[jarym]

For the recursive issue we have a directive that lets us specify a recurse level. The server validates that with a maximum value.

As for schema-less we generate a scheme that includes all types and fields but we filter out any non-available ones (according to user with) each time an introspection query is issued.