Agent-ready workflow · api
GraphQL Operation Boundaries
Map GraphQL operations, node identities, field authorization, batching, and cost controls without broad enumeration.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- GraphQL endpoint
- persisted query
- mobile schema
- field suggestion
Prerequisites
- controlled accounts
- approved endpoint
- bounded query budget
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Collect schema evidence
Use approved introspection, client documents, errors, or local bundles to build a source-labeled operation map.
Inputs
- endpoint or client artifacts
Outputs
- type and operation map
- Evidence gate
- Every field is labeled by source and confidence.
- Negative control
- Suggested or client-only fields are not assumed reachable.
- Stop condition
- Do not brute-force a production schema.
Bind nodes to identities
Map global IDs, tenant identifiers, ownership, roles, and lifecycle state.
Inputs
- controlled GraphQL traffic
Outputs
- node authorization matrix
- Evidence gate
- Each node belongs to a controlled account or tenant.
- Negative control
- Nonexistent and wrong-type IDs are recorded.
- Stop condition
- No enumeration of unrelated nodes.
Test fields and mutations separately
Change one node, field, alias, or role per request and preserve query plus variables.
Inputs
- known-good operation
Outputs
- paired responses
- Evidence gate
- A field or mutation crosses the expected authorization boundary.
- Negative control
- The original owner request and expected-deny control remain stable.
- Stop condition
- Use reversible controlled mutations only.
Check cost controls safely
Inspect depth, aliases, pagination, and batching with hard request and object caps.
Inputs
- approved cost test
Outputs
- bounded cost observations
- Evidence gate
- The test demonstrates policy inconsistency without service degradation.
- Negative control
- A small valid query provides a timing and response baseline.
- Stop condition
- Stop on latency growth, errors, or resource strain.
Related methods
Continue with the right depth.
Sources