MCP server

Run a Cypher statement and return columns and rows. Cells are plain JSON by default; set format to "tagged" for type-tagged cells. parameters fills $name placeholders. atTime (ISO-8601) reads the graph as of that valid time; it requires at least one top-level MATCH and cannot be combined with a temporal clause in the query, and it does not set the valid time of a write. To record a fact as true from a past date, start the write with AT VALID '<ISO-8601>', for example AT VALID '2025-11-01T00:00:00Z' CREATE (p:Person {name: 'A'}); the prefix also works on MERGE, MATCH ... SET and MATCH ... DELETE. provenance records who made a write and why (actor, source, reason, requestId, confidence from 0.0 to 1.0); the server adds the calling credential as principal. Read it back with CALL db.propertyProvenance("p-1", "status") YIELD value, version, actor, reason, principal. From 1.4.1, a statement stops when the client’s connection closes; a read at a past time that would have to look at more of the graph’s history than the server allows returns error -32603 with a message that names TEMPORAL_READ_LIMIT (no data.subcode) and no rows; and a float that is infinite or not a number is returned as "Infinity", "-Infinity" or "NaN" (1.4: null). From 1.4.2, pass idempotencyKey (1 to 256 characters) when a call may be resent: the same key with the same request returns the first result with replayed: true and writes nothing; the same key with a different request is refused (-32602, IDEMPOTENCY_KEY_REUSED); a key whose first call is still running is waited for and then answers -32000 IDEMPOTENCY_KEY_IN_PROGRESS (send the same call again). The key is used only when the query writes. From 1.4.2 the server records the calling credential as principal for every write of an authenticated call, with or without provenance. From 1.4.2, when the graph has an access policy that restricts the credential, nodes and relationships it may not read are absent from the result and from counts, a write the policy does not allow is refused, and a procedure call, a read at a past time or EXPLAIN is refused with ACCESS_POLICY_SURFACE_UNAVAILABLE. From 1.4.2.4 a call without atTime answers what is valid now: a value written with a future AT VALID time is returned from that time on, and while the graph holds such a value the result carries the warning CURRENT_READ_VALID_NOW. With format: "tagged" a null cell is JSON null (it was the string "null"). From 1.4.2.5 the access-policy refusals ACCESS_DENIED and ACCESS_POLICY_SURFACE_UNAVAILABLE answer -32007 with data.subcode (they answered -32603 without a subcode), and a CREATE or MERGE that names more than 256 labels new to the graph (the default limit) is refused with -32602 TOO_MANY_NEW_LABELS before it runs.

Return a node by its string id as {id, labels, properties, span}, or null if there is none. span holds valid_from, valid_to, txn_from and txn_to in nanoseconds and, from 1.4.2.4, the same times as validFrom, validTo, txnFrom and txnTo in ISO-8601 (null for an open end). From 1.4.2.4 the record is the version valid now: a value saved for a future date is not returned before that date.

Return a relationship by its string id as {id, edge_type, source, target, properties, span}, or null. source and target are internal integer node ids. span and the version returned are as for get_node_by_str.

List labels and relationship types with counts, and the source and target labels of each relationship type. Property names are not included. From 1.4.1 the counts include the latest writes.

List single-property (range) indexes and their state.

List the graphs you can access. A credential tied to a tenant sees its tenant’s graphs; admin credentials see all graphs. From 1.4.2 a credential that has neither a tenant nor an admin role sees only the graph the connection is bound to.

Return a sequence number that increases as saved changes become visible (current_snapshot_seq) and the calling credential’s subject, tenant, roles and capabilities. From 1.4.2 the result has graph, the name of the graph this connection is bound to, and graph_dir (the graph’s storage path on the server) is returned to admin credentials only and is null otherwise; on 1.4.1 and earlier every caller gets graph_dir and there is no graph. Use it to check which graph and which credential a connection uses.

