I have the dev environment setup locally. Should I make an issue for a read-only graphql solution? I think middleware to block it would be pretty easy 

carter

Stacker Saloon

saloon

I do think we can actually just allow queries and block mutations, by making the endpoint aware that we don't want to use mutations.

This requires more thinking and testing than just my sentence above. I know that we can do stuff to the GraphQL middleware.
If you don't mind the wait, I'll explore more about it in the coming days ^^