Evaluation record · mcp-server-neo4j

MCP Neo4j Server

v1.5.3 (2026-06-11)

Neo4j (Official)

MCPdatabasegraphcypherknowledge-graph
74
Adequate
About This MCP

Official Neo4j MCP server (neo4j/mcp; neo4j-mcp-server on PyPI, v1.5.3 released 2026-06-11): schema introspection, read-cypher (read-only enforced via EXPLAIN query classification), write-cypher, and GDS procedure listing over stdio. Arbitrary Cypher means read+write access to the graph unless NEO4J_READ_ONLY=true is set. Distinct from the experimental Neo4j Labs servers (mcp-neo4j-cypher, mcp-neo4j-memory), which carry no product support or compatibility guarantees.

Last Evaluated: July 9, 2026
Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability
+
cypher execution

Cypher execution capability review

Evidence
Neo4j MCP repository — read-cypher and write-cypher tools execute arbitrary Cypher through the official driver; read queries are validated via Neo4j's EXPLAIN-based query-type classification before execution
highVerified: 2026-07-09
schema introspection

Schema introspection review

Evidence
Neo4j MCP repository — get-schema retrieves node labels, relationship types, and property keys (APOC plugin required), with configurable schema sampling via NEO4J_SCHEMA_SAMPLE_SIZE
highVerified: 2026-07-09
connection stability

Connection stability and compatibility assessment

Evidence
Neo4j MCP documentation — Connects to Aura, Neo4j Desktop, and self-managed instances via the official driver (NEO4J_URI); optional dependencies like GDS trigger adaptive mode where unsupported features disable gracefully
mediumVerified: 2026-07-09
error handling

Error handling review

Evidence
Neo4j MCP repository — Write attempts through read-cypher are rejected by query classification and write-cypher is disabled under NEO4J_READ_ONLY=true; configurable logging (NEO4J_LOG_LEVEL, NEO4J_LOG_FORMAT) aids diagnosis
mediumVerified: 2026-07-09
large graph handling

Large graph handling assessment

Evidence
Neo4j MCP repository — Schema sampling size is configurable for large graphs, but unbounded Cypher reads can return result sets that overwhelm model context; no automatic pagination documented
lowVerified: 2026-07-09
🛡️Security
+
authentication security

Authentication mechanism review

Evidence
neo4j-mcp-server on PyPI — Authenticates with database credentials via NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD, NEO4J_DATABASE environment variables; no OAuth or token-based flow for the MCP layer itself
highVerified: 2026-07-09
credential exposure

Credential security analysis

Evidence
Neo4j MCP repository — Database username and password live in environment variables or MCP client config files on the local machine, following the same pattern as other stdio database servers
highVerified: 2026-07-09
cypher injection risk

Injection and prompt-injection exposure analysis

Evidence
Model Context Protocol security best practices — The AI composes arbitrary Cypher; untrusted content stored in graph properties can carry injected instructions back to the model, and write-capable sessions let those instructions mutate the graph
mediumVerified: 2026-07-09
data modification control

Write-surface assessment; read-only mode is a clean kill-switch but write mode is all-or-nothing, unlike graduated designs such as ClickHouse's two-flag gate

Evidence
neo4j-mcp-server on PyPI — write-cypher permits full create/update/delete by default; NEO4J_READ_ONLY=true disables it entirely, and read-cypher enforces read-only semantics via EXPLAIN validation — but there is no graduated gate separating writes from destructive deletes
highVerified: 2026-07-09
audit logging

Audit logging review

Evidence
Neo4j query logging documentation — Query logging is available in Neo4j Enterprise/Aura for agent-issued Cypher; the MCP server adds configurable structured logging but no dedicated audit trail of tool invocations
mediumVerified: 2026-07-09
🔒Privacy & Compliance
+
graph data exposure

Data flow analysis

Evidence
MCP Architecture — Query results, schema, and sampled property values are sent to the connected LLM provider; graph schemas often encode business-sensitive relationship structures
highVerified: 2026-07-09
pii protection

PII protection assessment

Evidence
Neo4j MCP repository — No built-in PII detection or property-level filtering; anything readable by the configured database user can reach the model, and person-centric graphs frequently concentrate PII
highVerified: 2026-07-09
self hosted option

Self-hosting options review

Evidence
Neo4j MCP documentation — Runs entirely locally over stdio against self-managed Neo4j or Desktop; telemetry is controllable via NEO4J_TELEMETRY
highVerified: 2026-07-09
third party data sharing

Data sharing analysis

Evidence
Model Context Protocol documentation — Graph content shared with the LLM provider is governed by that provider's data terms; the server itself sends optional telemetry to Neo4j unless disabled
mediumVerified: 2026-07-09
👁️Trust & Transparency
+
documentation quality

Documentation completeness review

Evidence
Neo4j MCP documentation — Dedicated official docs site covering prerequisites (APOC), configuration env vars, adaptive mode for optional dependencies, and client setup
highVerified: 2026-07-09
open source transparency

Source code review; scored down slightly for the conflicting license metadata between the repository and the PyPI package

Evidence
Neo4j MCP repository — Source available under the official neo4j org (268 stars, written in Go, distributed via PyPI); repo carries Apache 2.0 terms while PyPI metadata lists GPL-3.0-only — an unresolved licensing inconsistency
mediumVerified: 2026-07-09
official vs labs clarity

Product-boundary clarity review; the split is documented but the coexisting Labs servers with overlapping names still cause user confusion

