mcp-genelab

The server explicitly attempts to prevent write operations (MERGE, CREATE, SET, DELETE, REMOVE, ADD) by raising a ValueError if such keywords are detected in a Cypher query, which is a strong positive for security. Neo4j credentials are managed through environment variables, avoiding hardcoded secrets in production. The default 'neo4jdemo' password for local setup is not ideal for non-local instances, but users are expected to override it. The regex-based write query prevention is a good safeguard, but a sophisticated attacker *might* bypass it if not perfectly comprehensive; however, the tool is primarily intended for LLM-generated queries, not direct user input. There are no obvious `eval` or `exec` calls on user-controlled input.