MCP server · Org-owned · Audited from source

Graphiti MCP server

by getzep/graphitiApache-2.0 licenceAudited 19 Sep 2026 · source 5ac3b52f6cf3

PyPI graph-servicestreamable-http★ 31,002

✓SAFEGrade B · 89/100 · 19 Sep 2026 · 5ac3b52

31,002GitHub stars

Is it safe? Yes — SAFE, grade B (89/100). It exposes 13 tools: 8 read, 2 write and 3 destructive. The audit recorded 10 findings (0 critical, 0 high, 1 medium, 7 low). Maintainer's description: Build Real-Time Knowledge Graphs for AI Agents

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Graphiti MCP server (getzep/graphiti)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/getzep/graphiti

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score89/100✓SAFE B

0 critical0 high1 medium7 low2 info

10 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared2 observations
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 2 findings
`L1` Static source	Secrets, path traversal, supply chain	PASS 4 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 3 findings
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner getzepOrganizationAccount type recorded when we read the repository.
PackagePublished on PyPIgraph-service, no version recorded
LicenceApache-2.0From the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit read5ac3b52f6cf3The audit covers exactly this commit, read on 19 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory13 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (10)

Sorted by severity

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

clear_graph, delete_entity_edge, delete_episode

Why: 3 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injectioncode.dynamic_import · mcp_server/tests/run_tests.py:97

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

__import__(package.replace('-', '_'))

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · graphiti_core/llm_client/client.py:157

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

return hashlib.md5(key_str.encode()).hexdigest()

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · server/tests/test_live_falkordb_int.py:139

F-04 Network egressCWE-200 · CWE-319Layer L1

base_url = f'http://127.0.0.1:{port}'

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · examples/quickstart/requirements.txt

F-08 Supply chainCWE-829 · CWE-1357Layer L1

graphiti-core, python-dotenv

Why: 2 requirement(s) not pinned with ==
Fix: pin exact versions

LOWPrompt injectionprompt.credential_read · mcp_server/docker/README.md:183

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

cat .env | grep API_KEY

Why: asks the agent to read credentials
Fix: —

LOWSupply chainprompt.pipe_to_shell · mcp_server/README.md:92

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -LsSf https://astral.sh/uv/install.sh | sh

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.transfer_instruction · CONTRIBUTING.md:35

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Join the conversation on [GitHub Issues](https://github.com/getzep/graphiti/issues) and pitch in at the helpdesk. Answering questions and helping troubleshoot issues is an incredibly valuable contribu

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

INFOInventory / provenanceinv.oversize · tests/evals/data/longmemeval_data/longmemeval_oracle.json

F-13 Inventory / provenanceCWE-1104Layer L0

tests/evals/data/longmemeval_data/longmemeval_oracle.json

Why: 15388478 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · uv.lock

F-13 Inventory / provenanceCWE-1104Layer L0

uv.lock

Why: 1005857 bytes not read
Fix: —

Tools it exposes

13 declared in source · 3 destructive

8 read2 write3 destructive

3 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`clear_graph`	destructive	Clear all data from the graph for specified group IDs.
`delete_entity_edge`	destructive	Delete an entity edge from the graph memory.
`delete_episode`	destructive	Delete an episode from the graph memory.
`add_memory`	write	Add an episode to memory. This is the primary way to add information to the graph.
`add_triplet`	write	Directly add a single fact triplet (source entity -> fact -> target entity).
`build_communities`	read	Detect and build community summaries over the graph
`get_entity_edge`	read	Get an entity edge from the graph memory by its UUID.
`get_episode_entities`	read	Get the entities (nodes) and facts (edges) created by specific episodes.
`get_episodes`	read	Get episodes from the graph memory.
`get_status`	read	Get the status of the Graphiti MCP server and database connection.
`search_memory_facts`	read	Search the graph memory for relevant facts (entity edges).
`search_nodes`	read	Search for nodes (entities) in the graph memory.
`summarize_saga`	read	Summarize a saga: an ordered group of related episodes.

Install

audited commit 5ac3b52

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit 5ac3b52 only.

claude mcp add graph-service --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} --env CHUNK_MIN_TOKENS=${CHUNK_MIN_TOKENS} --env CHUNK_OVERLAP_TOKENS=${CHUNK_OVERLAP_TOKENS} -- uvx graph-service

{
  "mcpServers": {
    "graph-service": {
      "command": "uvx",
      "args": [
        "graph-service"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}",
        "CHUNK_MIN_TOKENS": "${CHUNK_MIN_TOKENS}",
        "CHUNK_OVERLAP_TOKENS": "${CHUNK_OVERLAP_TOKENS}"
      }
    }
  }
}

The command does not pin a version; the audit covers commit 5ac3b52f6cf3. Transport: streamable-http. Reads these environment variables: ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, CHUNK_MIN_TOKENS, CHUNK_OVERLAP_TOKENS, CHUNK_TOKEN_SIZE, FALKORDB_PASSWORD, GOOGLE_API_KEY, NEO4J_PASSWORD and 1 more. Give it the narrowest token it needs.

Audit history

2026-09-19
✓SAFE B 89 / 100
Source changed, verdict held · 5ac3b52f6cf3
2026-09-18
✓SAFE B 89 / 100
First audit · d7b2f46412da

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/getzep/graphiti/badge.svg)](https://modelsatlas.com/mcp/getzep/graphiti/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Graphiti MCP server

What is the Graphiti MCP server?

Build Real-Time Knowledge Graphs for AI Agents

What tools does Graphiti expose?

13 in total: 8 read-only, 2 that write, and 3 that can delete or overwrite (clear_graph, delete_entity_edge, delete_episode). Every one is listed on this page with its risk.

Is Graphiti safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Graphiti need?

It reads ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, CHUNK_MIN_TOKENS, CHUNK_OVERLAP_TOKENS, CHUNK_TOKEN_SIZE, FALKORDB_PASSWORD, GOOGLE_API_KEY, NEO4J_PASSWORD and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Graphiti run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as graph-service.

How current is this page?

The grade is for one exact copy of the source (5ac3b52f6cf3), read on 2026-09-19. The repository is watched and re-audited when it changes.

Sources

getzep/graphiti on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — SAFE verdict for commit 5ac3b52f6cf3Observed · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Graphiti MCP server?
GChatGPT CClaude PPerplexity
What tools does Graphiti expose?
GChatGPT CClaude PPerplexity
Is Graphiti safe to connect to an agent?
GChatGPT CClaude PPerplexity