Evidence
Neo4j MCP developer guide — Neo4j documents the split explicitly: neo4j/mcp is the supported product server, while neo4j-contrib/mcp-neo4j (mcp-neo4j-cypher, mcp-neo4j-memory, aura-manager, GDS agent) are Labs projects — actively developed but experimental, with no SLAs or backwards-compatibility guarantees
highVerified: 2026-07-09
community activity

Community engagement analysis

Evidence
Neo4j MCP repository — 268 stars, 54 forks; regular releases culminating in v1.5.3 (2026-06-11), maintained by the Neo4j product team with an active Labs ecosystem alongside
mediumVerified: 2026-07-09
⚙️Operational Excellence
+
ease of setup

Setup complexity assessment

Evidence
neo4j-mcp-server on PyPI — pip install neo4j-mcp-server plus four connection env vars; runs as a Python-launched subprocess over stdio against Aura, Desktop, or self-managed Neo4j (APOC required)
highVerified: 2026-07-09
query performance

Performance review of the underlying engine for agent workloads

Evidence
Neo4j performance documentation — Performance follows the underlying Neo4j instance: fast index-backed traversals, but unindexed agent-composed pattern matches on large graphs can be slow
mediumVerified: 2026-07-09
feature coverage

Feature coverage assessment; deliberately narrow product surface with breadth delegated to experimental Labs servers

Evidence
Neo4j MCP repository — Focused tool set: get-schema, read-cypher, write-cypher, list-gds-procedures; Aura management, agent memory, and GDS execution live in separate Labs servers rather than the product server
highVerified: 2026-07-09
reliability

Reliability analysis

Evidence
Neo4j MCP repository — Product-team maintained with steady releases (v1.5.3, 2026-06-11) built on the official Go driver; adaptive mode degrades gracefully when optional dependencies are missing
mediumVerified: 2026-07-09
community support

Community support assessment

Evidence
Neo4j MCP developer guide — Supported by the Neo4j product team, with the Field GenAI team maintaining the complementary Labs servers and active developer-relations content
mediumVerified: 2026-07-09
Strengths
  • +Official product server maintained by the Neo4j product team (v1.5.3, 2026-06-11), clearly separated from experimental Labs servers
  • +read-cypher enforces read-only semantics via EXPLAIN-based query classification rather than string heuristics
  • +Global kill-switch: NEO4J_READ_ONLY=true fully disables write-cypher
  • +First-class graph schema introspection gives agents accurate label/relationship/property context
  • +Works across Aura, Neo4j Desktop, and self-managed instances with graceful adaptive mode
  • +GDS procedure discovery enables graph-algorithm-aware agents
Limitations
  • !Arbitrary Cypher means full read+write to the graph by default — write-cypher is enabled unless NEO4J_READ_ONLY=true is set
  • !No graduated write gate: enabling writes also enables destructive deletes (DETACH DELETE, index/constraint drops) within the DB user's privileges
  • !Database credentials stored in environment variables or client config; no OAuth flow at the MCP layer
  • !Query results and graph structure exposed to the LLM provider with no PII filtering
  • !License metadata inconsistent: repo indicates Apache 2.0 while PyPI declares GPL-3.0-only
  • !Requires the APOC plugin; overlapping Labs servers (mcp-neo4j-cypher/memory) with similar names invite confusion
  • !stdio-only product server; no managed remote endpoint from Neo4j yet
Metadata
license: Apache 2.0 per repository LICENSE; PyPI metadata lists GPL-3.0-only (inconsistency noted)
supported platforms
0: All platforms with Python 3.10+ (Go binary distributed via PyPI)
programming languages
0: Go
mcp version: 1.0
github repo: https://github.com/neo4j/mcp
github stars: 268
package name: neo4j-mcp-server (PyPI)
latest version: 1.5.3 (2026-06-11)
docs: https://neo4j.com/docs/mcp/current/
api dependency: Neo4j Go driver; APOC plugin required; optional Graph Data Science library
authentication: Database credentials via NEO4J_URI / NEO4J_USERNAME / NEO4J_PASSWORD / NEO4J_DATABASE env vars
security controls
0: NEO4J_READ_ONLY=true disables write-cypher
1: EXPLAIN-based read-only validation for read-cypher
2: configurable telemetry (NEO4J_TELEMETRY)
labs counterparts: neo4j-contrib/mcp-neo4j: mcp-neo4j-cypher, mcp-neo4j-memory, mcp-neo4j-aura-manager, GDS agent (experimental, no SLAs)
first release: 2025 (Labs servers); product server GA line through 2026, v1.5.3 on 2026-06-11
transport types
0: stdio
maintained by: Neo4j product team

Use Case Ratings

code generation

Good for generating Cypher and graph data models from live schemas

customer support

Useful over customer-360 graphs, but such graphs concentrate PII

content creation

Knowledge-graph-backed content research is a reasonable secondary fit

data analysis

Strong for relationship-centric analysis, fraud rings, and network exploration

research assistant

Knowledge graphs plus GDS discovery suit multi-hop research questions well

legal compliance

Entity-relationship discovery helps investigations; PII exposure needs strict scoping

healthcare

Patient/provider graphs are PII-dense; not advised without read-only mode and scoped users

financial analysis

Well suited to fraud and exposure network analysis with read-only credentials

education

Excellent for teaching graph modeling and Cypher interactively

creative writing

Character/world relationship graphs are a genuinely good niche fit

Similar MCPs

MCP Memory Server

Anthropic

MCP PostgreSQL Server

Anthropic (Archived)

MCP MongoDB Server

MongoDB (Official)

MCP ClickHouse Server

ClickHouse (Official)