Evaluation record · mcp-server-neo4j

MCP Neo4j Server

v1.5.3 (2026-06-11)

Neo4j (Official)

MCPdatabasegraphcypherknowledge-graph

Adequate

About This MCP

Official Neo4j MCP server (neo4j/mcp; neo4j-mcp-server on PyPI, v1.5.3 released 2026-06-11): schema introspection, read-cypher (read-only enforced via EXPLAIN query classification), write-cypher, and GDS procedure listing over stdio. Arbitrary Cypher means read+write access to the graph unless NEO4J_READ_ONLY=true is set. Distinct from the experimental Neo4j Labs servers (mcp-neo4j-cypher, mcp-neo4j-memory), which carry no product support or compatibility guarantees.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

cypher execution

Cypher execution capability review

Evidence

Neo4j MCP repository — read-cypher and write-cypher tools execute arbitrary Cypher through the official driver; read queries are validated via Neo4j's EXPLAIN-based query-type classification before execution

highVerified: 2026-07-09

schema introspection

Schema introspection review

Evidence

Neo4j MCP repository — get-schema retrieves node labels, relationship types, and property keys (APOC plugin required), with configurable schema sampling via NEO4J_SCHEMA_SAMPLE_SIZE

highVerified: 2026-07-09

connection stability

Connection stability and compatibility assessment

Evidence

Neo4j MCP documentation — Connects to Aura, Neo4j Desktop, and self-managed instances via the official driver (NEO4J_URI); optional dependencies like GDS trigger adaptive mode where unsupported features disable gracefully

mediumVerified: 2026-07-09

error handling

Error handling review

Evidence

Neo4j MCP repository — Write attempts through read-cypher are rejected by query classification and write-cypher is disabled under NEO4J_READ_ONLY=true; configurable logging (NEO4J_LOG_LEVEL, NEO4J_LOG_FORMAT) aids diagnosis

mediumVerified: 2026-07-09

large graph handling

Large graph handling assessment

Evidence

Neo4j MCP repository — Schema sampling size is configurable for large graphs, but unbounded Cypher reads can return result sets that overwhelm model context; no automatic pagination documented

lowVerified: 2026-07-09

🛡️Security

authentication security

Authentication mechanism review

Evidence

neo4j-mcp-server on PyPI — Authenticates with database credentials via NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD, NEO4J_DATABASE environment variables; no OAuth or token-based flow for the MCP layer itself

highVerified: 2026-07-09

credential exposure

Credential security analysis

Evidence

Neo4j MCP repository — Database username and password live in environment variables or MCP client config files on the local machine, following the same pattern as other stdio database servers

highVerified: 2026-07-09

cypher injection risk

Injection and prompt-injection exposure analysis

Evidence

Model Context Protocol security best practices — The AI composes arbitrary Cypher; untrusted content stored in graph properties can carry injected instructions back to the model, and write-capable sessions let those instructions mutate the graph

mediumVerified: 2026-07-09

data modification control

Write-surface assessment; read-only mode is a clean kill-switch but write mode is all-or-nothing, unlike graduated designs such as ClickHouse's two-flag gate

Evidence

neo4j-mcp-server on PyPI — write-cypher permits full create/update/delete by default; NEO4J_READ_ONLY=true disables it entirely, and read-cypher enforces read-only semantics via EXPLAIN validation — but there is no graduated gate separating writes from destructive deletes

highVerified: 2026-07-09

audit logging

Audit logging review

Evidence

Neo4j query logging documentation — Query logging is available in Neo4j Enterprise/Aura for agent-issued Cypher; the MCP server adds configurable structured logging but no dedicated audit trail of tool invocations

mediumVerified: 2026-07-09

🔒Privacy & Compliance

graph data exposure

Data flow analysis

Evidence

MCP Architecture — Query results, schema, and sampled property values are sent to the connected LLM provider; graph schemas often encode business-sensitive relationship structures

highVerified: 2026-07-09

pii protection

PII protection assessment

Evidence

Neo4j MCP repository — No built-in PII detection or property-level filtering; anything readable by the configured database user can reach the model, and person-centric graphs frequently concentrate PII

highVerified: 2026-07-09

self hosted option

Self-hosting options review

Evidence

Neo4j MCP documentation — Runs entirely locally over stdio against self-managed Neo4j or Desktop; telemetry is controllable via NEO4J_TELEMETRY

highVerified: 2026-07-09

third party data sharing

Data sharing analysis

Evidence

Model Context Protocol documentation — Graph content shared with the LLM provider is governed by that provider's data terms; the server itself sends optional telemetry to Neo4j unless disabled

mediumVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review

Evidence

Neo4j MCP documentation — Dedicated official docs site covering prerequisites (APOC), configuration env vars, adaptive mode for optional dependencies, and client setup

highVerified: 2026-07-09

open source transparency

Source code review; scored down slightly for the conflicting license metadata between the repository and the PyPI package

Evidence

Neo4j MCP repository — Source available under the official neo4j org (268 stars, written in Go, distributed via PyPI); repo carries Apache 2.0 terms while PyPI metadata lists GPL-3.0-only — an unresolved licensing inconsistency

mediumVerified: 2026-07-09

official vs labs clarity

Product-boundary clarity review; the split is documented but the coexisting Labs servers with overlapping names still cause user confusion

