Repo brief: redwoodjs/graphql

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T01:52:26.999Z · commit a7852fb92d0e

Verdict

Mixed — Open vulnerabilities flagged by OpenSSF Scorecard

• Last commit 2d ago
• 16 active contributors
• MIT licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

RedwoodJS GraphQL is the backend/API framework for the Redwood full-stack JavaScript framework, providing opinionated GraphQL server infrastructure with built-in auth, caching, logging, and serverless deployment support. It includes packages/api (core GraphQL utilities), packages/api-server (Fastify-based HTTP server with watch/build management), and integrates JWT verification, Redis/Memcached caching, and AWS Lambda request handling. Monorepo split into packages/api (core library: auth verifiers, cache clients, logger, event system, errors) and packages/api-server (HTTP server: Fastify setup, CLI config, plugin system, request handlers). Fastify plugins (packages/api-server/src/plugins/)…

Start here

Open these first:

• packages/api-server/src/createServer.ts — Core Fastify server initialization—entry point for all HTTP request handling and GraphQL/API plugin setup.
• packages/api-server/src/plugins/graphql.ts — GraphQL server plugin configuration—establishes Apollo Server integration and request/response lifecycle.
• packages/api/src/index.ts — API package main export—defines public API for serverless functions, auth, caching, and utilities.
• packages/auth/src/AuthProvider/AuthProvider.tsx — Client-side authentication context provider—manages user state, login/logout, and auth hooks across the app.
• packages/api/src/cache/index.ts — Cache abstraction layer—supports Redis, Memcached, and in-memory backends for multi-backend caching strategy.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone and install: git clone https://github.com/redwoodjs/graphql.git && cd graphql && npm install (or yarn). No direct 'npm start' for this monorepo—it's consumed as packages. To develop locally: npm run dev in p…

Daily commands:

Dev server: Start in packages/api-server with npm run dev (inferred from watch.ts and serverManager.ts). This triggers buildManager to compile TypeScript and serverManager to start Fastify. API CLI: `npm run redwood a…

…shortened for this brief.

Key cautions & unknowns

• Scorecard: known vulnerabilities detected (scored 0/10 by OpenSSF)
• Concentrated ownership — top contributor handles 50% of recent commits
• No visible GraphQL schema loading code: graphql.ts registers the plugin but schema origin (file path, validation) is likely in consuming Redwood app, not here—assume you must provide context.schema. **CLI vs…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.