Splitting the two means a read-only deployment does not register write-cypher at all — the model cannot call a tool it was never offered, which is stronger than asking it not to. Enforcement leans on Neo4j's own EXPLAIN classification rather than on inspecting the query string, and the README says plainly where that stops: a misclassified custom procedure gets through. Worth checking before you point this at production with read-only assumed.
Neo4j's MCP server for a Neo4j instance. It exposes the schema so a model can reason about a data model it has never seen, then lets it write and run Cypher against that model — with read and write queries split into different tools rather than one query endpoint.
- get-schema — node labels, relationship types and property keys, so the model learns the data model instead of guessing at it
- read-cypher — read-only queries, enforced with EXPLAIN and Neo4j's own query-type classification rather than by pattern-matching the query text
- write-cypher — queries that change data, and it disappears entirely when NEO4J_MCP_READ_ONLY is true
- list-gds-procedures — the Graph Data Science procedures available on the instance
- Schema sampling is bounded by NEO4J_MCP_SCHEMA_SAMPLE_SIZE, so introspection on a large graph does not turn into a scan
- The README is explicit about the one gap in read-only enforcement: a custom procedure or function that Neo4j classifies incorrectly can slip past the check, and getting that classification right is the procedure author's job
A reachable Neo4j instance and credentials: NEO4J_MCP_URI, NEO4J_MCP_USERNAME, NEO4J_MCP_PASSWORD and NEO4J_MCP_DATABASE. Install from PyPI with pip install neo4j-mcp-server and run it over stdio. NEO4J_MCP_READ_ONLY decides whether write-cypher is registered at all, and NEO4J_MCP_TELEMETRY, NEO4J_MCP_LOG_LEVEL and NEO4J_MCP_LOG_FORMAT cover the rest. Serving it over HTTPS is possible but needs a certificate a client will accept — most MCP clients reject self-signed ones.
One command plus a key — pip install neo4j-mcp-server, then supply credentials