Evidence

Neo4j MCP developer guide — Neo4j documents the split explicitly: neo4j/mcp is the supported product server, while neo4j-contrib/mcp-neo4j (mcp-neo4j-cypher, mcp-neo4j-memory, aura-manager, GDS agent) are Labs projects — actively developed but experimental, with no SLAs or backwards-compatibility guarantees

highVerified: 2026-07-09

community activity

Community engagement analysis

Evidence

Neo4j MCP repository — 268 stars, 54 forks; regular releases culminating in v1.5.3 (2026-06-11), maintained by the Neo4j product team with an active Labs ecosystem alongside

mediumVerified: 2026-07-09

⚙️Operational Excellence

ease of setup

Setup complexity assessment

Evidence

neo4j-mcp-server on PyPI — pip install neo4j-mcp-server plus four connection env vars; runs as a Python-launched subprocess over stdio against Aura, Desktop, or self-managed Neo4j (APOC required)

highVerified: 2026-07-09

query performance

Performance review of the underlying engine for agent workloads

Evidence

Neo4j performance documentation — Performance follows the underlying Neo4j instance: fast index-backed traversals, but unindexed agent-composed pattern matches on large graphs can be slow

mediumVerified: 2026-07-09

feature coverage

Feature coverage assessment; deliberately narrow product surface with breadth delegated to experimental Labs servers

Evidence

Neo4j MCP repository — Focused tool set: get-schema, read-cypher, write-cypher, list-gds-procedures; Aura management, agent memory, and GDS execution live in separate Labs servers rather than the product server

highVerified: 2026-07-09

reliability

Reliability analysis

Evidence

Neo4j MCP repository — Product-team maintained with steady releases (v1.5.3, 2026-06-11) built on the official Go driver; adaptive mode degrades gracefully when optional dependencies are missing

mediumVerified: 2026-07-09

community support

Community support assessment

Evidence

Neo4j MCP developer guide — Supported by the Neo4j product team, with the Field GenAI team maintaining the complementary Labs servers and active developer-relations content

mediumVerified: 2026-07-09

Strengths

+Official product server maintained by the Neo4j product team (v1.5.3, 2026-06-11), clearly separated from experimental Labs servers
+read-cypher enforces read-only semantics via EXPLAIN-based query classification rather than string heuristics
+Global kill-switch: NEO4J_READ_ONLY=true fully disables write-cypher
+First-class graph schema introspection gives agents accurate label/relationship/property context
+Works across Aura, Neo4j Desktop, and self-managed instances with graceful adaptive mode
+GDS procedure discovery enables graph-algorithm-aware agents

Limitations

!Arbitrary Cypher means full read+write to the graph by default — write-cypher is enabled unless NEO4J_READ_ONLY=true is set
!No graduated write gate: enabling writes also enables destructive deletes (DETACH DELETE, index/constraint drops) within the DB user's privileges
!Database credentials stored in environment variables or client config; no OAuth flow at the MCP layer
!Query results and graph structure exposed to the LLM provider with no PII filtering
!License metadata inconsistent: repo indicates Apache 2.0 while PyPI declares GPL-3.0-only
!Requires the APOC plugin; overlapping Labs servers (mcp-neo4j-cypher/memory) with similar names invite confusion
!stdio-only product server; no managed remote endpoint from Neo4j yet

Metadata

license: Apache 2.0 per repository LICENSE; PyPI metadata lists GPL-3.0-only (inconsistency noted)

supported platforms

0: All platforms with Python 3.10+ (Go binary distributed via PyPI)

programming languages

0: Go

mcp version: 1.0

github repo: https://github.com/neo4j/mcp

github stars: 268

package name: neo4j-mcp-server (PyPI)

latest version: 1.5.3 (2026-06-11)

docs: https://neo4j.com/docs/mcp/current/

api dependency: Neo4j Go driver; APOC plugin required; optional Graph Data Science library

authentication: Database credentials via NEO4J_URI / NEO4J_USERNAME / NEO4J_PASSWORD / NEO4J_DATABASE env vars

security controls

0: NEO4J_READ_ONLY=true disables write-cypher

1: EXPLAIN-based read-only validation for read-cypher

2: configurable telemetry (NEO4J_TELEMETRY)

labs counterparts: neo4j-contrib/mcp-neo4j: mcp-neo4j-cypher, mcp-neo4j-memory, mcp-neo4j-aura-manager, GDS agent (experimental, no SLAs)

first release: 2025 (Labs servers); product server GA line through 2026, v1.5.3 on 2026-06-11

transport types

0: stdio

maintained by: Neo4j product team

Use Case Ratings

code generation

Good for generating Cypher and graph data models from live schemas

customer support

Useful over customer-360 graphs, but such graphs concentrate PII

content creation

Knowledge-graph-backed content research is a reasonable secondary fit

data analysis

Strong for relationship-centric analysis, fraud rings, and network exploration

research assistant

Knowledge graphs plus GDS discovery suit multi-hop research questions well

legal compliance

Entity-relationship discovery helps investigations; PII exposure needs strict scoping

healthcare

Patient/provider graphs are PII-dense; not advised without read-only mode and scoped users

financial analysis

Well suited to fraud and exposure network analysis with read-only credentials

education

Excellent for teaching graph modeling and Cypher interactively

creative writing

Character/world relationship graphs are a genuinely good niche fit

Similar MCPs

MCP Memory Server

Anthropic

MCP PostgreSQL Server

Anthropic (Archived)

MCP MongoDB Server

MongoDB (Official)

MCP ClickHouse Server

ClickHouse (Official)