arXiv (Cornell University)
PrediQL: Automated Testing of GraphQL APIs with LLMs
October 2025 • Shaolun Liu, Sina Marefat, O. D. Tsai, Yu Chen, Zecheng Deng, Jianwei Wang, Mohammad A. Tayebi
GraphQL's flexible query model and nested data dependencies expose APIs to complex, context-dependent vulnerabilities that are difficult to uncover using conventional testing tools. Existing fuzzers either rely on random payload generation or rigid mutation heuristics, failing to adapt to the dynamic structures of GraphQL schemas and responses. We present PrediQL, the first retrieval-augmented, LLM-guided fuzzer for GraphQL APIs. PrediQL combines large language model reasoning with adaptive feedback loops to gener…