GraphQL Clinic

GraphQL API review from a paste — verdict, findings, checklist, refined schema.

Back to SkillSafe
Or pick files: .graphql, .gql, .js and .ts files are read locally, nothing uploads until you run.
Context — what the API serves, what lives elsewhere
How it works

Nothing to hand? Load the — Int IDs, unpaginated lists, open introspection and N+1 resolvers — the , where the types are right but the contract is not, or the , which should come back sound.

1

Paste the GraphQL

A schema file, a resolver map, the server setup, or all of it. The instant prescan reads it for free while you type and lists what it mechanically found: IDs typed as Int, list fields with no pagination arguments, nullable list items, mutations taking loose scalar args, String fields where an enum belongs, introspection left on, servers with no depth or complexity limit, relationship resolvers hitting the database per row with no DataLoader, and deprecations without a reason - plus the declared types and the query, mutation, list-field, input, enum and DataLoader counts in your paste.

2

The AI reviews it

A sound/refactor/rework verdict; severity-ranked findings, each quoting the schema or resolver it concerns and carrying corrected SDL or resolver code; a twelve-item schema checklist scored pass, fail or not-observable against your paste; and an honest health check across schema design and nullability, pagination and list shape, resolver efficiency, security and abuse limits, and errors and mutation contracts. Every prescan hit is confirmed or explicitly set aside — including the false positives.

3

Take the rewrite and go

Your own contract refined — same domain, same intent, opaque IDs, connection pagination, input and payload mutations, errors as data, enums over bare strings, deliberate nullability — as a downloadable schema.refined.graphql, plus the ordered next steps, the findings as CSV, review history on this device with restore (fix, re-review, compare), and Markdown or JSON export.

Derived from the @sickn33/graphql skill (MIT).

Questions

What does a review cost?

Estimates are free and run as you type; the price meter beside the Review it button shows what a run would reserve, and the reservation prices the full output cap, so the amount actually charged is usually lower. The three bundled examples replay a saved run and cost nothing at all. Reviewing your own schema needs a signed-in SkillSafe account with credits.

Does my schema leave my browser?

The instant prescan, the diff, the patch and every export run entirely in your browser, and files you drop are read locally — nothing uploads until you press Review it. Pressing Review it does send the pasted text to the model, and the free price estimate sends it too so it can be priced. Saved reviews go to your SkillSafe account so they follow you between devices; Clear history removes them from the account and from this device.

What happens if a review is cut short?

Whatever arrived is kept and shown, and every section that did not arrive is labelled not received rather than scored. An empty findings list from a truncated run says so explicitly instead of reading as a clean bill of health, and if the refined schema never arrived the app shows nothing there rather than guessing at it.

How do I get the rewrite into my repo?

The refined schema is shown in full, as a line diff against your own paste, and as a standard unified patch you can copy or download and feed straight to git apply or paste into a review comment. The findings also export as CSV or as a Markdown work list of checkboxes.

Can I re-review after fixing things?

Yes — that is the loop the app is built around. Restore any past review to put its schema back in the form, edit it, and run again; the new result carries a comparison against the previous review of the same schema showing how the verdict, the finding count, the high-severity count and the failing checklist items moved.

What can it not tell me?

It reviews only the text you paste. It does not connect to a running server, execute queries, read your database or see resolvers you did not include, so anything outside the paste is raised as a next step rather than filed as a finding. The prescan is keyword and pattern matching, which is why the review is required to confirm or explicitly set aside every one of its hits, including the false positives.