
If the org already bought 42Crunch for OpenAPI, ask for the GraphQL row before you add a fourth scanner.
Limits
Commercial. We did not run it. It does not replace Armor on the server you own.
What the internet thinks about GraphQL security
GraphQL security threads keep asking for a whitelist of operations. That is persisted queries, not a permission language.
innomatics on Hacker News, Sep 2021: “If I know the queries that client apps are going to be running it would be useful to lock the API down to those.”
Prove Armor still has a license
Confirm GraphQL Armor still publishes a MIT tree. Do not attach it to a production gateway on the first install.
curl -fsS https://raw.githubusercontent.com/Escape-Technologies/graphql-armor/main/LICENSE | head -n 4FAQs
Does a depth limit replace object-level authZ?
No. Depth stops a walk. AuthZ stops another user’s node. Link BOLA on the API list when that page ships. Until then, link the IDOR guide.
Should introspection stay on in production?
No, unless you have a documented exception. That is the wrong door for a public graph.
Is this a second API security tools page?
No. That list is REST fuzz and lint. This list is the graph.
Is this a scored bake-off?
No. Order is editorial.
