Connect an agent

Agents reach the graph through the MCP server. It speaks streamable HTTP and authenticates each request with a Neo4j user (HTTP Basic auth); requests without credentials get 401 Unauthorized.

Claude Code

claude mcp add --transport http cirrusmapper http://localhost:8080/mcp \
  --header "Authorization: Basic $(printf 'neo4j:<password>' | base64)"

Cursor and VS Code

{
  "mcpServers": {
    "cirrusmapper": {
      "type": "http",
      "url": "http://localhost:8080/mcp",
      "headers": { "Authorization": "Basic <base64 of username:password>" }
    }
  }
}

VS Code uses the same entry under servers in .vscode/mcp.json.

What agents can do

The server runs read-only, so agents get two tools:

• get-schema: the labels, relationships and properties in the graph
• read-cypher: read-only Cypher queries

A write query is rejected. For example, to find principals with full admin access:

MATCH (p:AWSPrincipal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(s:AWSPolicyStatement)
WHERE s.effect = 'Allow' AND '*' IN s.action
RETURN p.name, p.arn