graphql

graphql/graphiql

TypeScript MIT Dev Tools known-xss-vulnerability-in-older-versions

GraphiQL & the GraphQL LSP Reference Ecosystem for building browser & IDE tools.

16.9k stars
1.8k forks
active
GitHub +6 / week

16.9k

Stars

1.8k

Forks

385

Open issues

30

Contributors

AI Analysis

GraphiQL is the official reference implementation of a GraphQL IDE, provided as a monorepo ecosystem with browser-based and LSP-based tooling. It serves developers building GraphQL servers and IDEs who need a production-ready, specification-compliant interface for querying GraphQL APIs, offering integrations with CodeMirror, Monaco, and LSP-compatible editors.

Dev Tools Developer Tool Discovery value: 3/10
Documentation 8/10
Activity 9/10
Community 9/10
Code quality 8/10

Inferred from signals mentioned in the README (tests, CI, type safety) — not a review of the actual code.

Overall score 8/10

AI's overall editorial judgment — not an average of the bars above, can weigh other factors too.

graphql-ide language-server-protocol developer-tools code-editor typescript-monorepo
Actively maintained Well documented MIT licensed Popular Beginner friendly Production ready
Deep Analysis · Based on README and public signals
3w ago

GraphiQL: The official GraphQL IDE and LSP ecosystem used across virtually every GraphQL deployment

GraphiQL is the reference in-browser GraphQL IDE and a monorepo providing the canonical language service infrastructure for the GraphQL ecosystem. It ships an interactive query explorer, schema documentation browser, and a full LSP server used by editor plugins across VS Code, JetBrains, and others. It is built for GraphQL API developers — both those embedding a query UI in their product and those wanting IDE-quality autocompletion and validation. As an official GraphQL Foundation project, it is the de facto standard for GraphQL developer tooling.

Origin

Created in August 2015 alongside GraphQL's initial open-source release by Facebook, it later became a GraphQL Foundation project. It evolved from a single React component into a full monorepo covering LSP, CodeMirror 5, CodeMirror 6, Monaco, and CLI tooling.

Growth

Star growth has plateau'd at ~16.8k, reflecting saturation rather than decline — GraphiQL is already embedded in nearly every GraphQL server framework (Apollo, Hasura, PostGraphile, etc.), so new users encounter it through those integrations rather than discovering it directly. The 2 stars gained in the last 7 days is consistent with a mature, widely-deployed infrastructure project whose adoption is driven by ecosystem embeds, not organic discovery.

In production

GraphiQL is embedded by default in Apollo Server, Hasura, PostGraphile, AWS AppSync console, and dozens of other GraphQL frameworks and platforms. NPM downloads for the graphiql package are in the millions per month based on its jsDelivr and npm badges (exact figures not confirmed from this README excerpt, but consistent with ecosystem ubiquity). Adoption is extensive and well-documented across the GraphQL ecosystem.

Code analysis
Architecture

Appears to be a TypeScript monorepo with clearly separated packages: the graphiql React UI component, graphql-language-service (core LSP logic), graphql-language-service-server (LSP daemon), codemirror-graphql (CM5), cm6-graphql (CM6), and monaco-graphql (Monaco editor integration). The language service appears to be a shared core consumed by all editor integrations, which is a sound architectural decision. CI is visible via GitHub Actions badges.

Tests

Code coverage is tracked via Codecov and a badge is shown in the README, indicating active measurement. CII Best Practices badge is also present, suggesting structured quality processes. Exact coverage percentage not stated in the README excerpt.

Maintenance

Last push was 2026-06-21, one day before the evaluation date — actively maintained. The project carries CII Best Practices certification, has continuous CI, and is under GraphQL Foundation governance, all strong long-term maintenance signals. pkg.pr.new integration suggests modern release tooling.

Honest verdict

ADOPT IF: you are building a GraphQL server or framework and need a proven, embeddable IDE component, or if you are building editor tooling and need a reference LSP implementation for GraphQL. AVOID IF: you need a feature-heavy standalone API testing client with collection management and environment variables — purpose-built clients like Altair serve that better. MONITOR IF: you are tracking whether the Monaco editor integration reaches parity with the CodeMirror implementation, or whether the LSP server becomes the canonical choice for all major editors.

Independent dimensions

Mainstream potential

7/10

Technical importance

9/10

Adoption evidence

9/10

Risks
  • React dependency for the graphiql UI component may be a constraint for teams using other frameworks or web components, though the language service packages are framework-agnostic.
  • Monorepo complexity means versioning and coordinating releases across many packages can introduce lag between ecosystem changes and published updates.
  • The XSS vulnerability noted in the README (pre-1.4.7) signals that security-sensitive environments must stay current — embedding in untrusted contexts requires care.
  • Monaco integration is noted as 'in the works' in the README, suggesting the Monaco path may be less mature than the CodeMirror path, which could affect teams standardizing on Monaco-based editors.
  • As an official foundation project, governance decisions may move slowly; fast-moving feature requests may stall pending committee consensus.
Prediction

GraphiQL will remain the reference standard for embedded GraphQL IDE tooling and the canonical LSP infrastructure for the ecosystem. Gradual expansion of Monaco and CM6 support will increase its relevance as editors modernize.

0 found this helpful

Newsletter

Get analyses like this every Monday

Free weekly digest of the most interesting open-source discoveries.

Languages

TypeScript
94.3%
CSS
3%
JavaScript
1.7%
HTML
0.5%
Shell
0.2%
Python
0.1%
Astro
0.1%
PHP
0%

Information

Language
TypeScript
License
MIT
Last updated
1d ago
Created
133mo ago
Analyzed with
anthropic/claude-haiku-4-5

Stars over time

Loading…

Contributors over time

Top 100 contributors only — repos with more will plateau at 100.

Loading…

Similar repos

graphql-editor

graphql-editor/graphql-editor

GraphQL Editor is a visual schema designer and IDE that converts GraphQL...

6.1k TypeScript Dev Tools
graphql

graphql/graphql-js

GraphQL.js is the official JavaScript reference implementation of GraphQL, a...

20.4k TypeScript Web Dev
graphile

graphile/crystal

Graphile Crystal is a monorepo housing PostGraphile and Grafast, two GraphQL...

12.9k TypeScript Web Dev
graphql

graphql/graphql-spec

This is the official GraphQL language specification repository, maintained by...

14.6k JavaScript Dev Tools
APIs-guru

APIs-guru/graphql-voyager

GraphQL Voyager is an interactive visualization tool that renders any GraphQL...

8.2k TypeScript Web Dev
vs. alternatives
graphql-editor/graphql-editor

graphql-editor targets visual schema design and is more of a schema builder than a query explorer or LSP. Serves a different use case; not a direct replacement for GraphiQL's IDE embedding or language service roles.

Altair GraphQL Client

Altair is a standalone desktop/browser GraphQL client with richer UI features (collections, environments, subscriptions). Better for API testing workflows; GraphiQL is better for embedding in a server's own UI and for programmatic IDE integration.

Apollo Studio Explorer

Apollo Studio Explorer is a hosted, feature-rich query IDE tied to Apollo's platform. GraphiQL is open, embeddable, and framework-agnostic — the tradeoff is raw features vs. openness and self-hosting.

Insomnia / Postman (GraphQL mode)

General-purpose API clients that added GraphQL support. Not specialized for embedding in a server UI or powering editor plugins. GraphiQL's LSP infrastructure has no equivalent in these tools.

vscode-graphql (standalone)

VS Code's GraphQL extension often depends on graphql-language-service-server from this very monorepo, making it a consumer of GraphiQL's ecosystem rather than a true competitor.