graphql_scanner

What graphql_scanner does on Nyxstrike

AI agents invoke graphql_scanner to trigger actions in Nyxstrike. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why graphql_scanner is rated High

The tool name 'graphql_scanner' strongly implies active scanning of GraphQL endpoints — an Execute-category action that probes external systems. The description is empty, so exact behavior is uncertain, but the offensive security context and sibling tools (payload generation, attack suites, vulnerability assessment) indicate this scans/interrogates remote GraphQL APIs, potentially exposing introspection data,…

From the tool's definition Tool name 'graphql_scanner' on a penetration testing platform ('AI Powered penetration testing Platform for offensive security research') alongside sibling tools like 'advanced_payload_generation', 'ai_generate_attack_suite', and 'ai_vulnerability_assessment'.

The rule that runs graphql_scanner safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Nyxstrike, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For graphql_scanner, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "graphql_scanner": {
      "limits": [
        {
          "counter": "graphql_scanner_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about graphql_scanner