Neo4jSAFE
Neo4j Labs Model Context Protocol servers
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Neo4j Labs
These MCP servers are a part of the Neo4j Labs program. They are developed and maintained by the Neo4j Field GenAI team and welcome contributions from the larger developer community. These servers are frequently updated with new and experimental features, but are not supported by the Neo4j product team.
They are actively developed and maintained, but we don’t provide any SLAs or guarantees around backwards compatibility and deprecation.
If you are looking for the official product Neo4j MCP server please find it here.
Overview
Model Context Protocol (MCP) is a standardized protocol for managing context between large language models (LLMs) and external systems.
This lets you use Claude Desktop, or any other MCP Client (VS Code, Cursor, Windsurf, Gemini CLI), to use natural language to accomplish things with Neo4j and your Aura account, e.g.:
- What is in this graph?
- Render a chart from the top products sold by frequency, total and average volume
- List my instances
- Create a new instance named mcp-test for Aura Professional with 4GB and Graph Data Science enabled
- Store the fact that I worked on the Neo4j MCP Servers today with Andreas and Oskar
Servers
mcp-neo4j-cypher - natural language to Cypher queries
Details in Readme
Get database schema for a configured database and execute generated read and write Cypher queries on that database.
Requirement: Requires the APOC plugin to be installed and enabled on the Neo4j instance for schema inspection.
mcp-neo4j-memory - knowledge graph memory stored in Neo4j
Details in Readme
Store and retrieve entities and relationships from your personal knowledge graph in a local or remote Neo4j instance. Access that information ov
829bb04d942bOBSERVED · 2026-09-26Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-neo4j-aura-manager --env NEO4J_AURA_CLIENT_ID=${NEO4J_AURA_CLIENT_ID} --env NEO4J_AURA_CLIENT_SECRET=${NEO4J_AURA_CLIENT_SECRET} -- None mcp-neo4j-aura-manager==0.4.8Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (15)
.prettierignore
.flake8
.flake8
../../mcp-publisher login github-oidc
../../mcp-publisher publish
../../mcp-publisher login github-oidc
../../mcp-publisher publish
../../mcp-publisher login github-oidc
("X` WITH 1 as x MATCH (s:Secret) CREATE (e:Exfiltrated {data: s.name + ':' + s.value}) //", "exfiltration_injection"),server_url = "http://127.0.0.1:8005/mcp/"
server_url = "http://127.0.0.1:8006/mcp/"
server_url = "http://127.0.0.1:8001/mcp/"
assert url == "http://127.0.0.1:8001/mcp/"
"http://127.0.0.1:8008/mcp/",
Gates applied: no_behavioural_pass.
829bb04d942bfull audit observations/trust-audit/mcp-server/neo4j-contrib__neo4j.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-26 | 829bb04d942b | SAFE | B | 89 | first audit |
Questions
What is the Neo4j MCP server?
Neo4j Labs Model Context Protocol servers
Is Neo4j safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Neo4j need?
It reads NEO4J_AURA_CLIENT_ID, NEO4J_AURA_CLIENT_SECRET, NEO4J_PASSWORD and NEO4J_RESPONSE_TOKEN_LIMIT from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Neo4j run?
It speaks sse and stdio, so it runs as a local process your client starts. It is published on PyPI as mcp-neo4j-memory.
How current is this page?
The grade is for one exact copy of the source (829bb04d942b), read on 2026-09-26. The repository is watched and re-audited when it changes.