The Complete Production SOP: How to Deploy and Run GraphQL Query Depth Limiting & Cost Analysis Armor in Autonomous AI Agents

---
name: "graphql-depth-limiting-armor"
description: "Protect GraphQL APIs against denial-of-service via nested query depth and cost limits."
triggers:
  - "limit graphql query depth"
  - "prevent nested query dos graphql"
  - "add graphql armor"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

import depthLimit from 'graphql-depth-limit';
import { costLimitPlugin } from '@escape.tech/graphql-armor-cost-limit';
import { maxDepthPlugin } from '@escape.tech/graphql-armor-max-depth';

export const MAX_QUERY_DEPTH = 6;
export const MAX_QUERY_COST = 1000;

export const validationRules = [
  depthLimit(MAX_QUERY_DEPTH, { ignore: [/_metadata$/, 'IntrospectionQuery'] })
];

export const securityPlugins = [
  maxDepthPlugin({ n: MAX_QUERY_DEPTH }),
  costLimitPlugin({ maxCost: MAX_QUERY_COST, defaultCost: 1 })
];

Review our Apollo Server configuration in src/server.ts and add graphql armor. Prevent nested query dos graphql by limiting query depth to 6 and enforcing a maximum query complexity budget of 1000.

import { describe, it, expect } from 'vitest';
import request from 'supertest';
import { app } from '../src/server';

describe('GraphQL Armor Protection', () => {
  it('rejects recursive queries exceeding depth limit', async () => {
    const deepQuery = `
      query MaliciousQuery {
        user {
          posts {
            comments {
              author {
                posts {
                  comments {
                    author { id }
                  }
                }
              }
            }
          }
        }
      }
    `;
    const res = await request(app).post('/graphql').send({ query: deepQuery });
    expect(res.status).toBe(400);
    expect(res.body.errors[0].message).toMatch(/exceeds maximum operation depth/i);
  });
});