DOCS / GETTING STARTED
Install & quick start
GQLStrike is a single static binary with no runtime dependencies. Install it, point it at a GraphQL endpoint, and read the report. The whole loop takes under a minute.
1. Install
Download the latest binary for your platform from the GitHub releases page.
2. Run your first scan
Community runs the 14 unauthenticated checks by default. Pro checks unlock automatically once a license key is configured.
$ gqls scan --url https://api.example.com/graphql
# paste a curl command copied from browser DevTools
$ gqls scan --curl 'curl https://api.example.com/graphql -H "Authorization: Bearer eyJ..."'
$ gqls serve # local web UI on :8080
3. View the report
Write findings in any supported format, or browse them in the local web UI with gqls serve.
$ gqls scan --url $URL --output html --output-file report.html
$ gqls serve # local web UI on :8080
4. Wire it into CI
Emit SARIF for code-scanning dashboards and fail the pipeline on severity. Use --baseline so only new findings can break the build.
$ gqls scan --url $URL \
--output sarif --output-file results.sarif \
--fail-on CRITICAL
5. Authenticated & authorization testing
Authorization checks are differential - they need two or more identities to compare. Supply them with repeatable --identity flags.
$ gqls scan --url $URL \
--identity 'name=owner;priv=10;header=Authorization: Bearer $A' \
--identity 'name=attacker;priv=1;header=Authorization: Bearer $B'
Ready for the full suite?
Pro adds 43 authenticated and offensive checks.