Keyword (BM25) search over one text property of a label. Returns up to k hits as {node_id, score}; node_id is the internal integer id. With the default analyzer, keywords match only words made of the letters a–z and the digits 0–9; when the query has other letters or digits (accented or non-Latin), the result carries the warning FULLTEXT_TOKENIZER_LIMITED. From 1.4.3, analyzer: "unicode-v2" indexes and matches every script (also unicode-v2+fold, unicode-v2+stem, unicode-v2+fold+stem). From 1.4.3, when a full-text index is declared on the label and property (CALL db.createFulltextIndex(label, property)), it answers by default (index: "auto"; "declared" or "adhoc" choose explicitly): the tool then takes syntax (words, legal, lucene, fts5), default_operator, order, cursor, max_expansions, snippets, total, at_valid and at_recorded, each hit also has str_id, matches and, when asked, snippets, and the result has index: "declared", total (the exact number of matches), complete, cursor (pass it back for the next page), parsed and stale. Send index: "adhoc" to keep the earlier answer. A declared-index argument on a label and property with no declared index is refused with -32602, with a message that names FULLTEXT_INDEX_NOT_FOUND; from 1.4.3.1 the refusal also carries the code in data.subcode (FULLTEXT_INDEX_NOT_FOUND, or FULLTEXT_OPTION_INVALID for an option value it does not accept). From 1.4.2 a node whose other label has a field read rule that hides the searched property from the caller is left out before the ranking, so the result holds the best k hits the caller may read, and hidden nodes are not counted in the scores of the other hits. From 1.4.3.3, with a declared index, the tool also takes fields (a list of properties or a map of property to weight; it must include property), filter and node_ids (applied before ranking), filter_statistics, matched_terms, excerpt and group_by; each hit then has field_scores, matched_words, matched_terms, excerpt, group and group_hits as asked. See Several fields, filters, matched words, excerpts, pages.

Nearest-neighbour search over a vector property. Pass queryText to have the server embed the text, or vector with a precomputed embedding. Returns up to k hits as {node_id, score}. Pass exactly one of queryText and vector; both or neither is refused with -32602. From 1.4.1 the tool’s inputSchema no longer declares this rule as a top-level anyOf (some clients refuse one); the rule is in the property descriptions and the server enforces it. From 1.4.2 a node whose other label has a field read rule that hides the searched property from the caller is left out before the ranking, so the result holds the best k hits the caller may read (1.4.1 dropped such hits after the ranking and could return fewer than k). From 1.4.2.2, while the label’s vector data is being rewritten (after an upgrade or a re-ingest of the label) and the label is over the scan size limit, the search is answered exactly from the label’s records, more slowly, with the warning VECTOR_FILE_REWRITE_PENDING; it was refused with -32000 until the rewrite finished. That refusal remains when too many such searches run at once or the label holds more than 16 GiB of vectors.

Search saved memories (text written by remember and record_episode), best matches first. From 1.4.1 each search runs by keyword and by meaning and the two rankings are combined. The result has memories: up to k matches (1 to 100, default 10; match: "match"), each followed by the turns before and after it in the same session (match: "context"; neighbours, 0 to 3, default 1), each with id, text, payload, kind, session, validFrom and savedAt; count, the number of matches; documents: passages from the current version of saved documents as {uri, revision, title, text, validFrom} (documents, 0 to 20, default 3); facts: facts saved with remember that are current now, each with subject, predicate, value or object, validFrom, validTo, source, single and previously, the earlier values it replaced (facts, 0 to 50, default 10); and search, which says how the search ran. When the search by meaning could not run, search.warning says so and the results come from keyword search only; search.notYetSearchableByMeaning counts memories whose embedding is still pending. On 1.4 and earlier recall searches by keyword only, returns {memories: [{id, text, payload}], count} and does not search saved documents: to find text in documents there, pass "label": "Chunk", "property": "text", or list documents with cypher_query and read one with get_document. Keywords match only words made of the letters a–z and the digits 0–9; when the query has other letters or digits (accented or non-Latin), the result carries a note saying that memories containing them may be missing. From 1.4.2 a search that asks to count, total, list or compare (for example “how many”, “in total”, “list all”, “average”) reads wider: up to 40 more matches after the first k (without neighbouring turns, marked wide: true), the other current facts with the same subject and predicate as the top facts, and items, a numbered list of the distinct matching events and facts in date order, at most 60. An event stated in several memories is one item; each item has line (the item as one line for a reader), happenedOn (when it took place, when the fact was saved with its own date), mentionedOn (the date of the memory that states it), facts and mentions (the facts and memories that state it), matches (whether it matches the search) and, when the search names a period such as “in the past two weeks”, inWindow. A value that a later one replaced is listed under the current item’s previously, not as an item. The list can include items that do not answer the question: count the items yourself. Options: breadth (auto, the default; normal never reads wider; wide always does), items (false leaves the list out), breadthBudget (the most tokens the wider read adds, default 4000, at most 16000) and referenceTime (ISO-8601; the time a period in the search is counted from, by default now). search.breadth says when a search read wider and why. The search is read with English cue words; pass breadth: "wide" for a question phrased without them. Other searches return what they returned on 1.4.1. Figures computed by the server (aggregates) are experimental and off by default. From 1.4.2 a memory or fact hidden from the caller by a field read rule does not change the scores of the others. From 1.4.3, when a full-text index is declared on the recalled label and property and is ready (CALL db.createFulltextIndex('Event', 'text')), the keyword side reads it, so memories written in any script are found by keyword; while it is built or rebuilt, recall searches as before. From 1.4.3 recall is faster, with the same answers. From 1.4.3.1 recall adds linked memories (on unless the server operator turns them off): when the search names a person, place or thing that saved facts are about (I, me and my name the user), those facts, and the facts of the subjects of the top facts, are followed one or two steps to other facts that share a topic word with the search or are as close in meaning as the best facts; the memories that state those facts and were not already returned follow the others, with match: "linked" and via (the entity, hops and the fact that linked it), at most 12 and within linkBudget tokens (default 2000, at most 8000). search.links says when this happened. Most linked memories do not answer the question; they widen what a reader sees. Send links: "off" to leave them out.

