neo4j-mcp-skill
Use when installing, configuring, or troubleshooting the official Neo4j MCP server (neo4j/mcp) — connecting Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Kiro, or other MCP-compatible editors to a Neo4j database via stdio or HTTP transport. Covers the four MCP tools (get-schema, read-cypher, write-cypher, list-gds-procedures), read-only mode, and multi-database configuration. Does NOT cover writing Cypher queries via those tools — use neo4j-cypher-skill. Does NOT cover agent memory — use neo4j-agent-memory-skill. Does NOT cover Aura instance provisioning — use neo4j-aura-provisioning-skill.
79
92%
Does it follow best practices?
Impact
85%
1.70xAverage score across 1 eval scenario
High
Do not use without reviewing
Security
2 findings: 1 high severity, 1 medium severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill contains examples and editor/server config snippets that embed NEO4J_PASSWORD (and show passing the password on the command line and in Base64 headers), which would require an agent to include secret values verbatim when generating configs or commands.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
The skill explicitly instructs changing neo4j.conf to whitelist APOC (dbms.security.procedures.unrestricted=apoc.*), which is a system configuration file that typically requires elevated privileges to modify, so it pushes the agent toward modifying protected system state.
- Repository
- neo4j-contrib/neo4j-skills
- Commit
a9a5e78
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.