What is benchmark-gql?

A performance benchmark for comparing production and staging GraphQL APIs across every public query. GraphQL is an API format where clients request specific data fields; staging is the test environment before production.

Measuring client response time, Worker CPU time, wall time, and response size, then appending the comparison to a Markdown report.

It shows whether an upcoming code version is slower or uses more Cloudflare Worker CPU than the live version.

How TrainLCD/StationAPI configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to TrainLCD/StationAPI. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/TrainLCD/StationAPI/dev/.claude/skills/benchmark-gql/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/TrainLCD/StationAPI

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/trainlcd/stationapi/benchmark-gql/github.svg)](https://agentmods.dev/skills/trainlcd/stationapi/benchmark-gql)

Your own site

<a href="https://agentmods.dev/skills/trainlcd/stationapi/benchmark-gql"><img src="https://agentmods.dev/badge/skills/trainlcd/stationapi/benchmark-gql/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/trainlcd/stationapi/benchmark-gql"><img src="https://agentmods.dev/badge/skills/trainlcd/stationapi/benchmark-gql.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 95 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,343 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 33
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 38
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00095	$0.03343
Opus 5.5	$0.00038	$0.01337
Sonnet 5.5	$0.00019	$0.00669
Haiku 4.5	$0.00010	$0.00334

Measured 1mo ago against content hash 5f5ef84dfca5, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

benchmark-gql scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 1 executable file (bench.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

for u in https://gql.trainlcd.app https://gql-stg.trainlcd.app; do curl -s "$u/__health"; echo " <- $u"; done

.claude/skills/benchmark-gql/SKILL.md · 155 lines

How it starts

The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.

benchmark-gql

本番 (https://gql.trainlcd.app / Worker stationapi) とステージング (https://gql-stg.trainlcd.app / Worker stationapi-stg) の GraphQL 性能を、 schema/public.graphql の全 Query フィールドについて比較する。

両環境は同じデータを積んでいる (/__health が返す駅数・路線数・会社数が一致する) ので、出てくる差は実装差だけ。ステージングは dev、本番は master から出るので、このベンチは「次のリリースで本番の性能がどう変わるか」を先に見るものになる。

何を測るか

指標	出どころ	何が見えるか
CPU Time	`wrangler tail --format json` の `cpuTime`	Worker が実際に計算に使った時間。ネットワークもコロの当たり外れも含まないので、実装差はここに出る。判定はこの列で行う
Worker wall time	同 `wallTime`	Worker 内の実時間。この Worker は I/O をしないので CPU Time とほぼ一致し、乖離したら外部待ちが混ざったサイン
クライアント応答時間	keep-alive を張った 1 本の接続での往復時間	利用者から見た体感。回線とエッジ処理と転送を含む
応答サイズ	レスポンスのバイト数	転送時間の効き方を読むための補助

CPU Time はリクエストと cf-ray で突き合わせる。wrangler tail 側には --header x-stationapi-bench:<実行 ID> を渡すので、本番に実ユーザーのトラフィックが流れていてもこの実行のリクエストだけが降ってくる。

前提条件

wrangler の認証が済んでいて、権限に workers_tail (read) があること。無いと CPU Time が欠測になる (応答時間の計測だけは続行する)。版は Makefile の WRANGLER_VERSION に合わせる。版を指定しない npx wrangler はその時点の最新を取ってくるので、Cloudflare の認証情報を持つ環境で走らせるものとしては固定しておく。bench.py も同じ値を読んで wrangler tail を起動する。
```
npx --yes wrangler@"$(sed -n 's/^WRANGLER_VERSION := //p' Makefile)" whoami
```
Python 3。依存は標準ライブラリのみ。
リポジトリルートで実行すること (wrangler tail の cwd に使う)。

手順

両環境が同じデータかを先に確認する。 違えば差は実装起因ではない。
```
for u in https://gql.trainlcd.app https://gql-stg.trainlcd.app; do curl -s "$u/__health"; echo " <- $u"; done
```
食い違っていたら、その旨をユーザーに伝えてから続けるか止めるかを決める。
ベンチを回す。 既定は queries.json の全ケース × 15 反復 × 2 環境で、2〜3 分。本番側が遅いクエリを抱えているとその分伸びる。
```
python3 .claude/skills/benchmark-gql/bench.py
# make bench でも同じ (追加引数は make bench BENCH_ARGS="--repeat 30")
```
wrangler tail の接続待ちだけで最大 90 秒かかるので、バックグラウンド実行にして待つこと。フォアグラウンドだとツールのタイムアウトに当たる。
レポートの「所見」節を埋める。 ここだけは自動生成しない。差が出たクエリについて、 src/graphql/query.rs や stationapi/src/use_case/interactor/query.rs の実装、および origin/master と origin/dev の差分を見て、 どの変更が効いているかを書く。差が出なかったこと自体が結論なら、それも明記する。

Read the full file on GitHub · 155 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed 5f5ef84dfca5
1mo ago Changed · +8 lines 13bc6cca76ce
2mo ago First seen · 147 lines · 95 tokens per session scan A d80c5dba1f95

Subscribe to this mod's changes

benchmark-gql is a skill published in the GitHub repository TrainLCD/StationAPI (14 stars, last pushed 4d ago), licensed MIT. It adds 95 tokens to every session and 3,343 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Testing api graphql japan station transit

StationAPI: Skill for Claude Code