io.github.neo4j-contrib/mcp-neo4j-cypher
A simple Neo4j MCP server that allows you to run Cypher queries against a Neo4j database.
Hold off. At least one reported issue affects the version the registry lists. The package may have a newer release, so read the issue below and check before you install.
Registry name io.github.neo4j-contrib/mcp-neo4j-cypher
· The registry calls this server version 1.0.0, but the package it points to is 0.5.1. The package version is what gets installed, so that's the one we check. · Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-x3cv-r3g3-fpg9Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL ProceduresAlso filed as CVE-2026-35402, PYSEC-2026-2626 | low | Affected | Apr 17, 2026 |
| GHSA-vcqx-v2mg-7chxNeo4j Cypher MCP server is vulnerable to DNS rebindingAlso filed as CVE-2025-10193, PYSEC-2026-1620 | high | Not flagged | Sep 11, 2025 |
Versions in the registry
0.6.0, 0.5.3, 0.5.2, 1.0.0 (package 0.5.1) (listed)