Agent Disco check

GraphQL introspection

← Back to all checks

passive · Category API discoverability · Weight 8 · Key api.graphql_introspection

POSTs a minimal GraphQL introspection query ({ __schema { queryType { name } } }) to /graphql, /api/graphql, /query. Passes when the server returns the schema root type; warns if introspection is disabled but the endpoint responds (a common security-hardening posture). Skips if nothing answers.