I've been using Scaphold for a long time as a prototyping backend for GraphQL frontends. The biggest issue I've had with it is that its permission system always uses the most "lenient" rule, which makes multi-tenant applications impossible. Looks like Graph.cool is REALLY catching up (and their permissions system is just better).