security enabled verified low v1.0.0

clairvoyance

GraphQL schema enumeration tool that uses introspection queries and field suggestion brute-force to recover API schema definitions.

📋 Live Preview

clairvoyance {flag-json} {flag-wordlist} {flag-threads} {flag-header} {flag-proxy} -u {url}

📎 flag-json 📎 flag-wordlist 📎 flag-threads 📎 flag-header 📎 flag-proxy 📎 url

clairvoyance {flag-json} {flag-wordlist} {flag-threads} {flag-header} {flag-proxy} -u {url}

Sandbox: execFile · Timeout: 300s

Capabilities

graphql.enum.schema

graphql.discovery.field

graphql.introspection

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	GraphQL endpoint URL	`-u`, `--url`
`flag-json`	string	No	-	Output file for the reconstructed schema JSON	`-j`, `--json`
`flag-wordlist`	string	No	-	Wordlist file for field name bruteforce	`-w`, `--wordlist`
`flag-threads`	integer	No	-	Number of threads for field discovery	`-t`, `--threads`
`flag-header`	string	No	-	Custom HTTP header (name:value)	`-H`, `--header`
`flag-proxy`	string	No	-	HTTP proxy to use	`-p`, `--proxy`

Artifacts

Type	Description	MIME	Schema	Trust
`graphql.schema.json`	Reconstructed GraphQL schema	application/json	-	verified
`report.txt`	Schema enumeration results	text/plain	-	verified

Contract

Inputs

web.target.url

GraphQL endpoint URL

Outputs

graphql.schema.json

Reconstructed GraphQL schema as JSON

Side effects: network_traffic

Workflow Edges

Produces

graphql.schema.json

Consumes

web.target.url

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Basic GraphQL schema enumeration

clairvoyance -u https://api.example.com/graphql

Save schema to file with custom wordlist

clairvoyance -u https://api.example.com/graphql -j schema.json -w wordlist.txt

Use proxy and custom header

clairvoyance -u https://api.example.com/graphql -p http://127.0.0.1:8080 -H "Authorization: Bearer token"

Documentation

Clairvoyance — GraphQL Schema Enumeration

Clairvoyance is a Python-based tool for GraphQL schema enumeration that uses introspection queries combined with field suggestion brute-force to recover API schema definitions even when introspection is partially restricted.

Usage

# Basic enumeration
clairvoyance -u https://api.example.com/graphql

# Save schema JSON
clairvoyance -u https://api.example.com/graphql -j schema.json

# Use wordlist for field discovery
clairvoyance -u https://api.example.com/graphql -w common_fields.txt

# Authenticated scan
clairvoyance -u https://api.example.com/graphql -H "Cookie: session=abc123"

Dependencies

python3

Related Tools

burpsuiteowasp-zapnmap

References

Clairvoyance GitHub