> So swagger is bad
No, because in Swagger the first step is carefully designing exactly what the inputs and outputs are of each and every API call. Most GraphQL servers you simply point it at a database and it automatically makes your entire schema, including tables and fields that shouldn't be exposed to end users, readily available.
> doesn't remotely mean the queries "run on the client side".
Sorry, that was poorly written. Obviously the queries are not running on the client side. My point was that the client can provide any query they want and the system will process it.