go-graphql

go-graphql is a skill for Claude Code from muratmirgun/gophers. It costs 107 tokens per session (2,164 once invoked), scanned A, original, MIT.

A guide to building GraphQL APIs in Go, where clients request structured data through a schema that defines available operations and fields.

In plain words
What is it for?
Use it when designing schemas, writing resolvers, adding authentication, pagination, mutations, subscriptions, or protections against expensive requests.
Why use it?
It helps keep the schema stable, resolvers focused, authorization controlled, repeated database queries limited, and disconnected subscriptions from leaking work.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: positional $N argument; mentions Claude Code; built for openclaw.

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is Read [references/gqlgen.md](../../../skills/go-graphql/references/gqlgen.md) for the codegen workflow, `gqlgen.yml`, DataLoaders, and Federation..

Part of the gophers plugin — 26 skills, 4 agents shipped together

Good fit Use it when designing schemas, writing resolvers, adding authentication, pagination, mutations, subscriptions…

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/muratmirgun/gophers
agentmods
npx agentmods add skills/muratmirgun/gophers/go-graphql

Made for: Claude Code.

Or install gophers, the plugin that ships this one along with the rest of its 26 skills, 4 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for go-graphql

README.md
[![agentmods](https://agentmods.dev/badge/skills/muratmirgun/gophers/go-graphql.svg)](https://agentmods.dev/skills/muratmirgun/gophers/go-graphql)
Your own site
<a href="https://agentmods.dev/skills/muratmirgun/gophers/go-graphql"><img src="https://agentmods.dev/badge/skills/muratmirgun/gophers/go-graphql.svg" alt="Measured on agentmods" height="20"></a>
Per session 107 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,164 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00107 $0.02164
Opus 5 $0.00053 $0.01082
Sonnet 5 $0.00021 $0.00433
Haiku 4.5 $0.00011 $0.00216

Measured 6d ago against content hash 0468b81375cd, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

go-graphql scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude-plugin/skills/go-graphql/SKILL.md · 183 lines

How it starts

The opening of the file, as written. The whole thing — 183 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Go GraphQL

Both production-grade Go GraphQL libraries are schema-first: write SDL (.graphql), bind Go resolvers. Pick the library, write the schema deliberately, and treat DataLoaders + complexity limits as non-optional.

Core Rules

  1. Schema is the contract. Design nullability and pagination once; clients depend on it forever. A change from nullable to non-null is a breaking change.
  2. Resolvers are thin. Translate GraphQL input → domain call → GraphQL output. No SQL, no business logic.
  3. DataLoaders are per-request. Construct in HTTP middleware, stash in context. A package-level DataLoader is a cross-tenant data leak.
  4. Authenticate in middleware, authorize in the schema. HTTP middleware extracts identity; schema directives (or resolver checks) enforce per-field rules.
  5. Subscriptions respect context. Every subscription goroutine selects on ctx.Done() and defer close(ch). Otherwise a disconnected client leaks a goroutine forever.
  6. Production limits are non-optional. Set complexity caps; gate introspection by environment; never expose raw internal errors.

Library Decision

Library Approach Type safety Build step Pick when
github.com/99designs/gqlgen Codegen Compile-time go generate Large schemas, Federation, strict types
github.com/graph-gophers/graphql-go Reflection Parse-time None Small/medium schemas, simple pipeline
github.com/graphql-go/graphql Code-first Runtime None Avoid — verbose, no SDL

Read references/gqlgen.md for the codegen workflow, gqlgen.yml, DataLoaders, and Federation. Read references/graph-gophers.md for the reflection model, type mapping, and tracing.

Schema Design

type User {
  id: ID!                # opaque scalar; never expose Int
  email: String!         # server can always return this → non-null
  bio: String            # may be unset → nullable
  posts(first: Int = 10, after: String): PostConnection!
}

type CreateUserPayload {  # mutation envelope: business errors as data
  user: User
  errors: [UserError!]!
}

type PostConnection {     # Relay cursor pagination
  edges: [PostEdge!]!
  pageInfo: PageInfo!
}

Read the full file on GitHub · 183 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 183 lines · 107 tokens per session scan A 0468b81375cd

Subscribe to this mod's changes

go-graphql is a skill published in the GitHub repository muratmirgun/gophers (8 stars, last pushed 26d ago), licensed MIT. It adds 107 tokens to every session and 2,164 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

go

Use when writing Go services, CLIs, or libraries. Covers idiomatic error wrapping, goroutine and context discipline, interface design, table-driven tests, and the race detector.

nimadorostkar/Claude-Skills-collection · 38 tokens

golang-pro

Implements concurrent Go patterns using goroutines and channels, designs and builds microservices with gRPC or REST, optimizes Go application performance with pprof, and enforces idiomatic Go with generics, interfaces, and robust error handling. Use when building Go applications requiring concurrent programming…

Jeffallan/claude-skills · 95 tokens

go-programming-expert

Expert-level skill for Go programming (Go 1.25+). Covers high-performance microservices, concurrency patterns, sqlc, net/http, Gin/Echo/Fiber, gRPC, and testing in English and Indonesian.

roedyrustam/vibes-plug · 51 tokens

encore-go-api

Define typed API endpoints in Encore Go using //encore:api annotations. Covers typed request/response structs, path/query/header/cookie params, and error returns. For raw endpoints (//encore:api raw) and inbound webhooks, use encore-go-webhook instead.

encoredev/skills · 66 tokens

encore-go-webhook

Receive inbound webhooks from external services (Stripe, GitHub, Slack, Twilio, etc.) in Encore Go using //encore:api raw. The right skill any time the user names a third-party provider that POSTs events to a URL you own.

encoredev/skills · 60 tokens

encore-go-bucket

Store unstructured files in Encore Go using objects.NewBucket from encore.dev/storage/objects — uploads, images, documents, blobs.

encoredev/skills · 37 tokens