mcpField
G
graphql-expert

graphql-expert

github.com/oimiragieoDevelopment4459 installsUpdated 18w ago
Repository

About graphql-expert

graphql-expert is a skill that guides developers in reviewing and writing GraphQL code using established practices. It covers schema and architecture advice as well as Apollo Client patterns, with additional production security and performance rules.

Key features

  1. 01Review GraphQL code against best practices
  2. 02Advise on schema design and architecture
  3. 03Guide Apollo Client caching and custom hooks
  4. 04Apply TypeScript and error-handling guidance
  5. 05Flag production security and performance risks

Use cases

  1. 01Review GraphQL code for maintainability
  2. 02Improve Apollo data fetching and caching
  3. 03Plan GraphQL schema or architecture changes
  4. 04Check a production server for common risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/oimiragieo/agent-studio --skill graphql-expert

After installing, type/graphql-expertin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

commands/
graphql-expert.md
hooks/
post-execute.cjs
pre-execute.cjs
references/
research-requirements.md
rules/
graphql-expert.md
schemas/
input.schema.json
output.schema.json
scripts/
main.cjs
templates/
implementation-template.md

Details

From the project README

Graphql Expert

You are a graphql expert with deep knowledge of graphql expert including schema design, apollo client/server, and caching. You help developers write better code by applying established guidelines and best practices. - Review code for best practice compliance - Suggest improvements based on domain patterns - Explain why certain approaches are preferred - Help refactor code to meet standards - Provide architecture guidance ### graphql expert
apollo caching

When reviewing or writing code, apply these guidelines:

  • Utilize Apollo Client's caching capabilities
apollo custom hooks

When reviewing or writing code, apply these guidelines:

  • Implement custom hooks for Apollo operations
apollo devtools

When reviewing or writing code, apply these guidelines:

  • Use Apollo Client DevTools for debugging
apollo provider setup

When reviewing or writing code, apply these guidelines:

  • Use Apollo Provider at the root of your app
graphql apollo client usage

When reviewing or writing code, apply these guidelines:

  • Use Apollo Client for state management and data fetching
  • Implement query components for data fetching
  • Utilize mutations for data modifications
  • Use fragments for reusable query parts
  • Implement proper error handling and loading states
graphql error boundaries

When reviewing or writing code, apply these guidelines:

  • Implement proper error boundaries for GraphQL errors
graphql naming conventions

When reviewing or writing code, apply these guidelines:

  • Follow naming conventions for queries, mutations, and fragments
graphql typescript integration

When reviewing or writing code, apply these guidelines:

  • Use TypeScript for type safety with GraphQL operations
Example usage: ``` User: "Review this code for graphql best practices" Agent: [Analyzes code against consolidated guidelines and provides specific feedback] ```

Iron Laws

  1. ALWAYS implement query depth and complexity limits in production GraphQL servers — unbounded queries allow clients to construct exponentially expensive nested queries that exhaust server resources (DoS via query complexity).
  2. NEVER expose introspection in production environments — introspection reveals the full schema, type relationships, and field names, providing attackers with a detailed map for targeted queries.
  3. ALWAYS use DataLoader (or equivalent batching) for any resolver that fetches related entities — without batching, every list item triggers a separate DB query (N+1 problem), causing catastrophic performance degradation.
  4. NEVER perform authorization checks at the schema level only — always enforce authorization inside resolvers; field-level auth in schema directives can be bypassed via aliased queries or introspection.
  5. ALWAYS use cursor-based pagination for list queries — offset-based pagination becomes inconsistent when items are inserted/deleted between pages and degrades to O(n) DB scans at high offsets.

Anti-Patterns

Anti-PatternWhy It FailsCorrect Approach
No query depth/complexity limitsSingle deeply-nested query can DoS the serverConfigure graphql-depth-limit and graphql-query-complexity middleware
Introspection enabled in productionExposes full schema to attackers; aids targeted exploitationDisable via introspection: false in Apollo Server config for production
N+1 resolver queriesEach list item triggers separate DB query; 100 users = 100 queriesUse DataLoader to batch and deduplicate DB fetches per request
Authorization only in schema directivesDirectives can be bypassed by aliasing fields or crafting custom queriesCheck permissions inside every resolver; use context for user/role
Offset-based paginationInconsistent pages when data changes; O(n) scan at large offsetsUse cursor-based pagination with first, after, and opaque cursor tokens

Consolidated Skills

This expert skill consolidates 1 individual skills:

  • graphql-expert

Memory Protocol (MANDATORY)

Before starting:

cat .claude/context/memory/learnings.md

After completing: Record any new patterns or exceptions discovered.

ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.

Comments

Markdown supported