# swisskyrepo/GraphQLmap

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;)

Repository: https://github.com/swisskyrepo/GraphQLmap
Canonical: https://ross.abutalabs.com/products/graphqlmap
Language: Python
License: MIT
License Family: permissive
Topics: graphql, sql-injection, nosql-injection, graphql-injection, fuzz, pentest, ctf, capture-the-flag, hacktoberfest
Last push: 2024-03-11T15:46:30+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2630, "days_push": 905, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1688, forks 228 (observed 2026-08-28T04:05:22.314440+00:00)

## What it is
GraphQLmap is a Python scripting engine and interactive CLI for interacting with GraphQL endpoints during penetration testing. It supports schema dumping, query execution with autocomplete, field fuzzing, and SQL/NoSQL injection testing against GraphQL fields.

## Use cases
- dump a graphql endpoint schema during a pentest
- fuzz graphql fields to discover hidden parameters
- test graphql fields for sql injection
- test graphql fields for nosql injection
- bruteforce graphql field values in ctf challenges
- send graphql queries through a proxy like burp

## When to choose
- you are pentesting or CTF-solving a GraphQL endpoint and need injection/fuzzing tooling
- you want an interactive shell with autocomplete for crafting GraphQL queries
- you need to quickly dump and explore a GraphQL schema

## When to avoid
- you need a general-purpose GraphQL client for legitimate application development
- you require a full vulnerability scanner with reporting rather than a manual testing console
- you need actively maintained tooling with recent updates and broad GraphQL feature support

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, http-client, cli
- domain: security, penetration-testing, apis, developer-tools
- platform: python, cli, windows
- tags: graphql, pentesting, sql-injection, nosql-injection, fuzzing, ctf, schema-dumping, linux, macos

## Member repositories
- swisskyrepo/GraphQLmap (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:22.314440+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:38:49.412557+00:00, confidence not recorded.
  - readme: https://github.com/swisskyrepo/GraphQLmap (fetched 2026-08-28T04:05:22.314440+00:00, sha 48f1f4f1ccb8)
- Data as of 2026-08-30T08:39:29.467469+00:00.