How it works

 your AWS account APIs
          │  read-only (SecurityAudit)
          ▼
 Cartography ── first sync at deploy, then every 24 hours
          │  bolt
          ▼
    Neo4j graph ◀──────────────┬───────────────────┐
                               │                   │
                         MCP server           Dashboard
                    (read-only Cypher)   (map, resources, sync status)
                               │
                               ▼
                           AI agents

Cartography

Cartography reads your account through an IAM role with the AWS-managed SecurityAudit policy and writes resources and their relationships (VPCs, subnets, security groups, IAM roles and policies, S3, and more) into Neo4j. Every node it writes is stamped with the time the sync started.

On AWS a scheduled rule runs it once when the stack is created and then every 24 hours. Locally you run it on demand.

Neo4j

The graph store. Run Neo4j as a container next to everything else, or use a Neo4j Aura instance you already have.

MCP server

The official Neo4j MCP server in HTTP mode. It holds no database credentials of its own: each request authenticates with a Neo4j user, and it runs read-only, so agents only get get-schema and read-cypher.

Dashboard

An optional web UI for the same graph: an infrastructure map grouped by VPC, a resource browser with each resource's full configuration and relationships, and per-account sync times.