samyama-graph

Name: samyama-graph
Author: samyama-ai

BLOCKgrade D · trust 67/100

Graph-vector database that queried 1 billion edges for $2.50. Rust, OpenCypher, vector search, 14 graph algorithms. 74M nodes / 1B edges on a single machine.

billion edgescyphercypher query languagegraph algorithmsgraph databasegraph raghnswknowledge graph

Overview

From the repository's own README, as read at the audited commit.

<p align="center">  <h1 align="center">Samyama Graph</h1>  <p align="center">A Rust-native graph-vector database for GraphRAG, knowledge graphs, and billion-edge analytics.</p>  <p align="center">    <strong>The graph database that queried 1 billion edges for $2.50</strong>  </p>  <p align="center">    <a href="https://github.com/samyama-ai/samyama-graph/releases"><img src="https://img.shields.io/badge/version-1.1.0-blue" alt="Version"></a>    <a href="https://github.com/samyama-ai/samyama-graph/actions"><img src="https://img.shields.io/badge/tests-2238_passing-brightgreen" alt="Tests"></a>    <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache_2.0-blue" alt="License"></a>    <a href="https://graph.samyama.cloud/book/"><img src="https://img.shields.io/badge/book-read_the_docs-orange" alt="Book"></a>    <a href="https://chat.whatsapp.com/Jjjkb3uWRDi1YMdfffaD9d"><img src="https://img.shields.io/badge/community-WhatsApp-25D366?logo=whatsapp&logoColor=white" alt="WhatsApp Community"></a>  </p>  <p align="center">    💬 <strong><a href="https://chat.whatsapp.com/Jjjkb3uWRDi1YMdfffaD9d">Join the Samyama OSS community on WhatsApp</a></strong> — questions, help, and updates.  </p></p>---## What is Samyama Graph?Samyama Graph is a Rust-native graph-vector database that lets developers store, query, search, and analyze connected data in one system.It brings together graph traversal, OpenCypher-style querying, vector search, graph algorithms, and Redis-compatible access, making it useful for GraphRAG, knowledge graphs, AI agent memory, and large-scale relationship analytics.### Quickstart#### Option 1 — Run with Docker Compose**Step 1 — Prerequisites**- ✅ Docker Desktop installed and running — [Watch setup video →](https://samyama.dev/videos)- ✅ No account or credentials needed — the image is public on GitHub Container Registry (`latest` is the newest release; pin a version such as `:1.8.0` for a reproducible setup)**Step 2 — Pull the Docker image**```bashdo

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add samyama-sdk -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "samyama-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (12) 10 read · 2 write · 0 destructive

Tool	Risk	Description
`bad_tool`	write	This tries to write
`count_nodes`	read	Count all nodes
`cypher_query`	write	Execute a read-only Cypher query against the graph.
`drug_neighbours`	read	Drugs that share a pathway (4-hop scan — intentionally slow)
`heavy-skew`	read	one value on ~50% of nodes, long tail — social/biomedical shape
`list_labels`	read	Aggregate nodes by label
`mild-skew`	read	10 values, most common 3x the rarest
`rare_probe`	read	Look up a specific rare drug by exact name
`sample_drugs`	read	List drug names
`schema_info`	read	Return the full graph schema including node types, edge types,
`top_people`	read	Top people by some metric
`uniform`	read	10 values, equal counts — the distribution the estimator assumes

Details

Source: samyama-ai/samyama-graph
npm: samyama-sdk@1.8.0
PyPI: samyama
License: Apache-2.0
Stars: 171 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (13 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (22)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/vector/index.rs:99

fn eval(&self, va: &[f32], vb: &[f32]) -> f32 {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/vector/index.rs:133

fn eval(&self, va: &[f32], vb: &[f32]) -> f32 {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

case_studies/_lib/demo_lib.py:88

base_url = base_url or os.environ.get("SG_BASE_URL", "http://127.0.0.1:8080")

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

case_studies/_lib/record_gif.sh:18

export SG_BASE_URL="${SG_BASE_URL:-http://127.0.0.1:8080}"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

case_studies/_lib/run_case_study.sh:43

BASE_URL="http://127.0.0.1:${PORT_HTTP}"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

case_studies/_lib/samyama_http.py:39

def __init__(self, base_url: str = "http://127.0.0.1:8080", graph: str = "default"):

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

case_studies/_lib/validate_queries.py:26

ap.add_argument("--base-url", default="http://127.0.0.1:8080")

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/ic1_index_regression.rs:22

fn exec(s: &GraphStore, q: &str) -> (usize, Duration) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/ic1_index_regression.rs:48

let (r, d) = exec(s, q);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/duration_between_across_dst.rs:17

fn eval(expr: &str) -> String {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/query/csv_source.rs:156

resolve("../../etc/passwd"),

LOWNetwork egress · net.beacon_words · CWE-200, CWE-319

examples/enterprise_soc_demo.rs:466

MitreDef { technique_id: "T1048",     name: "Exfiltration Over Alternative Protocol", tactic: "Exfiltration" },

LOWNetwork egress · net.beacon_words · CWE-200, CWE-319

examples/enterprise_soc_demo.rs:619

AttackStep { step: 5, source_name: "int-app-01",   target_name: "int-db-01",      technique: "T1048",     description: "Database credentials exfiltrated via DNS tunneling" },

LOWNetwork egress · net.beacon_words · CWE-200, CWE-319

examples/enterprise_soc_demo.rs:726

println!("    Incoming IOC: Suspicious PowerShell beacon pattern detected.");

LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

examples/uc3_capacity_planning.rs:273

"   {fid}: Δbeds={:+.1} Δnurses={:+.1} Δdoctors={:+.1}",

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

sdk/python/examples/mcp-demo/requirements.txt

samyama, PyYAML

Why it matters. 2 requirement(s) not pinned with ==

Fix. pin exact versions

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

sdk/typescript/package.json

@types/node, typescript

Why it matters. 2 dependency range(s) float

Fix. pin exact versions or ship a lockfile