Neo4j Cypher MCP Server: Query Your Graph Database from Claude, Cursor and Other Apps
Lets Claude, Cursor and other assistants read the shape of your Neo4j graph and run Cypher queries on it.
This server connects your assistant to a Neo4j database you already run, on Aura or on your own machine. It can show the database layout, answer questions with read queries, and change data with write queries. It runs on your computer with your Neo4j username and password. It comes from the Neo4j Labs program, which Neo4j says its product team does not support. Update to version 0.6.0 or later, and consider turning on read-only mode.
Good for
- Analysts who want to ask questions of a Neo4j graph in plain English
- Developers writing and testing Cypher with an assistant
- Teams that want a read-only view of a graph for an AI assistant
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install Neo4j Cypher MCP
Claude Code
- 1
Copy this prompt.
Add the Neo4j Cypher MCP server to Claude Code. Run this command: claude mcp add neo4j-cypher -e NEO4J_URI=<NEO4J_URI> -e NEO4J_USERNAME=<NEO4J_USERNAME> -e NEO4J_PASSWORD=<NEO4J_PASSWORD> -- uvx mcp-neo4j-cypher Ask me for NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires uv (Python).
Built from the package data we hold. Not yet tested by us.
Tools
Shows the node types and links in your graph
Reads a sample of your graph and returns each node label with its properties and how it links to other labels, so the assistant can write correct queries. It needs the APOC plugin on the database. The default sample is 1,000 nodes per label.
Try: “What node types and relationships does my movies database have?”
Network ·
get_neo4j_schemaRuns a read-only Cypher query
Runs a Cypher query as a read. The server first asks Neo4j to explain the query and refuses it if it would write. Reads time out after 30 seconds by default, and results can be cut to a token limit.
Try: “List the ten actors with the most movies.”
Network ·
read_neo4j_cypherRuns a Cypher query that changes data
Runs a Cypher query that creates, changes or deletes data and returns a count of what changed. It refuses queries that only read. It is not offered when you turn on read-only mode.
Try: “Create a Person node named Ada Lovelace and link her to the Analytical Engine.”
Delete ·
write_neo4j_cypher
Read from the source code
Permissions
high risk · 6 things to watch · 2 advisories
High risk
The write tool can create, change and delete any data the database user can reach, and the server holds your Neo4j password. Turn on read-only mode and use a database user that has only read rights.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
The write tool can delete graph data
write_neo4j_cypher runs any write query, including deleting nodes and relationships, and is marked destructive. Use read-only mode, or a database user without write rights. github.com
Read-only mode needs version 0.6.0 or later
Before 0.6.0, certain APOC CALL procedures could bypass read-only mode. Neo4j says only limited database credentials guarantee it. github.com
Older versions allowed DNS rebinding in HTTP mode
Versions 0.2.2 to 0.3.x let a malicious website call a locally running HTTP or SSE server. From 0.4.0 it blocks web access by default; stdio mode was not affected. github.com
Your password sits in the client config
NEO4J_PASSWORD is stored in plain text in the config file. Use a dedicated database user with minimal rights. github.com
The schema tool needs the APOC plugin
APOC adds powerful procedures to your database. Neo4j advises limiting which APOC procedures are enabled. github.com
HTTP mode listens on localhost by default
If you choose http or sse, the server binds 127.0.0.1 and allows only localhost hosts. The Docker image sets the bind address to 0.0.0.0, so publish its port with care. github.com
Security advisories
2 known advisories, all fixed in a newer version.
- DNS rebinding in HTTP/SSE mode (CVE-2025-10193). Affected: 0.2.2 up to before 0.4.0. Fixed in 0.4.0. Workaround: use stdio.high · Fixed in 0.4.0 · GHSA-vcqx-v2mg-7chx
- read_only mode bypass through CALL procedures, with SSRF and data change (CVE-2026-35402). Affected: before 0.6.0. Fixed in 0.6.0.low · Fixed in 0.6.0 · GHSA-x3cv-r3g3-fpg9
Technical details
| Turning on read-only | Set NEO4J_READ_ONLY=true or pass --read-only. This removes the write tool. Before version 0.6.0 this could be bypassed, and Neo4j says the only guarantee is a database user with read-only rights. |
|---|---|
| Talks to | Your Neo4j database |
| Sign-in and keys | Neo4j URI, username and password go in environment variables in your client config. |
Questions
Is the Neo4j Cypher MCP server official?
It is a Neo4j Labs server, made by Neo4j but not supported by Neo4j's product team. The repo README says the Labs servers are updated often with experimental features. Neo4j's supported product server is a different project: see Neo4j MCP (github.com/neo4j/mcp).
Should I use this or the Neo4j product server?
Use the Neo4j MCP server if you want the one Neo4j's product team supports. Use this Labs Cypher server if you need what it does that the product server may not, and accept that it can change quickly and has no product support.
Which version should I use?
Use 0.6.0 or later. Version 0.6.0 fixes a read-only bypass, and 0.4.0 fixed a DNS rebinding flaw in HTTP mode. The latest release on PyPI is 0.6.0.
Can I make it read-only?
Yes. Set NEO4J_READ_ONLY=true or pass --read-only and the write tool is removed. For a hard guarantee, also connect with a database user that has only read rights.
What do I need before I install it?
A running Neo4j database (Aura or self-managed) and its URI, username and password. The schema tool needs the APOC plugin enabled on the database.
Does my data leave my computer?
The server runs on your computer and talks to your Neo4j database. Query results go to your AI assistant, so they reach whichever model provider the assistant uses.
Can I connect two databases at once?
Yes. Give each server a namespace, and its tool names get that prefix, for example movies-read_neo4j_cypher.
How is it different from the Neo4j Memory and Data Modeling servers?
They are separate servers from the same repo. This one queries a database, Neo4j Memory stores an assistant's memory as a graph, and Neo4j Data Modeling designs graph models.
Is it free?
Yes. The repo is MIT licensed, but the published 0.6.0 wheel on PyPI has no license file and no license field in its metadata. You need your own Neo4j database, which may have its own cost.
Information
updated Nov 2, 2026
- Publisher
- Official
- Package
mcp-neo4j-cypher- Registry
- PyPI
- Transport
- stdio
- Auth
- token in env
- Version
- 1.0.0
- License
- MIT
- Last commit
- Sep 9, 2026
- Open issues
- 17
- Listed in
- Official MCP registry, Docker MCP Catalog
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 4Hide
- github.com · github.com
- github.com · github.com
- github.com · github.com
- pypi.org · pypi.org