Operators¶
Choose the smallest deployment surface that matches the client:
Need |
Surface |
Start |
|---|---|---|
Local shell, scripts, JSONL agent loop |
|
|
MCP-capable agent over stdio |
|
|
Neo4j driver / Bolt v5.x |
|
|
In-process application |
import/add the library; no protocol server |
Deployment checklist¶
Choose storage: memory for fastest small/medium graphs, mapped for mmap columns, disk for directory-backed CSR at very large scale.
Decide read-only vs writable operation. MCP writes require
--writableorextensions.writable: truein the manifest — either alone;builtins.save_graph: trueregisters onlysave_graphand leavescypher_queryread-only. Bolt uses--readonlyto reject writes.Use absolute graph/config paths and bind network listeners to loopback unless a trusted reverse proxy or host firewall provides the boundary.
Configure Bolt authentication/TLS where exposed beyond localhost. MCP uses stdio; source roots and manifests define its filesystem/tool boundary.
If callers need per-user access control, don’t reach for a protocol server — no bundled server has a principal model. Embed the engine behind your own API, which owns authn/authz, and serve reads from a refreshed
freeze()snapshot: the traversal-component pattern.Back up the complete
.kgl/disk directory before upgrades and read the migration notes. Portable CSV exports are intentionally not full backups.Run
--helpfor the installed version and a startup/self-test before routing production traffic.
For persistence semantics, backup limitations, and durable in-memory WAL use, see Import and Export and Durable apps.