Search memories as they stood at a past valid time. A memory counts from its validFrom: the time given to remember, or the moment it was saved. A memory saved without validFrom does not appear at an earlier atTime even when its text names an earlier date. From 1.4.1, with query the search is the same as recall (keyword and meaning, neighbouring turns, the same result shape) over the memories valid at atTime; document passages come from the version current then, and facts are those current then, a value replaced later carrying validTo. Without query the memories valid at atTime are listed, latest validFrom first. k is at most 100. On 1.4 and earlier, query keeps memories whose text contains that exact text (case-sensitive), results are not ranked, the result is {columns, rows} and k is at most 200. From 1.4.2, with query, a search that asks to count, total, list or compare reads wider as recall does (breadth, items, breadthBudget), over what was valid at atTime; a period in the search is counted from atTime unless referenceTime is given. From 1.4.2.4, with query the search finds a memory that was valid at atTime and deleted afterwards; before, it left such memories out. From 1.4.3 the keyword side reads a declared full-text index on the recalled label and property only when it was declared with history: 'all'. From 1.4.3.1, with query, linked memories are added as for recall (links, linkBudget), over what was valid at atTime.

Save a document under a stable uri as its current version; earlier versions stay in history. When fact extraction is enabled on the server, people, facts and relationships are also extracted; extracted is true when extraction ran and found at least one fact or entity. entity_types and min_confidence apply to this save. From 1.4 the tool waits up to about 45 seconds (before 1.4: about two minutes); if the save is still running it returns pending: true with the save’s jobId and status, and the same call again reports on it. From 1.4, pass idempotencyKey (1 to 256 characters) when a call may be resent: the same key with the same request returns the first result with replayed: true; the same key with a different request is refused (-32602, IDEMPOTENCY_KEY_REUSED). From 1.4.2.2 a save that a rule of the graph refuses (a constraint; for example the same uri and revision saved again with the text changed in a passage that recorded quotes cite) answers saved: false, refused: true, reason: "constraint", and nothing of the save is written; save the changed text under a new revision.

Return the current version of a document as one row per chunk, in order. Pass as_of (ISO-8601) for the version that was current at that time.

List the saved versions of a document, oldest first, with the time each was current (validFrom, validTo; validTo is null for the current one) and when it was saved (txnAt). From 1.4.2.4 these times are ISO-8601 and the nanoseconds are in the last columns validFromNanos, validToNanos and txnAtNanos; before, the three columns held nanoseconds. To read a past version, pass its validFrom to get_document as as_of.

From 1.4.2.4. List saved documents, most recently saved first: uri, title, revision (the current version’s label), savedAt (ISO-8601) and savedAtNanos. limit defaults to 50, at most 500. Use it to find the uri of a document saved in an earlier conversation before you save a new revision of it.

From 1.4.2.4. Find saved documents whose title or uri contains query, ignoring case. Same output as list_documents; limit defaults to 20, at most 500.

Set the categories extraction uses on this graph, and optionally relationship types and a minimum confidence. Each call replaces the category and relationship lists. From 1.4.2, pass idempotencyKey (1 to 256 characters) when a call may be resent: the same key with the same request returns the first result with replayed: true and writes nothing; the same key with a different request is refused (-32602, IDEMPOTENCY_KEY_REUSED); a key whose first call is still running is waited for and then answers -32000 IDEMPOTENCY_KEY_IN_PROGRESS (send the same call again).

Show the categories and relationship types set up for this graph and how many items each category holds. From 1.4.1 the counts include the latest writes.

Append an entry to a session’s log. The session is created on first use. Returns eventId and ts. From 1.4, pass idempotencyKey (1 to 256 characters) when a call may be resent: the same key with the same request returns the first result with replayed: true; the same key with a different request is refused (-32602, IDEMPOTENCY_KEY_REUSED). From 1.4.1, pass validFrom (ISO-8601) to say when the event happened; the default is the time of the save; on 1.4.1 to 1.4.2.3 a time more than 5 minutes in the future is refused, and from 1.4.2.4 a future time is accepted as for remember. From 1.4.1 the result also has validFrom and embedding: stored (the event can be found by meaning at once), pending (the embedding model was not available; the event is saved, keyword search finds it at once, and a job started by this save, or by a later save or recall call, adds it to search by meaning; no timer starts that job) or off (the server has no embedding model).

