---
name: graph
tools:
  - name: maxy-graph-read_neo4j_cypher
    publicAllowlist: false
    adminAllowlist: true
  - name: maxy-graph-get_neo4j_schema
    publicAllowlist: false
    adminAllowlist: true
  - name: maxy-graph-write_neo4j_cypher
    publicAllowlist: false
    adminAllowlist: false
mcp:
  command: node
  args:
    - ${PLATFORM_ROOT}/lib/graph-mcp/dist/index.js
  env:
    LOG_DIR: ${LOG_DIR}
    PLATFORM_ROOT: ${PLATFORM_ROOT}
    ACCOUNT_ID: ${ACCOUNT_ID}
    SESSION_ID: ${SESSION_ID}
    NEO4J_URI: ${NEO4J_URI}
    NEO4J_PASSWORD: ${NEO4J_PASSWORD}
description: "Raw Neo4j Cypher proxy. Wraps the upstream `mcp-neo4j-cypher` server (spawned under uvx by `platform/lib/graph-mcp`) under the stable `maxy-graph` namespace, so its tools register as `maxy-graph-read_neo4j_cypher`, `maxy-graph-get_neo4j_schema`, and `maxy-graph-write_neo4j_cypher`. The read and schema tools are admin-allowlisted for schema checks and read-only queries; the write tool is specialist-only (database-operator / librarian execute operator-confirmed `mergeCypher` templates through it, never hand-authored Cypher). The shim validates write Cypher against the live schema, stamps provenance, and rejects unknown labels/edges. Account isolation is per-brand Neo4j; the shim adds no query-layer tenant filter."
---

# graph

Cypher proxy plugin. The server is `platform/lib/graph-mcp`, which adopts the upstream
Python `mcp-neo4j-cypher` server per brand and proxies its JSON-RPC stdio under the
`maxy-graph` namespace. It is registered through the installed-plugin channel like every
other platform MCP, so its tools surface as `mcp__plugin_graph_graph__maxy-graph-*`.

Write Cypher is intercepted (not forwarded) so the shim can validate tokens against the
live schema cache, stamp `createdBy` provenance, and roll back orphan-producing writes.
Read Cypher and schema introspection forward to upstream with an envelope-warning probe
that stitches Neo4j `gql_status` codes back into the response.
