The spec states that valid names must conform to the /[_A-Za-z][_0-9A-Za-z]*/ regex (http://facebook.github.io/graphql/#sec-Names) but it doesn't seem like this validation is applied by this implementation.