Return a session’s events oldest first, up to limit (default 50).

Save one fact, decision or preference as a memory. Find it again with recall. From 1.4.1, pass validFrom (ISO-8601, for example 2023-03-01) when the fact became true at an earlier time; without it the memory is valid from the moment it is saved; a value that is not an ISO-8601 time is refused with -32602. On 1.4.1 to 1.4.2.3 a time more than 5 minutes in the future is refused (-32603). From 1.4.2.4 a future time is saved and the memory becomes current at that time: recall finds it from then on, and recall_as_of with an atTime at or after it finds it at once; with facts a future time is refused (-32602, FUTURE_VALID_FROM_WITH_FACTS). To keep an upcoming date findable now, leave validFrom out and write the date in text. On 1.4 and earlier remember has no input for an earlier date; write the fact with cypher_query and an AT VALID prefix. From 1.4.1, facts takes up to 64 facts the text states, saved in the same transaction: each has subject, predicate, and value (a string, number or boolean) or object (a person, place or thing), with optional text, validFrom, single and confidence. A fact with single: true and a new value replaces the value that was current at its validFrom; the earlier value is kept as true until then. Predicates that differ only in case, separators, a count wrapper (number_of_x, x_count) or a plural s are one predicate. Facts are shared by the whole graph. From 1.4.1 the result also has validFrom, embedding (stored, pending or off, as for record_episode) and, when facts were given, facts: per fact {fact, status, validFrom} with status created or restated; a created fact also has embedding, plus supersedes when it replaced a value and supersededBy when a later value replaces it; a restated fact has only the first three. From 1.4.2.4 the result also has eventId and savedAt (ISO-8601). A memory whose embedding cannot be computed is saved with the embedding pending; the write does not fail. From 1.4, pass idempotencyKey (1 to 256 characters) when a call may be resent: the same key with the same request returns the first result with replayed: true; the same key with a different request is refused (-32602, IDEMPOTENCY_KEY_REUSED).

Not available in this release: each call returns error -32006 with data.subcode TOOL_UNAVAILABLE. The error’s data.alternative names destroy_subject_key, which is in development; contact us about erasure requirements.

Trace a belief back through its revisions to the first version, one row per version. Evidence is not included; to get it, run CALL db.beliefLineage("churn-risk-acme", 1) YIELD beliefId, claim, evidence through cypher_query.

Show each version of a property with the attribution recorded for it: actor, source, reason, requestId and confidence. Attribution is present for writes that included provenance. From 1.4.2 the result has the column principal, the credential that made each write; the server records it for every write of an authenticated request and clients cannot set it. It is null for unauthenticated writes, for writes made before 1.4.2 without provenance, for import and other background jobs, and for the legacy POST /write route. On 1.4.1 and earlier, run CALL db.propertyProvenance(...) YIELD ..., principal through cypher_query. Identify the node with str_id or node_id; passing neither is refused with -32602. From 1.4.1 the tool’s inputSchema no longer declares this rule as a top-level anyOf. From 1.4.2.4 validFrom, validTo and txnAt are ISO-8601 (before: nanoseconds), the nanoseconds are in the new last columns validFromNanos, validToNanos and txnAtNanos, a version that a later write replaced shows where it ended (before: null when the later write had no AT VALID time), and a null cell is JSON null.

Follow DERIVED_FROM relationships from a node to its sources, up to max_depth hops. Returns source, kind and depth. From 1.4.2.2 node_str_id is resolved as db.linkDerivedFrom resolves it: a storage string id, then an id property value. A reference that names no node is refused (-32603, data.subcode LINEAGE_NOT_FOUND; LINEAGE_AMBIGUOUS when an id value matches more than one node); a node that exists and has no sources answers no rows. On 1.4.2 and earlier only the storage string id was read, and an id that named no node returned no rows and no error.

List field reads that access rules denied in Cypher, and the searches and node creates they refused, with the credential, label, property, time and reason. From 1.4.3.3, with no principal_filter (or an empty one) it returns every event the caller may see: all events for an administrator, the caller’s own events otherwise (before, it returned nothing).

Export one data subject’s node, its relationships and its property versions (GDPR Article 20). On a graph with no declared encrypted property it matches only the node whose string id equals the argument. A subject id held only in a property is not matched, and nodes created with Cypher CREATE or MERGE get a generated string id. An empty result does not show that the graph holds nothing about the subject.

Destroy one data subject’s encryption key and record a receipt. Crypto-shred (per-subject encryption keys and key destruction) is in development: on the current release, declaring an encrypted property is refused by default, and the call is refused without recording a receipt. Contact us before relying on it. The operation cannot be reversed, so get confirmation from a person before calling it.