Model Context Protocol

Decision-aware memory — one config line.

InvariantDB ships a Model Context Protocol server. One config line gives your agent durable memory it can trust, prove, and replay: bitemporal Cypher (what was true, when), provenance walks (why did the agent think that), 14 tools total. JSON-RPC 2.0 over HTTPS; auth via Authorization: Bearer gq_....

Endpoint

https://invariantdb.com/e/mcp

Pair with an API key from /apikeys. HTTP transport is the recommended path — see the self-hosted section below for on-prem deployments.

Drop into Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "invariantdb": {
      "type": "http",
      "url": "https://invariantdb.com/e/mcp",
      "headers": {
        "Authorization": "Bearer gq_paste_your_api_key_here"
      }
    }
  }
}

Restart Claude Desktop. The 14 tools appear under the 🔌 icon.

Drop into Cursor / Continue / VS Code

The same shape works in any MCP-compatible client. The endpoint is https://invariantdb.com/e/mcp; auth is Authorization: Bearer gq_…. Use your client's HTTP MCP transport config.

The 14 tools

Reads

cypher_query

{ "query": "MATCH (n) RETURN count(n)", "parameters": {} }

Arbitrary Cypher against the bound graph. Returns columns + rows in the engine's standard wire shape. Parameters substitute for $name placeholders.

get_node_by_str

{ "str_id": "alice" }

Look up one node by its string id. Cheap, no scan.

get_edge_by_str

{ "str_id": "edge-abc" }

Look up one edge by its string id.

engine_info

{}

Returns graph_dir + current_snapshot_seq + auth summary. Useful first call to confirm the connection is healthy.

Search

search_fulltext

{ "label": "Document", "property": "body", "query": "pricing strategy", "k": 10 }

BM25 fulltext via tantivy over (label, property). Returns top-k hits with score.

search_vector

{ "label": "Episode", "property": "embedding", "query": [0.1, 0.2, ...], "k": 10, "metric": "cosine" }

HNSW vector search via instant-distance. Returns top-k hits with score. Metric: cosine | euclidean | dot.

Agent memory

record_episode

{ "session": "conv-abc-123", "kind": "observation", "text": "User asked about Q3", "payload": {"topic": "forecast"} }

Record one event in an agent's session — per-agent sequential log. kind is operator-defined: observation, thought, toolCall, decision, etc. Yields the event id and timestamp.

replay_episodes

{ "session": "conv-abc-123", "limit": 50 }

Replay an agent's session — last N events, time-ordered. Use it to show a user what the agent did, or feed past context back into the next prompt.

belief_lineage

{ "belief_key": "churn-risk-acme" }

Walk every version of a belief + its evidence. The full inference-revision history: what the agent believed, when, and why.

property_provenance

{ "node_id": 42, "property": "approved" }

Full bitemporal version history + provenance (actor, source, reason, confidence) for one node property. ECOA adverse-action explanations, AI decision audits.

derived_from

{ "node_str_id": "claim-99", "max_depth": 5 }

Walk derived-from edges back from a node — RAG citation chains, inference trees, document derivation. depth limits the walk.

Compliance

acl_events

{ "since_id": 0, "principal_filter": "bearer:abc...", "limit": 100 }

Replay the hash-chained ACL audit log. Who tried to read what, when, and whether the engine denied them. Pair with db.verifyAclChain for tamper-evidence.

subject_export

{ "subject": "user_42" }

GDPR Article 20 right-to-portability. One call returns every atom of the subject's data: node, every incident edge, full bitemporal version history, plus provenance for each property.

destroy_subject_key

{ "subject": "user_42" }

GDPR Article 17 crypto-shred. Destroys the subject's encryption key (irreversible). Every encrypted property for that subject becomes unrecoverable ciphertext — retroactively across every snapshot, backup, and audit replay. Returns a signed receipt your DPO hands the subject.

Defense in depth

The MCP server refuses mutations by default. A misbehaving agent can read, search, and audit. It cannot CREATE / SET / DELETE unless you flip the explicit allow-mutate flag.
Every tool call lands in the audit chain. Tamper-evidence via db.verifyAclChain at any time.
Private-mode API keys (differential privacy) restrict the agent to scalar aggregate returns only. The planner refuses any non-aggregate; Laplace noise is added to every count/sum/avg; the ε budget is persistent. See DP details.
Capability tokens let you mint a short-lived, session-scoped credential per conversation. Drop into your MCP client via env; it expires on its own. See conversation sub-tenancy.

Self-hosted MCP server

If you run your own InvariantDB cluster, the MCP endpoint is at POST /mcp (default graph) or POST /graphs/{name}/mcp (named graph) on your InvariantDB endpoint. Auth is the same API-key gate. See the SDK page for client invocation examples.

What's NOT exposed via MCP

By design, the MCP surface is a read-and-replay surface. Operations that change schema, manage tenancy, or control infrastructure (creating graphs, dropping data, issuing API keys, maintenance operations) stay on the HTTP surface where they belong — behind admin-role gates and not adjacent to whatever the agent decided to do this turn.

If you want to give an agent broader access, mint a separate API key with explicit role + scope and pass it through — don't widen the MCP server's default surface.

Quickstart → · AI memory → · All features → · Get an API key →