GraphQL security scanner · single binary
Scan any GraphQL API for the vulns that actually get exploited.
GQLStrike runs 57 checks - BOLA, injection, JWT flaws, DoS and business-logic abuse - against any endpoint, from your terminal or CI. No agent. No SaaS. One binary.
$ gqls scan --url https://api.acme.dev/graphql GQLStrike · 57 checks loaded · target api.acme.dev [✓] discovery introspection enabled ............ HIGH [✓] discovery field suggestions leak schema .... MED [!] authz BOLA on node(id:) cross-tenant .. CRIT A01 [!] injection SQLi via filter argument ........ CRIT I01 [!] dos unbounded query depth ........... HIGH 007 [✓] dos alias amplification blocked ..... PASS 2 critical · 2 high · 1 medium · 57 checks report → results.sarif gqls serve▋
57
security checks
8
attack categories
1
binary, zero deps
14
free in Community
Eight categories of attack
Browse the full catalog →DDiscovery & Information Disclosure11
Introspection, field suggestions, playgrounds and leaked schema detail.
AAuthorization & Access Control12
BOLA/IDOR, BFLA, field-level authz and cross-tenant isolation.
IInjection9
SQLi, NoSQL, OS command, SSRF, XSS and template injection.
SDenial of Service10
Depth, complexity, aliasing and amplification abuse.
PPersisted Queries & APQ6
APQ handshake, allowlist bypass and cache poisoning.
NAuthentication & Session4
JWT weaknesses, CSRF and identifier enumeration.
CConfiguration & Hardening3
Transport, CORS and security-header posture.
FServer Intelligence & Fingerprinting2
Engine fingerprinting and known-CVE correlation.
Install → scan → report
02 - SCAN
Point it at an endpoint
$ gqls scan --url $URL
03 - REPORT
Open the local web UI
$ gqls serve
results.sarif · api.acme.dev
2 CRIT2 HIGH1 MED
GQL-A01authzBOLA - node(id:) returns cross-tenant recordsCRIT
GQL-I01injectionBoolean-based SQL injection via filter argumentCRIT
GQL-A08authnJWT signature not verified on mutationsHIGH
GQL-007dosQuery depth limit not enforcedHIGH
GQL-003discoveryField suggestions leak hidden schema typesMED
Community vs Pro
Everything the free tier does, plus authenticated and offensive testing.
Community
Pro
Security checks
14
57
Discovery & misconfiguration
✓
✓
Authorization (BOLA/BFLA/JWT)
—
✓
Injection (SQLi, SSRF, SSTI)
—
✓
Denial of service & complexity
—
✓
Persisted-query attacks
—
✓
Business-logic testing
—
✓
Authenticated / multi-identity scans
—
✓
Exploit PoC generation
—
✓
Local web report UI
✓
✓
CI / CD integration
✓
✓
Export formats
all
all
Support
Community
Priority
Price
Free
Contact
Ship it before an attacker finds it.
Free for recon and misconfig. Pro for the offensive suite.