---
name: graph
tools:
  - name: maxy-graph-read_neo4j_cypher
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: maxy-graph-get_neo4j_schema
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: maxy-graph-write_neo4j_cypher
    publicAllowlist: false
    adminAllowlist: false
    riskClass: write_local
mcp-manifest: shared-lib
mcp:
  command: node
  args:
    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
    - ${PLATFORM_ROOT}/lib/graph-mcp/dist/index.js
  env:
    MCP_SPAWN_TEE_NAME: graph
    LOG_DIR: ${LOG_DIR}
    PLATFORM_ROOT: ${PLATFORM_ROOT}
    ACCOUNT_ID: ${ACCOUNT_ID}
    SESSION_ID: ${SESSION_ID}
    NEO4J_URI: ${NEO4J_URI}
    NEO4J_PASSWORD: ${NEO4J_PASSWORD}
description: "Raw Neo4j Cypher proxy. Wraps the upstream `mcp-neo4j-cypher` server (spawned under uvx by `platform/lib/graph-mcp`) under the stable `maxy-graph` namespace, so its tools register as `maxy-graph-read_neo4j_cypher`, `maxy-graph-get_neo4j_schema`, and `maxy-graph-write_neo4j_cypher`. The read and schema tools are admin-allowlisted for schema checks and read-only queries; the write tool is specialist-only (database-operator / librarian execute operator-confirmed `mergeCypher` templates through it, never hand-authored Cypher). The shim validates write Cypher against the live schema, stamps provenance, and rejects unknown labels/edges. Account isolation is per-brand Neo4j; the shim adds no query-layer tenant filter."
---

# graph

Cypher proxy plugin. The server is the shared binary `platform/lib/graph-mcp`,
which adopts the upstream Python `mcp-neo4j-cypher` server per brand and proxies
its JSON-RPC stdio under the `maxy-graph` namespace. Unlike plugins that ship a
plugin-local `mcp/` dir, graph's server is a shared `platform/lib/<name>` binary,
so it mounts via the generator's `shared-lib` disposition: `mcp-manifest: shared-lib`
tells `scripts/generate-plugin-manifests.mjs` to emit graph's `mcp:` block into the
generated `.claude-plugin/plugin.json` `mcpServers`, routed through the shared
`mcp-spawn-tee`. Its tools then surface to admin and specialist spawns as
`mcp__plugin_graph_graph__maxy-graph-*`.

Write Cypher is intercepted (not forwarded) so the shim can validate tokens against the
live schema cache, stamp `createdBy` provenance, and roll back orphan-producing writes.
Read Cypher and schema introspection forward to upstream with an envelope-warning probe
that stitches Neo4j `gql_status` codes back into the response.